{ "Event": { "published": true, "date": "2023-02-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-23", "timestamp": 1677196982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "03e4b4fc-1d0f-4f51-b85e-745c15becbcc", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a117920d-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677142016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142016, "uuid": "ce9b13d1-b747-4011-aeb1-439dba9aca43", "comment": "Malware payload (SnakeKeylogger)", "value": "6e8518b4abb267391421c5fa3ddf849e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142016, "uuid": "f0d9a0a3-7d9b-41c1-b451-947b77c2f1ce", "comment": "Malware payload (SnakeKeylogger)", "value": "071eb944862ebe1d549a43b3ada9bad840b5b5cfa6b0af60fb56047b15998b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142016, "uuid": "0bf5c2bf-13a5-48e7-a349-81cb28368ca2", "comment": "Malware payload (SnakeKeylogger)", "value": "9cdd441be9c5d40aa2031d94b16b1a03b3b569b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142016, "uuid": "67245db6-4851-4258-8bda-056064370368", "comment": "Malware payload (SnakeKeylogger)", "value": "06eed15d8c19e0f18eced07fb38a8d53d332ec8657fcf4413d6cb52f7e0c919a6fa1b96e8bf7a0433987b04fbfd91376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142016, "uuid": "0b1fd270-5267-4c98-a435-6ad123ed8b4f", "value": "T1DE057B8BB6F0A077F99E509D063916CF6D31A253764CE2265F3B38488D86DFBB1D8211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142016, "uuid": "a93de852-f884-4dd8-9c1d-169398289507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142016, "uuid": "26379a78-7aa8-4bff-aa33-9cf43852378e", "value": "24576:QE1gpVuGJK+6DU5B1+DSv11ditNrSF5W4nNV4yCtcu:QEH+BswdkNGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142016, "uuid": "884f0a09-b282-4526-938a-ce2a66b6475d", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142016, "uuid": "8045de07-c822-4a8e-90f0-98a3e3982ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142016, "uuid": "1a0a3f50-9418-4455-bd65-0255ff28a676", "value": "6e8518b4abb267391421c5fa3ddf849e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf557f4-b36a-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677150623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150623, "uuid": "99afb9cc-8565-4012-9793-5c04be54a439", "comment": "Malware payload (DCRat)", "value": "07dd973404101f2902dcfaea87f7c146", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150623, "uuid": "7924ceff-6def-4ed2-aeb1-a67145f348b0", "comment": "Malware payload (DCRat)", "value": "07bbbe5a96f5615a45cfda97aa871d48633234eb7e86ab592a97107fdb9d8684", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150623, "uuid": "a1502bfe-b58f-466b-bf14-70160a27ad0a", "comment": "Malware payload (DCRat)", "value": "56d588e93a54136b36fc7b6cd6ea7a5028b45ab8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150623, "uuid": "41e128c4-0265-4b44-aaa9-0b78112b0fb7", "comment": "Malware payload (DCRat)", "value": "4a45da7b0db7156b795dbc42529b399a842213745b9aee05a4a895c00c07fb726584284cbbfbecb9ba54b4e0630dc81b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150623, "uuid": "8d6f6237-0af0-4eb9-8173-73e8717d824c", "value": "T13BD393865643C08DEEA4ACBFC72E91516B938EFED38581D533C3B0BB5491F7286E8412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150623, "uuid": "bf5e61d6-764e-4155-a32d-4c731c967f7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150623, "uuid": "22afa63f-89db-4221-a135-c76ef2049bcd", "value": "3072:1WzrAE6OzXTznv4UNm5hLxfUm9ONpakZo/FqkOvRVP1sfanHJK/GA8lkroufAHzm:sHXHnvPNmT1POp3Zy8kOvRVP1sfanHJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677150623, "uuid": "a409449a-ee09-415e-b222-cf6b97ed2965", "value": 132616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677150623, "uuid": "0e7d4538-7f66-4745-95d2-e00ba9bdfe02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150623, "uuid": "d54e7549-2e75-4baa-adc2-5a40e81fe2c3", "value": "07dd973404101f2902dcfaea87f7c146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef5560e-b383-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677161394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161394, "uuid": "cba4bc81-f3d4-4c07-a97c-3ad828cdf43f", "comment": "Malware payload (AgentTesla)", "value": "af58f9a410f4d1f2d1d20dc107c4b33d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161394, "uuid": "86f44bfe-187f-466e-bd2f-605b7e281cac", "comment": "Malware payload (AgentTesla)", "value": "0924ec2d25c83aeb344fb81b3a8a643e8089702f05bcba6d480e97dc6e085d10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161394, "uuid": "66ec5e17-d223-4910-b507-5078e9491c0d", "comment": "Malware payload (AgentTesla)", "value": "689bf0caab0ff769c6bee7fa9a7f24ead3151c83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161394, "uuid": "17db22b2-ab7e-4a63-a1c3-9a8778d8b41f", "comment": "Malware payload (AgentTesla)", "value": "46168e179cd6d1d07ad03688d134e1788881042babf77cdf4ede86c8eeec40d888f6f36b0a884ef6836ede50017f2d7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161394, "uuid": "c4b72cee-957c-4023-bc77-910a4282c4a8", "value": "T17D45AD4BB7B09437F99E51BD053912CF1E31A252759CE2265F3B38448E9ADFBB2C8211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161394, "uuid": "afbbe747-fe09-44f8-a62d-8716cc7e6616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161394, "uuid": "2afd64f7-c224-4eef-8815-bb12de3a4227", "value": "24576:3T5KGPr1eTGV+9jjqz0OypJiCGg7zUsAOSWQa37h74RCtcu:3TYyVI6zNypJIAws9GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677161394, "uuid": "ff9ae73c-325e-4408-bcf4-2eca0c0897fe", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677161394, "uuid": "9b23066f-845a-465c-b4f6-43458a70c38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161394, "uuid": "148cabc9-775d-4535-957d-f154b5eecaac", "value": "po invoice xj210821Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9356688d-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141993, "uuid": "4c85ea3f-778a-42e8-95d8-ebc2c92bb4a2", "comment": "Malware payload (SnakeKeylogger)", "value": "d765951c7ad5239aa3635d0e0d62e614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141993, "uuid": "e1ed98c8-8139-4075-a931-bcecb21ae833", "comment": "Malware payload (SnakeKeylogger)", "value": "092d252847b5c7d38f15bf70a993d2593bb200791fbea4e4f83586786ddc04ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141993, "uuid": "fce18f76-b156-4514-9b67-47f833008c02", "comment": "Malware payload (SnakeKeylogger)", "value": "0930fb4ba222e6dd575bd43aadb47e071b67a899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141993, "uuid": "5e096f69-6250-409b-bb73-6bf076a25ace", "comment": "Malware payload (SnakeKeylogger)", "value": "cea6ac737b719e131666d69765df2c071bca4dfc9900cc3f537f4c175ab282ab02c1786620df94576817be738ad6eb30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141993, "uuid": "234299a2-0591-48bb-bc52-b8d829701036", "value": "T1D4056A9672B09073FDDE80AC17341ACF1E31A252710CE6675F3B6A988D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141993, "uuid": "97aa2bca-858f-4701-b063-32dfe7fe037a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141993, "uuid": "6765183d-a869-4e15-949e-90b1c8300702", "value": "24576:2J8ejj64XfY6KmHqQaONME/rkPQcZNIWQ2acYj:wXXfdZGE/gPpZas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141993, "uuid": "400a7fd6-9dd5-4b09-a4b4-a6bb42d7927f", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141993, "uuid": "c715ebd5-5caa-483a-a209-1f7393fa99ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141993, "uuid": "cc593b2e-5180-4819-9935-9505bd8b47c1", "value": "Inquiry_10068495 _Leostar Private Limited.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34404b03-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677151712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151712, "uuid": "1f48b4b7-6390-454e-a3f4-d803071f7a50", "comment": "Malware payload (AgentTesla)", "value": "ae1326001449fe75dc85515ba5628f7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151712, "uuid": "01b5005b-4f18-4b2b-989e-aca016fd7927", "comment": "Malware payload (AgentTesla)", "value": "094b5e896bf9c2b8b10f16de33313f39384a9e42784a49e3176a0d9b565bb0d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151712, "uuid": "f04d9c07-a450-46c0-a0fe-73ab77921cf2", "comment": "Malware payload (AgentTesla)", "value": "cbb5b3565a3223565ae9c92a52b0800567186649", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151712, "uuid": "26dab785-139f-42e1-9dec-792efbb0ae5b", "comment": "Malware payload (AgentTesla)", "value": "a8e6c2aad6e128700a10bdec8c53d2d7cff16154e4c1e5cd9b44fe2d4ee78ba81aff1190c28641b75908d70d2f9260dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151712, "uuid": "6393b96c-69d8-4f12-aa78-5200eb7a5cfa", "value": "T14D157B4662B08037FEDE90AD07341ACF1E31B252710CE6675F3B6A989D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151712, "uuid": "1692eb87-6691-49cc-9591-70d7c1e9b5cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151712, "uuid": "cb34db85-5e24-4513-9b41-f0a404b4236a", "value": "12288:yJ8ejP/PGrkJrM+GWetGC2Kkmja7BpZDgmNJuM2EGcfT4FGB8VYy:yJ8ejviUg+GWetGWkmSpXpoDU8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151712, "uuid": "d39df19e-c8aa-43b5-ae1e-1d740e90df46", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151712, "uuid": "e73e070e-c761-4618-99e1-5363a3a0b19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151712, "uuid": "18aff048-c8bc-4b84-8a93-69bf9b2e6688", "value": "ae1326001449fe75dc85515ba5628f7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b023e8e-b37f-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1677159616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159616, "uuid": "3a4d4f23-bf18-42a0-8e0a-4ff23b13437a", "comment": "Malware payload (ManusCrypt)", "value": "b7f3bbe2d4281867faafbf082b126334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159616, "uuid": "d14426e7-f4c5-4dfa-8962-08644cde2292", "comment": "Malware payload (ManusCrypt)", "value": "0a5d832f3594465625f855e63075362cf73ef323fc32964e73327aa6a1030584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159616, "uuid": "3da844b3-db50-4154-9cb0-6a88b627d592", "comment": "Malware payload (ManusCrypt)", "value": "ffc748cf49fbc9fcd8fb9ba42ffd11839bcb9e4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159616, "uuid": "b5e9b772-6753-43be-86d3-e967546e6ce5", "comment": "Malware payload (ManusCrypt)", "value": "20d185bf2051c6c4ba22902ad33458da657696d8c416446be92a0debd0c421ccfaaa1b23a643dc1fa78231033015bc41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159616, "uuid": "646df520-01ef-4724-a66c-e0b0fb13f2a7", "value": "T1FB649E1133E1C837D5A311734E66C7A9B7F9BE115E32824BABD03B0DAD705828A35F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159616, "uuid": "cf4d0a7f-63d3-4f02-b2af-99e510431852", "value": "133f3376cf0cccd687518010e78757e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159616, "uuid": "3db3992b-12e1-4261-bf8c-ff377872e30a", "value": "6144:E4PWLN3m+XeeqeO0UQeQ8KbLVHqAQg5jIQsfEPn:6aeqeO0UQB8KFHqAYfEPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677159616, "uuid": "d57d1de4-6e85-46e8-a0d2-fd93b6bf2def", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677159616, "uuid": "956fcb20-d881-41c9-b741-669fdcfc19a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159616, "uuid": "d12fd432-9349-42a1-858e-65550930c01f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed24062-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677151811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151811, "uuid": "f71d9fe3-6630-4546-a987-ab6238464b0a", "comment": "Malware payload (RedLineStealer)", "value": "ec15a771862471edba555cbd00ffa217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151811, "uuid": "9923501a-480a-43bf-84f0-abc5fe203ee3", "comment": "Malware payload (RedLineStealer)", "value": "0b171221d21fe41a94e4e2b098683835d98eb76f5857a79819d2cd2045b1d061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151811, "uuid": "9ee1ea3a-5fd9-4821-bbe3-dbec9d3cf515", "comment": "Malware payload (RedLineStealer)", "value": "b31f79fc235bbac0ebd0523d654d9ca08d116c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151811, "uuid": "9a8e1cfc-496b-4a03-b100-9489b1d863b8", "comment": "Malware payload (RedLineStealer)", "value": "72d9ae57adc778367c92bda4bfdbf26c6d1cbdff7fe365afdfcefe7af0f0a3c0a8ff0a5ced70be74395494353e58355c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151811, "uuid": "913e2eec-ac0f-40b4-997e-ef0f265a6328", "value": "T144252207ABDC8472E8B627316DFA13D32535FE115F34470A638A6D4E08B2674B634B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151811, "uuid": "045ce8e3-521a-457b-8050-0d33b1121ad2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151811, "uuid": "00a31bba-6d19-4bd4-95ee-b1b9ccd23acd", "value": "12288:oMrZy90IgESilB/aX8nPFEoKav8tBg6WBthmvNb1G8Jrsu1lQsesaQ1nqq1Mei80:xybblBaXANJzaAmvNbpvwbsXwPcDX/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151811, "uuid": "20fd44dd-bc83-45a2-9c1c-d8a054ff394a", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151811, "uuid": "cb00d67a-6f50-46de-a103-bb2b7a1c065d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151811, "uuid": "09b0f693-98bf-4679-a089-5bac2052c4bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2c6e75-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677143218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143218, "uuid": "eb71549d-d397-47f7-b5b7-54acc6d22f8c", "comment": "Malware payload (GuLoader)", "value": "2b725990978a56bcec0ebbe18770eb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143218, "uuid": "337e1004-f421-4007-a234-573e829ec83c", "comment": "Malware payload (GuLoader)", "value": "0b70890de92c30c7bb24e9dd6b9eff0483abb489dd89e1c8c422d370adb320bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143218, "uuid": "d1958358-c8a9-4217-a637-575419fabae4", "comment": "Malware payload (GuLoader)", "value": "8e8b75afef8e497c7fe57a8a9256c6505d7e57be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143218, "uuid": "f70078a2-0e71-4f7d-9261-32993983a59b", "comment": "Malware payload (GuLoader)", "value": "869938612eb90f454c25c6705f286484344a4ed216d77eef974a3a0136857eb96a3e3cabea93c7b5c566c1dd0cdf3d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143218, "uuid": "f3cfda83-d793-4353-a112-d1c5a26a235c", "value": "T147A4120B12B18D33DD650AB089F79A56BFB59E214CE5864F1700BFDB2D70B805A1F26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143218, "uuid": "e762ab40-3402-4a82-a334-5f27185395cb", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143218, "uuid": "cbd6605e-5b48-4ad6-ad98-5b736d6860c5", "value": "12288:Gq88HEWQj9nxUsUge3YWshC+IeQ+ImWmyJYj1fLe:n88HpS9nasUg1Vn++ImdfLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143218, "uuid": "bcbaa2f2-e648-4a8f-9a64-c6929c245108", "value": 472280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143218, "uuid": "90c05449-010e-48a4-9178-7487a2bae93c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143218, "uuid": "a9d72d58-1301-47b0-95a1-8353bf1b825f", "value": "E-DEKONT#22022023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819e101b-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141964, "uuid": "25e605a5-b5ce-478d-baf3-840aaf8f033c", "comment": "Malware payload (SnakeKeylogger)", "value": "a2b9b135dc7e2895a138beb376717347", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141964, "uuid": "f259e727-5c13-4ead-ab13-eb71a030aa8c", "comment": "Malware payload (SnakeKeylogger)", "value": "0b9962178789a82a2aef61faaa84d32e88688c3e7d5ab1f6b130bce11ea2fef6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141964, "uuid": "c0ad6af1-9197-4f6c-8e19-7ed87324aa5c", "comment": "Malware payload (SnakeKeylogger)", "value": "f04e15f35b2440b6c9bbdf9c77cc03a21b7a1a70", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141964, "uuid": "d3ff759b-5b50-403f-b54b-1541b941d9df", "comment": "Malware payload (SnakeKeylogger)", "value": "57984c3135b6d54774ca95e632c88f37f7bd50a351b957412c43a597c5eab7e9983f3f373057934fedd74d398b928d62", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141964, "uuid": "78da65e2-eea4-40b5-b30f-aeb38a4b809d", "value": "T133056B4662B09033FDDE80AD03341ACF1E31B652710DE66B5F3B6A988D1ADFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141964, "uuid": "29a446a6-2c01-4922-ac6c-d108a499f552", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141964, "uuid": "ae32cd8b-6402-44ff-8612-87853f738d70", "value": "12288:oJ8ejTWrDD5pF98SOtVS/Twiy8HcjFuZWLEPpLbKNclf:oJ8ejKrDDLcSOtw/Tu88jFzEBKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141964, "uuid": "6068db1c-2471-4688-b2e4-c548d3d26637", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141964, "uuid": "8c7cd97d-de0a-4c85-9454-fcc8e238fd15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141964, "uuid": "938f0669-55be-4b77-9f4a-1f5d245e01bf", "value": "DHL Shipment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e940fa5-b317-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677114766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114766, "uuid": "5707babb-83ef-4455-99b9-bd83c7b43c94", "comment": "Malware payload (Formbook)", "value": "ba79f26ac9099e86e4ee3b045c484909", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114766, "uuid": "faa47a8d-b249-4090-8440-fe0b218cdd36", "comment": "Malware payload (Formbook)", "value": "0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114766, "uuid": "1c86f4df-00d2-4b4c-b996-d91edbf30e04", "comment": "Malware payload (Formbook)", "value": "3b991533e9a9fb044015e13265dc61028fd19d5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114766, "uuid": "fe2e4734-ceff-4891-a759-644679c56b8e", "comment": "Malware payload (Formbook)", "value": "414fb4003a495deb9e84080a1dbfa949cf718b805100cf708b73773dc92b3f7fa85d0b6ce7befd626b9556faccb17953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114766, "uuid": "63c19ec2-d09f-4318-ae42-ad97fd4b3c15", "value": "T1E535AE09A7B0D677D68B01EF18385B0D39A435477618E26C8FB77FD292709BB35A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114766, "uuid": "266bb7bd-f96a-42d8-af04-4d9da7e8b6de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114766, "uuid": "13f68743-3de3-48e0-97ba-5cfd7a5d1b06", "value": "24576:B4w4yZ1sQDNaCz9HFB6VBf2q+3y6BJQEcXNrYE:GUPaiuVBfm7Q1eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114766, "uuid": "665fcfa2-5d05-472f-babc-5009cbbdef9c", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114766, "uuid": "560e38fa-6dce-4a4d-8d1d-0594fdf27e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114766, "uuid": "b36ab759-1df7-45d2-be4d-36d085a51be1", "value": "ba79f26ac9099e86e4ee3b045c484909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1170be79-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677158526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158526, "uuid": "e52fea5e-f5f3-4e15-a742-5c611ea3bd5e", "comment": "Malware payload (RedLineStealer)", "value": "72dfdf9d61ded1407b183487e24ec507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158526, "uuid": "fbcf0101-83f8-4fae-9116-072ddfe9b87f", "comment": "Malware payload (RedLineStealer)", "value": "0d0bfa07235b50f52af3544e14b65794f9114c923fdf23c28f4e2c0a2bef944e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158526, "uuid": "645a50ca-7f11-454e-b93b-4b05b96c1a51", "comment": "Malware payload (RedLineStealer)", "value": "b3af7cdfa839edf64bdab17d2bd1df82dc0e787c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158526, "uuid": "1788634a-afcb-47ae-baf6-0bb3006a9f4b", "comment": "Malware payload (RedLineStealer)", "value": "386a5419dcc59c8f7270d65f82827f1cc6c7f09ffb30832ec1384958438ad16165ad036229e04f005594d743233a9a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158526, "uuid": "356bde68-dacb-4783-8c58-b6cf0a116bcc", "value": "T191251207E7ED8175EC709BB01CB706C30632BD606B3C839B5A4E5D1E19B32A4A67536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158526, "uuid": "80067224-54b9-499d-beeb-0e4c3dc2bcdc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158526, "uuid": "ee1bc493-c06b-44eb-85b3-ddfc5dd358ed", "value": "12288:DMr4y90hcdFdOUw+mI9MnYxcvfPzOzx7yDolO/O7FL7P4w53+SKOwAvdQe2wgxUy:/ym6d/AYSYxcXLm4qOO3pllDgPY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158526, "uuid": "4ee84ed0-6126-4e9f-8721-72bcfeccde0b", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158526, "uuid": "49d5ac08-1fec-470e-a01b-bbb9f7438614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158526, "uuid": "2e4b5b76-e405-43a3-89b1-80588d81eee5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad520737-b35a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677143755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143755, "uuid": "54342c66-8f54-44c5-85c4-55bea1a0c07b", "comment": "Malware payload (RedLineStealer)", "value": "101999e3b4fc7384b3b4c17622c4be6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143755, "uuid": "61ec9b76-7783-4e31-9028-d721eb07a88d", "comment": "Malware payload (RedLineStealer)", "value": "0d572238b9860b5db4f6d62eaad3ed9b1919efd9fcd92f165a0565ca9c1dd2ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143755, "uuid": "3a79a01a-6570-4a6b-8e22-5a10851a3e40", "comment": "Malware payload (RedLineStealer)", "value": "2210d5028365032fa8f99d38b1708ff50e3a1804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143755, "uuid": "79de723a-2c9b-455b-a572-012d8a77d4b7", "comment": "Malware payload (RedLineStealer)", "value": "96a22d2f1b5813404148c9bb9e81b42c2e5ec6658d0937cf2eb32d1e96ea1746799a137d6a57366db89cd500219dde9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143755, "uuid": "8835ac8d-00d6-41a8-b462-ca6887985393", "value": "T1B8B52382A3F48659F2B62BB5187683A01E723C65EC70D75E61C4B94F1D32E12CD3972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143755, "uuid": "7fc4a9bc-251e-4c49-be46-50c7fe340a73", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143755, "uuid": "1247e128-4a1e-4fc4-ad6a-7bb5ae402813", "value": "49152:6JL8pU0T0wsVwC8164r8/grS02+gbJ/FIyLPVGLc+tFEzVx:QLMUDwsVwC894aS0iJNIrX3Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143755, "uuid": "93908306-f768-4e04-886f-9ce758e5d0d1", "value": 2311168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143755, "uuid": "7c76dd10-0b43-4a1d-ab33-2290585ab385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143755, "uuid": "feef44ab-b888-4f89-91ac-a7846f21edbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe73c0b-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142176, "uuid": "b9a50951-88a1-4663-9a0c-f864acebd37c", "comment": "Malware payload", "value": "4eda40b6e2669ccf005e4a9b4223f5bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142176, "uuid": "44cd6ddf-ca36-4957-a877-a07c0e3041c5", "comment": "Malware payload", "value": "0e26bbb3236e15e0ba06e697c49c89d2b23f203d59e593b284221d1f431f73af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142176, "uuid": "9e4b4fa9-e985-4413-910c-5d7429bb814a", "comment": "Malware payload", "value": "c682d8c1adb079b528bd54c757a753c9c7aca850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142176, "uuid": "9eeeac31-1ae1-4f65-86d8-3a35be3790e5", "comment": "Malware payload", "value": "bd324f60747ae642079d6c60cae77ec552b6cf9e2a082c810ee5186b6e8214c7c09db12cd3b179f9c9c04d1c4b2d104e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142176, "uuid": "165b3d5c-a740-4fe4-a159-9e07e109c7f0", "value": "T12885E00372E8845CEABB22BC8EDF951CD43936D70B65DDD3418366DA0421BC99E7CA72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142176, "uuid": "e0bd80be-1c1e-4ab5-bc82-b3019c3a298e", "value": "d3ef7ff125eee1c6b9d433b0829d1dc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142176, "uuid": "02698d38-702c-4553-930f-1f7177a8a308", "value": "49152:SvY8fOwCsYf0SwAFbt48v38qELbLXK7msn:Sv32wCNwAF38K9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142176, "uuid": "710649bc-d59c-4a50-bb2b-d176ce145400", "value": 1711528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142176, "uuid": "869c2749-a81b-488f-ab83-a38a66b9a579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142176, "uuid": "f7757a20-e1b8-44cf-aa73-9ffc6a184336", "value": "4eda40b6e2669ccf005e4a9b4223f5bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e413ef8d-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128814, "uuid": "026b4193-1f9d-4ea1-8857-d33c316811c8", "comment": "Malware payload (WannaCry)", "value": "efe70e514cf869d4b46cee676c74ba2e", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128814, "uuid": "733cdd17-c7df-4df5-9c39-5093577db4a3", "comment": "Malware payload (WannaCry)", "value": "0e524346835f7c208667a18699df3faf34fcf8a3cceab8a7418d3f88e87211e4", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128814, "uuid": "09f31f37-125b-435b-98e0-ba60e968c869", "comment": "Malware payload (WannaCry)", "value": "2d00e444cc2f1bd39952f830bc471be100e2b0d5", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128814, "uuid": "c78303bb-6784-4511-839e-f84eebdfaf7a", "comment": "Malware payload (WannaCry)", "value": "fbdd767f9c82b30fbb48209e13a5d04b9792f1520a8f86ae6cac359f25e7d4026dcb5f6cebcf9b757f9486a22e69f171", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128814, "uuid": "74df117c-cf7a-4bb3-81d2-0be522f3f766", "value": "T14ED52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128814, "uuid": "17ac95fb-a17b-4446-81fc-9183ba057e63", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128814, "uuid": "dc77716c-9184-4203-802c-4bec9a47076f", "value": "24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE/S:BSy6PX3PpM+P5IdIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128814, "uuid": "e5759855-474f-4729-9aca-06c72cb26c22", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128814, "uuid": "35a8a1be-43f4-4737-a098-bd2554ae00bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128814, "uuid": "8135d98c-da85-4ce2-921d-49a6595d4aa9", "value": "2023-02-21_efe70e514cf869d4b46cee676c74ba2e_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c917bc1-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677158518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158518, "uuid": "e4fef295-8f9e-4217-88fb-8c7f908595d0", "comment": "Malware payload", "value": "13da590b2e0c16371fcaffc808a1fee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158518, "uuid": "bcfcf57c-601a-4011-b334-c33cdabd3ad2", "comment": "Malware payload", "value": "0e564fe0886db8c6cb754ede331a814f0e949fef213fce44a1ea1f395a1ca3da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158518, "uuid": "f8307c01-34de-4c84-b0c6-01e20bbf8755", "comment": "Malware payload", "value": "efbf21ae78953db4a9be00e90f9601b70121d00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158518, "uuid": "1e0b4dab-8b19-42bb-bc51-a5e7ebca357c", "comment": "Malware payload", "value": "f81d2fdfb91c9a2ec0b996911371614d03dc875a05247c8cab7244948bbb26d783ace09e262c13b2c192be5854bc471d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158518, "uuid": "e807359d-2a04-4353-bb46-ef1540b10a08", "value": "T16B256C6923EC43D8DA76E172EA12C707DEB3788A0674BB1F0DE04A762F13671161E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158518, "uuid": "c8c48613-a072-4c43-9480-409334511512", "value": "161c85364c462057ba28801ac1ad5404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158518, "uuid": "787ae8f9-4bc6-49a1-8c26-2a5153e7d03e", "value": "24576:1fTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0HKUM:xG00SSgCmP/ZwYj48a0qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158518, "uuid": "5c75665c-58d0-4727-84bf-ee384d00d148", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158518, "uuid": "051d0fa2-546f-4860-b198-902c37df18c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158518, "uuid": "64f3e35c-f8f2-48fd-9751-88fe622981f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4780c2d3-b39c-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1677171931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171931, "uuid": "66bf7dbf-53f9-4b77-84ba-77b3c7ca4f0e", "comment": "Malware payload (NanoCore)", "value": "72d5933b565d1030efd4f0bc848de0b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171931, "uuid": "16e76a07-4973-407c-95cd-47640fcc3fb8", "comment": "Malware payload (NanoCore)", "value": "0ee4073a3fa23edbed9e6fa313cb261314027b58b0d23a0d236da2b316ecc0d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171931, "uuid": "f16fe1cb-2976-4ae8-b591-00351a6fba5f", "comment": "Malware payload (NanoCore)", "value": "ec75d289506187cc518fd6a0d2afb7e6600105d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171931, "uuid": "760f6ae1-53a7-4674-ae75-b2a1c655fc44", "comment": "Malware payload (NanoCore)", "value": "f99f871eb81099f7d2d078f4817400dfdd5fd64e83d3d5af6d7158417916bedd2f8e605c4527ac11ffe9f5282a120c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171931, "uuid": "2c30dfe8-2a30-442f-933d-8774b5965f3b", "value": "T147659E43B39DC2ADFE5652B3FA3562F246785F27C122401F32D8BD6C79710A9122D6E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171931, "uuid": "e323765e-3e61-4dec-bd5c-afe00592f681", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171931, "uuid": "76dc7b95-adc7-4dbc-b4ba-9b585c9498b3", "value": "24576:6AHnh+eWsN3skA4RV1Hom2KXMmHaYDBNkmBRGEMdSR5ADIAsG/jJ45N:Nh+ZkldoPK8YaZSeIAmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677171931, "uuid": "1f69ab7c-d56a-4499-928c-0cd077b85c18", "value": 1460760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677171931, "uuid": "3943ecac-56a1-43ab-8340-d6cc814fc53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171931, "uuid": "e2e0300e-3a4f-48b9-97c1-76cd03ca5c29", "value": "72d5933b565d1030efd4f0bc848de0b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088194b3-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677151639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151639, "uuid": "c3c04c01-5234-4a68-801d-bdaed711095c", "comment": "Malware payload (LummaStealer)", "value": "7510dc3428586ebacf3a05fa02695b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151639, "uuid": "f8e86e23-67e6-4347-a1c4-8e48a5499a10", "comment": "Malware payload (LummaStealer)", "value": "0f5d1dc2bdd460564540f39e3df7436c86afe4f40c186890f25a97e43d52244c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151639, "uuid": "c9a239a6-bf32-4c79-be5a-0f12b5f8db32", "comment": "Malware payload (LummaStealer)", "value": "ef6518cc71948543f4a8dff485b1f91f273a7267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151639, "uuid": "64e8d40e-fe4c-4457-8384-bceb6091cbf3", "comment": "Malware payload (LummaStealer)", "value": "c033f8a0b12d6052ba31b5d364b25d6a0b7a6cadfc39fb821e9b7ff16f1804e15dc9589e628d127221596204c38a02a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151639, "uuid": "8e5c5e2f-ceee-4321-8148-3880e210dbb8", "value": "T130662337132A6085E0D99C3B892FBED431F6037B8B4278B9659359D022375E4B716BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151639, "uuid": "146eff60-9498-4df7-993c-9c4af3318979", "value": "18a082a1d0ea8b8a92363367eb0f3369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151639, "uuid": "b013a2ad-7c68-428a-84f2-67cde408fd57", "value": "98304:fhjcKneB/0nHA8B2EuXiojjuvfIwuvItVcygJsyoUhtjqadkVNar38:fZcKnUYHxu1X0P9tV50jh0akNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151639, "uuid": "e1487e73-ae82-46bd-aa59-e24ab6950880", "value": 6629376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151639, "uuid": "67416fad-de70-4c07-9748-e9bac78d5476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151639, "uuid": "88cf6529-adfc-4bbf-944b-55edd18ca042", "value": "7510dc3428586ebacf3a05fa02695b6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32425cb-b36c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677151576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151576, "uuid": "c7bb95e5-a41d-48e4-abf3-f9a30fed63f1", "comment": "Malware payload (Vidar)", "value": "27db65f67cb44ed41ed1c6b3d98728b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151576, "uuid": "411dcab8-3a6c-4bb8-860f-5a3b153e5cb5", "comment": "Malware payload (Vidar)", "value": "0fe62bce5fdca99b82bc40a1b6c62413a7738207462bcae6c83dae1da8501b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151576, "uuid": "2945127f-61cb-4e46-ae27-7ad3845eb23f", "comment": "Malware payload (Vidar)", "value": "09b47d66868783b8e8738a3bda8116bb1beb1828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151576, "uuid": "c825da1c-50c8-4529-b02f-dcb2aaa13a97", "comment": "Malware payload (Vidar)", "value": "47dfc92fa22c827f4f23967e16f74edfaef6902036871a5792d0ee0f07ec202877fd77692cbae6c50ad28fd971d02f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151576, "uuid": "a17ed6b1-f48a-4867-8d6b-501c9bc9bdb9", "value": "T14756123FF1152A3EC23A86770AB786207C7B63BAAD568D1B23F4444ECF515502D3A25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151576, "uuid": "4f3513ba-b3e6-4421-a694-23e1f91b57be", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151576, "uuid": "a31d0bbe-b5c9-44d5-a1ce-c8f7fd55cddf", "value": "98304:nkLzWwTDkq9lJmjqJMmrHV2CXc0R0IEVWdzejsucYccIzBX6TU6zUzQwhXxsjal1:cy1qHJmjqlrHQjCsLXI1HBQwRxEafnEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151576, "uuid": "629fee8a-402c-4430-aa0b-130f3f78045e", "value": 5899569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151576, "uuid": "358c435f-e218-40ed-9cf0-ac964ce71b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151576, "uuid": "ed39c68f-5811-427a-8406-931c825cdd7d", "value": "27db65f67cb44ed41ed1c6b3d98728b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5affe065-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677143187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143187, "uuid": "b7555c22-8a7c-4181-ada2-b37b9a6dbc34", "comment": "Malware payload (Formbook)", "value": "125eb7ac41dcf6bc4ea6937383e681c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143187, "uuid": "028b864f-73ec-4d84-9a90-4c4b6864923f", "comment": "Malware payload (Formbook)", "value": "10f07d893ce971191295d3c52b3a5c761b62edde3a50981cafb2ffc5fab72dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143187, "uuid": "558bcfe2-6a88-4e6a-9a5c-b6cb0ac20bbf", "comment": "Malware payload (Formbook)", "value": "2e2421c7f83b1092b9a56b60346216e14a200f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143187, "uuid": "fe8ba6c1-2577-4241-b6cf-6ed4c01a07cd", "comment": "Malware payload (Formbook)", "value": "a7e4300cb60f8629483ff5498602c9ca511fef487d9f14bb2afc5ee48502bfe272d1d4a2ed5c8e289c81a516a43d206f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143187, "uuid": "46da6690-bb59-4d55-9fe6-fc3078c9d088", "value": "T1FA056A8762B09133F9DE90AC17341ACF1E31B252710DE6675F3B2A988D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143187, "uuid": "d3ef5d14-9cf2-4a73-b391-51ef43a5e6a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143187, "uuid": "e7e1fa5e-302b-4f6e-bd2c-3f5d62d1a4ab", "value": "12288:OJ8ejRu66dT1VezkvMIywXNnKSSbWC9aSg9D7DUFaJ65K2KHjfRxP2VPDaKrU1:OJ8ejmdC6MYhkWC9CdDUoJPDfRxYOqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143187, "uuid": "3a5b6fa1-f0bb-483a-9f09-18d3c7b81480", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143187, "uuid": "b2ad5734-850e-472e-bdc2-65c1f2bd8eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143187, "uuid": "6814eda7-d55e-4bf3-b9a5-669fe0ebad1f", "value": "ink\u00f6psorder pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35646b1a-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677143124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143124, "uuid": "bd4f66a4-527b-4365-9591-356fbc20bf8d", "comment": "Malware payload (Loki)", "value": "e30a710b927f0faf66dbae4e4d4c1be3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143124, "uuid": "a2b33109-e21e-4614-8972-03fa3e756954", "comment": "Malware payload (Loki)", "value": "1220c8e619ffb9ea80e3cafe92364b842d6f4a244f6c4e6ce4f01f3a9a0528bf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143124, "uuid": "5fac9d72-c9f2-4747-96ff-21769d40de47", "comment": "Malware payload (Loki)", "value": "43025e1ff87b7c013c9899a4afedd9de565db271", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143124, "uuid": "a363cdac-a217-4825-9f8e-27c7255beb05", "comment": "Malware payload (Loki)", "value": "08dc9004d5dc691ec24ea10b2707aac8cea9faf94aa78c2323d7414592c2f538c49422b58b4243c378efdd1eee7a095c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143124, "uuid": "dd00dd21-2238-4138-95a8-fe9ae11e411d", "value": "T189350206E696C92BEC334530E847648382159C2EBE45DB4A31C2731F5736BF14F7AEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143124, "uuid": "e8b9b9e5-3930-4623-9acf-ba5d82ef20e2", "value": "24576:YFecp59vBm7zKFe3LwNv2m/y7FjAXKVaRfaLJP8WXMY7R7yN5XXXXXXXXXXXXUXQ:sbezKWLwVk55l3Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143124, "uuid": "81664144-a6f7-44fc-acb2-aa858f6d5d9d", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143124, "uuid": "58263c57-19ef-40ae-aa20-71cf5d7c3b22", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143124, "uuid": "411d4a4f-047f-42c1-9df0-edf054fe36fd", "value": "Swift copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66329067-b3b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677180572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180572, "uuid": "08c8b70f-eda6-4033-a70c-3dced2643770", "comment": "Malware payload (RedLineStealer)", "value": "3cd4ffdb489efabec9e1591f9fc02410", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180572, "uuid": "409437a9-05ec-4cc3-8a83-103c11efdb20", "comment": "Malware payload (RedLineStealer)", "value": "126575fa347e9012fd409e1692f132143f869541fc2445819d640fd1e7c60065", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180572, "uuid": "6c44fc1c-fa45-469b-94e2-169cad25b54f", "comment": "Malware payload (RedLineStealer)", "value": "ae69d661759893f61f6ea26fff77b605437592c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180572, "uuid": "ed54f168-6dc7-47a5-8785-fa29a539023e", "comment": "Malware payload (RedLineStealer)", "value": "a41834dc99107e50a429c0212169b7c36d9c9055ddd6d80fd7c3c1694ffd591d4a445bb4d6577141f088b8edd62acdcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180572, "uuid": "0b9a747e-d9d4-42eb-b05c-0ee833d3b4d8", "value": "T18894F107E7EC8062D8F557701DF607D3063ABEA06B3882A6374F5D1A49725B0BA3572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180572, "uuid": "1519bfb2-5aa5-438b-9de0-a30195a87b40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180572, "uuid": "c9d50fc4-020a-4e5d-8fcc-62a50d244be4", "value": "12288:wMrAy90wvWo3eFSq1ByTaysvn7C4LHnEAOGfM:gyJvb3eFSqbyTarWoHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677180572, "uuid": "28325355-407f-4872-9f6b-3526c4090b35", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677180572, "uuid": "f5cbf113-4230-480d-b935-e956df0b4e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180572, "uuid": "7c362e8c-fa49-4b80-8938-822fe05c1f41", "value": "3cd4ffdb489efabec9e1591f9fc02410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fa6efc-b387-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677163115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163115, "uuid": "b32d41f4-895e-4fc7-a18f-337157ec7493", "comment": "Malware payload (AgentTesla)", "value": "17f6405fffb0032159a90fa6818ba577", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163115, "uuid": "b39f0439-d922-483f-8391-39d80663bff9", "comment": "Malware payload (AgentTesla)", "value": "1307aabd4251736619cc78c16a7b35bd5d35d68e03c1d6fe48b250b2a17c3f16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163115, "uuid": "cc640d59-633a-418b-9629-d626782f3ea1", "comment": "Malware payload (AgentTesla)", "value": "fc8382a99e4383e8e5799d6be4c0627d9cd146e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163115, "uuid": "74c0152b-28b2-4c98-960b-abcafe537047", "comment": "Malware payload (AgentTesla)", "value": "8746635f046ba7eeb1be29b093e46226ff8dd01275326e6d9fdb5ca4bf498c6c4ed7dc925581e28a35241bb39f60b746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163115, "uuid": "e7867496-033c-48c9-8a8d-acc35cd101b7", "value": "T1AA056B8662B09033FDDE80AD07341ACF1E31B252710DE6675F7B2A989D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163115, "uuid": "06078eed-1924-47a9-aaa6-86408a4b977f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163115, "uuid": "a12641d0-8995-4396-aea0-24292cf2d512", "value": "24576:0J8ejKE556P4/j0Qytl2D3KcY+5HkvDYn3y8SiYU5:y5roQoM3N5Hkrm3uvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677163115, "uuid": "a5e7b60a-6acc-415c-b85f-4f7fe77f952d", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677163115, "uuid": "42370d21-cf4a-4b83-8c53-dbb3ee6d90c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163115, "uuid": "8a3f05bb-adea-48ad-8bb8-3af5b2f99977", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d756f218-b387-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677163153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163153, "uuid": "e9cae88c-9a99-4111-87a3-b0dfc3e52eaa", "comment": "Malware payload (AgentTesla)", "value": "217d27769940bf105e673f27c96441b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163153, "uuid": "7440f6f1-a3b8-42f3-ad07-c3af47c196e4", "comment": "Malware payload (AgentTesla)", "value": "135cbc54b63c8ec17f8174791d5fdfce239e587a319a335d4c22ef7e7ec225d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163153, "uuid": "bdd374c9-c153-4db2-b24b-6329c4212914", "comment": "Malware payload (AgentTesla)", "value": "0527d94315a3ef240d991f09a5b52c65bf67ec4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163153, "uuid": "d4a77424-7a6f-4ed4-a18a-d77c1a29e957", "comment": "Malware payload (AgentTesla)", "value": "860994d5076e866fb2e27ec983d04588fa405bc57110e4281d588f9d1489db0d8d150ca5fa4cef4a8a3c6af35a2a5f09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163153, "uuid": "c61af3e4-e7f9-48b0-bb1f-08aea7d4b523", "value": "T113F4F22233946F54FABD9F391621222047F1764AE362CF1FBCC501D85F62B82AB63B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163153, "uuid": "e755341b-d959-4876-b485-843550b22a77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163153, "uuid": "93ecc1c5-c7bf-4182-a1fa-43a46e107722", "value": "12288:T4KEGLl3tEyxUTdA2hUnrSOIXmjMS9+I8TXIn211111111111111aBeilF9/w8iX:/9JiT/gnOmeT911111111111111rilkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677163153, "uuid": "815c461d-a4be-484c-b681-c620f2e4e93f", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677163153, "uuid": "0a67927c-2cf1-4255-9a74-461239cb9e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163153, "uuid": "7cafedde-b5be-4f30-955b-376205a32bef", "value": "Scan Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249bdcdd-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677151686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151686, "uuid": "9eda1351-8d7b-405f-aa05-629e73182ef2", "comment": "Malware payload (AveMariaRAT)", "value": "c60f1da307389c105e1aa8cb22992413", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151686, "uuid": "9f19343d-ca7c-4d45-9abe-233de34ebc54", "comment": "Malware payload (AveMariaRAT)", "value": "1376df41ef75f22b8d35a4407c9aa23789e82c5b49bbef3cba7406bafa067122", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151686, "uuid": "1dd422c9-f419-4bd4-8d1d-d5ff8477e8bc", "comment": "Malware payload (AveMariaRAT)", "value": "a0cee0c49a307c9d4703c7a722f8632d1ee1f7ec", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151686, "uuid": "5dcc78e1-3eb0-4d46-a3aa-364f487ee742", "comment": "Malware payload (AveMariaRAT)", "value": "3de39ecbe48f457281f60275ec05730a271c40d1afc60cf95fbd9d258684e890e21d64dbae767baccfc670210f9996c0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151686, "uuid": "4f360230-4489-4fb7-ab1b-5304a6bfe293", "value": "T18424F10577A4C1A3D8724B311E38D7FF16A9BD299C685A0B33C47F4FB6365829A0EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151686, "uuid": "d75ac9ad-4216-4860-9871-34e6fe7ef1f3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151686, "uuid": "060f6748-99c4-491b-b2c2-177c620da203", "value": "3072:2fY/TU9fE9PEtuPbr6IHtXFt7mWfz0V8WbBX/bXHMMmYIjhhuajn22jDYZFauPfI:gYa6JrFDhn783bBPgVYIjbuajFXuHwxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151686, "uuid": "4224f7ea-38d2-49d5-b81c-8bcdcfcdbbd5", "value": 225093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151686, "uuid": "5333b3be-739d-4abd-aa29-ff07cb37f549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151686, "uuid": "fe2a4cbc-260f-4bd1-abfe-10c7245e1844", "value": "c60f1da307389c105e1aa8cb22992413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bfb3f1-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1677143264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143264, "uuid": "bd3259dc-7513-4c7c-8bbe-a351a7119a4e", "comment": "Malware payload (Vjw0rm)", "value": "2e2078339793c66d19efb2c4b642ccb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143264, "uuid": "aeceb117-bc4b-4baf-b385-70e813196767", "comment": "Malware payload (Vjw0rm)", "value": "15473e094a9ec464cce7a31879bc27eec654a43ea27239bd7f56afa333a59a7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143264, "uuid": "f0de31f4-f905-40c7-b348-4f998bc8a176", "comment": "Malware payload (Vjw0rm)", "value": "714ae2b2c1ac173e5539c95d4594c0d3ed4aa438", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143264, "uuid": "9ddfe870-6896-451d-bc4a-d3953a9e25fd", "comment": "Malware payload (Vjw0rm)", "value": "b3a33c4abc3716f127a068efb5f231737458429ff99b58af36a16258aae92dc4ff26013dbee4431567bf7343a29c7c78", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143264, "uuid": "541cee1e-1f5a-4a06-99f8-b3bbd0b264c2", "value": "T1BB96489832C6CA1FC78E0873F97849E9A823892F5AD52383EF2DF44C495445BC58D8F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143264, "uuid": "88decdd2-4427-478e-9bfa-8fb56f6a2860", "value": "96:BZH1uy6XIUoN2lcJc9l8SVinV2F2uFInZW6cNxTGji578Gji5rmjiQD0wGji57ty:BZVh7yeSQnV2F2AIZW3NxT78i0w7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143264, "uuid": "f13b37df-9097-4670-aef9-1cca6421789a", "value": 9437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143264, "uuid": "dd5d5474-d762-4083-81a5-da1d46642f3d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143264, "uuid": "2420c5ef-78d8-4acc-a28b-6fe33d1c953b", "value": "1ZXSAOPKH09SA_PAYMENT-COPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c98b604-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136211, "uuid": "025b5981-0f64-433c-a181-32157bb6ac87", "comment": "Malware payload (AgentTesla)", "value": "8fec400fe4a176cec1cfa2a6270a59d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136211, "uuid": "ee7877ea-b6f5-46b0-8661-e6693d38ffc2", "comment": "Malware payload (AgentTesla)", "value": "16eae916fbb458cd6e6f5885e56ec19eacbe55a5dfd124c8e8668098820b3204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136211, "uuid": "332bc95e-4eb4-469b-986c-84529aa2b2c9", "comment": "Malware payload (AgentTesla)", "value": "46b05d63e280a71d5d9f14ecff14ee5bffe92542", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136211, "uuid": "2743efdb-7d4f-424f-8855-68c7c8b5cf4f", "comment": "Malware payload (AgentTesla)", "value": "af8ee5c895a281d35a5786f6aadd248b3d60b8179a7fbef70b43d19517f92c930ea122eb3e54ed8fddc4a321d94c2d9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136211, "uuid": "806040a7-c3ec-45d8-852a-bfa5f02c4195", "value": "T16F83FB3377444629E52E327544F3E26C8267B341D4B75A3A38CD9D7B8F971438AB2364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136211, "uuid": "6eb95620-ae8d-4e47-807e-80f3594591b8", "value": "192:eVlrYraTdQS53M58auD28GSALhtGfygJrBhIf3jdZ:0NvTuS53uuDV2LhtGfygJ8fTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136211, "uuid": "c888f339-84e6-4d0f-8382-f5bf5e598b7f", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136211, "uuid": "d2bf3491-c41e-4166-8cfe-d3a87c7b3cb5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136211, "uuid": "08912fdd-fdb2-4028-8819-844a8b556263", "value": "DHL_AWB_NO_#907853880911_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e301df-b384-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677161510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161510, "uuid": "defdce85-5593-4cf3-932f-f296c390df92", "comment": "Malware payload (AgentTesla)", "value": "c72fa49cc27c9a3faa77d4608a086005", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161510, "uuid": "7b341b7a-2f8d-4912-a3a5-4a291f6b9474", "comment": "Malware payload (AgentTesla)", "value": "1848273b479f368e281177c9b8d643ff1994906f7c2479c92b1ae7f38440f0ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161510, "uuid": "01c069ba-1d4e-4681-ac78-34fa3ab8f47f", "comment": "Malware payload (AgentTesla)", "value": "71a398adff6117b459999bd480ba3fd4eccbb086", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161510, "uuid": "b3c88169-a563-4b37-9258-5e3d01eb7085", "comment": "Malware payload (AgentTesla)", "value": "0a8451986ae9baa8790ab79be511b1dbcbd29fb83ad7b9f271ee325ce9a7f3ca02e538746396dec8a04960f0efe0711b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161510, "uuid": "578598fd-4aab-40e2-bab1-a52f0148bc5d", "value": "T1F0158B4BBBF09076F9AE51AC063926CF1D31A243725CE2265F3B79449D8ADFBB1C8110", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161510, "uuid": "e0a0c655-966c-4ee3-84a8-243e0251e60f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161510, "uuid": "70062b06-482a-419e-81ff-e41c0c01666c", "value": "24576:P1ufG5wfV5dxuBYUrTY0fyUiDn4QCtcu:Poh/dxDMU0fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677161510, "uuid": "94de59b8-98c2-46db-bc87-80b92d146662", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677161510, "uuid": "463fef09-a1ca-4bad-a023-a04d589d5108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161510, "uuid": "91dca4b2-f2bc-4eb6-a7df-0748ca1b6abe", "value": "invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e321f1f9-b3a3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677175199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175199, "uuid": "d7fa38d9-ed24-4d34-9579-ea5dd6509fd8", "comment": "Malware payload", "value": "c911c2daf69ae5a21c7e77f23d56beea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175199, "uuid": "f72f2d71-2dca-46fa-9107-f91503c70315", "comment": "Malware payload", "value": "18974b34be71de640e050040cf42e81097ddd481622c47a02b1497ac0e2a2282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175199, "uuid": "785bbf44-228a-417d-bed7-98f591f24866", "comment": "Malware payload", "value": "7492ae1b536945b4b0f4ecb6a2fe1b57528d6a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175199, "uuid": "252f41e4-ad3d-49ae-866f-d1c0d0e63f90", "comment": "Malware payload", "value": "dac9ba345a3d5e8d24e405452d99f3458a36c7e60f8a3a4af4d08c505fffd3ca9768445a002a57a5c34bac15211c47c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175199, "uuid": "c496beaa-9396-41a6-b769-71bd3808ee6d", "value": "T1D16708626805B10FE9D437FAA3D32AF107E6ED94A36949C381E43D1DD331AC36A3658D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175199, "uuid": "a205aafd-dab7-4148-ba2d-b15ba0668da7", "value": "5170e6c47d56d58f55405d8528cdff6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175199, "uuid": "f3826835-61bd-4688-9147-c7d9f19c0e58", "value": "196608:hKbeBC29Z6z02LGz70vcP28HGPpzRKc33j0g1BPYi8TMqZ1TtvG/QZIDcQXR5SwE:hkD29Z6zvjv3iJeb8m/tcQB5S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677175199, "uuid": "eac2c48d-0754-4fba-967f-018dd2c3e9c5", "value": 30662144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677175199, "uuid": "97b1e52a-0510-4331-8313-9ef6832ab7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175199, "uuid": "cad50c16-f88c-47de-9c1d-2bc9adcf0886", "value": "Start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0941d7e-b381-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackGuard)", "timestamp": 1677160511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160511, "uuid": "ce4cfc23-bcfb-4154-a90f-9950acced574", "comment": "Malware payload (BlackGuard)", "value": "08c1b360ad5f727a0660adfa74bd7509", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160511, "uuid": "3e32c7b8-feab-4ca3-8cac-4bf1eead6e3a", "comment": "Malware payload (BlackGuard)", "value": "18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160511, "uuid": "785925d6-1b49-42f9-adff-21d826c3b127", "comment": "Malware payload (BlackGuard)", "value": "43a8d5a55f858ac67b195d2ebebc4ea498686f38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160511, "uuid": "ecd09fd7-3865-41b1-9c64-9e7a90acb8bd", "comment": "Malware payload (BlackGuard)", "value": "be55c0d91ec7830628de523ee3b377d47e86f256aa3cab57724e6851eae8ef4caed27f2878cc07c7dbdfc7c17d95e067", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160511, "uuid": "a982f778-7640-4e04-b977-5eb5d457d980", "value": "T1C8345B50B7E84B16E2FE9BB9E4741165C3B17862FC7EDB8E9C4024ED1922380C951BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160511, "uuid": "4a86c41f-cec1-45e1-a000-333b19299751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160511, "uuid": "86b9c789-8354-435f-a5b0-c8132bdc2fc9", "value": "3072:L5IAyZvNOYWO3bAfFFHjBl+Bl2K4eqibSE6czFKJLQPeI/Kh73WmqcSCJLeKgh2B:iAyZvHWbTH1l6RDbDjkIpbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677160511, "uuid": "7077cee8-10b1-456b-9a42-9a4f2188f55d", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677160511, "uuid": "f58f1493-3d7a-4ecc-a630-1b118b503523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160511, "uuid": "7274faf0-d03c-422c-be3a-a0998d3f18c3", "value": "08c1b360ad5f727a0660adfa74bd7509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2be850-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192095, "uuid": "4b86c91f-6fa7-44f4-9c60-ffe0654491ce", "comment": "Malware payload (Mirai)", "value": "d1e136ef523fe3f42158861e984c7c1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192095, "uuid": "f0a9843f-6ebf-4215-9e52-e72ac5bf30a6", "comment": "Malware payload (Mirai)", "value": "19bf95cf07d9f9dbccdad3436f6f88bebdf5fb5054528b575403872ab8f7c48b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192095, "uuid": "ae263787-a3e8-4010-8db7-6ce4c9b6c25e", "comment": "Malware payload (Mirai)", "value": "bd1c8deeb2794b8c59efc4e1f6d682418c7dbcce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192095, "uuid": "662f37f7-a056-47aa-9c48-4131fa0cdffa", "comment": "Malware payload (Mirai)", "value": "8a3fb01969156cf2a7fe0037de09ef7b7fadb4bb4776046658df4f10baed65813600bd12f6610d9a1394b696a17bd465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192095, "uuid": "404373af-6da8-45ef-a776-8eef174e2635", "value": "T1B9A2E02576632D56E3AD1C3CC96E8357B9671BFC90F6327639405620C94D24B3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192095, "uuid": "dff6518b-1bee-41f8-aa24-01777d661c2e", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjGlhymdGUop5hi:vvQn4j+ZO5fKAlxils3Uozg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192095, "uuid": "bc4d8796-9355-40ca-86a1-1acec22ce404", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192095, "uuid": "ee979f84-bde4-45a3-92cc-060545666dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192095, "uuid": "ad948707-9ab3-40ec-9b97-b79e3bf3f839", "value": "d1e136ef523fe3f42158861e984c7c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94217a0e-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141995, "uuid": "9d1e1596-ac6d-4fa7-9d93-a1faed7dd806", "comment": "Malware payload (SnakeKeylogger)", "value": "b47c554e60e52548ae315066efb30cc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141995, "uuid": "4dc4bff3-2b04-4194-837c-fefa2a764023", "comment": "Malware payload (SnakeKeylogger)", "value": "1aa7db53e0577e895af6e61418bf22d85852b62e30f585ba41a81b533bb32296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141995, "uuid": "f2d682bb-5fe2-4034-9c0c-a0aaa923b48b", "comment": "Malware payload (SnakeKeylogger)", "value": "4df8edb64b8ff418b4a1620ed36c75ee061fd70d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141995, "uuid": "d25b2b31-d50e-42b1-b8e5-99f1092d177d", "comment": "Malware payload (SnakeKeylogger)", "value": "962338ba86daceaf3dfb85aaabe86bd9ef542821fc077774b454071db52081d790bc1d20c4918bdbe391621840a5ee01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141995, "uuid": "1f571ba7-a00e-49cc-b804-0e76e27a3cea", "value": "T1B6F45A8772B09033F9DE80AC17341ACF1E31A252710DE6675F3B6A989D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141995, "uuid": "262cfdbb-1dbb-4b07-b490-ea4ddc91f1c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141995, "uuid": "dcdf0c2f-3dbd-4b61-9be8-1b1e2f1b4bbe", "value": "12288:wJ8ejfVJvpblPPcbr/rnQD0HjGvIZWVj1c8EP6N4oi0S:wJ8ejrvpwr/rRDGUOfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141995, "uuid": "f788febe-6ab4-4f62-a37c-8955a9e14a32", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141995, "uuid": "18fe132c-aa70-413e-b691-3802eed4ed51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141995, "uuid": "4226258b-7051-4f6a-b152-9d2c4b07c747", "value": "dZzttG9S7iYxkrd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ac14e5-b38d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677165786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165786, "uuid": "ab0c47c1-af6a-479c-8270-e80257d1f9ff", "comment": "Malware payload (RedLineStealer)", "value": "dcf561b72b6ece5a13bcaf5e650e9943", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165786, "uuid": "029cf2e2-be29-4e17-bea5-1afe216ec72e", "comment": "Malware payload (RedLineStealer)", "value": "1c0ebc3fa874f0e6205ee5e541e1f5582d7dd80751d40be1c42c5aedfc472b18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165786, "uuid": "71b94883-75e0-4b86-9c42-696684eb3709", "comment": "Malware payload (RedLineStealer)", "value": "ae8674dd65eed5360075e2b585346cc29b224b34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165786, "uuid": "2810df4e-2e23-46c0-9df5-23afeb567447", "comment": "Malware payload (RedLineStealer)", "value": "fa01625167a0298f7e15a73c485bd3a35119782b7c422392ca66b8be5dbe847416cc25ece512dfe30143d4cb26637611", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165786, "uuid": "1cfeed28-3ff1-4655-931e-8b089f0e926b", "value": "T19144F11272E0D030D4A7063129B483B15FBABDA16778463F37D4167E4F70690AE793A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165786, "uuid": "3cc291a5-1221-4391-b229-19e50eae1e6a", "value": "1c8b36d5b484aff1ec9ec4a50bf16f99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165786, "uuid": "bec61108-2517-4aec-9dee-6bd08efae954", "value": "6144:fV3BmYl5kOkx7lxSmNn1zy7XdwhVozIeFENcGEN/WbbAoYpH:d3BLl5I9lxSC1esVgIeGH+wA55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677165786, "uuid": "7a9c9bcc-cf0f-4638-aced-ff1efc546103", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677165786, "uuid": "3a473ee3-f703-470b-9c5f-81c71a3c2d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165786, "uuid": "be246de3-9845-4ce6-9dff-4e1ffc2b1992", "value": "dcf561b72b6ece5a13bcaf5e650e9943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66655cd9-b332-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677126456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677126456, "uuid": "6a0b7ec8-4a25-44c3-ada0-d3b8ddbce293", "comment": "Malware payload", "value": "afd4d3388773fd8c6786fde556644a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677126456, "uuid": "0d118fa0-1ab4-4f39-aa6b-775c8673db0a", "comment": "Malware payload", "value": "1e3674916588065211306bdca36d753a67d84f601c5763cb8c8b89b48c28199b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677126456, "uuid": "075e5b20-25eb-4c5e-82e5-1ffc6a842cbb", "comment": "Malware payload", "value": "765ff72d1af6d3c6cf934cf127072ec9b255c5b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677126456, "uuid": "1012ddc1-71ef-463e-ab2d-dc1abf77e4eb", "comment": "Malware payload", "value": "ed40e4ad8c7a8490fa3d773455beefa67f2e054a8d8ae8da7c9a6020fb44fefd487979bcb0e7403796bdde94c78377ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677126456, "uuid": "a6e14348-7443-4a9f-ae5f-8e8d4468590d", "value": "T19B45123322351045E4E6C93CD937FEF175F616774E82A8785ADE6CCA16328E8E643A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677126456, "uuid": "f125186a-3acc-424c-b6cc-5dc7831f76fe", "value": "f2ff070ce0a6197f4bd81b3ca156891d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677126456, "uuid": "84a2e370-5ed7-4b90-b3c9-02ba1b57ef17", "value": "24576:9XGK/c7d8+B3EFpLibRzJSp6tTLnVzcVbooGRA1OOmkXm+erO:j+BkLinTLhcVbHCJOmkW+erO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677126456, "uuid": "a2695bf4-7097-4230-ac21-5af4158bdd4b", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677126456, "uuid": "4c55fc4f-b5e3-4d10-a54a-603f8a443f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677126456, "uuid": "7c5e4694-b788-4276-9a73-fecd7f7bbb77", "value": "SecuriteInfo.com.W32.Damaged_File.E.gen.Eldorado.15147.30046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62803b4-b3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677194477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677194477, "uuid": "bbb83355-6f89-4665-aefc-4fdab6b0c4a2", "comment": "Malware payload (RedLineStealer)", "value": "f1a5d668b65f4db0c423ed6e9239e217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677194477, "uuid": "f058850f-9689-4202-b473-cd2d2c76396c", "comment": "Malware payload (RedLineStealer)", "value": "1f9843ff169fa572bc715c398ccb74e6d04232ae9a2f23d964d839bea5a94cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677194477, "uuid": "2b539ef1-e6c1-4741-bae5-979e33369564", "comment": "Malware payload (RedLineStealer)", "value": "17d986b65eef4389f0c311730a06ff062499adf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677194477, "uuid": "a369aea6-ea23-4680-83cf-64ebc1cc194b", "comment": "Malware payload (RedLineStealer)", "value": "365df2f2596ee88b7b5f51d1494cbdf480bf2ccf4da90c3035c004d29df475adf05ac6acc55bbeecf2633a83232d6ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677194477, "uuid": "efba6d8d-44d8-440e-b03e-23c9fc649412", "value": "T13214C000265C911AF8FBE5F478F35E2678B990F4769FA59FE71500D80A063F161FA60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677194477, "uuid": "605a8f23-17c4-4781-889c-f08b15b05078", "value": "ae02ebc1e8c04c1e04fbf9093bdee9f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677194477, "uuid": "cd8469b3-946b-4fcd-8362-cd75b20f1125", "value": "3072:7OvZrP9bo8BdUayvjKRTtTO2NMmBM155t3S9CuVkXGsG4Ii+qJAmx8:7OBrFbo8BdE1sMnvSEkkvG4kquh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677194477, "uuid": "9d6e4e30-04e2-40c9-ab16-6d358d6ac0be", "value": 196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677194477, "uuid": "bd1bd4b2-3d19-47c2-988c-f75d3809ae37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677194477, "uuid": "0a6e6727-3b16-46e1-a078-5ec3db7f404c", "value": "Discord Logger V4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5faeb52-b32a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677123261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123261, "uuid": "d9075eeb-e204-45b0-8b7d-148787899420", "comment": "Malware payload (Mirai)", "value": "b78e49712deb14bd29ff1be629dc04f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123261, "uuid": "5fc19afb-eb5d-4c60-8f9c-aa90b262776c", "comment": "Malware payload (Mirai)", "value": "1fadddcf1a0f4db8db5c74b7f5cc08ee1619e514f3d026a46f238622c5824b9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123261, "uuid": "1d19e533-3527-4628-8eda-f8590fa56efa", "comment": "Malware payload (Mirai)", "value": "df3eb718f9a4b5fb5bfe15ba3523550880f97062", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123261, "uuid": "0d06fbe0-9923-4117-b1a1-4e085e8e9cdd", "comment": "Malware payload (Mirai)", "value": "f3f302ad2c29354c372ac1196e90c44c3b1bfc0badc55e91e35e01bb331ebb7f72eceaa8cbefdece435d84573cc8436a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123261, "uuid": "f8b0bf03-dd7f-4b28-8566-784749c83bdc", "value": "T15CC33B42EA409B17C5D61777FE9F414A3322DB54A3DB330689285FF43F86A9E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123261, "uuid": "3c420029-cf0a-4203-807e-3d4e5dc753c5", "value": "3072:tc/BCltnde5hLckPBrPDVpN+Gt4hmxoWM/9xM/:O/BCltnAcErPDVpgGymxjM/9xM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677123261, "uuid": "0a5cc40a-05ba-4286-a521-940daceb3831", "value": 126644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677123261, "uuid": "fd32b84b-5f76-4030-a52a-05d4c1825980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123261, "uuid": "28d108a1-ea5c-4d76-88b7-bf745f0e9a80", "value": "b78e49712deb14bd29ff1be629dc04f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53865678-b3a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677176246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176246, "uuid": "52f8f2bb-ad87-4942-aaab-ed8869caa9a1", "comment": "Malware payload", "value": "1e0385a670b81ebf47ac4e0b3e5b3187", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176246, "uuid": "1a178424-42c5-49d7-bdc3-bac82709d044", "comment": "Malware payload", "value": "203531dbc79b0a46d6cb0f536f3d39b4fc4c5ed334e74a086d2764e747f3004f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176246, "uuid": "17a24055-cb82-4411-9edd-e974600ada75", "comment": "Malware payload", "value": "aa944931703c00be7b66f1d6f59739cc3479ea72", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176246, "uuid": "a73d7a87-4bbe-4af6-b99b-54ce8ac4fc45", "comment": "Malware payload", "value": "f040cbe77efff967871bdbe88352cdc6fc9384c6b0b691941c71c0d6795d671a14a9446798b776cd205d5fe7ff318195", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677176246, "uuid": "51593236-b319-4d7c-91ec-eb93264cdc0d", "value": "T1957633ACD50728B90A285BAC5D1AB77FADBF8010F41819115213F181AEE12EE77C5F9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677176246, "uuid": "5347c27e-41d6-4bca-9c65-3c172c8adbe6", "value": "196608:lVvw5qvTL3Zd1O96ZsH5+19iID9eWEP5+POsk:jw4r1U5+nhEWEP5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677176246, "uuid": "15ab9fd6-8f10-4cc9-9884-4c869b402aba", "value": 7363840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677176246, "uuid": "e59579c6-334e-4062-a41e-186b264cc3c3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677176246, "uuid": "15c29f6c-3869-40ad-af02-631e4e7a2159", "value": "Reksati Multihack 2022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31420c29-b33f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677131950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677131950, "uuid": "46ee02ed-40d4-41e8-a93a-e5b88db4a55c", "comment": "Malware payload", "value": "e81cb1a3fc80d819687a9e185d69a0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677131950, "uuid": "8745dfb5-76ec-468c-bcc3-ec4b19288caa", "comment": "Malware payload", "value": "21ee3d0969be5a06e723ef34ebdc4f2688aded1fcfaa787c320a48d528165dd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677131950, "uuid": "629270ac-ccbd-42c1-82c4-d34c1fb0956e", "comment": "Malware payload", "value": "fb5c3c6250b25eba6d4ec971cfe49b1ab1eb5266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677131950, "uuid": "48824b0b-b9ec-4921-b444-25fe72bed0ea", "comment": "Malware payload", "value": "2a2dc8242c15aa70002a9b7e5b3b704da803bb359e5371eebe06e0874b7acfa0b6454a55f661422c4851b13a1bd5e38e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677131950, "uuid": "ba349e74-a616-44ac-b66e-16ba76e3f153", "value": "T12F5412743061D473DFA24FF0403AA56E9BF9832518A5338777A01BE97D23383896A3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677131950, "uuid": "77dedf2c-0e07-4d4c-b5d5-7e91dedc6b8a", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677131950, "uuid": "366fed70-c85d-46f6-b346-1439384c28a9", "value": "6144:CQLFhRR0ni87GH121RcickK/EIAd7WubzyooUhWnkmfigs7C:/FjRei8K1MNKMIAMubWooUfqigsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677131950, "uuid": "c36036f5-a6d2-4aa6-878f-97c59cb6dcfe", "value": 287888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677131950, "uuid": "e3e49cea-b0b6-4f8a-b85e-1aab64133b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677131950, "uuid": "e1ab1a83-3ea5-49f1-8ff9-fbbd2c81ed45", "value": "Awe.pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96713949-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128684, "uuid": "077b3bd7-9b95-447d-88f3-534ecf609a59", "comment": "Malware payload (WannaCry)", "value": "9365d0c962d3e541c9ae05660346545a", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128684, "uuid": "91bb7b05-5748-40e5-83e4-f674dd2f7677", "comment": "Malware payload (WannaCry)", "value": "225cd58d12da277a9a7f197fecf4fda9ba6e46c37fd65193e339e87a55715341", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128684, "uuid": "a50bf526-63db-4448-b145-25041a5fdee4", "comment": "Malware payload (WannaCry)", "value": "63ea30be5756ea0789149ef894087a59d6a31631", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128684, "uuid": "ba139686-ee9e-4f76-b211-cb947f5f8604", "comment": "Malware payload (WannaCry)", "value": "7297de29bf771eefc3dc0e62edcaa7e5aeda369872e83cd4f0ff478de0317eeaf7c5483127a15bb55766d12b0a0eda04", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128684, "uuid": "5018b942-ba10-4a3b-981b-b97f17471c55", "value": "T11ED52D3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128684, "uuid": "aeaf6edc-c72b-429d-b676-5cf8f1e9b3df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128684, "uuid": "86c3e309-3c13-4e89-a744-5130a1ec6c74", "value": "24576:s9S4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:s9Sy6PX3PpM+P5Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128684, "uuid": "ed67e069-2c72-4bc6-a0e4-765317a70021", "value": 2843136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128684, "uuid": "0eabd0c3-d5d8-4a09-95a9-3bfc13ddf096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128684, "uuid": "27cc4f43-8799-4f2b-8b89-26e91c4a5e32", "value": "2023-02-21_9365d0c962d3e541c9ae05660346545a_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f10cfd-b377-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677156225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156225, "uuid": "482183cc-da8c-45d0-bfbd-85f718b898ba", "comment": "Malware payload", "value": "d59554cdd4233718e886bf002a0cef7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156225, "uuid": "ca586bba-aa47-4e7e-9d0f-1c6b995df7d6", "comment": "Malware payload", "value": "2350ae73c003cbd494242d2cf66b5e750107666fbcb3d61f8cfaf57e4abafb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156225, "uuid": "8dd07402-5156-4472-aeb6-bea51201b5b0", "comment": "Malware payload", "value": "9bbc2034af89d1f506c571778801bc14144c61ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156225, "uuid": "fc570de1-6a77-4ad6-b5cd-fb1d3fd73868", "comment": "Malware payload", "value": "2661963e1c4109215252e96faf36b473d81c7d21af85a850a5e520841553414d1713e02bb4e09aadca26768904ceb8b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156225, "uuid": "1943d79e-171b-41e0-a902-2c14d15e2509", "value": "T14B936D5078D1C472E87A29315870DAB45A3DFD711E219FAB3788127B4F312C19A29EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156225, "uuid": "40d3ab36-1d5c-445e-8cc7-46a60c6dbca3", "value": "cfdf2acf6e3fbbd2034e45d2f46cd580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156225, "uuid": "5496ca9f-9ab0-4ec1-9fb9-4275144b5e1b", "value": "1536:PL2Ltv5Y19UHLoatgRDoQlvnhIKTRun6sB2VhdSb2y7aafLsWxN6vhcdPGEGC5gL:PL258iLo1xo+hIKTIn6sBASvaoMoPrGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677156225, "uuid": "521269e3-b157-477a-b639-93fd8e254e7c", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677156225, "uuid": "1737757b-1487-45a3-a9e3-d4b8414b4637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156225, "uuid": "e0cf81a0-d166-424d-ad97-0bd2340de5b1", "value": "SecuriteInfo.com.Win32.PWSX-gen.11575.3966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa91e7f-b319-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677115753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115753, "uuid": "83c86b40-7c37-4f96-b103-715e30346b88", "comment": "Malware payload (SnakeKeylogger)", "value": "12b9a19395cf98c9934928d771f65656", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115753, "uuid": "c1196c85-a43a-4870-b0a2-1617e811c28c", "comment": "Malware payload (SnakeKeylogger)", "value": "249c5c71ebc2adb3ba6c243fde0a5ab8ffc3fd4135afb93cd50ea2edc492a709", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115753, "uuid": "ef672d17-86ed-4114-a09c-627bd5dc3ab6", "comment": "Malware payload (SnakeKeylogger)", "value": "94df6f7ad1ec76eb14cde3f2a1bc6bbaa48f8945", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115753, "uuid": "3f4a2c61-2625-4aeb-8e6a-ca75d5caf3e0", "comment": "Malware payload (SnakeKeylogger)", "value": "3a57b8612b144cbc11511748ab06c6fec9bb03ebb1dd3bdf20df72a7df49d601209e19f70a03347a453a10f6c2330f57", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677115753, "uuid": "d7af679b-2d18-4811-a4a4-a47d14527866", "value": "T10E6219421B8E9DF2C254F473921981090E7EDA2731572AE9788ED49537FD60E4AF82F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677115753, "uuid": "9bb8e178-252c-4f63-b8f1-2e9da864bd05", "value": "384:zC4QFT0kyMZtvj4XAB36LYb9keicdcaFiC7d5:zKtQikXAGYR1d7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677115753, "uuid": "9bd33529-faad-41ad-be81-c1fc0af501fe", "value": 14899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677115753, "uuid": "f05564f2-452c-4448-a193-4f6171baac93", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677115753, "uuid": "56efde2a-85dd-4151-96da-4a68817fc814", "value": "12b9a19395cf98c9934928d771f65656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c43086-b396-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677169477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169477, "uuid": "878e032c-d0e2-4a93-8fc9-7df01e4ee5b0", "comment": "Malware payload", "value": "b408de8fcf09b737831386c30332cb7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169477, "uuid": "3a33b946-4a85-4296-b63d-11fbaddae9c5", "comment": "Malware payload", "value": "250e7d7162aae36069d93c35c449b56ee0195d2e3560b2c2c124ab44ad18c7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169477, "uuid": "31e54032-1e62-42ee-9c84-cb616e47757b", "comment": "Malware payload", "value": "d604f041444c80f9931ac57f99c5b7f4b44b8723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169477, "uuid": "c4509a77-a449-4081-a169-b7f376da447a", "comment": "Malware payload", "value": "d30e6e4cbc3eae96450040491a8ebbeafc161755103fef83b6b966d99842b6067570cd881bc8f53b414c2e699097467b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169477, "uuid": "cb968306-8276-44a7-8269-0537ab376e87", "value": "T1EDA4134631B18933CD794B7001E7E6A56EB1ED615CC00A4F6BA06ADF3DB17C1DE1A22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169477, "uuid": "98f116c4-f0d6-4025-92f8-d006414ffcd4", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169477, "uuid": "4684d528-2a40-4aa3-b8af-a1405b7fa7b0", "value": "12288:xq8Txg/ui5nsZCVxGvd+bhC+IeQ+ImWmyJYj1fLP:w8T2/ui5nsZCaQn++ImdfLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677169477, "uuid": "6b0583ee-3039-4b67-ba70-f44b2556a5b8", "value": 465768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677169477, "uuid": "3b005d88-24c3-415c-922a-639b8555b2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169477, "uuid": "b76e0b4c-fa9e-447e-84fe-0bad40621c06", "value": "AIDA91091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe5adcc-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192105, "uuid": "d1d598ee-775c-4509-a4fe-83e474135379", "comment": "Malware payload (Mirai)", "value": "9e048f35226f438923e7b72d1f8582fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192105, "uuid": "c92c7eb1-2d7b-4b9e-8e20-5a6e77e23615", "comment": "Malware payload (Mirai)", "value": "25a09e26888c73b079dfd85f682318d06ec1d525070884396682ec14a4a73827", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192105, "uuid": "c6362b67-9341-4fe2-8bc2-7e8a816d6960", "comment": "Malware payload (Mirai)", "value": "2610b6e88b252219e7c6571a24fc050b6ec4aff8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192105, "uuid": "b3a46d77-24c9-4b0d-a46c-779641b76019", "comment": "Malware payload (Mirai)", "value": "ba30b3a835b4eb958365eb92e34ee7c5d1bc3facf56a616edd3cbb00e115b351a4932df64331a68fc46cc7cd70e16cb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192105, "uuid": "c5739eb4-83eb-447f-88a0-b87f3349ae96", "value": "T14FA2D025E345AEF4DFAF9D9452C1C2C276E987C72786C8E380FEAF012516046BB88D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192105, "uuid": "f287a5c0-063b-484e-8249-d6483e51cdc7", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5FM4uVcqgw05VxJs:mRxsSVsMD6xiJJE5zRWNw4uVcqgw09+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192105, "uuid": "e42276ab-2695-41ca-ae69-59d7c474fa5d", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192105, "uuid": "6b98baf8-cba0-4cf9-af16-30f79af4a368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192105, "uuid": "b652c1fe-9d0b-4aa7-a16e-be2c190c004c", "value": "9e048f35226f438923e7b72d1f8582fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877bed36-b388-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677163448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163448, "uuid": "b0c8295b-5bc7-4a2b-9a15-23231fe57516", "comment": "Malware payload", "value": "9d6c627b003a0dd90909abdaaac0e318", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163448, "uuid": "7c81d6a2-f051-4d3f-9f67-7466d532fdf1", "comment": "Malware payload", "value": "25e633f14a627f12dd9c1b0f0932d50aa003930b84cd7b9d656755262896b8af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163448, "uuid": "596059bc-95e7-4bb6-928d-3959d50ccb16", "comment": "Malware payload", "value": "63850e24c1d880db63d3f2a83016cd958e94a5ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163448, "uuid": "b1c2978f-ecd8-40cf-baa2-afee078af7f2", "comment": "Malware payload", "value": "1d49d7b91082774fc896a9628c38e3a145d70463f839f4018df97258cfee2438e05728c47b45dce8f330cc814bfd3873", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163448, "uuid": "caaf5b0c-be22-4b64-845a-dc98616fad63", "value": "T1F155492439EB501AF173EFB94BE4B5D6DAAFBB733B03645D106103864623A81DD8253E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163448, "uuid": "df1eaea1-32b4-425f-a0c6-2e9df832205d", "value": "12288:iv8Q8ccmJ/gmAtWqO2XecmvEWTIj/ZxO0PNqBQairhfFlLmlsrkRQ5vIcKsQqxu3:iJJUU6biqLbncLTn44ezv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677163448, "uuid": "3b73d0b9-06e9-4b4d-9235-ac83cadb42df", "value": 1325056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677163448, "uuid": "905978e8-aabf-46a8-9cef-d5f35a3fe55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163448, "uuid": "e0f62d59-bdad-4f44-8929-bedf6ae113e7", "value": "Transferencia. MXN $40,834.90.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148a855d-b317-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677114722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114722, "uuid": "85971c38-f82c-4a02-a080-7f5e1f4e7cab", "comment": "Malware payload (SnakeKeylogger)", "value": "ec9f3f8f0a9ed73f8144d0b99f3cd7e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114722, "uuid": "e0f462ba-3a79-420c-b349-490a93ef6a34", "comment": "Malware payload (SnakeKeylogger)", "value": "26b651e58c2f3327e4bb8f994047e77bb3c4a9a9b821ffa3d6e5c61ddfc6408e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114722, "uuid": "cd166524-5b74-4bab-a276-093dcd397286", "comment": "Malware payload (SnakeKeylogger)", "value": "2703fad2afb16066d2d0bc026267f08f5b54a799", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114722, "uuid": "f5d56445-2868-4961-9625-0e98610fe8f4", "comment": "Malware payload (SnakeKeylogger)", "value": "d3fad801db19fcfc53ce3f2c1d9bc219ef4ba20935053da98063103bc02c65fe5e6247dfe13525f58d8fb44a0c18cc11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114722, "uuid": "ce2300d4-3458-4370-95cf-a5a0b7633d0c", "value": "T1FC45AD4BBAB09876F8AF41BC053916CE0E32F252755CEA265FBB38448D56DFBB1C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114722, "uuid": "34228193-0d99-43ff-8d7f-ea636aea65e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114722, "uuid": "ffc1ede9-97b2-434f-a085-ffa672703c6e", "value": "24576:ooG5XGIfEUzbjlQcqNgA0fJaS+KZyPeB/3hMuK4/Ctcu:ooIIUPjlQcqNBWpZxJhMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114722, "uuid": "c8a45403-f847-4171-a286-49177705aa18", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114722, "uuid": "0c07eca7-8e7e-4a08-85b7-4c18a9c4a2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114722, "uuid": "3b1a8dc7-4b5d-4069-8564-653aba487aeb", "value": "ec9f3f8f0a9ed73f8144d0b99f3cd7e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03e5045-b38a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677164429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164429, "uuid": "ac0f17d7-0999-4900-b171-0e26de76d9c2", "comment": "Malware payload (njrat)", "value": "564a6e1b4cc1393cf1bdf23b8ebcc94c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164429, "uuid": "997d90fd-ad05-4deb-aa65-1df1f4ff271f", "comment": "Malware payload (njrat)", "value": "275879e7221905320723ef82e35b83c4291082f2233d46f4626409c4167bfc0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164429, "uuid": "faf6b47a-2f1f-40ff-b81e-29c885483bf3", "comment": "Malware payload (njrat)", "value": "3acc67aeb2d621967076998f6cad3f30067da721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164429, "uuid": "d65e72b3-7bee-4583-8320-49717322be01", "comment": "Malware payload (njrat)", "value": "4e3d611ca159e47dfa0d16074a1fb84eb166e4d56db5fca1424bce26951eab7c15a8e58a824ac8012fe65d7ac05b91fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164429, "uuid": "f310ba10-1853-4c76-9fc8-06f0a3ddb326", "value": "T144939347BF838A5FD2EC0A7644A5C63123B1A3AF0673872B7DD065A9FE521E36E10950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164429, "uuid": "6f731e1a-f7d1-43f8-84d7-f85bf2d02260", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164429, "uuid": "f09f9324-43f0-496f-99db-5c5f1f78c4f6", "value": "768:5kIJrJ/cPXoKUU1oCrM+rMRa8Nu6Wt1j6uAAAjLA1Tb+/YA//k/oZ:yWrJ0PoHUW9+gRJNhwOub+/YA//k/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677164429, "uuid": "5f8edebe-8cb5-49c2-99b5-fbffee9ad0af", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677164429, "uuid": "b800d3fb-73cd-444c-b700-bc72464c0c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164429, "uuid": "dcfc8372-dd64-4287-96e3-4832a6fdf1cc", "value": "564a6e1b4cc1393cf1bdf23b8ebcc94c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a377716-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1677142273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142273, "uuid": "f90eefd7-04a4-446e-bf90-d404db535ebd", "comment": "Malware payload (AZORult)", "value": "6a1b98c2a59290e32fa438e0454227cc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142273, "uuid": "181aca1b-bea2-47d5-86b3-81345ea810ef", "comment": "Malware payload (AZORult)", "value": "29638b2e72b9ffe56629a801b56e65aeb64299466bc7ae8ca4b3e86f246a4d19", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142273, "uuid": "49bb1329-d9d5-4428-bfb5-839d4eb9af77", "comment": "Malware payload (AZORult)", "value": "16cfe90908fa6530e279f70c29bb18880663d44d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142273, "uuid": "3d2afcca-28bc-4961-a5d7-49613f7633f3", "comment": "Malware payload (AZORult)", "value": "ca352315b46e64ed6ae042caa895abaf046c2a3d4930753dc58d52d12a1a53907cdff976c38b180a3d2d783844178a4e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142273, "uuid": "222e85d6-06d7-46a4-a663-816c93087688", "value": "T14125F106E291D93BDC668530E843649392158C6EED55CB8A31C3B31F6B32BF10E7BE65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142273, "uuid": "50fa7733-aeef-46f5-ba30-4f2d864ee242", "value": "24576:jFeVOEezj1RBmrFe69urZSmmoNI0PAtb4EwxScz/XbXXXXXXXXXXUXXXXXXXXXXi:h2OpCPutMoNrodrwUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142273, "uuid": "056c3cba-0e06-46c0-a13b-32dbd05cd898", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142273, "uuid": "37f6d8ff-63ba-4742-9d2b-762894cd4934", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142273, "uuid": "b020be29-9861-4e7f-9ab5-0e06aee0df67", "value": "9021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9e6e66-b316-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677114333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114333, "uuid": "e76b8f01-13db-4667-b8d3-f55197a855f8", "comment": "Malware payload (RedLineStealer)", "value": "433823b79612ec0e9f4b6bdd09b56718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114333, "uuid": "b857c492-378c-49e6-a6e0-161755cb5a1b", "comment": "Malware payload (RedLineStealer)", "value": "2a124aa2536a9d0fb475101bffb51e75a2cab8c0c90456cc5564d87b7c7fa16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114333, "uuid": "09d9db30-bf58-40e7-a06c-c12303a51821", "comment": "Malware payload (RedLineStealer)", "value": "7e7d5bfdda02c52ec2c63b729e63ef361139e0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114333, "uuid": "7d3b2966-cd19-4df4-ac4f-1ec9f4dcf119", "comment": "Malware payload (RedLineStealer)", "value": "dd76b5632c06ffade57317084b8d4c359f4f80d4ee305375b9d9b3ef76e3bf12ac762edf0a0532fb7dd65cc9ee9548ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114333, "uuid": "bb255fc8-b10e-48cd-a7af-dcd476095065", "value": "T1A644E976F39C8802F7A6F83091F72E56153E70753D4F49CB87BAA51212CA9E2A57CD08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114333, "uuid": "06b9c84b-38e5-4369-88b4-523a66263d99", "value": "1b58743aa6d3922ef077981e7514edd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114333, "uuid": "fa06ad64-84d2-4903-a831-741622e91eb4", "value": "3072:Cedck3uuC1G4UYi7ysfYdsOyPqTtzcRP0lJjPIe1ZdLLFXSd3pRO5lQQBvZVn:C7k3S1+Y8QdIiB4VoHz/URKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114333, "uuid": "e4942e19-d467-4056-bd81-44faf8693776", "value": 265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114333, "uuid": "9a1d3ae0-6853-498f-b376-6a52c8c31dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114333, "uuid": "62476071-e8be-4788-88a2-79797cc90e9b", "value": "433823b79612ec0e9f4b6bdd09b56718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ad905a-b30d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677110730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110730, "uuid": "f9069710-8e7d-48a4-b271-a6e74fd3927a", "comment": "Malware payload (RedLineStealer)", "value": "35b9ca8173ed97c958176e1d5753bba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110730, "uuid": "8d4891d3-a762-488f-b89e-de07a5b9e85a", "comment": "Malware payload (RedLineStealer)", "value": "2b0364a2395e43fd3a6545e3ae0d66da6a3a2cfc1438dd0aaffd4c65758f5703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110730, "uuid": "20136757-2b41-442b-958a-d5240bc8e43a", "comment": "Malware payload (RedLineStealer)", "value": "7adad06c41cd4a513a49f1cfec059c564a6748e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110730, "uuid": "03bee072-5af2-4cf8-bf41-9eb2ecdbbaf7", "comment": "Malware payload (RedLineStealer)", "value": "820039fada3de6f5341a2524a6352e8fdc49cbd95921c620172db4d43ad373d0083bf0829929e906ca9bc58249e8b184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110730, "uuid": "4bdaa212-37ca-4f24-9cad-9e52f02c7567", "value": "T1BD74FA987670FD9EC857C87F8A581C64E6636466970BA203B05313AC993D79BFE130B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110730, "uuid": "3c044555-5868-4c71-965f-0b885d5079a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110730, "uuid": "1c7412df-30ae-4f5f-b53b-0dd96ba86672", "value": "6144:0bUlO6ppZmaSzY3xmUbaXml9L+89TNaQ8WqO7sE/r+X7w+e:nFppZmLKjK89TNaQ8WqO7sE/r+X7w+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677110730, "uuid": "1d2c0b7c-dcff-43c8-a621-58ec4d7f80f6", "value": 344261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677110730, "uuid": "9a826763-4b2c-45fe-ac3e-c2821f4bcfa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110730, "uuid": "be511f5d-7d9e-48b0-8c3a-513029499e36", "value": "35b9ca8173ed97c958176e1d5753bba3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5122ff42-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192133, "uuid": "9cbd4d62-f9f5-4145-ab4f-f88c7d580a6a", "comment": "Malware payload (Mirai)", "value": "860a8256536b563e540ea5cf9716c704", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192133, "uuid": "6f6b5068-503d-4dbb-8178-f325f6fe6c71", "comment": "Malware payload (Mirai)", "value": "2ea3247ff73e5bb9461d08c8365fa91e33130e5a741dfcde5020aa1802191aeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192133, "uuid": "e23eaaae-c66d-4924-9098-6f7623dda88e", "comment": "Malware payload (Mirai)", "value": "6df46a0b3c660a21148eae54d67c56c7e1aa009c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192133, "uuid": "5f48b0d8-1230-47f2-9c92-4d5b8e1e6b38", "comment": "Malware payload (Mirai)", "value": "d24f13a4997f71d2a33e3e384f6baf217caa13e9e77c654a3fd99d8611a3114b16c0c27ab88ca2591e6e9541a46c0b3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192133, "uuid": "8eac58c4-d1bf-4de2-ba96-20a4303bc3d8", "value": "T1DDC2D0E07726F931C4206C7DE52B4C8A7A51167C91FF393764158C398FC1A5A63E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192133, "uuid": "920eda1a-2320-4547-99da-749ffe688c0b", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrgT9q3UELum:PKy4qfqoeJdXWgVLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192133, "uuid": "6b6ea8f1-bfd1-43bf-a048-1fd4ee895322", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192133, "uuid": "262e9386-1425-4155-baa4-e15f82b3ca1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192133, "uuid": "805450c0-6f78-48ce-b07c-ddc5a5d15705", "value": "860a8256536b563e540ea5cf9716c704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05a622d-b394-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677168671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168671, "uuid": "23562d6d-bd2e-460f-8dc2-a9e859d5fc9d", "comment": "Malware payload", "value": "54fc962e8963129ed9ee02f93c61ca0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168671, "uuid": "8d4bd887-3c33-4699-8ccd-cfe177d85b47", "comment": "Malware payload", "value": "2eee592b19e01789f384e99ce780785722a66f6abd6a01db3a135f7840892275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168671, "uuid": "3d367351-b460-4abc-8906-8e841f9c4f69", "comment": "Malware payload", "value": "b08648d5517b81f6cbc3f5769375d0df70242c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168671, "uuid": "745180ac-f4bc-449d-8f97-0fe12fedba55", "comment": "Malware payload", "value": "8740eb2531c2a5b230ddc00456999b9e15a12d86dca50675e68da747def5a469f7cd92573a677ecce17d2126c88b1d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168671, "uuid": "48c101dc-5cb4-4c3f-af8d-f593fd3acb99", "value": "T1E80733E57A620CEAD49F6A3760D0775C823DBDC62222DA1B19707D443B3BB419F396B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168671, "uuid": "369605b7-7163-4508-b9fd-fbad02813609", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168671, "uuid": "153d0708-83a3-4d8e-a56f-5d326bcf1a24", "value": "393216:ou7L/1edQ2l6+9Joaw2N+mzW8+OQwGJLaX4FcYqP:oCLdedQm9Jq2NZW8+hVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677168671, "uuid": "f2843dd1-fb93-46af-8047-ce86469ac30a", "value": 17172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677168671, "uuid": "a2bf6a76-bb1e-4a67-ba37-455fcd1e6712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168671, "uuid": "b9249611-ae94-4fb5-bfb2-0d4d3415c77c", "value": "Disney [CHECKER] V3.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c82d88c-b394-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677168450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168450, "uuid": "fdd3421a-e947-4298-93bf-1fcbdb523422", "comment": "Malware payload", "value": "92b485e82500b6827cbbaabfcbb08b16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168450, "uuid": "a74f0bb0-f89e-44a0-80e9-699ac1e0e857", "comment": "Malware payload", "value": "2f0bb4d74005cf2460f4e5f0ef95390ef017fd154b00ada7492b266ca589ba3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168450, "uuid": "2581058f-b10f-430f-a43a-a1d83030b4ec", "comment": "Malware payload", "value": "37577934002e1f8b2d05cee98de8f672e4b64b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168450, "uuid": "b973b88a-c658-44e6-866a-057460ebc930", "comment": "Malware payload", "value": "c1cedb79e4213237a85cafe1e561a5040e1e5a1f108570f940681dc474e9bec363ab45ba46b6136f9aa9770da78c48de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168450, "uuid": "8b29a03c-4883-4a70-8ae0-b7211f898d8c", "value": "T191073355B3921CD9E4EE4337E09381509A22FC134391F2DB0AE43DA63D9B39C9D35AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168450, "uuid": "4bbd1bdc-1ba6-4b8d-b971-c8f6f2b05127", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168450, "uuid": "bde98242-5b39-45e7-b321-e004a64c1653", "value": "393216:gu7L/1edQ2l6+9Joaw2N+mzW83OmwGJLaX4FcYq:gCLdedQm9Jq2NZW833Vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677168450, "uuid": "b038d9fa-1c25-4693-b224-fbbe8ee4b981", "value": 16922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677168450, "uuid": "78961ad3-9ec6-4395-82db-f1ab6651702b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168450, "uuid": "65648182-89b7-4abc-85cf-7f72deca4a8e", "value": "Crunchyroll [CHECKER 2023] V1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8778c39d-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141973, "uuid": "29df06de-ea15-4662-a933-ec0f7d5cba21", "comment": "Malware payload (SnakeKeylogger)", "value": "998aae54d9b8165cf507c14eafee855f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141973, "uuid": "e74641c0-f415-49e1-b5e8-7f3efe171e95", "comment": "Malware payload (SnakeKeylogger)", "value": "2f9ef63066f74d25b08fe6aedc0739bcb965c2008d941a63fc67086db7b7ed59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141973, "uuid": "e1d272f1-d15e-41dc-a725-1f23aedcf644", "comment": "Malware payload (SnakeKeylogger)", "value": "b8ce93df5f3f1651e4939de65485d10bba101a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141973, "uuid": "63082dc6-0d9b-457d-87eb-816b681a8f49", "comment": "Malware payload (SnakeKeylogger)", "value": "4afc7818ba249cf97f422c9d361ff5bbc5db9319ec599b5847d22f56b3e3c2877ca656374c22a67e44360a8af6785e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141973, "uuid": "52033bf2-d86c-4f36-a609-8d82a4c67e9c", "value": "T145B401FDB6F79F62E3491573D0C7841003BA96869433E70B2AA506A7CE02383AB55FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141973, "uuid": "d8b4b190-ebd6-49b1-9080-45ff547fe13b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141973, "uuid": "6e1abb63-e105-4ec9-8044-2e723b99e970", "value": "12288:7czbd7SzKYvbBU3B9HHKwofQpQg98ffK:7czbd0bB4rHqwo6V9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141973, "uuid": "71cad92f-f1db-430f-89f6-7556f98d68a0", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141973, "uuid": "afb5bd90-e914-4ce8-8a33-1b1b4ed5cfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141973, "uuid": "4bff8a59-521a-4c25-9643-c909beab7ee3", "value": "998aae54d9b8165cf507c14eafee855f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8f0032-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677143190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143190, "uuid": "1e46145c-dd27-428e-aef2-ff02fdcaef51", "comment": "Malware payload (Formbook)", "value": "172c7514c4653bfb66200b4bbe6a35de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143190, "uuid": "9388bb0f-a16f-4119-948f-e3157eee0b22", "comment": "Malware payload (Formbook)", "value": "3130fe0040aca5135a6c22251a313fcaca05c404082727d8191545fccfcd3a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143190, "uuid": "8fc6d383-95e8-4064-9734-fa09604c1bef", "comment": "Malware payload (Formbook)", "value": "f52f8fc2ac3a3c49748fc9fc8facaa5417b7f1d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143190, "uuid": "e0b055e9-6bcb-4ce0-889b-79a17a6d027e", "comment": "Malware payload (Formbook)", "value": "24795c602d697c65aed9539f96c19758997aabc8dad82e819197355ea5e8407685c35ddb19e1c840eb908f30fce1753a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143190, "uuid": "57c4a6fb-be52-4837-8a8c-e209ec95056e", "value": "T18E158B8BBBF09077F99E419C063916CF5E31A252764CE2265F3B39488D8ADFBB1D8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143190, "uuid": "c6016309-e267-4027-aa73-57950feee5ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143190, "uuid": "8abb1859-e287-4741-8fe5-d9f63cd9e7d0", "value": "24576:ka174dajhYHKRfu/FuKcfGdZcPhsbCjrlpCtcu:ka6alYH4guF+Aysl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143190, "uuid": "f7de9081-6a48-4ad9-95dd-16b1b4c5a5e7", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143190, "uuid": "a7eb0056-44d8-4e9e-be9f-f7dd9c2341a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143190, "uuid": "c20c8312-be05-4ff2-b640-ae5227851dd9", "value": "Notificaci\u00f3n de transferencia de pago 1005680458220223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0455ca12-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677151632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151632, "uuid": "980264b9-a28e-4ba1-a170-de42d2152a2b", "comment": "Malware payload (AgentTesla)", "value": "6225c976e57ef4670b8224b6ab76339b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151632, "uuid": "0fc283f9-58a8-4be4-9aef-d1e2b72cda4c", "comment": "Malware payload (AgentTesla)", "value": "3138dc3cb4f7bda6e0b01d3afd5835e1162f7f017fa329f51784a4e94a027cab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151632, "uuid": "7bc68f79-a629-4dd9-a386-7b99f989c19d", "comment": "Malware payload (AgentTesla)", "value": "596f4a914c94c10c45a930481b9102c21c045743", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151632, "uuid": "323e737e-d587-4ac1-9597-c3d27b3cbc4d", "comment": "Malware payload (AgentTesla)", "value": "b317016e423920075ede064368633eb8ee81204db07db27f78b0f0e0234249a716d1d08f9a4168b85d7e136ee734ef5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151632, "uuid": "f7618195-e385-4150-a362-a67e04c647fd", "value": "T10D45AC4BBAB09437F99E51BD053812CF1E32B212754CE2265F7B39449D9AEFBB1C8112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151632, "uuid": "aca44f4f-d58d-4c85-abbf-2b12ca040bac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151632, "uuid": "89d922b1-b640-4308-a4b4-237c95ef0bb6", "value": "24576:B5m5E5VfMk3fj4rdKIZ++/MHDcHjupMYHhjiVyR84RCtcu:B5m5EZvkrQIZ+bH4DRshs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151632, "uuid": "8fbce161-fe50-4261-99e4-09fc564d1787", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151632, "uuid": "9d10123e-bac0-4e69-a13f-f39568e342a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151632, "uuid": "14109b69-dc72-4102-8bf3-e3faf9e931d9", "value": "6225c976e57ef4670b8224b6ab76339b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5332ab7-b377-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677156304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156304, "uuid": "bab8f3ba-7f19-41a1-adf8-cdebb56d25f6", "comment": "Malware payload", "value": "81d6afb50d596a135e93f26e007dafa1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156304, "uuid": "9040b76c-bbe8-46e7-816a-244bb5cb79db", "comment": "Malware payload", "value": "31b4914e1f96dbc8c64866566b8d4948c6da3377251f9457b2446e6b91b45974", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156304, "uuid": "b91bfbe1-91a9-41b5-bb64-018674ed6110", "comment": "Malware payload", "value": "9fc11d6341eb4fc22f40d8fa6bb0c2f9ce3897da", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156304, "uuid": "4250b3af-44a9-474e-a528-d48eacab09d1", "comment": "Malware payload", "value": "e171da51aa4d860a7bbef32884dfa2031c50e8c4623aac43a901577c1621b820f6f5fe2d94ef6448aa32995159265802", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156304, "uuid": "a63b2fa5-214e-468b-8736-d0fe7b6e0b01", "value": "T128E63397DB16EA63D1E7C632C33E06A7A91A4C984243F3571B92B52C0DB39C05BC6EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156304, "uuid": "e9d3d614-bccc-469b-8fdd-eb2d286aaad4", "value": "196608:MIHSNgqI1LrHgLjgqZ9g9O6jBhux2m0oFbvlwcRYnlj5+sTB88nyB+tuIter+uZO:M11I9HgLB9UxBQxdwpnystzA+Or0nvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677156304, "uuid": "33e9bf7d-e8e6-402b-8b80-d0e5800c4d3f", "value": 14006782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677156304, "uuid": "a6da18b3-1857-4e47-98ee-20b3e7ee8ec2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156304, "uuid": "346ffb57-1499-4f35-9b5b-40cbac988683", "value": "jyn2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c280eb-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677158530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158530, "uuid": "4ef95f50-710a-4598-bf04-9d22e52bbc98", "comment": "Malware payload", "value": "283e1a42aac91530f9b354449e430e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158530, "uuid": "adf3b505-7104-408c-810e-8e718c73fd77", "comment": "Malware payload", "value": "31bfb72bb69499861c6e389f60e998a3d85837c5a20b343bb51e503547e80309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158530, "uuid": "4ae876f7-01de-4a76-9682-a6cc4459e436", "comment": "Malware payload", "value": "f268af1cabd0f114fe0d9c5d8fbf0635ec48afe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158530, "uuid": "a7eef4b0-7195-4f9e-a6b0-313fc45a1009", "comment": "Malware payload", "value": "2d539713e2c3784ebde65f844e76673ca9df64dc6bc206c173fe5e56635e9e5a856b112a3dbfcd741bcd50226d260baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158530, "uuid": "3b63e823-ff0f-483f-bfa0-1f95660ab87e", "value": "T108254B9963EC43D4DA76E072EA128607DEB37C8A0674BB1F0DE07A756F33660161E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158530, "uuid": "a0791e0e-ef78-4180-9bdf-ab0d4dd1d9ff", "value": "161c85364c462057ba28801ac1ad5404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158530, "uuid": "4a3a5bee-66ac-481e-884a-7842b49bcc6f", "value": "24576:3fTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0HhxV:PG00SSgCmP/ZwYj48a0Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158530, "uuid": "a29c0be2-6817-4ff6-86ee-9e8a9418c9a4", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158530, "uuid": "36da90f8-aee1-4cc1-b907-18a5543fd874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158530, "uuid": "71598676-672f-4692-8d14-8aa296b80bdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a76da0a-b362-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677147025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147025, "uuid": "e518e410-4609-4d3a-b9ce-4c12d2238343", "comment": "Malware payload (DCRat)", "value": "03bc874acc69eb42eee7b2bcfd88bcd8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147025, "uuid": "9e90fd84-29ff-478b-b7ca-510d5a5b4f42", "comment": "Malware payload (DCRat)", "value": "323d81d4c14ffba8b3b35ef139db46fe6a96380aa853a86b7c6412cf29d161e1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147025, "uuid": "54f59688-84e5-4243-8a32-f09d26c2ca71", "comment": "Malware payload (DCRat)", "value": "a890ddebafc04d953b4fb642cf76a6df79bc2ce1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147025, "uuid": "d0a8a8b4-cd02-4fc5-9270-d741968a0665", "comment": "Malware payload (DCRat)", "value": "0ebca96964463317503c80bc4f33e4c04be2ba35e473f4b41a7ef556362bcdcef4c3dde3c48b119162b577f1b99da320", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147025, "uuid": "b494a021-9bb6-4139-862e-c0cb7bce2a15", "value": "T1FA05F7027E44CA22F01D1233C2EF494C87B4AD5166A6E32B7DBA376D55123A77C0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147025, "uuid": "6e2ea44f-26ff-4627-9d6e-5eba43a56372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147025, "uuid": "686a2a13-3748-4dd4-8148-377c1022003f", "value": "12288:IJhUvRKfUmCZsofE82b2GiEdEN+2Jm0emQQhvdXmPJD2bAEQ:dvRKfqZso4iEGwX8d2P52bAEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677147025, "uuid": "13457eff-04bd-4633-993f-86f293009dfa", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677147025, "uuid": "35e8750f-9342-4abd-b517-3637e2a72bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147025, "uuid": "49789833-d939-4a4b-85bd-0518c6a7a5c5", "value": "03bc874acc69eb42eee7b2bcfd88bcd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8282c9-b35b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677144024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144024, "uuid": "840b8a4b-41b2-438a-9995-6fc0e4f4843d", "comment": "Malware payload (DCRat)", "value": "177c793be2b6fa0efded606675bdac57", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144024, "uuid": "24d13b26-f9dc-4c6b-9334-985f57b16cd9", "comment": "Malware payload (DCRat)", "value": "334a0034a9827d10f6b082f5f32a774a946a9b33e4cdcc8c4d4c905d1e760bbf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144024, "uuid": "69248cd2-4fa3-430d-b7f8-6685e25ff439", "comment": "Malware payload (DCRat)", "value": "bfac16b64659a714497457777c015cbf907124e5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144024, "uuid": "66704e4a-8259-43e4-8aaf-5076548b1544", "comment": "Malware payload (DCRat)", "value": "c91930a09db19c9d3d14f6125a235c03217f9ea65c2bceb6d68e61c2e1b5fca9bfb74ea93e902a3629f63952f2d7e41c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144024, "uuid": "33cebca2-dbba-4de4-b4af-fb384c3cad02", "value": "T108A57C017E408E11E2371F33E3EF4514CF74B81827A9D71B7EAB366D65213A26CA95CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144024, "uuid": "4aa8cd26-9dc3-48d9-a5f9-8fd83d16b6a9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144024, "uuid": "3c98dfdb-f5ea-426e-a26b-15cf5d3b1bd3", "value": "24576:h2G/nvxW3Wb2SA00hIBQW4Mt6v/ziXvkUD0gM8m8h7Lw5jLyP/cgF88cNhahG0sO:hbA3g26ESQotF8QpwZe/588chas0sHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677144024, "uuid": "dc0505dc-42a1-44e5-8ed8-f2cc72a79f34", "value": 2117906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677144024, "uuid": "e438a1b4-5074-405d-b045-998d92c1dce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144024, "uuid": "dda71966-a753-4f72-b8f8-6ecceaabd244", "value": "177c793be2b6fa0efded606675bdac57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc60ba8-b31b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677116432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677116432, "uuid": "14b460a2-0440-4c06-a093-a28c33d9caf4", "comment": "Malware payload (njrat)", "value": "1a3226268ab809378a6f859e4c2022fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677116432, "uuid": "9c7ca16b-0fbb-4225-a0c6-75a7b5963d55", "comment": "Malware payload (njrat)", "value": "33b44d571249bd4eee11fbf13baea769030803b9aceba1a7de1d93422fb3f50a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677116432, "uuid": "cffddbd5-0f4d-437b-bb8c-3ee3bc126601", "comment": "Malware payload (njrat)", "value": "a5096bea5f311eb0c5d5b3c1021ed9428aaafbe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677116432, "uuid": "b8e6402e-afb7-482b-9a18-468bce75871c", "comment": "Malware payload (njrat)", "value": "4784ba94da7f1e5024ac9263b16d38429e855392b6e709a2663087b778bb5f16c9f598741319a57b3caa699cab1b480d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677116432, "uuid": "5d63397c-c4e2-44ca-9ab9-eda8a86317d5", "value": "T1CC256C69BBCC9E07E02D4AF189BB94100776BC549927C65E3CC973ED28763835902E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677116432, "uuid": "5af8eab4-9f94-48f9-81d9-787d9b3ff489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677116432, "uuid": "00cc35a1-109f-4f16-ab54-7b41aaed878e", "value": "3072:urTM7VP3QZf7M3mEP4M7uaLPhXr/KiWsXSHr+JapA2ib0U1NRiDwWdwcX33jJvBw:x7ubEPI6ksb0QgdNXnjvl+GcSg5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677116432, "uuid": "0aadde35-4480-4684-87b8-fd0b61930286", "value": 1021208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677116432, "uuid": "77389aa3-06b2-4363-84cf-03aaa408fe12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677116432, "uuid": "f587ca29-30be-411e-a1af-1fda4d39190d", "value": "33B44D571249BD4EEE11FBF13BAEA769030803B9ACEBA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc97efd-b3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677193091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677193091, "uuid": "8916ae94-7ed3-42a1-aca7-76c693d32837", "comment": "Malware payload (RecordBreaker)", "value": "021572d0b77d0898af851e521edbb407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677193091, "uuid": "87ec6bf6-88d7-49ab-9d47-310ab5dd9215", "comment": "Malware payload (RecordBreaker)", "value": "342252f7105920b87d44ab88776da1da2c105b539e4a9736bd0c96f1a66a1ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677193091, "uuid": "2a5bd442-1fb5-4faa-9a30-e5c2f17a3380", "comment": "Malware payload (RecordBreaker)", "value": "b8e1bc3dffa6e0a36440b082636c0bc8e36839ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677193091, "uuid": "ae4f97f5-4c58-4088-9ded-b0e0cd463b7b", "comment": "Malware payload (RecordBreaker)", "value": "722476558d79e97a9fd71b4098e426b5d8151805bc1872c12af639c5b9b055560c6807e51ff0e2e84a1d97f962f781db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677193091, "uuid": "b1353148-8fd4-46ee-9953-831f3b10aadc", "value": "T1BCE6336B4A64458EF0D8CA784D27BCA5B0F5FF37CBC26CB767963AC61930252D203652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677193091, "uuid": "394662b5-98da-448d-993f-d753fd5b8d89", "value": "1c6788ab459e74ff34b16016192dcb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677193091, "uuid": "741587b8-0021-4ac3-b9dd-d03077eb3355", "value": "393216:fDbDYW1BNEX1hXi5IKGyI8eUNiSj0ZZep:fjf14XjXBKGfl802p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677193091, "uuid": "a721e3a7-b8b0-4960-a410-8344ad20dd75", "value": 14256479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677193091, "uuid": "ff0800f7-93e9-4918-be54-514e22460aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677193091, "uuid": "2b2029f3-d06f-4406-bf57-3b377cb7227c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8471f11-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1677128768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128768, "uuid": "f2eb215e-5ed8-4ee0-9cdc-e4d1632e0a37", "comment": "Malware payload (XWorm)", "value": "154f4067dc6d8c25805590e5795f6483", "object_relation": "md5", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128768, "uuid": "72801093-cb78-4e29-8e31-9bf615b8c7e8", "comment": "Malware payload (XWorm)", "value": "343200619f71915859ff36887b0e8b185adb90496e9b11716a1fc522aa447ed9", "object_relation": "sha256", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128768, "uuid": "edcea7f0-30d7-4346-a9f2-cc0bb652185f", "comment": "Malware payload (XWorm)", "value": "050b599cc745fe364f094b7aab9f16952919ef52", "object_relation": "sha1", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128768, "uuid": "df31e214-6522-4c02-9201-1ef2dc881ab2", "comment": "Malware payload (XWorm)", "value": "7abe504792323326aadd8c3f2cb2f3e73fe4300a5c5393697aaea7c06bf54ab945b387715c5fecea6932c7abc33b9f5a", "object_relation": "sha3-384", "Tag": [ { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128768, "uuid": "f40ee32d-870c-4adb-8815-a91af651e260", "value": "T168410D2886338B2FA483516DE15CB30AEEC8FF4EA5853254C14434107BF23A76EC61B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128768, "uuid": "11640cc8-4568-46c6-b8a8-c14466fb7529", "value": "48:7oajauwBOT7lzOVmvzezXFuezwD5+Fppfc1VsYQCbhh9gfVVVCT:EaWOBOgbeXFuew9+Fppfc1yYQCbhhmfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128768, "uuid": "26f6000d-9e27-4cf2-9385-6a39c13ad820", "value": 2281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128768, "uuid": "577ea5e6-7b00-499d-9d08-8a291e02ac02", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128768, "uuid": "4883c576-aa00-46c0-8e1c-0b2c86826085", "value": "gqvuqe.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82504f9-b32c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677124070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124070, "uuid": "8acecf31-5bdb-4947-88cb-f3919b89ec32", "comment": "Malware payload (Mirai)", "value": "cd3c1d4747f6ff74e6035c5b472c7fff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124070, "uuid": "2cb45029-506c-4968-a3d8-690e45e685d3", "comment": "Malware payload (Mirai)", "value": "3484aac5259bbc26a403c4546f9134efd076606467f7a8d370fbee1b69cc113c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124070, "uuid": "b95b92dd-1530-4a3b-ad2d-d5824f901bb0", "comment": "Malware payload (Mirai)", "value": "09c593bb00ae3d6bba2f586d9cef483653777e53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124070, "uuid": "ae5c894a-2fca-499f-a036-fab80e3facab", "comment": "Malware payload (Mirai)", "value": "c8003d02484da65624b36d6d143776944a97a9ed1c6dbcccfdd8bb45c72fb7be4835195ceaeb684740296f798b9c82ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124070, "uuid": "9a9efa17-62ff-4c19-8206-a032a9887c45", "value": "T1D163971A3E219FBDFBAC863887B78E20965833D616F1C584D15CED015E7038E645FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124070, "uuid": "c3a5bacc-23c3-4166-8e0d-9eb37fe77a87", "value": "1536:2VVUIa+SzL6P1rNVHV0vaEfKOYFRhOJmuE79ywo8eFp3:2VqIfVBNf0STDhO5PPHr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677124070, "uuid": "8ae21efa-9603-40c1-8b5c-833ea2b9bfed", "value": 68804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677124070, "uuid": "c2e98ed0-dba1-4ecb-b3de-1fa03547eb10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124070, "uuid": "4131d6df-6ac3-4865-bb6a-6f0de265ed44", "value": "cd3c1d4747f6ff74e6035c5b472c7fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ff128d-b32c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677124113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124113, "uuid": "1395eb60-dc1d-4028-8ed5-86c31e4e5aa7", "comment": "Malware payload (Mirai)", "value": "b32b4394d1b8079d82d603c82f9b58a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124113, "uuid": "dfdc72a5-40df-4201-ba44-35d4d20116f0", "comment": "Malware payload (Mirai)", "value": "3723612eec0cd17c112a6bea0c8ce6b381834b06eb3352b479496a5f72ef0e53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124113, "uuid": "8243e138-4b93-43ae-8923-218ee043f98b", "comment": "Malware payload (Mirai)", "value": "18c8c0ec46e54a0365cb7889b1ba7e1f8fdd58da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124113, "uuid": "92bfe033-d2a7-4128-9ae4-634d5be65d9c", "comment": "Malware payload (Mirai)", "value": "e777020d82b00afa0dccb242e339cef9f8ca56c213a40268a4ca5d1a22d626cab76bdc8839fc2273d521158ef0ed5357", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124113, "uuid": "239e5396-48fa-4cc4-8153-c6f4727c274b", "value": "T1B123F8C27892AA39C3D0577BEEAF418D331497D8D1DB3357C8281B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124113, "uuid": "9ba4c90c-fbda-4dd6-a8f1-6c1bce208606", "value": "768:HR7nhgvz7/a6M1yyj69CFLUEZmY89ntf2OfFGv3kNmekTtk7wCVy/rCxHghW1/K7:VhgHLM1oBY89zGv3kNmekpfhWE5kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677124113, "uuid": "786e1e32-3d15-47ae-b321-6868a2b3bd36", "value": 48792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677124113, "uuid": "07bd2adf-2d3a-43eb-8c3f-a5b40c006024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124113, "uuid": "71f98915-0fff-4504-8441-26577b5cff21", "value": "b32b4394d1b8079d82d603c82f9b58a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff7f8ed-b373-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1677154524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154524, "uuid": "ddf88691-dc87-403d-8fc8-e3c36f456d02", "comment": "Malware payload (AZORult)", "value": "ee9485eba618aa497ade493518824f09", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154524, "uuid": "cc30c957-636f-433a-bbb3-de6e7dfdaa2d", "comment": "Malware payload (AZORult)", "value": "38c78ebf970f2fc711eddcfa9ab6562c8ccbcfb053e5ececaa695650cf7d8727", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154524, "uuid": "fe78ed23-e7cb-4748-a32b-35e7bfc5bc3e", "comment": "Malware payload (AZORult)", "value": "5d119e0f069772acc5e97ad6c38c8629ddfb56ce", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154524, "uuid": "e4f8ade0-50b4-413c-a2f9-f665addd7d2b", "comment": "Malware payload (AZORult)", "value": "6bd694ec3a21d5dcd59b53fbc413a9cea26f4840168b433595e946083505730e0b7431ee180207ba6e05ee67c268eef3", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154524, "uuid": "bffdc54e-7439-477f-874d-24fd797747d8", "value": "T12E256BB183437E8ED7BB2DF9E54426329C66B6174702CB38BDE50EE87256104ADDC878", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154524, "uuid": "4e2d887a-7149-4439-96fc-a17c2668b8c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154524, "uuid": "cb68175a-af65-4b53-8d0e-9e810b608486", "value": "24576:9k2/JkITyzgThZ4+Et8EKzeN1M5ITD8B0uNBNUFmBD58avq8Bu6bN6caDnES5nU1:XxVT8LXhen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677154524, "uuid": "fc67d010-7f08-477a-aead-1fb18d69d817", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677154524, "uuid": "b19fd8b1-20dd-4e69-b5e9-66f7c60c17b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154524, "uuid": "daf89fa1-1df3-4078-ba78-a82f64db4f67", "value": "ee9485eba618aa497ade493518824f09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a02704-b360-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677146317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146317, "uuid": "f3442cb2-fb4b-4b64-a687-ae2668290f2f", "comment": "Malware payload (AveMariaRAT)", "value": "5d86a72e84fb09b9a475b4874b3dc7c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146317, "uuid": "0464cd1e-b2c0-4cd2-a4c2-c0bb0d38a610", "comment": "Malware payload (AveMariaRAT)", "value": "3952f433586344471f8ab039c2b682b090a38d880d5f2335483d07347068b0a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146317, "uuid": "04a73a77-cc3a-44df-baeb-ee6f9302f7ca", "comment": "Malware payload (AveMariaRAT)", "value": "4350c102b9fc78aa327590d66e1e0790d2719ada", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146317, "uuid": "0045b852-6efe-40a2-8d5b-96d360d02fd7", "comment": "Malware payload (AveMariaRAT)", "value": "2975f23fbe34f7c5dcd75dc9f7068c51bac1cbc40fbf74a680cfa4d2a839f493c5c6d1d1c42636a5bb2e533a673a0204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146317, "uuid": "449dd178-07e3-4e5e-bd3c-e1659c510322", "value": "T11A057B46BBF09076F99E41AD063912CF1E31B253765CE22A5F3B78489D4AEFBB1C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146317, "uuid": "de7037ce-e23d-4b23-9708-c4eedb9ee512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146317, "uuid": "e5405651-8281-4b02-9cea-2175e750199f", "value": "24576:5wss9uk39IZqFIeYg7w8wtPX+A34yCtcu:Zs9PIZ2Ies8wEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677146317, "uuid": "3ab1871b-a8e8-483d-9d65-9ca9d0845dc4", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677146317, "uuid": "a7a50973-f2e2-41b5-ae34-81e8f54a8f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146317, "uuid": "8e82d69b-b726-4530-9714-ae8ba4c301d6", "value": "5d86a72e84fb09b9a475b4874b3dc7c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d32124-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677143182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143182, "uuid": "69eb6991-025e-4140-b62d-19142b0e9e51", "comment": "Malware payload (SnakeKeylogger)", "value": "6b980bb9c2935440e1bebc95d03d00c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143182, "uuid": "97a949da-8aa3-4639-8629-0bcee87792c7", "comment": "Malware payload (SnakeKeylogger)", "value": "39b1f0062671054c08424c70f2251c9c1c1f43bb87f12a95a44ad3b531d2c496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143182, "uuid": "ab7ef281-b3fa-4125-95d9-beb803a834ff", "comment": "Malware payload (SnakeKeylogger)", "value": "3309179cf5d8b05f69343932e1a002c922c992cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143182, "uuid": "d5f0468d-2d81-43fa-906d-6e3de13ab22b", "comment": "Malware payload (SnakeKeylogger)", "value": "a78175ec9bda88fa90056999c95fe200c959935651e60c4946a7c1f4297ae054f5009eae1759ca7df8353a8a33e9ab99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143182, "uuid": "f85e1f90-eb74-4048-85b0-b7f7994f3700", "value": "T103354A82B2B084B6FC5F01F9593A55691872BE4A749CD10D1F6B7A0569B37F330CEE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143182, "uuid": "c44187ab-f3f1-4ee2-8f4c-6a6c39d646f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143182, "uuid": "293627b1-d20f-4b15-a9ea-5ed7017d5ec7", "value": "12288:j04ld3flffeg1fmDWA1RaCrX8L1Z6H/JykFcAeqPl/wiGLzl+dtoPu:j04ltdfme+Dt1TrocHhyfcPGPLCtcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143182, "uuid": "6a0bb624-95bd-44bb-9a12-824a8c109925", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143182, "uuid": "5ee1f225-9243-4781-a5b2-80581948b3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143182, "uuid": "9cf7b2e0-6649-4020-9cd1-50c87a85564c", "value": "PO#4325668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405d6e5f-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677141854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141854, "uuid": "ece8002f-59dc-49ec-8b62-555d0c18355f", "comment": "Malware payload (RemcosRAT)", "value": "d8c13afcbebd67664b8ff695e15d9869", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141854, "uuid": "500d5dcf-f7a8-4539-922f-c65f9fabdbd5", "comment": "Malware payload (RemcosRAT)", "value": "3bf702bc7bf2ff4c9688b572fbf657112d7c6e6adc76f1ca2ff8247a6e304497", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141854, "uuid": "b246513d-12d3-4f24-b95a-9637a71908a3", "comment": "Malware payload (RemcosRAT)", "value": "a2a90734517cf6608a79c19fe567afb7456f46a1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141854, "uuid": "6aa74c1c-539d-4210-b2e8-91259bb8fc37", "comment": "Malware payload (RemcosRAT)", "value": "62d9af7fac30d4d617e6de2c519fc4290c83a34430d437b163cf7dcdb35cceda49b38f5514755fb2b941dd7be4a10bf3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141854, "uuid": "b3d3d852-790b-4d8b-9dfc-592b0ef3be20", "value": "T15C134BE52F03237D340779A20DDB5B76C130ECB356F15C2A1C99F9293B1630B6A6B886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141854, "uuid": "179dfa74-2f66-4edb-8a30-cbda60d7d764", "value": "768:H41RMAe2B68wweP3m7a9XQNMzJHyReTU5l2JVyORTIbDnc1V:oRMAekvjeP3m7MDcTIVBAQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141854, "uuid": "82531051-0476-4fdf-9f5d-ba05d29fafe1", "value": 42749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141854, "uuid": "941341fb-efc1-4f2e-a977-e4329439e523", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141854, "uuid": "f2377e9d-07b6-45e1-ba84-06fbf4b926a2", "value": "Specification.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c67b467-b35c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677144398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144398, "uuid": "704ef010-5170-47d2-9854-55b18ed483e4", "comment": "Malware payload", "value": "999be7fe0fcff066def3cd9d289eaf30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144398, "uuid": "1730fce8-35ff-45e4-a978-f2a43bd2dc56", "comment": "Malware payload", "value": "3c10a2630cc7569328614192fc7e6fea9b15fc9a6d56f847eff860ba5ea15816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144398, "uuid": "8ecf2a9c-3689-4b9c-a175-0dc9041bbc83", "comment": "Malware payload", "value": "b29c44e7aec0952a82af00ee1e7e00d4c53f4626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677144398, "uuid": "cd3e69c2-1477-450f-b694-ca57f6ce47ad", "comment": "Malware payload", "value": "66eb6d7d3265482c8592121553853704f516381f4e1d803213429a821a4c08c4af59a90298274cb5f72bd65b5e72a6be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144398, "uuid": "f7b5db14-af6e-4361-b6e1-367bce0a89d8", "value": "T13BA423202CB0E46BD9235B72DEB9776B5BF1F5783166C96323255E787210688CA3F342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144398, "uuid": "d1a40a30-b211-46e8-92be-e704e5409ae4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144398, "uuid": "37f481df-1dd0-46c1-bbab-4ce0c7729353", "value": "12288:vYfiBzGrP4IqLpsCJutnd+3br6vUzJvS97GV47afP5:vYf1ATutd+3bWAJvA7m4q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677144398, "uuid": "cb0118f5-92b6-43f7-b8a3-9daaa5dad562", "value": 450790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677144398, "uuid": "0f12dcde-2f5d-4192-bfdd-b821f3d6c84b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677144398, "uuid": "c5405098-78aa-497c-8de4-b22b6d00af86", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233c0496-b317-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677114747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114747, "uuid": "2f63ad9c-ad98-4368-b36f-82f7f120e9f9", "comment": "Malware payload (AgentTesla)", "value": "4b3501435442bb8f881f2bcb42131653", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114747, "uuid": "363d6f4c-f2a4-4706-a664-ad4900752362", "comment": "Malware payload (AgentTesla)", "value": "3cad854eda95637323863a0bdb6b13dd7865ff83aa3a66d97fe55b693be98696", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114747, "uuid": "f282cef7-a659-48ff-9862-0edabdfbf505", "comment": "Malware payload (AgentTesla)", "value": "ddb0fbaf344958d5469bdc6f4143a1f88278243a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114747, "uuid": "fdaee5c2-87c3-4d50-8d88-281fa26af83f", "comment": "Malware payload (AgentTesla)", "value": "0a4be2705989158b1cdb05617cd1bc763fde50ddb779c5a9425ce2e9c4e44d5d9263e447946d756aa784ef4942224942", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114747, "uuid": "4317dfc0-6fb8-476c-94cd-e472e77b9bd4", "value": "T1D642D5825B8D59B1D35DE1338269804C1CFEE13730962AE9B8CD99903BBE60E46FD1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114747, "uuid": "06f7f076-5677-428d-9f86-734756c6dffb", "value": "192:79mTXb/EdTxCOJRxs6V9asGagneTGlz1z/lxlj4p4ikKP4WW:79m7YdT79VjFNOdxV4pCKPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114747, "uuid": "48f50ff6-b675-4ca2-9f67-219038f722be", "value": 12852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114747, "uuid": "fe306984-098a-4d7c-ad91-7210e2a31d3e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114747, "uuid": "960f0c4f-e4e6-459f-b518-82f3f3b852df", "value": "4b3501435442bb8f881f2bcb42131653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b82b885-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128558, "uuid": "4cc202c1-14b8-4791-8753-876ee1f54ae8", "comment": "Malware payload (WannaCry)", "value": "9c96b270974e2c85acb6fe1f888f5254", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128558, "uuid": "4eb7beb3-d080-444f-9bc1-6149677d0990", "comment": "Malware payload (WannaCry)", "value": "3ea4dcc81d251b7a313b9d58459b7939bad1de950feb9aaf38953bea8b1ec7bb", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128558, "uuid": "ada9125c-373a-444d-a655-ee712b5ec44d", "comment": "Malware payload (WannaCry)", "value": "23bbb4806eeba02ee9420c76884572b47f138daa", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128558, "uuid": "c18efb75-fd36-4afa-b7a6-22feedab6e79", "comment": "Malware payload (WannaCry)", "value": "44086c92bd0d7cb18118c4b60a199d6d52c36f5c7b001d43031c0b03de59eb0af7ee6fa853f05e6c342bebe4db4f199c", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128558, "uuid": "7bb581d1-0e90-4ff9-aa89-2c55199eda81", "value": "T1E3B2D51867FA4A39F6FB1F786CB210405B75B993EC3DD74C188A004D0922B9CDDA1B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128558, "uuid": "a8b87e06-873d-4ec1-97df-83540958e9ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128558, "uuid": "a5cbde0d-a351-4be2-8349-018bf4951fbd", "value": "384:w3Mg/bqo2ppsKaYN+pLAWOXdd1kJSr91Cwewb5Sek:Oqo2LAtpMjlsSr9+wbUek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128558, "uuid": "9829159a-5f2f-465a-9184-45659b3184c3", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128558, "uuid": "ceb8b5bf-6bb0-4549-951c-f01fffaa41d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128558, "uuid": "30dd28c1-e8f6-4717-97e2-4b3492cbf06d", "value": "2023-02-22_9c96b270974e2c85acb6fe1f888f5254_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad2239b-b315-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1677114035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "bc2323b3-643b-4669-ae79-281744418c94", "comment": "Malware payload (AuroraStealer)", "value": "29cf4ee689e1663d0d534af24edd5e9e", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "afc91616-17e6-4e9e-b3d8-c6dd93c642b0", "comment": "Malware payload (AuroraStealer)", "value": "40dd33f8816f85541430af34a6e7bd7579fa0fa46bfdf482cac644d0bbd8fd09", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "3006fbea-c366-4c99-88a4-985956e019c7", "comment": "Malware payload (AuroraStealer)", "value": "63f7a936cba60b7ee6e05ed9f7fb8c53c8bb97ad", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "4f722067-5fe4-4be1-b313-82d11dc58eb0", "comment": "Malware payload (AuroraStealer)", "value": "73402d1fd765eb385e86965d43c58a5ec8be0a813db198d0d1166706e47badbd7fec46336ba28f468f14111416445806", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114035, "uuid": "72e39ea2-3bd0-4e4d-8427-8dfcfd4aa6d8", "value": "T18314D02179E0C072C05344BB8835D6A4EEBAB931FA61C98B375417AE1F707E053B739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114035, "uuid": "7b3cd210-6e08-4daf-93b7-c338ad98f8bd", "value": "b7b66070cf182b2615019a5dbe522294", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114035, "uuid": "e0d37fd5-ae15-455c-badf-324fc6600afa", "value": "3072:uliHYkFLjA2vNhxXYAXBCXt2yF0RWChs2eGLNSdCa//iS4f+qjH7mut:xHLFL1hXIt2XRWQs2NLsdCa/bW22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114035, "uuid": "d8def720-4169-48b5-857b-089a560e060e", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114035, "uuid": "a3fa1a87-606f-499d-8326-1dbf94144081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114035, "uuid": "82a7bb6d-cbb5-4d91-a7d4-c8ef19b40be9", "value": "29cf4ee689e1663d0d534af24edd5e9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a1936-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141968, "uuid": "ba8d6f72-3e4b-4d57-acf7-e38dde6426ee", "comment": "Malware payload (SnakeKeylogger)", "value": "30792a83ac4419eb960c6699c20eac32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141968, "uuid": "2a8a4098-c104-416c-bc2d-dcff0b0c23f5", "comment": "Malware payload (SnakeKeylogger)", "value": "4150b0c9b940a9acec03b61a140092a6d1c9aca8b8a179f5c8eb1e4227ddbff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141968, "uuid": "006fc712-e136-40de-b2a4-72f06173900a", "comment": "Malware payload (SnakeKeylogger)", "value": "947ec8b00ce9602caced80136546da6b29193bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141968, "uuid": "1f62dab1-7c7f-4e13-99b1-e71c90516e11", "comment": "Malware payload (SnakeKeylogger)", "value": "bdf4128c9dafda9b2dbef6ee5145899141ad7b70aa7aa00e7c1b2585960d399ddd3b0a7b32bebfa2a0ee1a13aaa0a16d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141968, "uuid": "817e8717-1675-417c-be36-71f23efc8cbd", "value": "T1CB44120466F6D6E7FE92063189791AAB6FF86A26D8101F4F07404A5C7D7E6C2FA0F341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141968, "uuid": "0357a8ee-19aa-4c64-a5d1-9cc6f3359170", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141968, "uuid": "ced05377-f308-4017-beed-2ddf9412219d", "value": "6144:vYa6FsiNd/vf/xzgfeJO/j6pUv/w6LNqJxEBtg4Y0T:vY7sizvf/xzgfXcUvVLIEBpY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141968, "uuid": "bcaa5e0c-3675-454b-8c92-cdc77b9f41b9", "value": 278534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141968, "uuid": "4cb97a0b-f481-45d6-99e8-e662f0be8d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141968, "uuid": "75de265b-295b-4239-8fb6-1ddde23d553d", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a608b9f-b32b-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1677123295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123295, "uuid": "f3184610-e415-47b2-9de8-568c866833ac", "comment": "Malware payload (PureCrypter)", "value": "6713cd9337e181f5845664c1f922b60e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123295, "uuid": "416eb77f-faf3-4384-bb6f-6ff15fe399de", "comment": "Malware payload (PureCrypter)", "value": "421946e1a35813f2b90345a317e7b8632a7163f7b16709bdb4f8870503d3e376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123295, "uuid": "1c0356b7-2b49-4686-a056-ea36ee6522ea", "comment": "Malware payload (PureCrypter)", "value": "173ad425b9646d28348cc2725e27c3202a08f63c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123295, "uuid": "66fae86f-415f-4037-8e79-d9d2abcb5586", "comment": "Malware payload (PureCrypter)", "value": "3f7d53c59abade69e73bb04875e9bf171f3962daf99df13179ace51828c816237a9ee1377ac65949f001a8296bc751ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123295, "uuid": "2c3506e5-86de-4cd8-93b4-755c409d50dc", "value": "T19DE1D921B3D84632DD374B3AE9E3A342027CA34119838FADA5C1615BAC177565BB2770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123295, "uuid": "099e73c9-c58a-48db-ba4c-a78bc0600079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123295, "uuid": "71cf51b2-75fd-4da0-b473-aa941c8eb7c3", "value": "96:ObBqMGapWomUh0ScZF6DYwaiODJRZ1g+s3Gkxtd3uzNt:mBSkBfyF6D4JT1gF3rxHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677123295, "uuid": "b0081834-3b71-40ca-b00a-68ed63e65706", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677123295, "uuid": "5193b079-a6e0-49c8-a004-e1464b8eb19f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123295, "uuid": "49cd3c07-76ec-4f27-ba0e-a7ce70fed5d8", "value": "6713cd9337e181f5845664c1f922b60e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae301308-b39d-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677172533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677172533, "uuid": "accdace3-f9cd-4d18-86d4-ccb685ed60bc", "comment": "Malware payload (njrat)", "value": "764f46538f5ecaa897d97e6efffd7177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677172533, "uuid": "b2cf93e1-ed57-4013-a506-62d8274eba86", "comment": "Malware payload (njrat)", "value": "42d6e8e62b92d12c0eae8146b483a3d61a409072183a2d4dd29a04a1554f34c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677172533, "uuid": "633059a2-17eb-4afe-93ed-9052a9ba5753", "comment": "Malware payload (njrat)", "value": "21537b2b119261a9a1b86fb464938d0b9962d677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677172533, "uuid": "958495fd-b9c3-4fe6-8215-f0c923de9900", "comment": "Malware payload (njrat)", "value": "d3020719055cf80d2b29d0e9ec4dd806c3a312acbf58f4131a14d2dce5c9acde522c4dc475ec54a503b4e2c3240b640d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677172533, "uuid": "4fac8ea4-52db-4e52-80a3-0676dcd5ddae", "value": "T1A83501382DEE6009F177AF75ABF57AD68A2FFB772603D44D1081134A4623982ED9093D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677172533, "uuid": "68277fd4-2d8f-490e-a95f-df314651e8b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677172533, "uuid": "f41db147-6bd1-42ff-8ee9-267551a290a7", "value": "24576:Dr9GdR+HQzzC07C40onu7owuBqzEG3yspqmf+thtGozWm/:Dr9w4Qz2uC0zwuBonJ7f+thtGozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677172533, "uuid": "3b58c8f7-c5ac-4804-9e1e-aa8d9167e108", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677172533, "uuid": "c36554df-19d7-4735-851d-d91421c43891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677172533, "uuid": "7b05be10-708f-4b0e-a23a-88ac24481f20", "value": "764f46538f5ecaa897d97e6efffd7177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0783810-b324-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677120621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677120621, "uuid": "89e2079b-6780-4e80-9554-454dc93d88d4", "comment": "Malware payload (RedLineStealer)", "value": "6b996b81f877014eb608df2595e642c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677120621, "uuid": "5d14ea8c-9f07-48c3-9c84-34fc80d80156", "comment": "Malware payload (RedLineStealer)", "value": "42f7bb27c087010d331e1cb409e7e3cfc477ba17afd92ab5155c062a318ff06a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677120621, "uuid": "4de320ee-d724-477c-ba40-f48de1f53241", "comment": "Malware payload (RedLineStealer)", "value": "436e8325a1b0920ebb85fa08734a2ccb852fab67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677120621, "uuid": "6986c5ce-01e3-4aba-9808-822f86313e9f", "comment": "Malware payload (RedLineStealer)", "value": "7b401384a808b85179689eae9b1884a70ccd4cec8572687585eb5ca93342a15f993c88288a172a95497ef893026cb2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677120621, "uuid": "5d5bec2a-333e-4ae2-85e4-8adefb46699f", "value": "T13574FA987670FD9EC857C87F8A581C64E6636466970BA203B05313AC993D79BFE130B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677120621, "uuid": "a20002f7-3e0a-4a92-a4ec-cad94798bd0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677120621, "uuid": "9868ff12-bcae-43b6-b1e8-9eabb131fbf9", "value": "6144:0bUlO6ppZmaSzY3xmUbaXml9L+89TNaQ8WqO7sE/r+X7w+e:nFppZmLKjK89TNaQ8WqO7sE/r+X7w+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677120621, "uuid": "2addd5ae-6ff7-4a43-a698-222d56bbd232", "value": 344264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677120621, "uuid": "30c7ae46-8cb4-4ba8-a3aa-ecbb131651a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677120621, "uuid": "be04ca5c-76cc-40cf-82e1-8616e7f3a884", "value": "6b996b81f877014eb608df2595e642c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175bf4a5-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136202, "uuid": "f9fbf7cf-b537-4c91-82b6-9a3a304f21dc", "comment": "Malware payload (AgentTesla)", "value": "16b03e4e5bc0ff1dbef3918cfad2b735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136202, "uuid": "7e9b8460-2b26-4986-a5f7-f2a261f57471", "comment": "Malware payload (AgentTesla)", "value": "43b957e57a959571b4ee4dedf823b4122dd2774b1290daa5848a4ea830673124", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136202, "uuid": "353c5075-86f7-495a-b575-9136ba781e42", "comment": "Malware payload (AgentTesla)", "value": "fcba7690aa8b5fd59530018117c9a23d1d9479d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136202, "uuid": "c1785e64-091c-4348-a234-8f6747254fa3", "comment": "Malware payload (AgentTesla)", "value": "eae59aef453b03ec1b66ffa6d16be65d709d5dd8a13817bbe1cd485c2268ca0fccc5adaa7a68fe0963720a45db423926", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136202, "uuid": "40147234-d8d7-4dfa-97bf-fe8e5996b633", "value": "T136825273B7484629E52E327654F3C26CC27BB301E4575A7A38D1DC7B9C96247CAB2720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136202, "uuid": "edadff8c-0fd6-45c8-ad25-b1446bad235b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136202, "uuid": "71262eaa-f6ee-4320-bbdd-4d0acdb6a4a8", "value": "192:HaTdQS53M58auD28GSALhtGfygJrBhIf3jdZ:6TuS53uuDV2LhtGfygJ8fTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136202, "uuid": "65b97527-14b4-4094-96ef-2b6c225a2653", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136202, "uuid": "e354c7e6-7677-4cc7-9d31-88a2154b81cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136202, "uuid": "9ed3d8ed-5c99-4148-acf3-70a467f41f1c", "value": "DHL_AWB_NO_#907853880911_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eba2552-b3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677181097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181097, "uuid": "b819898c-9a42-4407-ab1e-e359be0566dc", "comment": "Malware payload", "value": "01c0ffbf4899dd9659ab3d69bd071a3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181097, "uuid": "2d21ae40-c39b-4bbf-8ce8-f3902224d753", "comment": "Malware payload", "value": "45407220b71e139d1e851741eb586d7424ce7ec726e39a125669fa23f4c6598f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181097, "uuid": "cfa1b6ad-3afc-4474-af3a-2b6ab35efc80", "comment": "Malware payload", "value": "fef363e5680db20ffe13eac15092a0deb98492ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181097, "uuid": "c2a03254-94de-466a-9041-a1348b66ea65", "comment": "Malware payload", "value": "d063b11d147aada9a238f58bddd27dda9ee4c7487eabe33905627007a21c24260107768293575fac62716a6402392660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181097, "uuid": "18e5eb43-434a-4ec4-93d0-18ee5619e969", "value": "T1CB2633402D12CDB1F61353B1659CD28198CBC37883647DCC7ED72A2AE7817AF2A77A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181097, "uuid": "97c43c08-e508-4889-8174-12f936eba9ff", "value": "9fea208ccdcf10250aab0de95b2199b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181097, "uuid": "9ca56144-ec6a-44bd-9a46-379e3234ecbb", "value": "98304:XJm36qQN6mR38bMHjx7nggGRVewGPYnJLFiwKZ0NQsdUxNYJId:ZmKq1mFjkr+R8JLF8qdamId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677181097, "uuid": "6c65272a-7ae5-4013-ac20-98cfa05ab57e", "value": 4844048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677181097, "uuid": "86c1f6ac-6a44-4cb3-8ff6-d9682177e0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181097, "uuid": "676ff2f4-0cae-40b5-8c3f-32dac5952826", "value": "cartridge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd6f2b9-b350-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677139511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139511, "uuid": "c175ceaa-33ef-4ba3-985f-457a1b4a4cdf", "comment": "Malware payload", "value": "72c3075d4a9df73e193b868e62ce9adf", "object_relation": "md5", "Tag": [ { "name": "chatgpt", "colour": "#61C21F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139511, "uuid": "400222d1-e9ac-48b9-8554-6e94089b488d", "comment": "Malware payload", "value": "454e9baffc5051ebadbee3026d4b1d64fbb613140dfa0859f3a3d4b790509153", "object_relation": "sha256", "Tag": [ { "name": "chatgpt", "colour": "#61C21F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139511, "uuid": "6891a784-1083-466a-90cf-4cd7229a7cc8", "comment": "Malware payload", "value": "671685268066ce1779aaf3e6f0298fada9600833", "object_relation": "sha1", "Tag": [ { "name": "chatgpt", "colour": "#61C21F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139511, "uuid": "035ab6f6-694c-4301-8a5a-fcae27bfda85", "comment": "Malware payload", "value": "625a0dcde05196480ded87fdfe4b51d951592412ddd0920362d0e4b22f61c6d764ce6d4a3305c3901615d19ef6a8b8ce", "object_relation": "sha3-384", "Tag": [ { "name": "chatgpt", "colour": "#61C21F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677139511, "uuid": "bb795681-8b44-40db-95f3-d8b8b5ab4416", "value": "T1A71733180816FFDD8705526E9E942DAF8E4C36DA74EBBD3D8903C07463B51CDAA1A6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677139511, "uuid": "0f103f5f-7c3f-4e16-8cad-2336a3a93df4", "value": "393216:5g9O35j+qxqVieMCBLSDbpu4uKeCpLub/Mzvtfg6ii8PdS1hkK5jIBv8Izxejevm:5g9OAoUlLo9/LVvtrL8FS1aK+58IQjee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677139511, "uuid": "28442ca2-5a8d-4ca0-8c2c-5f46ec394c5e", "value": 20028720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677139511, "uuid": "4e114c76-c143-4b65-ad29-a08c0f809b2b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677139511, "uuid": "44423d9a-d522-48f0-824e-3ab83985d350", "value": "ChatGPT-OpenAI-.Full..-15.6.14576483US-ggde3468W45sdrc-setup.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86d7111-b36c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677151478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151478, "uuid": "c3c761b9-3b47-4957-93b6-86ff677577d8", "comment": "Malware payload", "value": "ff6a14361f66d35ebfb429abf1298ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151478, "uuid": "85801433-ec84-41bd-8734-4c4e4e11d137", "comment": "Malware payload", "value": "48a3c491491166fdb13cffc43c9f5d30133c47b1971fa7ab3a305801457634e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151478, "uuid": "e5392908-c12f-4bfe-a306-f45a91351901", "comment": "Malware payload", "value": "81e47741e043bed8934e87d872fac8caf0e955f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151478, "uuid": "ca98876c-1223-4109-8789-47b7c35cbfe3", "comment": "Malware payload", "value": "3672de82d5048c9535f470c3ed80d0a1a6fb927f8658421efc6a6068fd0f3169c4a5eb2670009476bf4324ac90fae99f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151478, "uuid": "389a97c6-77ce-4127-987f-788e419a8fa3", "value": "T17B32B743BAB19CB7DA7646B99491CD85D75761BA97F290070E1C038DEB0B3C0273B71A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151478, "uuid": "d158c90e-d58e-4200-8abb-40a70ced6b0e", "value": "192:i+An8nnnnnnnnnntxZ/K/uFxxggGWOKGYh8+g3Ozz:fxNEuFbjh86z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151478, "uuid": "ac57c677-ba57-4793-a4ee-b8019ccb0dca", "value": 11940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151478, "uuid": "07a92e4a-6575-4738-b489-caa3c13d5509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151478, "uuid": "6b85c0f3-02e2-42cb-a11c-ba113d24f2cd", "value": "ff6a14361f66d35ebfb429abf1298ce3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976d530f-b3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677184950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184950, "uuid": "42d331a0-39b6-44e2-aed6-54913414565f", "comment": "Malware payload", "value": "0501d8b1dbcbc0e3e8ca531674e22b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184950, "uuid": "db55d5cb-5a3c-43d1-bd75-ed3bed124e9f", "comment": "Malware payload", "value": "48dafaa8205d075ebe926fb5f0c3a31e286cc72d1f4eba63abbb7c5564ce3028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184950, "uuid": "79cbb90c-152c-41a4-b64e-d2a79dda9037", "comment": "Malware payload", "value": "6520c34f8112462373068e8fbf6420b831dfaa00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184950, "uuid": "e453a6d6-7d85-4f92-895e-06466089bf86", "comment": "Malware payload", "value": "ce57d0a610a62f6f2a47151894e0c569a03292bfb1a3a2da031790a20517b3db3e26b11280660443196a01fa3c476c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184950, "uuid": "475663b7-d2ec-45fd-90cb-7067291f0df9", "value": "T16D5623332691A150C4A4C835C627BDE6B6FA5EB68B016C7A34DDBDC72F768A1D103B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184950, "uuid": "62d308d7-a9d4-45d6-a568-f0deacba1e02", "value": "a76c012d2a75441ea9da353b7b587ed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184950, "uuid": "8b3a4df2-dbef-4d14-90b8-15e70b9979ed", "value": "98304:7lqh99gtK3Uq8OeCu7W9AcxaDKDkLnsbbnx9QxJD/d2rNXwQcdZJVcx87cKDz:5JK3UO5EWDxmKD6sbTjAbdsXwQcdZJVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677184950, "uuid": "5d268abf-d586-4a12-b1d2-3dd943bf2464", "value": 5964288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677184950, "uuid": "cdb6943a-bd8a-4406-9d13-50310e3fa88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184950, "uuid": "336ccf72-d150-4540-aecd-badafa415173", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5113cb-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1677128697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128697, "uuid": "900793d9-f250-4b67-b935-f670001ebbed", "comment": "Malware payload (Chaos)", "value": "4431e8c03162a470cc1c74edfded4afb", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128697, "uuid": "9d23db03-c55c-4f2f-9c51-9987d4bfbb9c", "comment": "Malware payload (Chaos)", "value": "49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128697, "uuid": "b14c402a-025a-43d8-a712-36e5a029ae45", "comment": "Malware payload (Chaos)", "value": "1fdd90a0a702447aebbd683e175c85a50acb9715", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128697, "uuid": "79316e28-e77c-428f-a471-0e1519514ebe", "comment": "Malware payload (Chaos)", "value": "cf9d22c43555a80bc05be1e844ffd0a64ce6de128c2f2c9e64dce0d46ebd8181db8f5861b3405fee0120d3212c0cade0", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128697, "uuid": "08803115-980c-40d5-b6c6-967f690e9021", "value": "T195D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128697, "uuid": "8cacf988-5bfd-4202-ad0c-f17fec753c3d", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128697, "uuid": "6bb72326-b7f3-4eb1-94f2-121c59a32f77", "value": "24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEC+:BSy6PX3PpM+P5IdF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128697, "uuid": "1db6677e-2702-4c80-8216-52d37cde65fb", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128697, "uuid": "6e0f5733-f65c-4b57-9c5e-62611e5117c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128697, "uuid": "38aaaa17-159b-4eee-80a8-aff0978bda97", "value": "2023-02-21_4431e8c03162a470cc1c74edfded4afb_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd983202-b328-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677122415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122415, "uuid": "988641c7-bca9-4888-8789-303b6138eac8", "comment": "Malware payload (LaplasClipper)", "value": "6e494069f55de7049a5699dd72301b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122415, "uuid": "d61fec2d-41ec-4481-9aa6-4bccfb4f8e88", "comment": "Malware payload (LaplasClipper)", "value": "49d4689b5641b161f0ab00aa490ea276fcab2128cb33d802fab9154b83516569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122415, "uuid": "1d153ea2-655e-4d50-a93a-5b0a33cad3c5", "comment": "Malware payload (LaplasClipper)", "value": "1b0b21207777bed6e187adfdf9d3b2d1db40e298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122415, "uuid": "e1fd42de-d9d8-40b4-a355-6cdf8e77f028", "comment": "Malware payload (LaplasClipper)", "value": "dace9ff28f408aea355c2914d3c0ebe02f0dd312796665c3dbd9dcbc5fdc649a3fc045cfd147c11715bcd46ce959dcc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677122415, "uuid": "8d048f59-a086-40a1-88f2-c33a1863d016", "value": "T150462323E36508D7DCA48934883B7FE073F5D5664991D77B269A66CA7E3B1B4AC03803", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677122415, "uuid": "4960d314-62f3-4e55-9ba9-aeea09739356", "value": "f540b6d6dcfc33b21d0deb0ccba24751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677122415, "uuid": "2913ad4e-787c-481a-9f72-61c08b73b485", "value": "98304:6BkLi3hdqYnPhrisRYrS806k+tPhAxw8qmVoaDwyqXyR2me7Pi2YazxTYB/y2kZZ:6BUimURi506phmVonCMPTzxMB/WVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677122415, "uuid": "f4867697-b8a6-4017-9934-b8bdf493f77b", "value": 5763080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677122415, "uuid": "d484bc62-6a22-4555-9d23-d7e14984b936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677122415, "uuid": "a8661217-95ae-4800-9e58-66748332f24c", "value": "6e494069f55de7049a5699dd72301b4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f47d56-b355-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677141536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141536, "uuid": "0423505a-380f-45be-a540-4b77e605a82b", "comment": "Malware payload", "value": "c4bfac6646112414bdae2f599866e57e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141536, "uuid": "b04ee690-8b04-46dd-83e9-79df33cc96bf", "comment": "Malware payload", "value": "4b765dbc4d8e20cb8385eadd5a52f88c86b7547c0a8466d13c40cea9e87e1cdf", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141536, "uuid": "70f5f235-a3e1-43e2-9990-7e47226b2a39", "comment": "Malware payload", "value": "96bee1809151eb43985e1695dd82d7e74da98d72", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141536, "uuid": "526fc807-49e0-4fa4-bba9-129649873f49", "comment": "Malware payload", "value": "3aa7464633d5697acb2403b6b7587029c123455dee410a3cb027508de169e990988b34561929459b6d683b333a9b5b17", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141536, "uuid": "3cd31884-faef-475b-82e0-9c2489749bc7", "value": "T18365394772BC823EFA9E40B816341A9E1D316E43710CE5667EEAB95C8D36CBB75C81C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141536, "uuid": "e9490c43-c7c6-4d52-b53b-d195e8cb6b37", "value": "12288:oJ8ejd1PrK2VZWT2KXmsrc1AoYJvxrBB70iqqj/gggzz7S:oJ8ejd1e0ZWSgmNm17TqqxMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141536, "uuid": "65a06714-d7dd-4a69-a429-495ac13478d0", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141536, "uuid": "c1eb4e4c-da9a-4793-8a5c-90baa22f929d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141536, "uuid": "2777d3d5-e707-4842-9a82-2f917f791afe", "value": "RFQ-000267RET9084.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4843c1-b317-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677114739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114739, "uuid": "a98724e2-5aec-4346-93a5-8b860943cadb", "comment": "Malware payload (AgentTesla)", "value": "9d023c47b3299129beac0ee5d3df10b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114739, "uuid": "f80b504b-0113-40a4-b763-f568057b1267", "comment": "Malware payload (AgentTesla)", "value": "4d13c083733f91952877388ea9aca09aab32bb5f31a422c0fb0590921cb2316e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114739, "uuid": "4c589660-4644-4bf4-a801-2c2b8a2f3b12", "comment": "Malware payload (AgentTesla)", "value": "273eb0eed71799de88d1db9ba72ce2aebd7cbe49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114739, "uuid": "7b85dcae-707b-45bd-a096-e644d5b61389", "comment": "Malware payload (AgentTesla)", "value": "04665a2fc69a7bd588ec430da1169a663ed13ea567d0b0a449071f375b5db5e3c6c67ecfebf6b62fe3bc6424271c7b77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114739, "uuid": "d2987606-d990-47c0-a9d3-62a1d886db81", "value": "T124541299BBD6C017F8B21B707F3906B61FAC5813166AC3476B912B89783E1D2E11E707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114739, "uuid": "5364bd15-04d5-4cb9-bb6e-28317da43139", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114739, "uuid": "2ce2fb93-9789-4fd2-85a4-2e83374c172e", "value": "6144:vYa6vVtyZQdRqlVEvQZd60W+IBTuLtD/CzT856N4qftI:vYFVtyZqwgQr6vduLh/Cv85l+tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114739, "uuid": "93ab544f-98c2-43e4-a258-1d7dd26fee91", "value": 297427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114739, "uuid": "b6817fb6-43e7-468a-9f6f-02b2090e7698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114739, "uuid": "c7b14800-7b12-4519-85da-3a64c108b5de", "value": "9d023c47b3299129beac0ee5d3df10b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ed5af5-b367-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677149076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677149076, "uuid": "9277bfce-e8fe-4e64-8c9f-f49d28a65d2b", "comment": "Malware payload (Amadey)", "value": "e67a7363bbc2cd52ce9a54ba017d1b00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677149076, "uuid": "1592de65-9c70-4803-8d69-6c673f38a435", "comment": "Malware payload (Amadey)", "value": "4ff1334aa7a3790f75a40310f5839056e43c130199f761d2a82a84e7d57a1e6d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677149076, "uuid": "72422ff2-f101-4352-bc60-35f70f1299b0", "comment": "Malware payload (Amadey)", "value": "76c0056d09aee7566d762e0b9f86fbcf0cd11b06", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677149076, "uuid": "25c60f33-8ec0-4e3b-8925-57b7cfc1b925", "comment": "Malware payload (Amadey)", "value": "6c1b58d6a7e7a2cf49cfb71d7d9f978a385f5483a120e9544e5519a5b791ea10061f761833c2d021cdfa0f9da0639d9e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677149076, "uuid": "12cb5b0b-a74a-479c-9bc6-1ce9494dd570", "value": "T14F252347F5F89422D4B613704EF942E3093EBD21577892C7379E6C492D321A8BA3276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677149076, "uuid": "f796dcfb-5373-43be-a7ad-aa9de172c33a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677149076, "uuid": "0222994e-9c2b-4967-aaec-50e1b9453d58", "value": "24576:oyMWgNQ1ux9Nw1oIISTolX9Zbek42sChUp:vMWguq9O1L3iX9Zak429", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677149076, "uuid": "ef0944d4-feb0-4c48-94af-e8ed5381d672", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677149076, "uuid": "01271e69-2f34-4e6d-8609-cd4c59f4a234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677149076, "uuid": "dfad22ca-e1bd-4e55-8e40-eb56262aa160", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4114475b-b371-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677153452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153452, "uuid": "97582eb4-29f6-4ac2-b51a-0bc66f1c1659", "comment": "Malware payload", "value": "81f80ad0feb88bc454157415ef84d940", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153452, "uuid": "40db037b-d76a-4a38-a0b1-bacffd6a13b8", "comment": "Malware payload", "value": "51d1dfcb9a8422d85e76e9eadc78b22ddf535124da74a064605ae36d6689ca61", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153452, "uuid": "ed397acd-0b0c-46e6-b999-b3241c4311d2", "comment": "Malware payload", "value": "bec8e473e7a663a4e04405a4b5361e65b91c597a", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153452, "uuid": "341753e1-1412-44f1-8b5c-03e2b577432a", "comment": "Malware payload", "value": "94790e6efba312520048162f657537197dea86d93084ac36f7b7c0c7e317c261272fc02fc43192e5aa588a722d5fb919", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153452, "uuid": "5059127b-4194-45c4-b16a-b4888c988207", "value": "T1FB250106E245D82BED724530A847248382199C7AFD1AC74A32D7731F5736BF20E7BDA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153452, "uuid": "305ad9ed-70ed-43aa-9813-b5addd42cc40", "value": "24576:TFey2btm7uFe8hMdqhgmSl9tfyd5C63DwXl4wtXXXXXXXbXXXXUXXXXXXXXXXXXj:RZObxqlHfyd5CIiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677153452, "uuid": "cfed21da-9af7-487b-afcc-0b3d04a915e9", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677153452, "uuid": "02ec2be7-ca50-453b-8615-37a1b28ff5c3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153452, "uuid": "d06f1b1b-8335-4d38-b252-d0631701be3b", "value": "Request for Quote.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c7e6e1-b371-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677153481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153481, "uuid": "43816d4b-1cfb-4e99-a7b6-6ed9a11ba7ab", "comment": "Malware payload (SnakeKeylogger)", "value": "4c38f4e57905ed6b22f76cae97f49ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153481, "uuid": "3cc5a0f0-62a3-43bf-8401-c73f165375c8", "comment": "Malware payload (SnakeKeylogger)", "value": "52716bd9945e29e5677a9915e771c8c18c3c8dd16d29c70fdfe11dcd0be39ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153481, "uuid": "859a1867-db83-4d4d-99fc-6bb871d70f39", "comment": "Malware payload (SnakeKeylogger)", "value": "2bcdadba9b3109ea515eef24d2d4b32572863e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153481, "uuid": "2222f001-3159-4210-843a-d678fb279ad1", "comment": "Malware payload (SnakeKeylogger)", "value": "94ee1489f77f03b1e6f4e118b8d69dec5921787954747e3e0ab848f5e5095d1dd13ac826a33e15485bbe4bf927d2e65b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153481, "uuid": "9a95821d-0a9a-47c0-b8a5-d08092c12d10", "value": "T11D943A86EA804184DC3D6770243E8D25565BBEFAE8B8B14E2F8DB23577F31E3143654A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153481, "uuid": "9280a69a-267c-44d4-9c29-6c5f3cefe4a1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153481, "uuid": "53b46e86-7a60-48d7-8efa-8ad8cf33369f", "value": "6144:IYa6B0+uhQMdnfPHstOENQddHMADXuQ8rPzGTVvMqE3jvUi:IYw+uhQMdfPrENQX2+VvM7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677153481, "uuid": "a6fc6b03-c240-4f70-b9a7-809d7edbd2f2", "value": 439423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677153481, "uuid": "5acb05ef-c71f-4e31-8a95-14875c1821fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153481, "uuid": "f39950a7-9948-4fdf-a21e-ad3473972367", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e13184e-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677136267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136267, "uuid": "5f28baf4-5d82-4809-8418-608ccefbb474", "comment": "Malware payload (Formbook)", "value": "843c9be5a6902c85d22e5c768346d184", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136267, "uuid": "6747b6bd-b043-431c-b692-9eaa443fa644", "comment": "Malware payload (Formbook)", "value": "528016d0aefb7d14ea4650501daaf32b9958862d567706a72b18f3cc41aaf2a8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136267, "uuid": "06a3147f-9da7-473d-a5b7-29ed7a7279ab", "comment": "Malware payload (Formbook)", "value": "92bfa1b0f8dfd39b3064522d0341b2d18eb5a99c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136267, "uuid": "f8f1d192-38cb-4e7e-94f4-853176edd386", "comment": "Malware payload (Formbook)", "value": "8586a73eb30729e870c1885fccbfd8091ccfcb129f236e08316270ef9e2a3a7e51f39b0a88165a4273bfcfdc61a636fd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136267, "uuid": "d9b3fbfb-ccb1-4369-bceb-df2a1ddb159f", "value": "T1F0825BDCDF8A464CED20BFCC0DD30A8915A713618031176B3BB9C95B69AB43CB24B5DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136267, "uuid": "dd455bb9-7e8a-48dd-a46c-fa686c5366c7", "value": "384:JnngVEf/PyE27G/1bcp4pchR+l1kyz+OPlMc9RioMdN2gmlXqvjNbEzkQtijnuKQ:GvKVBIdYmtbXIgbixNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136267, "uuid": "000008db-9bae-445e-96bf-894750a11431", "value": 19260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136267, "uuid": "f4b57852-c3af-4f0c-ba3d-49a7235b4126", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136267, "uuid": "c5c8d05b-4946-4588-afd8-2dfa3ce8f5fe", "value": "Payment Advice Note from 02.22.2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e887da5b-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677143425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143425, "uuid": "15e00917-e7b2-4252-9754-e762c2a4c00f", "comment": "Malware payload (RedLineStealer)", "value": "2f17d3695e172549198733da49e9ae10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143425, "uuid": "71d8d9e7-c28f-44ee-be43-7b0a3b6b6c88", "comment": "Malware payload (RedLineStealer)", "value": "52fc701e6de84ffbbab98e07e451b69700fca99a064e54285915f0823e68aaf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143425, "uuid": "b2518e44-5126-4aa1-9d6b-f64956bfc2f1", "comment": "Malware payload (RedLineStealer)", "value": "a2b1676d0e835471c7c5e61b7c8942d8a24a0178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143425, "uuid": "572af70b-53fc-4434-9f76-3438ea8581e1", "comment": "Malware payload (RedLineStealer)", "value": "56402b1bbc21fac5a6fe712668fd7ed743214249959526e4ee399056fa8a7ddfca008a72ccc38000d3153395bcb43528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143425, "uuid": "54ad75c3-5bba-4420-b92f-0ce89c694651", "value": "T15D04D61037FCCD11E1BA1A3F6962A05046BFD802A942F25B76C767DD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143425, "uuid": "6ac8a344-79d1-431e-92ae-974e0f594909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143425, "uuid": "93efe60b-4cb5-4f06-bb0f-00d45e2483e1", "value": "3072:sxqZWrxafU74Xn3EIae/59rhPzxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwo:CqZXn3fZrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143425, "uuid": "722cc057-4af7-4bcf-94ec-94b32f5a927e", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143425, "uuid": "30f59701-e942-477a-b190-c24dc722c7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143425, "uuid": "27ab053b-73e9-4969-9bda-77db8e00c196", "value": "2f17d3695e172549198733da49e9ae10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bffc65-b37e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677159197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159197, "uuid": "73cba832-f93e-48e5-b325-398729b486c4", "comment": "Malware payload (Formbook)", "value": "578911e6d46b3e0984b5cb683e780143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159197, "uuid": "bbbc5d42-8afc-47b8-83dc-3a6eb45c7abc", "comment": "Malware payload (Formbook)", "value": "530f54838a7be7f1875ba2afdfdaf65b7027a98acbb40134e7cbac980d256746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159197, "uuid": "02c50595-15e4-4e78-9e8d-62734a896de0", "comment": "Malware payload (Formbook)", "value": "07c45f92402d4ed23c14359c2677a425e5ab4112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159197, "uuid": "fbf04e90-3e3f-4d3c-9ce0-b43e140e8f57", "comment": "Malware payload (Formbook)", "value": "03044788b6f30928fd4566d0b5741bb9245c296a55c4010e9ae3d7d0e267eed42c039d50970065a0b7b4ccdb10de5d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159197, "uuid": "41709657-0038-4113-8b17-a342c82a50a8", "value": "T147157A87BBF0A437F99E40AC063952CF5E35A253724CE2265F7B29449D8ADFBB1C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159197, "uuid": "e198c1ae-5e07-40cf-9682-5b5ae645ce8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159197, "uuid": "9e1f9271-7c17-4bb9-a289-4141bcb2dacb", "value": "12288:OfhcL3ndOysPMokQd/OCc61Zh1ho2e7pS3kp3MQt84Kzl+dtoPuP:/L3ndgrkY/6kGn7pS0c4KCtcuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677159197, "uuid": "5f9d52cb-0702-4fa6-a1f2-4ff9ec13a750", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677159197, "uuid": "26fc363c-ceac-48f7-85b8-5076b4f8afb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159197, "uuid": "6a86f8cc-d213-4bde-aae7-b60edb091ff0", "value": "Banka odemesi havale bilgileri TL9989000080_23022023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5edeee-b36e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677152422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152422, "uuid": "68221d27-f347-4018-9b25-ad7005162945", "comment": "Malware payload (AgentTesla)", "value": "14654e9902f1997287e700446d70660a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152422, "uuid": "c1d38599-b505-483a-83cc-b446c3e68615", "comment": "Malware payload (AgentTesla)", "value": "567ca06ef21382ff925abe4bc43f751cf68605d88be5e8c6cdf225129dc805ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152422, "uuid": "e6b38e3c-3a85-4e13-973d-afff0ad828f8", "comment": "Malware payload (AgentTesla)", "value": "8f82f7fcc7380d463e2d5a535e1d458f80aba96e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152422, "uuid": "99ce70e5-a237-4459-bc38-fb8a04e7d76e", "comment": "Malware payload (AgentTesla)", "value": "73af0263be09217a5e3e88d55f947d37665aa3845b49e86b613806484ec5c7aa62c287f657d4661afe585b1f61d2e381", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152422, "uuid": "7cd2899f-6fee-4f62-92ec-d9e43e325ac0", "value": "T1406532B054BB4EDAE00BC9B01AFCFDB9027671F3DDD50DA1435CA6085F2AEA86F4154A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152422, "uuid": "d082d9c9-2f2e-4270-a242-b6c3affcde29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152422, "uuid": "df6980c7-f691-4dee-9d32-6272c5c2ea12", "value": "12288:ozR8iex05QApPJ3lo9r79f/lSWFEddBRHUJm2UcZ0o2kVOLP7GBnBDNdld+5n6uP:UddBRSP3SkVKW+5n68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677152422, "uuid": "f5a80085-7e73-42cd-bd4c-2d7ab178ccef", "value": 1479168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677152422, "uuid": "a52cf063-cdd3-454d-ac0b-29f4aeadbb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152422, "uuid": "ad8c99f5-1c43-4f87-91d8-6a70d25d314e", "value": "Bertolicaviordine(PO42738150)doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5efd16-b383-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677161284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161284, "uuid": "79af35b4-d35f-4226-8979-3873afbba46d", "comment": "Malware payload (GuLoader)", "value": "3c3561f66dba7c560c7843504b18382f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161284, "uuid": "a7a14378-5783-4829-902b-7b250058c8cc", "comment": "Malware payload (GuLoader)", "value": "577df68dc78405d4ff64ae5b17bf22017d639a48fe7bbfce7e4a779106b49d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161284, "uuid": "fd8452ae-25cc-411d-ac1e-8fa908511b32", "comment": "Malware payload (GuLoader)", "value": "1ad177ce7b288534398e3361412cdac53ca3e0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161284, "uuid": "1f77d283-00da-438e-bb32-f02214d38315", "comment": "Malware payload (GuLoader)", "value": "58db5d488828e898a7ad378094ef8ec723bae502d7f67a71a0f72896369d838e20af88e3ea58be54cdeb9487a83eed36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161284, "uuid": "f5335707-0493-40f3-8ddd-114b0a63fcb5", "value": "T11B4412CA24E141F3E5AA437206B35737217BB51641A09D8FD7909FA70E70346CA1FA9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161284, "uuid": "0fcec34f-5155-4eb0-addf-f98be3ac6f38", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161284, "uuid": "6e165059-1dc5-4b38-8ea2-f45fb2868be6", "value": "6144:JBeMKZAaauvXcqFkSHz68Gr12aXHQ2+MlVjkJqNY8EJA:JKZouvXjtT6JJ2SLvVJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677161284, "uuid": "f7aaf001-8f70-4f57-9a16-829d36616f30", "value": 276448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677161284, "uuid": "bbb4b9f3-d382-45d9-94a8-ee92621cf8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161284, "uuid": "fab9ce92-6a80-4c09-b958-12309334484c", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e4d05a-b3b4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677182390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182390, "uuid": "5e414426-efb0-400e-af39-c56eed938d15", "comment": "Malware payload", "value": "8ef343648cf5da01d6232f4239875888", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182390, "uuid": "f2fa0674-7cd0-40b0-98d5-ceb7e0bb0b4e", "comment": "Malware payload", "value": "57bd88bb6d0b418e64f193a7c6b6da9f18c44b092685572e8b708bfea72f8bed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182390, "uuid": "6929eec4-7739-49c7-96f1-60869e73b089", "comment": "Malware payload", "value": "9c770ff2dd7be83465275971c73026ac911e1ab5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182390, "uuid": "6b6a7f52-e694-4348-b813-013888d3d255", "comment": "Malware payload", "value": "8dac2dcfa2fab2819bf41d827d1fa361f9b8061698b13fe5c8a5d70b7d01c6f07690de57d6ff605080c885f5bdb99168", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182390, "uuid": "c00c10ec-d3c2-4b2c-b003-01b432c5dda9", "value": "T1AAE623B300817EC3E27193BA6C2785498C25F5B64F462276F12F6BE5818649DCFF4BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182390, "uuid": "ad394fc1-cedc-44dd-9f53-d8e0f877940b", "value": "f4fc9084548cd4b9d921befccf1ffb4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182390, "uuid": "f4734fd8-8f3e-4640-82c8-01b3b49e78bc", "value": "393216:wrKyxZ9hUPx2hSeJRgrY3RF3Bpep5KpmAivtBgS:tsUPxwSeJRR3RF2pQUAcBgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677182390, "uuid": "84977459-07bd-45e1-8a5d-8df16d76d01e", "value": 14599680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677182390, "uuid": "b08b6d2f-7a3e-494d-ad49-8be1f42ebb5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182390, "uuid": "1d343976-38e0-471c-af52-b548747460e4", "value": "DBBSTXHMGY.fYY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a09aa66-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677151722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151722, "uuid": "7e2d1459-fc2d-4e1c-b0b2-88f5eebee4a9", "comment": "Malware payload (AgentTesla)", "value": "8c68f1a6573b8acc47c493a92ede87ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151722, "uuid": "36ed747d-923e-4855-86aa-8fa51ce9ddb1", "comment": "Malware payload (AgentTesla)", "value": "5859c56c2787b13ed32640c3461733c9f288056d248b81bfed47ce61873f7011", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151722, "uuid": "80adfeca-ab23-40ef-aa3c-1a15ff21e21d", "comment": "Malware payload (AgentTesla)", "value": "070f7215419dcf8db138f96919438d4d64de310f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151722, "uuid": "37ec714c-ceb2-4db2-9683-b205d8f88363", "comment": "Malware payload (AgentTesla)", "value": "f795e90b6e7dc65e03635ca94dabe4aeb4f498a2d6375058fa1543cc4c41904c44cb093e1f653501f798c6e269b62ef2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151722, "uuid": "5206dd53-4269-4b21-a05c-b3bba66e37f4", "value": "T1CA057B8662B09133FDDE90AC07342ACF1D31B252710DE6675F3B6A989D1ADFBB5D8240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151722, "uuid": "61e44dc2-67ed-4a87-bfce-bf5598204fa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151722, "uuid": "6928197c-cfdc-4dd9-b49f-def42a608323", "value": "24576:DJ8ejui/qSzSvB18059YspbRV0FlGbIX3vbofg:qLSzO80n3ulGUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151722, "uuid": "8ee7223f-6fc1-4b22-99e7-3f389bf8f796", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151722, "uuid": "82586b5b-0cdb-41f8-b63f-6c7a98255f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151722, "uuid": "5a6daee7-1f1c-4e98-908b-8131612400cd", "value": "8c68f1a6573b8acc47c493a92ede87ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3c21c8-b326-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677121228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677121228, "uuid": "9af56dd6-a824-404c-a88a-6c0c7e6d32de", "comment": "Malware payload (LaplasClipper)", "value": "6ae7c8af8b5d7d38a38661dead883de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677121228, "uuid": "5ec98151-52a0-44be-912e-101089122491", "comment": "Malware payload (LaplasClipper)", "value": "5a0501d96e313d2df39c38516aef7b5283a4f2979a4377f0f54e110d69de8e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677121228, "uuid": "b4566191-0cf5-4e29-9e46-a8e9271d5354", "comment": "Malware payload (LaplasClipper)", "value": "138205f761dd153d83a40935e9d61ea74b664478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677121228, "uuid": "c130c837-194b-4461-a263-51ebba17fd06", "comment": "Malware payload (LaplasClipper)", "value": "95e4e394645f058f530cf4dce395914f5a7f8fb81eb55961046467080320e4a3a05d5c2488ddb3ab3e37f2847c2a059a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677121228, "uuid": "b85804a8-466f-4566-8a03-59085bdab3af", "value": "T158B6332BC0AB5E83CAB4C2F1EB78C5C8162F65AB155A88EFB55FD13409712839FC7584", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677121228, "uuid": "1b9a1bf7-5faa-4c1b-8acd-b3b7f8308f82", "value": "8644c121c872427eb396f62148006088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677121228, "uuid": "cfb3d865-10e2-40e2-8898-9c1dba9cfe6a", "value": "196608:vv6fpeoEnI1ZIp2lHxVKFEUxRxCSZI4i3hDqkz4d7QHyiLuadP2wN/tfIKSxN6/g:vvOfZU2XUzoSZI4iMkcdqricP2whR8Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677121228, "uuid": "3d82df64-3624-4099-85c5-314c6464a610", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677121228, "uuid": "595e3197-fd1b-4464-aef1-ab87763517be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677121228, "uuid": "51e963b7-1884-4214-a44b-d8340c74be90", "value": "6ae7c8af8b5d7d38a38661dead883de8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14c3608-b37a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677157532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157532, "uuid": "8f4e65a2-b4eb-4290-92af-4a86b42b19cd", "comment": "Malware payload (Formbook)", "value": "b1cb580f5d949e1824858d2db13234bc", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157532, "uuid": "6103e27c-f1dc-41b7-a8a2-abd6b0d2302b", "comment": "Malware payload (Formbook)", "value": "5a7b148bbd4bab19e7fdcbc451918d55a2f93a460aa65bdf49d0e1783ba6cfcb", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157532, "uuid": "bb709a39-625f-40c6-aff5-16e0c2628d68", "comment": "Malware payload (Formbook)", "value": "d6bb297881e781bea9e95eff746ec450e050b666", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157532, "uuid": "9203427f-6a74-4f35-98d4-a5d65a13fca9", "comment": "Malware payload (Formbook)", "value": "d9dd529a4919ed7cbf0e3b94894f9bf7372078532f327382a67166a15dff4063bd3a9c39f7698846b3bdaad27b5b46b8", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157532, "uuid": "f964fb73-2ab6-4f30-aab8-831a5a644cb1", "value": "T189E423419F70CC3104F24065B37BB81A8931FD5AA3DA9666AD3E422EF4077DA583DB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157532, "uuid": "14cb0abd-cbb1-49fe-b417-93f7dcd94a75", "value": "12288:x0bDg1+2SWbx9lZEwOnzrlGFVC3qMRLLg3tNLvmSIPOoryNys8JqYyU9kw9gxhX:x0DgAVxXr8PC3V+rqfbe83XowexhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677157532, "uuid": "11352161-8e76-4032-9823-62e73b96a24e", "value": 721387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677157532, "uuid": "2d7ce59a-b55a-4780-a37f-a070bfec267c", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157532, "uuid": "791825ca-d110-451a-9930-0b92a701110c", "value": "nNUEVA COTIZACI.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3ef8c7-b31f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SocGholish)", "timestamp": 1677118149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677118149, "uuid": "c8427ea3-b6d0-4eb0-92f6-9c69f7ba5a5c", "comment": "Malware payload (SocGholish)", "value": "46768123a4353405848e3894bdf8a409", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677118149, "uuid": "7351aa3f-f070-4742-9a43-d440ee079d92", "comment": "Malware payload (SocGholish)", "value": "5b184676394c27bd35f074f462948fe565c3213edbf8472957c1572f95a1635f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677118149, "uuid": "32cfaee2-b6be-48af-9992-5ab0b5b871fa", "comment": "Malware payload (SocGholish)", "value": "ab876aac8c0d0794991c094f0c97ffeccbd8567d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677118149, "uuid": "c2343825-b5d6-445f-b68c-35bb6d600625", "comment": "Malware payload (SocGholish)", "value": "e53830653ebd2607b7464027ea183d79dba1de9ebec38812f798628498d9d9ba2d2ca192b5d974a4e7d042f78a4bdbe1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677118149, "uuid": "b6f0d937-45ed-442a-b841-edc8208a021c", "value": "T1E7B2A4C83BD2F059526721BB842F20D7F23E6E6674ACAA40D220E5E83C7591DD137E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677118149, "uuid": "73c2f525-f25d-4813-9be5-fe9f4900d001", "value": "768:kHAwyVIvOI/IExc5EWTB9fRNCOu1nPO1+7:IAYZIl+Wcn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677118149, "uuid": "b2a4d2f8-4212-4ec7-a7ee-68540374ed2f", "value": 24882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677118149, "uuid": "a638dd02-3128-4655-97be-f2cad23c9b75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677118149, "uuid": "70c1bca0-97be-4e39-a696-487e30aa167a", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a99317-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128574, "uuid": "7026ad52-860d-4eb9-882a-38601cb439e3", "comment": "Malware payload (WannaCry)", "value": "385e9ddb0b07b60c83e13e09357b4ec8", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128574, "uuid": "7ac958e0-b40d-43a0-a7e4-db620055f411", "comment": "Malware payload (WannaCry)", "value": "5bcec5c1b613e7b0f9195285603d861a01ca5ba594d0760a207b6debe0356617", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128574, "uuid": "90e56516-5ad8-4c20-a61e-556db61ce99d", "comment": "Malware payload (WannaCry)", "value": "5269e477f9626444f405a1776ab85c290810e7f4", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128574, "uuid": "22541703-8b7b-4c75-91af-2b0f1f5c691a", "comment": "Malware payload (WannaCry)", "value": "b83d2b32434ce16504c4dda9bec9c7041e961ad2f95b13056b2385492ed3223916797c13a7dbbccfd783a78f48795b15", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128574, "uuid": "0ca65fca-a7f7-43fb-a9a0-1bd43d8603cb", "value": "T1BAA2E70867FA4A39F7FF2E786CB251515B71BD53ED3EDB4D188A404D0C22B8C8960B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128574, "uuid": "0e44b164-fc62-43a5-b290-9bf29a9b2838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128574, "uuid": "85207ee4-ad3c-417d-8108-083154c22b2e", "value": "384:c3MLWHn3kI3fcSxlR2WpsVPCQoNrJ1r91Crxb58eL:0n3kIE69pfQ61r9SxbSeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128574, "uuid": "7686053c-6731-4be7-bac7-bf302b43b591", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128574, "uuid": "b6cde41f-6679-451a-84aa-b8afb6b77e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128574, "uuid": "036fb81c-3e0d-4cc4-a4b2-dca81b60a63f", "value": "2023-02-23_385e9ddb0b07b60c83e13e09357b4ec8_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6739a95b-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677143208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143208, "uuid": "09e79d10-006e-4e8f-85d4-86f88afb8949", "comment": "Malware payload (AgentTesla)", "value": "aa032a011d728dffee140c06e31e940d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143208, "uuid": "85efb683-688f-4630-aaed-6ff049af59dc", "comment": "Malware payload (AgentTesla)", "value": "5d8be46b4470316ef7c2b9c230b997598a6b8a0eb49d334c87e6fece01b9f460", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143208, "uuid": "b76be5d7-c3ba-41a4-ad4c-474362ba139b", "comment": "Malware payload (AgentTesla)", "value": "a2689f6f159691a37d1dbcdf452b665674023a1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143208, "uuid": "3d0ed527-310e-4a7a-9933-406351e12dce", "comment": "Malware payload (AgentTesla)", "value": "79cb2cdf36eb63310569405c50e33598d2430b1fecb81073953b42550bc27b5e811c1b15e17e25e4e4b3482757bb39a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143208, "uuid": "1c9c09de-bce2-4ea1-afa3-16bb022b1137", "value": "T1B3057C8766B09133FEDE40AC17381ACF1E31A252710CE6675E7B2A588D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143208, "uuid": "06b0f2a8-442b-4ed9-be4b-52b2d66ebaa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143208, "uuid": "7e258e47-2ecd-40ea-afc9-26691328f6b7", "value": "12288:ZRJ8ejCfnS+Y95tYj0jDjZCwbYFAA7FMPIdWa+0xYCk7ySrw:bJ8ej0iVFVaDWUmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143208, "uuid": "797526dc-4a35-4a9e-a2fa-aa9ed416339b", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143208, "uuid": "268894e2-3943-406a-a17b-dce1632c6dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143208, "uuid": "37e64f0a-2d9b-416a-a74f-94bc68f0938e", "value": "FedEx Express_1022355160763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f59ad5b-b35a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677143705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143705, "uuid": "2ecc0445-28c0-4e5e-84de-22ba53a8baa2", "comment": "Malware payload", "value": "5998ff85213b0d5f6c74464db0da2937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143705, "uuid": "23456722-96fd-44d5-93d7-4923588f22e0", "comment": "Malware payload", "value": "5e46dde6a0498a8132a2c3f67274c7da0957bd91b20be8399b9ed685332afb23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143705, "uuid": "8b6a4853-4e03-483a-bea2-ac26aa59dcbc", "comment": "Malware payload", "value": "c6674118a10232ec99cc50a5afe0388387ced232", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143705, "uuid": "de29e6bd-ef74-4ee1-9fd3-1b7cdeb1b0d8", "comment": "Malware payload", "value": "4be78c4382f458a9de9f7b1a4078b638a9318dade11a3d8b36d8ded66d9895ab7ff726885dedceae0211f35db177b086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143705, "uuid": "ea9cfa51-9b3c-402b-97a2-ed6e3bc82098", "value": "T14A057B46BBF09076F99E41AD063912CF1E31B253765CE22A5F3B78489D4AEFBB1C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143705, "uuid": "b27b0f95-d792-4f3a-bcaa-ae9e53c527d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143705, "uuid": "b8da12ff-4382-4418-a749-a5d488441ec4", "value": "24576:5wsssuk39IZqFIeYg7w8wtPX+A34yCtcu:ZssPIZ2Ies8wEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143705, "uuid": "45f8ac13-bf29-4f8b-a412-5700011ec393", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143705, "uuid": "f187bbe7-1145-4759-aa84-fbfbbb7d2218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143705, "uuid": "5490c87a-a18d-4401-8526-307d029f8f49", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7eb6b2-b316-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677114330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114330, "uuid": "6b23670a-bc8d-48c7-92cd-7656fa2e70f3", "comment": "Malware payload (RedLineStealer)", "value": "49625c0c3b476046d748c6cc7a5929a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114330, "uuid": "33da4574-dd32-40c0-9d0a-48b37343489f", "comment": "Malware payload (RedLineStealer)", "value": "5ed041ed1069c8bcf71d44d39a3c1f6bd4ef1ae7748dfb5249e3d1f1496a687d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114330, "uuid": "b8d8553d-6158-405c-ba32-383646fb6925", "comment": "Malware payload (RedLineStealer)", "value": "3d974ebe2f66ef2d41728176931db460690e281f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114330, "uuid": "eeb53bd4-5cba-4f9a-ae07-9bea7532208e", "comment": "Malware payload (RedLineStealer)", "value": "fe36dc4179a55d988481b4c1e4bc2d9ed6c4db4e8c1d6f278d180278990f1509f0af41b8851877195d9cb799a4bbae58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114330, "uuid": "027b2380-cc56-4e60-a452-13e8e77147e1", "value": "T12074FA987670FD9EC857C87F8A581C64E6636466970BA203B05313AC993D79BFE130B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114330, "uuid": "806c9ade-a50b-4f21-bd66-8273b21f8786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114330, "uuid": "469cf66a-0992-4fef-af29-451295e74170", "value": "6144:0bUlO6ppZmaSzY3xmUbaXml9L+89TNaQ8WqO7sE/r+X7w+e:nFppZmLKjK89TNaQ8WqO7sE/r+X7w+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114330, "uuid": "22991282-7867-4664-954f-db8a14a1126c", "value": 344162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114330, "uuid": "a0fd93c5-9add-43ee-84e7-1e215f689c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114330, "uuid": "26e1bb14-3999-4f57-b392-78cb34b30d65", "value": "49625c0c3b476046d748c6cc7a5929a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a08812d-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677143132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143132, "uuid": "03dc93e2-4856-4f52-8eeb-0f9aba8d967f", "comment": "Malware payload (AgentTesla)", "value": "b69580b8467fea7bb7be748589a87803", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143132, "uuid": "cdc2f89e-ffe3-4dad-bb05-fbf43344a676", "comment": "Malware payload (AgentTesla)", "value": "5f4024816ea65b791ba0ee319fd1acf938f52d6793a75f90814710c0fa7aa3ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143132, "uuid": "40242180-8151-4ad4-8295-d9ab59dbc599", "comment": "Malware payload (AgentTesla)", "value": "a275a81dd0cac2d9c4a44ea8bccc7c00ebee100a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143132, "uuid": "7cbe5466-c533-46de-b299-9b6761b4fe58", "comment": "Malware payload (AgentTesla)", "value": "757a03a793db99a445aa6a83f901dce0dc17673ecbe206bf792ef037b5bed1b44d545c5c81350ef2f3d3579504d444a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143132, "uuid": "c24cd01d-de41-4bfd-a7fd-74eadb5c1810", "value": "T1B7E24A59D34F02A4CF5A5277931A4A9446BCB33EF25541B2306C837433EEC3E866A6BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143132, "uuid": "2d22badd-5d0c-4849-8fc0-d36be2b50f11", "value": "384:pL0AbZS0tJpFGx5uSWTecgL5nfVqSbtemO1gg3zoWEM7HUE8R/hkwy5:pwAbZSiJjGx5uXenFffbttmr3cI/4+b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143132, "uuid": "d388bd95-a891-4845-8965-1fb16c4eb274", "value": 32062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143132, "uuid": "8f17ea87-6544-4182-ae4f-a5654b82d324", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143132, "uuid": "0eef675a-3e44-417d-b880-40b047994e21", "value": "RFQ 23022398.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91efa8ab-b360-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677146286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146286, "uuid": "69a6f485-b95d-4989-893f-0bec25e43eb6", "comment": "Malware payload (Mirai)", "value": "72ee0a3849c52e298bf69414ba5d1dc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146286, "uuid": "cc0baab1-8ac0-4950-b012-d11fe20eb494", "comment": "Malware payload (Mirai)", "value": "60df2221945e788fffeedca123f604f0fc664b99f929ee3c4bc4340cefb8f33a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146286, "uuid": "c44c0e92-24b4-4c44-ae04-842f38a11bfa", "comment": "Malware payload (Mirai)", "value": "253661a9100a4df6f4f89066d1ce63d98984eb54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146286, "uuid": "81fdb5b1-4e73-47d6-ac58-8ae032d63ea0", "comment": "Malware payload (Mirai)", "value": "3e5e51d31509586bf35ebaa7e18b957e40c63db05e7ffa6d84149475039c9bd4a3d51747e2540d51fd18207ae4f77622", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146286, "uuid": "8abbe0bb-8216-49d7-9354-9eec1f83111e", "value": "T123835D97F5118D2DF547EAFF90234940BD554367E5A70B13BA72AC837C632893A32E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146286, "uuid": "68231fe0-1cbc-4663-9921-4b77b0ff910d", "value": "1536:c4tghaTB5gC1d4TJnOM/CPTr2SqnXWXFEHSuCR8RoFXJxCFxCI:cYghi5gC1d4TJnOX7CnJHHCPxCFxCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677146286, "uuid": "c572440a-31dc-4a51-be22-8a5ed669ef35", "value": 82880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677146286, "uuid": "5b67c43b-c947-4968-bef2-08acbdd913a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146286, "uuid": "6b5ff8e2-106b-48dc-bb58-c36a00483961", "value": "72ee0a3849c52e298bf69414ba5d1dc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988f6c4b-b358-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677142861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142861, "uuid": "d4d8c3d0-60e7-4276-bb19-b41fc9e08d71", "comment": "Malware payload (DCRat)", "value": "1cae45a7f49649686b4be8f475b56315", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142861, "uuid": "7e260d84-b5ce-412f-9a8e-4073715ff234", "comment": "Malware payload (DCRat)", "value": "62b9be575cf2eb0b78544df78d45abc92c6544df62a74398483cbd203c3c3836", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142861, "uuid": "af94c34c-ffc8-4766-9263-01005049da11", "comment": "Malware payload (DCRat)", "value": "e80f03e273460eafb62f60f7195ac48402e1c51d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142861, "uuid": "9ef93fec-ed08-4cc0-8319-38a7a65dd1a3", "comment": "Malware payload (DCRat)", "value": "c9c290b8f4cb89efdbf01d2eec0117c78e755c73da9545b8f6bfa4a36a4b3b39ce4b97f8477d14f9c11d4ee5f7fe4a0b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142861, "uuid": "5519f3fd-a4ed-4f18-85f9-9899d6f0c73f", "value": "T19C536C002798CD65E1AD4AF8ACF2554106B5D6772106DB1E7CC804DFAB9FFC64A223EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142861, "uuid": "d4653555-f211-4b83-bbbc-b0252f7544ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142861, "uuid": "31043be6-4df6-43c8-bca7-c8761ca5099b", "value": "1536:4hjMxLDRwQuNMXbmaeCs2lz9oKlI1pbbjwuVGftpqKmY7:4hjMxLDRwQuNMXbreKlz9JQpbbj82z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142861, "uuid": "06758c60-99f7-47c6-976a-dfd635bea29e", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142861, "uuid": "5e465fce-f981-4634-b070-2640c3529985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142861, "uuid": "6cc7c323-1b16-4e97-b757-38c644d4278f", "value": "1cae45a7f49649686b4be8f475b56315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95970714-b369-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677150158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150158, "uuid": "2a2c773a-6f3c-45cb-a002-8cdbf6b35d5f", "comment": "Malware payload (RedLineStealer)", "value": "943794f4000443cb5f0b21883785516b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150158, "uuid": "e32782e8-504e-4767-8cd8-7d56507697b7", "comment": "Malware payload (RedLineStealer)", "value": "667119dc6e5aa376b5de1c263b42f4e11a5b5548467032f01f07c23fb98383fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150158, "uuid": "4bd65aa6-c29d-4584-b7e5-7c35d4f52c7a", "comment": "Malware payload (RedLineStealer)", "value": "cf847feda1b255b46989808ea05d06fe66908aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677150158, "uuid": "bea26c92-835e-4d11-b024-438dd967e11c", "comment": "Malware payload (RedLineStealer)", "value": "25dcc9403ba8e8ba6edb7891d121e0fc159f8631f51854098c8011ad956fc06dcafaaaec04f8ff920e99d0b21e040684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150158, "uuid": "361c2df2-16c9-4fc2-b002-c24ea0e50c61", "value": "T1E725220BA7F44032E4B2277159FA43E3073AFD145A38854B535A6D4A0DB26B8F731B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150158, "uuid": "304d008f-c8d9-42b4-92c2-6117d9b94b0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150158, "uuid": "50da5ee2-c2c0-4245-a7bd-c9b4fd1e8285", "value": "24576:nyJI7JNFHtDFL6eWH7mfV9TOCtxCp826R:yJI9NltBme/aCtx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677150158, "uuid": "c0221dd3-7a9e-40b6-8777-143ca49676e9", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677150158, "uuid": "1ff40300-b8b1-4b8b-9442-af9d17fe0177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677150158, "uuid": "f9ca2235-0b9f-44b9-8577-49ebe2d0a026", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6aae6a-b32a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677123273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123273, "uuid": "3d3b4785-6484-45a6-9e10-bf83148404a2", "comment": "Malware payload (Mirai)", "value": "31fc5994c1ab2576a77cccdfa95abefd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123273, "uuid": "15c51fd2-afd8-41f2-bb28-67095b05face", "comment": "Malware payload (Mirai)", "value": "667f91a70708006b377bd5e61ea248768ad706e0e833414846152137ec6ff318", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123273, "uuid": "714bb070-a848-40b3-9d6a-05c84531346e", "comment": "Malware payload (Mirai)", "value": "1fd11bb5d9768093c47f1e727c6bd4db29b95e6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123273, "uuid": "ab73fa3b-d688-45d7-b0cc-37f2fa5376df", "comment": "Malware payload (Mirai)", "value": "9e322074c07f72214008e0a18494d6d62ae47f7a8b5a19686c57a4a69ca5f8f0297a0f3a14ba14dd7549765b0c551736", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123273, "uuid": "ff6675f3-2e5c-4b6d-82b5-147529d2a5a0", "value": "T191338EA5C4B9EDE8D2148E74BD258E788763E100C6932EFAEE4486599047EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123273, "uuid": "eb6d98f3-d73e-4fd3-81cd-21cf27de71c5", "value": "768:waIwqwtOZc5p3hnYep3v0Gvdn/fAPs3g58cAlOSpE4rC/oIaNCy:wanqwtYduxxAPs3gvAlZpEyvLNCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677123273, "uuid": "b817c5d5-004f-4334-8820-8eb3a99e1188", "value": 51072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677123273, "uuid": "5047100b-b974-4dd4-987e-a2fbf761c367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123273, "uuid": "f65fbfba-a85e-4827-950d-eaaec5e50f79", "value": "31fc5994c1ab2576a77cccdfa95abefd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ab1aed-b3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677177459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177459, "uuid": "a909ff16-9f35-4b3d-ae62-e96a0f34b6da", "comment": "Malware payload (RedLineStealer)", "value": "91cef2a011a8a099168a598c12b9c67c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177459, "uuid": "a2ca0d02-0162-4a8b-828b-e87f96b33c5b", "comment": "Malware payload (RedLineStealer)", "value": "668f014732e2576d67a6cf8a6949ea2ab634c8d2b15997684abf99a8991e3ac6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177459, "uuid": "18dd2af2-b234-4448-a783-10012fe19605", "comment": "Malware payload (RedLineStealer)", "value": "5aac70b952e42e9f16fd08364ae5cb4f0662dca3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177459, "uuid": "256ec69e-9eb6-4954-9fdf-5ef380060dc4", "comment": "Malware payload (RedLineStealer)", "value": "3a03e100d9e3fd29272f52639ca36682aa469c20e01328c27dc551a87a559131b5b66768bf1fdbc283ed6d669b11066c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177459, "uuid": "5867555d-b392-4d8f-bcff-a062d15de53e", "value": "T17394F147E7ECC072E8F4577019F607D3063ABEA06A384666374F9D1A08725B5BA3172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177459, "uuid": "8b96c569-0df0-42d1-99ca-244ef31b4458", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177459, "uuid": "ff7a6f74-adfe-4d30-9339-c1c14f3a0cd4", "value": "12288:wMrny90MvWo3eFSq1ByTaysvn7C4LHnEgOML7:Hyhvb3eFSqbyTarWoHL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677177459, "uuid": "9e4fc014-9bb1-4eef-9e53-d9d57782e9ae", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677177459, "uuid": "a3e6266a-c744-4c6f-8f22-40758591a64f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177459, "uuid": "d9d78bf8-8a1d-42f2-bd1c-12299fda8245", "value": "91cef2a011a8a099168a598c12b9c67c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e757f8a2-b377-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677156308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156308, "uuid": "b0b05130-14f6-46e7-8971-77282c72dc08", "comment": "Malware payload (RecordBreaker)", "value": "2bdec9cce89ecee83a559eac415e2822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156308, "uuid": "0c169be5-144e-4e15-9287-508c2de833a1", "comment": "Malware payload (RecordBreaker)", "value": "67a95e8478140adae734fd001ef1604be1370201df0c7897c42fae643730c7c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156308, "uuid": "3f7552b3-1b92-4508-8ed0-3c88dd94fea7", "comment": "Malware payload (RecordBreaker)", "value": "bf186b0cbc5cec2a631ed6b6f0359e53e52bc89b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156308, "uuid": "befac97b-2996-4392-9a90-c5edd119eb4c", "comment": "Malware payload (RecordBreaker)", "value": "0d1d6875499f1943ba00bd5fbb45e05612eb00bb52a716d88004f97e08b5a141b5daa97dd7c2d932e0c0011cbe81ec44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156308, "uuid": "823d7a06-9b22-4674-86ea-e1842f3c7a29", "value": "T1C5662373632281DAC4A88838C83BFDBC75F13E5AD843987764D679DB6A318B0D253953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156308, "uuid": "09e9ae3c-ee6e-4c86-8d04-86d93bb8e777", "value": "20fcca9c4f6d6a96b55e9305c9ac59ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156308, "uuid": "34b5ca28-5ef9-4ca8-b2bc-97fdc41b23a5", "value": "98304:5ou1p/gqwdtHsuW2h/Eu84j8621QqwqSIc3S6iR8a1sSaKlTp945S+OF/:GMplutMut7hjkHHMi6iRNaQpi53M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677156308, "uuid": "20365c27-a2cf-4fcb-8795-9fcfed4fa579", "value": 6894020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677156308, "uuid": "361a4eb0-9b2e-43b5-b00b-e62d0e947384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156308, "uuid": "4645918f-1f2a-417e-b1e0-a991ddd86768", "value": "2bdec9cce89ecee83a559eac415e2822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0187afb1-b3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677180833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180833, "uuid": "d1b634f5-a75d-49fd-8402-c06c1c4bf227", "comment": "Malware payload", "value": "afe963035eb4dfd0ffffe10af26ed9b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180833, "uuid": "d16bad92-cc90-44e8-9c04-de29f179896c", "comment": "Malware payload", "value": "683e732dc3eb7aadf5ff03f0287aba811d501b1b2b2fd61d16e3617295d17fea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180833, "uuid": "f573e4a6-8aab-4fac-8f01-6cf51b677cfb", "comment": "Malware payload", "value": "10adb66473c94a1b6b98f0d2ec308152c4796650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180833, "uuid": "e01fb531-c835-4740-922c-16c8a3ae52a9", "comment": "Malware payload", "value": "723f76f961bd6a265d636b26da2458222e1dd431f6ac49c6c05a20fe257c69d947fb1de9392358c6656242877724b78e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180833, "uuid": "663e339b-a69c-4bea-9c1d-8fb626dc8d77", "value": "T16D523A837B860DFBE6268375C4731E1AE4B6F221272157DF03B452350EA62C16C36A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180833, "uuid": "66aa0e74-cf25-4eb2-b83e-4e16c75d3aae", "value": "c278343ea71d19799459485230b15cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180833, "uuid": "52f9de8a-a6d2-487b-bfcd-9a7b16529c25", "value": "192:wBjlOgJRQyFVDKOe5QG552MOajDGExm5+xEqcmGkcW5tfW9D:wxtQyFdNG552Vow5+uWRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677180833, "uuid": "ef822651-a110-4acb-bc32-5114e3e6f127", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677180833, "uuid": "7160e58a-d2a8-47b9-9b47-7b15a0f1bb80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180833, "uuid": "689f6205-8687-4c6b-a8c3-a3cbc9f7e202", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c65501-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1677128656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128656, "uuid": "55c77f06-c0a3-466d-a995-b0a728d62810", "comment": "Malware payload (Chaos)", "value": "86f13175fc8011acabf0740eebb9bdf8", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128656, "uuid": "86fc21da-7787-4012-abab-cdaa08003495", "comment": "Malware payload (Chaos)", "value": "6b31ca6c8f2e9316d774083b38b454dd9dab046ad40760c2d35ccb417e9a2857", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128656, "uuid": "9893787a-fcd6-4f8c-9b7b-09cf0c8e2f21", "comment": "Malware payload (Chaos)", "value": "015d5aaf868337ec93dded8eb62d738499529c53", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128656, "uuid": "91ed3d3d-26f8-4a41-8377-c593f2e9f9db", "comment": "Malware payload (Chaos)", "value": "1689e7ad90bd42ef0aea4205e8a1d5705abd61ac7635f7a05ace461ea727d4a4127bb79c573850976256450667b3efb4", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128656, "uuid": "62075bc4-ad39-494b-b22b-ab1909dd47fb", "value": "T18E542C2439EB502EF373AEB54FD8B59FAA6FF7732707A4592061038A4712940DD8173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128656, "uuid": "845a1bd7-6552-43e9-b00b-8f63c24acf6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128656, "uuid": "5ff80e20-9c76-4b82-88c1-459881f7a6f0", "value": "6144:sr9mur96XZKypIHKgVWK8fHIfyUMFpOCnu:G96XZKyp2KgVWLfHIfydCAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128656, "uuid": "75d3a47c-0c27-479e-b9e7-ac007bab2220", "value": 283576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128656, "uuid": "6ecc6036-b0d5-4a58-9008-3f0b5bcbcff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128656, "uuid": "cff44bfc-b519-46a9-8bba-88fe349ebffe", "value": "2023-02-21_86f13175fc8011acabf0740eebb9bdf8_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcb5f05-b39b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677171757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171757, "uuid": "3e7a37ac-98ea-425b-8f19-da430021587b", "comment": "Malware payload (Mirai)", "value": "240d81d9c5be749615ce30076362c5ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171757, "uuid": "fb281d29-0d74-4d43-bc41-4831f8f5732a", "comment": "Malware payload (Mirai)", "value": "6f5f6ba6c55ce93773878e0b320bc45bebe7939cb516bf2d22cde276ff7ddb37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171757, "uuid": "a0d30e74-adbe-4db0-991f-c3ccef1e1928", "comment": "Malware payload (Mirai)", "value": "2240b66e8c211e0cafc484418a575adea060ce62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171757, "uuid": "7986f356-946c-4253-bedd-eb73256d92c0", "comment": "Malware payload (Mirai)", "value": "3d3f2c2f50fd6892486aeccce7aba3a3daa4d044bd7e7efd5aa7a80fff29390dd0e2c32c46d446c4b86a2f3bf22ef692", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171757, "uuid": "71cabf65-8638-4505-b475-05dda4165844", "value": "T1EF638109BF604FF7ECAFDC374AA9275524CD641A21A83B397934D818B34B64B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171757, "uuid": "7823a179-0dd5-4320-91dc-fb64b35981b9", "value": "1536:EU9FiGVT9h6nNnMD3h421FtEjL4NmZB7g2RK7:EMFiGVJhWMDk48W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677171757, "uuid": "4ba31093-0816-459d-a03c-ee60f574655e", "value": 67560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677171757, "uuid": "a94c0c0c-105f-467b-bd5c-3ccd202933f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171757, "uuid": "62b1c233-d2d1-4883-8226-1e085cb4b280", "value": "240d81d9c5be749615ce30076362c5ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316dec7e-b394-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677168458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168458, "uuid": "f0909f3c-02b6-4f9f-a6ca-e0d41ff9c58b", "comment": "Malware payload", "value": "7c912e129b01ed2c52a1a2afe5843215", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168458, "uuid": "603a9b1f-c765-4c78-932d-6f6ef93380da", "comment": "Malware payload", "value": "6f7bcbe28571449c7afa14bf87af9fe16d9addf58e2da6ca63740a6b52e8ad68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168458, "uuid": "5170f945-96ec-4cce-bb16-f633acdf40b3", "comment": "Malware payload", "value": "61c4173f83bfd8daa8156a317ebc49870c655bdc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168458, "uuid": "274c292f-f1a4-4465-8890-fa55d7b407ab", "comment": "Malware payload", "value": "c9f7d295a3c4a087fd2bb1165a5b19a224532ef0dc9a097117d8f5d80a2e4ad2c62f23a04330c59ddd126c85b3c5abe0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168458, "uuid": "d1e2ecc7-a366-4710-9f9a-ef788a8f7f61", "value": "T114F40B38B8F8405B5C052DE6AA3D7D78E5203D3DAA45495BD1642F9C6283C7BEE2C372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168458, "uuid": "d376d2e3-8b41-449c-8762-d00700ba17ce", "value": "6144:oQkgbJ850zrUjvaUyaFi+K820goSJmcQEk8klK++u2xCOMbvazmK0i7UuHVHM:oQk5QJ3pk0HuVO2jXP+VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677168458, "uuid": "598601bb-0750-48e1-843a-fd93cc8ba699", "value": 759880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677168458, "uuid": "e717ddd7-5953-4901-8f97-267b26e5313f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168458, "uuid": "91e5321c-77e5-42b1-9cc7-779a2aad1d77", "value": "Invoice#IL2-1752-S7-1.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fb186f-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677142028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142028, "uuid": "7ae6b641-2241-490c-b0ed-62b0497eb818", "comment": "Malware payload (SnakeKeylogger)", "value": "c0fab2349c94340677c7183e4ddf0dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142028, "uuid": "5432ddf5-3add-405b-a523-6246641a6a6d", "comment": "Malware payload (SnakeKeylogger)", "value": "6fc39fae12e7820ebca91a201bca578afd3c9b02539f42927cec1d61f362827c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142028, "uuid": "65e35f96-4481-4464-a7df-80f30741b77d", "comment": "Malware payload (SnakeKeylogger)", "value": "9f1ac71aa9bc91a73f6bd059d400733272879c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142028, "uuid": "b9f9b13b-cd10-4127-8373-f630f75ba674", "comment": "Malware payload (SnakeKeylogger)", "value": "4be63bb972d75525a1ed9c997a91cc8c6e9fb61f60fc0c75025a6a3e40a959e2dae1fdb9d2853790bb4e907304884ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142028, "uuid": "b91ea3d3-9e28-44e6-b14c-ca8019c9a651", "value": "T10A45AD8BBAF0A036F99E41BD063956CF1E31A293714CE2265F3B79488D46DFBB1D8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142028, "uuid": "7f53e6ad-9584-4adc-9607-40c7c0b4418e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142028, "uuid": "99c3bf16-1f71-405b-bde7-246bce030b39", "value": "24576:o1f4yIfo4Q6mQRuH0rMaykZz8qETBauC7ky3VtJbUKYtqqCtcu:oPA5VrMoZzsguck2VjbUVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142028, "uuid": "a9cbab10-05ee-4252-96b3-77382f5bc85a", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142028, "uuid": "40e6f24b-dc9e-45cc-99f7-afc63a86f100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142028, "uuid": "e29a163d-f222-4bd6-9bf6-9c90686ac00a", "value": "rooming.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2a4320-b3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1677184824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184824, "uuid": "421515e6-4538-48db-9b56-3533af6c310b", "comment": "Malware payload (CrimsonRAT)", "value": "9b75e3e28f95345937f507b281e2a32a", "object_relation": "md5", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184824, "uuid": "c8251f17-6dac-4e3c-82b3-014f8ba4fea9", "comment": "Malware payload (CrimsonRAT)", "value": "718137900e59dd9dd9f3582bfb6841d27955484b47290b94ec5316317e623aec", "object_relation": "sha256", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184824, "uuid": "9e1b6f42-094e-44c8-a476-fd94bdaa2ce5", "comment": "Malware payload (CrimsonRAT)", "value": "36909a5b5a0c8355eaa649af2f9136a7689d1cd9", "object_relation": "sha1", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184824, "uuid": "929d9673-0dbd-4980-96a3-9b07fa75cdde", "comment": "Malware payload (CrimsonRAT)", "value": "16d5f3ff0067b82d80c5037b89b215b3f0ce5e6abc10bfaf0dc218aaa9992c35371b976a047bbbefa7d768d7de35a529", "object_relation": "sha3-384", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184824, "uuid": "ca09a459-6500-46c8-876d-84aff58b2a7f", "value": "T1D4A6D88577F943DEC06DEBBB84520189D6308253BE12C65E28B4146E8D923DD7D0EEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184824, "uuid": "83f7e354-8e46-4a39-aaaf-fdeafa8e9021", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184824, "uuid": "20d8121d-aae1-47e3-9161-e775a11d11a5", "value": "1536:DI0GoA46YNd709zZQEu3FMLIpUmY9f+9Nq:c0GoDPD09qEu3Yvvf+9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677184824, "uuid": "334c6fa5-5143-490e-9ba6-21e8c9634ec2", "value": 10139136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677184824, "uuid": "c6fa325e-a530-49a1-9ab1-74f425412f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184824, "uuid": "0b7e42c7-14d8-4560-8663-75244381f530", "value": "9b75e3e28f95345937f507b281e2a32a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ef59a0-b399-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677170833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170833, "uuid": "fa2c9b83-2d03-4000-b492-f746dcdbe1bd", "comment": "Malware payload", "value": "75b5ea20b576d353e05c273c32d7f5cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170833, "uuid": "92d346f4-52ad-4f45-9f96-3f6919351b3f", "comment": "Malware payload", "value": "73d7458f2325b5cf6ddc5bd22fba550654447ca0086c77e72bfebe909ae36541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170833, "uuid": "2d881abc-f197-4ee6-9230-ae4dfad436b1", "comment": "Malware payload", "value": "b6d04d11a840191522280dec62fec4fe32bcc498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170833, "uuid": "c01fdfca-6396-4a59-a83f-b3405772dee0", "comment": "Malware payload", "value": "c75294dae922d08d8cfaa1e535febf38ce16ebcb484e4db45a4fe932c94deabcc12825547b65fa6d59801fe55a913597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677170833, "uuid": "bcf7197e-b4a3-4cdb-b3fb-1c165a97bb78", "value": "T1E2B633B2320004E1F87D4BB72EC6EA7759EDBC7F0AC4598513DC35F4497322099ADA6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677170833, "uuid": "ebe70765-ba14-40f0-87a6-128a93f220af", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677170833, "uuid": "424e0fe9-670f-4be9-b499-d10cd14b66c1", "value": "196608:4OenwPwnjMeNFiFJMIDJhgsAGKs4u0RFT1o0W8/LahmytUh4UtJE+:dwwPwnf0FqyhgsaJBW8kg4R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677170833, "uuid": "8e4395eb-e7cd-4322-9b40-61731b3e23aa", "value": 10846140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677170833, "uuid": "0ace5eb8-49f2-4f86-9651-da2fd6b5db2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677170833, "uuid": "57bfa5f5-a37e-48f0-95ab-3a45a7887238", "value": "gpt-chat-setup_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565ee605-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192142, "uuid": "1b9bafe1-3c1c-4c8d-a568-cc492f0dad99", "comment": "Malware payload (Mirai)", "value": "d3ce9eda4a4a09dc9cb69c2e242bf6a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192142, "uuid": "84a85ba5-2d2d-4ba0-8613-b88c7e59a7cb", "comment": "Malware payload (Mirai)", "value": "7419957eee5880113a10904032ed4a3c8968efe7a9461fb9c13e490cf9b407ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192142, "uuid": "575ba330-2946-4e96-b0ce-2a144de14e2b", "comment": "Malware payload (Mirai)", "value": "dedc245981bec1aa09c621bd5928662e8dbfc9bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192142, "uuid": "0d4b9755-1672-4c65-af88-92acf1a173e2", "comment": "Malware payload (Mirai)", "value": "886c2188ed7c37af0e580de3bdb06499dbae5c195af9d1a95fd5b6da875ecb8dc1f15d691435a73496ac6bd8dcf74164", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192142, "uuid": "3d48e824-b312-43dd-8c43-7acce25f71f9", "value": "T110B2CFDD61443084CA8D7C7C1B8D4A664F6CA190BAED9F16E350CD98B3BEA4B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192142, "uuid": "08177a3c-657d-4f44-a931-0b42137557e9", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp5RZqSWvy:4QlS07FUXqIYSXQKqu5XqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192142, "uuid": "35f12939-3a66-4a29-aff2-2ed9c85acc8c", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192142, "uuid": "88423a64-816a-4e0f-8800-75b010a01a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192142, "uuid": "0f564095-0050-4591-a673-dc7b1b913c3d", "value": "d3ce9eda4a4a09dc9cb69c2e242bf6a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ced3cb-b36c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677151492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151492, "uuid": "f83aceac-209c-469a-a757-dadaaa2929e5", "comment": "Malware payload", "value": "fc9582c1210c6b67e2fb89a0eee64689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151492, "uuid": "278b0a82-57e0-4a46-aa13-cfaf2bd382bc", "comment": "Malware payload", "value": "75141e7addc7952332872c6995ddda4325b0f383d17fcec15aaa7d3a9fb6c5a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151492, "uuid": "0bccad7e-215c-4ab7-b62a-0e08a56e9a61", "comment": "Malware payload", "value": "12350aa6223e1a52a3afeb87fa23f44e69887af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151492, "uuid": "da193637-503e-4331-91c9-43efec5bb649", "comment": "Malware payload", "value": "7094926916e83e4dbbf77cbb94e1d65399b88c5f4b1dac017b2f79e1e6223b57542bc00a78faa8a73f4da7a14344e37d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151492, "uuid": "cf8ebac4-e956-46f2-8527-dfe9c6cdfe27", "value": "T1FE745C17766919F9C06BF3BC85838A02F7767C5203618ACF03F122762E672E69D3E654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151492, "uuid": "56362433-1875-4b98-b88a-06ba98f900ad", "value": "258b541a0269916ea981a57aeec367e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151492, "uuid": "241e6b3b-c442-4f18-819d-13328252f3c4", "value": "6144:g8EJN2g9rr+xvW1q8Wos4ukKG2evduXIOe1ijH:1EJEgxr+dsq8jsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151492, "uuid": "42c02c2d-9920-4922-bb71-ca91bdfd36fa", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151492, "uuid": "ffd5df4d-7341-4052-97f5-9b61ab3bf74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151492, "uuid": "acf464bd-fc3f-455b-90c2-b8e96e528e59", "value": "fc9582c1210c6b67e2fb89a0eee64689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202e43e3-b3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677177448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177448, "uuid": "3660d50e-d07d-4983-bcfd-9194fd5dbad2", "comment": "Malware payload (RedLineStealer)", "value": "5592710c0db3be31a923e0e281f1d024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177448, "uuid": "7c6d18cb-f428-40ce-b5ed-e8e501e452f9", "comment": "Malware payload (RedLineStealer)", "value": "75fe3828ff3ab874cb754dc3d5852ad90944f8c05bfd7226652872d391e0613f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177448, "uuid": "51e32983-a0a6-49df-a5c0-b8e77ac9a305", "comment": "Malware payload (RedLineStealer)", "value": "6bd328decdcbc22da15808aec4e8ee799ea93f1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677177448, "uuid": "d91a0741-7c35-454d-af33-893d93bc3137", "comment": "Malware payload (RedLineStealer)", "value": "9654f85a724045e852e6bf7274f4b2819ff74f35021c2c5a5edd29013864dd037b4d9fcdc3cc9e4cc223a07245fac906", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177448, "uuid": "16aa8980-5b98-4cdb-9298-4c14a385ba7f", "value": "T1F294F207E7EC8022D8F5577019F607D3063ABEA06B3C86A6374F5D2949725B0BA3572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177448, "uuid": "6ae26218-4c7c-494a-b9a4-b18421c303f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177448, "uuid": "1033d194-472d-48b0-9996-92f1ce6b8a0c", "value": "12288:AMrYy90AvWo3eFSq1ByTaysvn7C4LHnEAOGfA:oyZvb3eFSqbyTarWoHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677177448, "uuid": "a9d4d527-28d2-448f-a2d5-a8ba281cd249", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677177448, "uuid": "530106c0-0265-40e0-be2f-2f02882d8e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677177448, "uuid": "68efe368-e56b-45d0-8163-2e9943155966", "value": "5592710c0db3be31a923e0e281f1d024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5f6363-b360-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677146307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146307, "uuid": "b089e02b-b9b4-49d7-b8b4-9e8665e59b54", "comment": "Malware payload (Mirai)", "value": "7c4a9e2f712cbb9d9e7bb6ab85901baf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146307, "uuid": "b7b2d611-68ff-4402-8cfe-29346b7f08c7", "comment": "Malware payload (Mirai)", "value": "76e53006d318f6a95a0cb9164caf3b508da910ce5b582680893080a1d0b08119", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146307, "uuid": "89d5afbd-48fd-4348-b3cb-a48d955761b0", "comment": "Malware payload (Mirai)", "value": "910727a0d4a8ce0fa4c3971a1274486b16f1429d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677146307, "uuid": "f5786fa1-0eff-43be-9825-193427b0ee4f", "comment": "Malware payload (Mirai)", "value": "14eaa4e0af900928417d5ae9fdf15715f6cdb6fe6f38d8b54645911c9163702e271d0187e7c0eea2c8f9a39a689c95ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146307, "uuid": "237a6d95-c0b7-4564-a76f-ec4eca8fafcd", "value": "T10BD34B46FB808E13C4D517BABAEF41453323A764D3DB730699285FB43F8AA9E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146307, "uuid": "458ec6e5-cbcd-42f7-b750-b4649367ca6b", "value": "3072:MTzkjIGO+TTkU9hLk8zPnbUAmpIlpsHc8KE8gZVM/9yiBqJ:okjIoTk4hLrzPnbUAGIWKELM/9tqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677146307, "uuid": "80a49187-40e8-46ff-9f46-489266151332", "value": 133857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677146307, "uuid": "e23b6da5-af5c-4ebe-baf9-294790a4b476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677146307, "uuid": "f332ba68-1f0b-4fb6-a10d-9c002d43d2cb", "value": "7c4a9e2f712cbb9d9e7bb6ab85901baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07edfdb7-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677158510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158510, "uuid": "67a60d30-bf7d-4d7c-9fe1-aa56c0659f16", "comment": "Malware payload", "value": "ca368ee7d23ae429b00fc1f845e72295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158510, "uuid": "3a034d21-5838-49ff-89fa-4ff40b17402b", "comment": "Malware payload", "value": "78747d888058d1338e27d57baf5064e6cd43aedad423be6442f71e2d4167f66c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158510, "uuid": "b85959d3-7078-41ef-8348-03392d331398", "comment": "Malware payload", "value": "621f974b2ab75c37cfa7e4d9accb34931fd3e27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158510, "uuid": "cd2eb75c-a975-44b5-90f2-7d69003ad9ab", "comment": "Malware payload", "value": "b0900cf6157bdb50acb17740b499f0137042a34de4132b1c3285622f28ea11c1d807b7924dfc45f67264cb4af36386d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158510, "uuid": "8f7d8a68-d7fb-4e80-95c4-2e2710c23d11", "value": "T124254B9963EC43D4DA76E072EA128607DEB37C8A0674BB1F0DE07A756F33660161E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158510, "uuid": "e33ab1b7-fec5-4cd7-984b-9624b6b20e49", "value": "161c85364c462057ba28801ac1ad5404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158510, "uuid": "8d27ab7a-c9c9-413f-ae61-d6d73d8d0636", "value": "24576:WfTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0HrxW:yG00SSgCmP/ZwYj48a0Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158510, "uuid": "cd527397-2437-44a1-8548-f67ce678073e", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158510, "uuid": "d36851c5-7c06-4ce9-b5df-82018db2ccce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158510, "uuid": "437257c1-d197-45b2-8b33-81cb8869eabb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7879f0b5-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1677143237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143237, "uuid": "0a41784b-96f6-46ac-aba4-5f33f72bf9b2", "comment": "Malware payload (Vjw0rm)", "value": "4a38e31d3ef1231427efec1bf45cd882", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143237, "uuid": "cfd0c335-363f-4fe2-9fc9-f7acb59c9c33", "comment": "Malware payload (Vjw0rm)", "value": "78882c274365a8fb9b0ce2402c31b4a173ea04e7645288c3a0210908533403cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143237, "uuid": "a69df04d-02cc-4cfa-a6f9-8a5356e16277", "comment": "Malware payload (Vjw0rm)", "value": "e8bea5f848779e84bbb9cc0f5585a62e086fadc7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143237, "uuid": "df7265fa-9cb6-46eb-9d4f-fdd4e4f93041", "comment": "Malware payload (Vjw0rm)", "value": "875bc48baf0f5a1fbfea03abaa3b8da30549850af04f1c541b35be49ef7cdf91b2968d67dc6e8705347ec449afd65cd4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143237, "uuid": "cc72ff0f-736c-4017-83a8-083ec7535023", "value": "T10A36C6C8BB88C8072B8D5D436F35BEE5402ED1729AAC21C3F5697ECC51F89874659CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143237, "uuid": "03275afc-905c-4c8f-80d7-8df92c1a2411", "value": "3072:OPcyNWe8yIe784AfkDT6sfndkHoa7Qr1Lqy/3OMEvDgzo5O2IzE1aYHgDhKXU/Wd:6TN1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143237, "uuid": "c869bc3e-f507-424c-81c9-25d027ff8eb0", "value": 5112668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143237, "uuid": "7a03484a-3fa0-4c6e-8705-f8ee492eca81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143237, "uuid": "d834ca63-fbc3-4412-ba15-2b1139075b96", "value": "Signode_Order No 0089079.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e93d3c1-b36f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677152723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152723, "uuid": "87179ca7-2b81-452c-b5cc-6dbe5a5944f8", "comment": "Malware payload (AsyncRAT)", "value": "0c7f4ddbd03632a937be894a7db41bab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152723, "uuid": "7776e167-50c5-45c0-a4db-a2eeb1dc32ae", "comment": "Malware payload (AsyncRAT)", "value": "78e9ff46f25960c5d0d0d7e20a2418fb724f2979c45c69b7a9272b79f2d6fa19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152723, "uuid": "af5cfb93-6dbe-44e0-8821-2be9aac05269", "comment": "Malware payload (AsyncRAT)", "value": "b2f22fbcff5dc566ae3091c6e92bba6c5274a286", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677152723, "uuid": "95a8aaaa-0cb8-4f0e-976a-fd4a58fe0ae4", "comment": "Malware payload (AsyncRAT)", "value": "e4a958c10591b582a13705f9383882547294ce56d22fbc2dcb350fd197ac7787873bab62d98481f47b3f0918b68120c0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152723, "uuid": "11ab79be-f37f-4a7b-9d1c-83811c19a012", "value": "T13034CF2AB75B5A92C9084671D1E7811443B4D3CAF333C75F35C9136A4D873B6AFAC28A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152723, "uuid": "6c1a1cc5-ba7f-4660-a040-30dc8bd58423", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152723, "uuid": "7ab0b65b-1586-411b-a224-36b1464fa64f", "value": "6144:wUXmIvLG8jD9Zbss0kG9gTJuy0O12udoEUAZn4:wUXmIv68bXJuwldE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677152723, "uuid": "5ece6cfa-78eb-4131-badf-f255a4c55927", "value": 245832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677152723, "uuid": "411722a5-800b-4b35-a0e0-09e965e239b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677152723, "uuid": "62498bca-a5b6-4ee4-92a9-bfd3ecf3f445", "value": "hsbc bank confirmation slip copy 309289281 pd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a69928c-b365-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677148233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677148233, "uuid": "5586bf07-2732-4a98-bc36-67283e4a1cff", "comment": "Malware payload", "value": "d6fcc2f5c07ec8566b751dd4030fb0f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677148233, "uuid": "8b92ed89-8594-439b-8c97-2fc02338b02b", "comment": "Malware payload", "value": "799a810fb4c0632c8f7580f156fd56adf4f16f85d4f1fab9552871ea070dc4d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677148233, "uuid": "491907e8-460e-44bf-9d67-84d26d93eab0", "comment": "Malware payload", "value": "60713a9441aa2242ca496b3ecd43bdcf48156ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677148233, "uuid": "fa471fbc-3206-475e-bfe9-645586e8a5ae", "comment": "Malware payload", "value": "4be505b9225928a7349f83b572c57c5732c979797e2e50bc559f3b83175b7eaa4bf774042eb2e7c1aca3fd696815ec51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677148233, "uuid": "bea6210c-730d-40c6-bc6c-ca18a936bad1", "value": "T15BA439F1A05854C9FAC3B738BA0386D40BAEFDF815668B2B7C5836734E35341A46C799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677148233, "uuid": "776d447e-6762-4fc0-a9c6-857f712812e3", "value": "bca2531756ba16e86c17f8c0aa6012c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677148233, "uuid": "7fac4f97-9f58-4da0-9443-34d382da62d9", "value": "3072:MWZL4SkGETU5YjAB3dQ1SkP1Sk4uF2Pn1rz11pfO1LY/5LxZWb3v3vvv:MWJVKjABhuCnVXpfO1M/5m3v3vvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677148233, "uuid": "6bda103f-284b-46ad-977b-7fb523e5edb3", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677148233, "uuid": "400a38f5-70ad-447c-ab70-c28a7c98c43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677148233, "uuid": "e72036f4-0817-4e46-8134-02fed388406b", "value": "CamMotorControl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d599bf01-b362-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677147259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147259, "uuid": "c279f447-7696-4613-84a1-a23dd0e4de1b", "comment": "Malware payload", "value": "fa0a56497394e546593c1fcd92e42b90", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147259, "uuid": "00227d47-ad10-4792-9f12-e8a28eccf182", "comment": "Malware payload", "value": "7ada7862c25979b8b5ec5729ee9d0693ee234131f207eb5c786081cc2ff2e17e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147259, "uuid": "cd52b27a-618a-468c-a99b-61e1c3198702", "comment": "Malware payload", "value": "5399e82f3d5eb3eff7356e33002cff3105b29722", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147259, "uuid": "7efb1244-9f9b-4b47-aed1-2bf5d6e80edf", "comment": "Malware payload", "value": "d056f3809dd51cbc9c667d4999f290565804c559cf8dc58a20d3b202edb1a7975f8da8a70ecc1c9032014b1a46bfba12", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147259, "uuid": "80f7d31f-51f5-4629-bd47-b76548d2d55a", "value": "T1D7E433EA47DECCD1A56D5CD70C0A3CAF93428074C88A6EE93A1967045129CD8F76ACFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147259, "uuid": "87a83669-c550-4a2e-9e50-fb4244bd3374", "value": "12288:5wJhKqzj2snmW9Q+JhO7ykoMoSbvNJOMAJm8hIWVug/AWlfqkDJMCr0S:5wiqjnmke7jotmvyMAJSWkg1NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677147259, "uuid": "9c68ba75-bc9d-4b92-be65-4ab26c8bef52", "value": 703396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677147259, "uuid": "0ae967ab-306c-4e85-9a07-629265448b83", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147259, "uuid": "7cc7e99d-7a52-40d0-b9c5-6893615bb616", "value": "Lista zam\u00f3wie\u0144 zakupu.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0ce794-b397-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677169850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169850, "uuid": "77885003-dcf6-4b3d-9c86-8d6aca335e69", "comment": "Malware payload (RedLineStealer)", "value": "43381336748053e5e9769bc1739e1720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169850, "uuid": "07a38493-edfa-4d3a-b297-37ff5c410d11", "comment": "Malware payload (RedLineStealer)", "value": "7b0d4459230be42afe4364be515b0af233acce6749f8d03fdec2b45d33a41958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169850, "uuid": "22ec0f4a-d5e6-4658-9f17-a95c23dac8a3", "comment": "Malware payload (RedLineStealer)", "value": "e5292091f2e0f0be2af60471f74f6d0d3f51e498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169850, "uuid": "03f710a9-bdfa-4622-8c3d-ea2dc13f4c76", "comment": "Malware payload (RedLineStealer)", "value": "c6288ed9c58756837247b283adb6eb9d2ca515daf56b6a62da00b69a6a67ef902723d007b1cd950a1ae052bde2a4eb04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169850, "uuid": "6a34f22b-48d7-49a2-812c-2cf7f7bdfb4c", "value": "T11254F18A43807E51F61C4B38B174A6219B78DEB61732C39312CDDDA58AB23CB4757B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169850, "uuid": "68e1dccd-03a2-496d-9edd-5c5ddfd7b001", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169850, "uuid": "d7c4fd43-3548-408f-b7d2-5573bdfc4d9e", "value": "6144:38b0AQzMzKcuTrUgDzJCuLT8Qph//+U13M:+Uz1UMzJCAAg13M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677169850, "uuid": "0d51d0b4-2326-4e7b-963a-d449263ba154", "value": 288284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677169850, "uuid": "38357143-d4a4-4506-a188-2be8d130dd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169850, "uuid": "350f2926-dd46-427a-9e5e-34c4f9e9b0ce", "value": "Valorant Hack 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92fdefe-b375-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677155425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155425, "uuid": "46ac9834-fbaf-47a0-9b18-07bb69ccda88", "comment": "Malware payload (RedLineStealer)", "value": "336253581f378e48066a6dd18c5dcea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155425, "uuid": "1827198f-d3b3-409a-9877-9d7b6fbf1675", "comment": "Malware payload (RedLineStealer)", "value": "7b8e8d674ec79b796ea7fd9925305d4a581ea173d70857def96bf5a347c2b55f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155425, "uuid": "d3d29917-4ff5-43e0-849e-907ec0a8f0a3", "comment": "Malware payload (RedLineStealer)", "value": "e6d819989da73b7898ab7229216262098ce5c6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155425, "uuid": "0e8f0ae1-0a8e-4c58-8c4d-a2e852fae079", "comment": "Malware payload (RedLineStealer)", "value": "9eafdaea04dd12aefa2e7dc70c8297a81130e16e732ba815eaeac72e627a30342a8767fdc30cc64022483c6a2693ab50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677155425, "uuid": "77d0e848-4c79-4209-b9ec-d098998e02d1", "value": "T16A455A00EF80646BF0A708378D5C4E3C47ABA712729C89AED770F699861ADFC4D5C6D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677155425, "uuid": "09bc11aa-6d16-486f-b225-8c73524c70bc", "value": "6386803ce5b01926df5975d310d21789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677155425, "uuid": "fe9000eb-e2cb-42a7-9bf7-445e7b26b38e", "value": "6144:sUjchbrYjlYRAOH1FWDk1OrR9qVB+2Wg2xL5FEj:sUjchYohY3qVBtWg2xLMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677155425, "uuid": "faed8243-93b7-4fc3-ada5-7aca5401ed08", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677155425, "uuid": "3d3f5ec6-f692-48b5-a9db-bffe16f0bb47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677155425, "uuid": "c02c3519-35a4-4b52-a578-1037ce0c6ca8", "value": "336253581f378e48066a6dd18c5dcea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2853b7a8-b3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Neurevt)", "timestamp": 1677192924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192924, "uuid": "22ebc9a2-8f4c-411e-8e00-f11bc6a5832f", "comment": "Malware payload (Neurevt)", "value": "a10dc6b42cc3fb9760bab497980660c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192924, "uuid": "82a9eb64-4f32-4916-beb1-9476a5ebfee1", "comment": "Malware payload (Neurevt)", "value": "7c9805c8b00e8154700e1cafef63cd4d62152b2ec5bec038d7e32c9f128eca9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192924, "uuid": "a407cbb4-e21d-47bb-b05e-c08167c073df", "comment": "Malware payload (Neurevt)", "value": "f33d25561d78ae7c4f6ba273582aae78f08726fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192924, "uuid": "eb573968-8b06-47ad-8023-1f156b7c8044", "comment": "Malware payload (Neurevt)", "value": "f13b79ba45be4629aa7df0c1cf3b10e429f90b7b0ec69c941d1358906deee3e7a9a2e4e7554ef873fe51856ffa74df98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192924, "uuid": "aafea911-ec1f-40f7-aa93-084747fa4805", "value": "T1E7840212B682C472D4B601F402F1D704DABBBA7107B6D4C3B79D969D8B226E2A737713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192924, "uuid": "ae0d9943-a5a9-4e5c-9c04-f9ba297d9025", "value": "9eab64d61b2f1f6b33a5d544637a49d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192924, "uuid": "c82cc7e7-2f27-4bf1-898b-95664ee2f40b", "value": "6144:TniQx54q/PzfXxbtFy9mZ9Ohnc3sHysGuiIirvdg109zMSqoL:TnVx55rfXU9mcuVhIirvdcf/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192924, "uuid": "ffc20805-52ce-49f3-ba2d-cb425702fd6e", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192924, "uuid": "f2871728-3f98-438b-b0ae-2115dc17c2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192924, "uuid": "e78d3ef3-b937-44ec-b4a0-e723257b41f0", "value": "7C9805C8B00E8154700E1CAFEF63CD4D62152B2EC5BEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69906f3-b3a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677174372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174372, "uuid": "ad7b6a44-2194-46ee-9b47-333404fd62a5", "comment": "Malware payload (RedLineStealer)", "value": "259a71102338f76f74ded0eb50a5e95c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174372, "uuid": "a7af4ae4-8ce0-4dad-8464-0e0d27bd012b", "comment": "Malware payload (RedLineStealer)", "value": "802c163bd044ab5ec2235759ba39d173905de326b2a79051a1e58853a247ba82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174372, "uuid": "08cdd5c6-76b7-40fb-ba37-33be51f1f526", "comment": "Malware payload (RedLineStealer)", "value": "6dbb4ec02d126655ebea1c36a4eef1344f1ff9b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174372, "uuid": "436419ac-a957-49d5-acbb-6a49362d4a9d", "comment": "Malware payload (RedLineStealer)", "value": "b462b44614f7192b79d0486ec6b6e5c4d5d0aca1cc8a0cb664dbf507e59d08c77209cbee8a3c02c90d788dc46754b431", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174372, "uuid": "7d1cb165-4983-4ab7-8435-08f5fc526d50", "value": "T1AA94F107A6FC8033E8B567305DFA02D30A36BD905A79939E234FAC5E18B2575A931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174372, "uuid": "7b763bfc-d719-451b-8861-d23605f134a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174372, "uuid": "9ae3ef13-6d38-4879-8e8a-ec074a005c8d", "value": "12288:ZMrFy90jZhMgDbYNLOBHiZ1nqn08Z8bfV:Iygh12LOBA1qyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677174372, "uuid": "be12ddad-9d85-47ad-96f6-b92d3eb5cbc0", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677174372, "uuid": "843e2454-5b31-4b92-b2b0-ade39b2351d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174372, "uuid": "76806c37-9947-4733-b1e8-e06b2ece7cbc", "value": "259a71102338f76f74ded0eb50a5e95c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919786a8-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141990, "uuid": "7e3e7192-9a98-4975-8880-2da7ca0ad976", "comment": "Malware payload (SnakeKeylogger)", "value": "999be50c6456ab1560f2b58c472f8a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141990, "uuid": "9c94ad2b-b693-4900-8632-512ceb8878f3", "comment": "Malware payload (SnakeKeylogger)", "value": "81d94c6c2ef79e622d1ef007c3c0be9b218a2b418833d958c20a52ae8906dabf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141990, "uuid": "9d3e23c0-7cb0-4f01-a1ba-1efe60100424", "comment": "Malware payload (SnakeKeylogger)", "value": "baf1b95d9b09e8aa3b6b3b6a0aa1aafce44b846f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141990, "uuid": "a4eb2ed3-7f8c-44c0-a488-585325d5c7f1", "comment": "Malware payload (SnakeKeylogger)", "value": "304052581b8239f498fa0361d46a77da59e3d6b123685b6f93f4d2799e123190c3db3ef0524530d6cd009a7805dfe2ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141990, "uuid": "dbe41430-dd93-41de-aa61-3af085e39830", "value": "T1A8F45A8666B09133FDDE809C07341ACF1E31B252711DE66B5F3B2A988D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141990, "uuid": "5fc6d84d-fa47-4646-927b-dcbace23b553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141990, "uuid": "f9e36ecd-b771-4df7-89b7-398fb9cc594b", "value": "12288:3J8ej9beu+8+D44XmbGurevgbwjsI6FMPDZpKL6BoUEs7SAN3V/Qmd0ScN:3J8ej9I8+DDPUevPAIkejKJbUNF/QEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141990, "uuid": "116df68a-7509-40c8-acb1-64795271f2c3", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141990, "uuid": "af8d08e6-8da2-4195-970c-44366a94d17b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141990, "uuid": "b633e79f-f107-4ce7-93e4-ccb3119e4db6", "value": "999be50c6456ab1560f2b58c472f8a19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f352d55f-b38d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677165777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165777, "uuid": "5c8db480-ad59-4c67-b150-72b0601464f8", "comment": "Malware payload (Mirai)", "value": "7b007026f40be59754732b9028ad35dc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165777, "uuid": "280e76c5-77dd-4ddf-89ff-5fb0087e4059", "comment": "Malware payload (Mirai)", "value": "83554a055a555c06f90290b7e8de23e11b1527e03da94d0a128fb2ca9648668c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165777, "uuid": "545c8782-9d20-4776-9733-09202e103f32", "comment": "Malware payload (Mirai)", "value": "72140690ebb65f82f09a4bc6de4c4aed7660d8e5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165777, "uuid": "65f05dbf-42a1-4c52-96f1-45c03d2b9204", "comment": "Malware payload (Mirai)", "value": "c994f04e720258b253efa1463f1cefcbe991a90cfc10bd4f8fe4c96687ba726b2fa151b86ab26e3689a98b993839f775", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165777, "uuid": "dd694c18-6307-4278-8673-8abd9e0babfe", "value": "T168332917A9C1C1FDC559C23443BBB13AD862347E023CB19A7BC8FE2B6D49D609E2D858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165777, "uuid": "49331add-d4ce-4c06-90ff-2572a88dcffc", "value": "1536:mSy2VYToJhFOQSsx7tsQWw0qBo9ho7E6b:42VYsJhwQSsxJXmio9SE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677165777, "uuid": "964c8b3b-e0e2-4bcd-b578-556f9f8f2830", "value": 50432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677165777, "uuid": "bed3dbd6-7779-48dd-862d-ed0ffe483e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165777, "uuid": "b04cc002-0c15-4280-a011-223839532f0e", "value": "7b007026f40be59754732b9028ad35dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e69de3-b335-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677127848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127848, "uuid": "3db50ec9-7829-4ced-8264-f310e5f7c42b", "comment": "Malware payload", "value": "da882d1154b23576f886dee8cae881cb", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127848, "uuid": "3042a900-3cfd-4bf9-b725-c78c2ed3e1ac", "comment": "Malware payload", "value": "836cd1dbb96268f267f46c20dec7ea50909184f8d163f418b95a3eee1271dcb4", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127848, "uuid": "559c5681-9ed3-4667-8d51-32e8346d269e", "comment": "Malware payload", "value": "fa34a3b86cea69093097106817ce304817dc62df", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127848, "uuid": "f1b2c21e-e8d1-4d7d-88f6-1f254757be2f", "comment": "Malware payload", "value": "21125df08c19ca00ae5eba87d124e720ac2059ef8823071dda965cd7f3465ca8826b6fd1b2ea590cb00d21963606c575", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677127848, "uuid": "e62bfbeb-58fe-42b6-98d3-ad2cbd79ba66", "value": "T1338423FB2326AB09C976B9F5F1D92DFB5B70D9C22488463F8810651C4B40AD490BFD9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677127848, "uuid": "0240c9f1-5fdc-498d-9678-9eac99970996", "value": "12288:Um+TroR/1Urv5m6ddxoBiuf+d5UKzksN9t:QrCWLPvaBiuf85bvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677127848, "uuid": "1dd70dab-5453-4916-9348-ed9689f04d5e", "value": 393246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677127848, "uuid": "ac3aad29-c24b-4767-bd37-bebc825a858b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677127848, "uuid": "ba2c50b5-257c-40fd-890d-9ce4cc65bae5", "value": "detallesXparaXreservar.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0d6c30-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141981, "uuid": "c565b837-81d8-4802-bd5f-ed23550d0379", "comment": "Malware payload (SnakeKeylogger)", "value": "6b934ded05bcbfbe0c3dd0bb68f93237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141981, "uuid": "3da69898-c0f7-4938-9628-1fc9ab3b2a9b", "comment": "Malware payload (SnakeKeylogger)", "value": "83d4d0164632ca9b57a2aae61726a5475ee601113319b4dc21ae9993e6727ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141981, "uuid": "9739fd1e-442d-4fc0-bea5-7d6c99feaf64", "comment": "Malware payload (SnakeKeylogger)", "value": "3db92a46b692cc59cb11d05f55be09437e517c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141981, "uuid": "0519501c-0601-4830-84fc-bb34ff74bac3", "comment": "Malware payload (SnakeKeylogger)", "value": "11f54465ae2aa83f55b354c2b154f424861ab09f33b702628975022768da519139d52ceff0ecb7356e174b8f9fa10561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141981, "uuid": "d525bc24-a212-47fe-8eac-db451a2720cf", "value": "T121E3291D6BF88800E1FF4A7305B15126C776BC42192ACE1D5AD1F52A2A7DB90CE1BF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141981, "uuid": "5bd616e1-504e-4c56-bd7a-5f723fb9985a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141981, "uuid": "bd2fd2a2-95eb-40da-bb74-81ff338fe4d9", "value": "3072:lAgAEcCv/IgOYrvQovxAb80dY6dTuwBWjO/FbY:OFyI65xAbvd1MOtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141981, "uuid": "d4ff8f1e-eba8-49ab-8235-028a24611057", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141981, "uuid": "47815282-2bed-46e9-acbd-74ebe68d69af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141981, "uuid": "851a53e5-8bd9-4393-a970-ceb37b0c1327", "value": "6b934ded05bcbfbe0c3dd0bb68f93237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed810459-b32c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677124106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124106, "uuid": "56fbaf6b-1d64-483b-b40a-300ae2540844", "comment": "Malware payload (Mirai)", "value": "812d6006952ce13f762ede149f0c9a7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124106, "uuid": "b8583123-4f14-4d8e-aa5e-29bc5bc84d00", "comment": "Malware payload (Mirai)", "value": "8407a95c0f2ca8603a834e542d1feaeed77a02c153b84d22eb4dd44ad5492977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124106, "uuid": "eaa543e3-6cdf-48f9-b06b-8480256e42ba", "comment": "Malware payload (Mirai)", "value": "1835e75033e55154502933e101f3e86dec5ab094", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124106, "uuid": "8321f617-19f8-4e06-8179-4525e4f95926", "comment": "Malware payload (Mirai)", "value": "4912ab493831ec1d14a713161e09e4755e2f0b9cb144aa11373f0f6dc27cc5d145e48b71c562a66b593791ded67e3eee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124106, "uuid": "c219c3bc-3f4d-47d9-ad50-37453980d03c", "value": "T1C74307C17881A626C3D05377FE5F018D33199798E1EA33568C295FA47B8AC1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124106, "uuid": "a7124288-3431-4108-bb5b-0c8ffe0cf928", "value": "768:K/9qJEBv+zFvDLtU07KuucD056SRmYKrI4ekVrZBfV7nKbwvTLwCVy/rCxHghW1A:Kq+WFbpnJYKrnj7nKEShW5i5m//zqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677124106, "uuid": "0e0be212-9415-451f-9241-129d6634c094", "value": 56332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677124106, "uuid": "1e550411-79b7-4d15-b32f-91d206599fd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124106, "uuid": "29f21102-197b-4cbc-8517-3ba9a4ff3bc6", "value": "812d6006952ce13f762ede149f0c9a7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecea847-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677142254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142254, "uuid": "f2309882-b58b-40f6-941e-1cfb430aacc6", "comment": "Malware payload (GCleaner)", "value": "bae2fda3079bd3e78c36218b5c81ef6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142254, "uuid": "6b1b10df-52ab-4a2d-b06a-b777c9aa8384", "comment": "Malware payload (GCleaner)", "value": "8477758adafcbd2f292d6a1cf38b8a61e3606eea86e9930d1e347353e26f142b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142254, "uuid": "8a06b666-5140-443e-b4b6-56334ee10461", "comment": "Malware payload (GCleaner)", "value": "140b6bdab3108ae6002d939f98523ee535d67409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142254, "uuid": "8be4a109-f8dc-4de8-8dc8-b330853f68ad", "comment": "Malware payload (GCleaner)", "value": "d938a38413a1a3af4499d9f716636f30321a770e8242eb15553ca1de186ebc7667582929563e61ddc94aada99b94e55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142254, "uuid": "89c1eaf1-c7c4-430c-a79b-fb1bd1009de4", "value": "T10754F1313CE1C032C85670345974EF95ABBFBC621AB4CA0B36B426BA5F612D12E75397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142254, "uuid": "5e8c4e4e-f47a-4f16-b3c3-471545cd175d", "value": "e7c477d0b0cb5ed685b6b07eef0bd4e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142254, "uuid": "46190e6b-73a2-4de3-a9a2-041f05711908", "value": "3072:nLO3i/CLRloASdFdJ39rpGhEqLbxPwCksldZNAe0sAgPk68CXEmJrgc3rFal0eoM:i3/LxS/dLUEWPnLZNK5gPkGF2c3wljV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142254, "uuid": "5dbe7cbc-6b73-4b72-9e85-e5d62c66618e", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142254, "uuid": "4febf67d-3ebb-4f22-a687-15af4401c157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142254, "uuid": "c40c345d-54a3-4877-aa3a-a01d8c649456", "value": "bae2fda3079bd3e78c36218b5c81ef6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a97301-b397-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677169700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169700, "uuid": "1010342a-1b4f-4198-a7dc-28bea771c341", "comment": "Malware payload", "value": "e495e44b34943ff2e827104fafd0cce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169700, "uuid": "285619e5-ad08-4d6d-a172-bc626276ee77", "comment": "Malware payload", "value": "84dda8cee2cadb15b5c4d76caf775093fcae7c8ebd6b92b3458c6cb9b4208a2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169700, "uuid": "3a9c05c7-0d33-4c67-8277-bb08d8c866fa", "comment": "Malware payload", "value": "e0199002766944123d1e34c6d707282ece0bce6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169700, "uuid": "cb35e896-07e4-4421-b715-f247f5e56ef7", "comment": "Malware payload", "value": "b8eb0fc09273c7ccf0b944ef1dc416094761e195a2e13ce25be7124880ef8cf8f22bf3ad62f6e42ad8d692f8b56ac2ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169700, "uuid": "3b0dbaca-06e6-4198-91e8-34cc0825309c", "value": "T1C0936D5078D1C472E87A29315870DAB45A3DFD711E219FAB3788127B4F312C19A29EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169700, "uuid": "6d5f1642-150c-4dee-ad34-dad81a33afb7", "value": "cfdf2acf6e3fbbd2034e45d2f46cd580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169700, "uuid": "f0eb8f18-3d30-4909-82d6-556c4bfd9d44", "value": "1536:TL2Ltv5Y19UHLoatgRDoQlvnhIKTRun6sB2VhdSb2y7aafLsWxN6vhcdPgEGC5gL:TL258iLo1xo+hIKTIn6sBASvaoMoPdGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677169700, "uuid": "3b221fb9-07e9-4664-9080-48dcb90c98cc", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677169700, "uuid": "572bd3db-7b9f-4f79-ad8d-edb59abd9e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169700, "uuid": "7059d994-857b-44f1-9734-373a64b21b28", "value": "SecuriteInfo.com.Win32.PWSX-gen.12652.23668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4796d6cd-b386-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677162482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162482, "uuid": "7aabf841-3a79-4675-9051-3facb5818966", "comment": "Malware payload (RemcosRAT)", "value": "64de769e101650cd4909cc20c0c760fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162482, "uuid": "5123bd8d-c662-4027-88ad-66f920b3d0b7", "comment": "Malware payload (RemcosRAT)", "value": "860ddead6961e24905683ff61ff9509d0915e7a549f7a6a551335c1c310f042d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162482, "uuid": "a397fb8b-5f03-4e55-a959-2518884b64f8", "comment": "Malware payload (RemcosRAT)", "value": "873f19735f7977ae3846d925e90e8d9de4bcfe79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162482, "uuid": "ef041ffc-ead0-483d-99aa-f0f0b51f2f7d", "comment": "Malware payload (RemcosRAT)", "value": "ce50b277bae5fe950e0bb969cb882082c83f32f5f9428bdd9b17cc7de0a7c7396025b64845e007b13683f4cc76952d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162482, "uuid": "a47edc3d-deec-4eaa-a13f-2618e92fbbc0", "value": "T10A35AD8676B09133F9DE50AC07381ACF1E31A242710DE6675F7B6E989D1ACFBB5D8240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162482, "uuid": "454f1166-4070-496b-b5fe-430d2dd2d1db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162482, "uuid": "cc9071e8-520c-4475-802f-846c3620ed5c", "value": "24576:oJ8ejVWQDrvFl9usxfbUp7S101Y3SvAAO2FYMEzvKRGLGj68uX+mOtp:0XD5LvZbI210CihFyv0GLGj6hX+mOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677162482, "uuid": "f642f0bb-da71-41bf-ae54-141ff998e884", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677162482, "uuid": "4862a7c7-7d44-4435-a5e3-0d3a01073e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162482, "uuid": "3fc1c388-7392-41d4-b057-6672b382864a", "value": "SecuriteInfo.com.Trojan.PackedNET.1427.17267.9871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ca151b-b377-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677155933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155933, "uuid": "30942897-9955-4212-803a-043e23d19efd", "comment": "Malware payload", "value": "1456f1102d032909ee3071fc84b1aa7c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155933, "uuid": "15445010-e480-486f-90a7-5a9961c8dd8c", "comment": "Malware payload", "value": "86c54803523b9382401d760f96748f7910cf647ae436ec51a9d0a101f45ba451", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155933, "uuid": "36b5615b-9c34-4d9d-9bcd-b49ca6e37bf8", "comment": "Malware payload", "value": "8399cd02dad87cc5ab42a089df7ba2583084e036", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677155933, "uuid": "9981f36a-7f15-4f99-bfc8-7d6461e941c4", "comment": "Malware payload", "value": "7fc3a79d67abbfa75ffddc9afe06f344f626edb203eda99945e50b2dc06d55b68471f9205f436badbd67f1cd54f348ec", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677155933, "uuid": "1eac1181-c84a-4fae-9f9b-82976aa18c87", "value": "T13956128BE709B46FC4BBC6364A7702A661938C1A8E93D7934955B23C4CB75C01F5AF8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677155933, "uuid": "e19fffe5-b163-4c83-b758-782a38cc286d", "value": "98304:enaeei8iHlDha3BJlP8w5JaL3ed7LlaYnxTbWUdWdfKtBi/UBdrQr6495G7TCVve:peei8iHlcSw5JWed7MYnpWIAGi/UBd8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677155933, "uuid": "0d9d37c1-c4a4-42b1-bfac-96d2ecc77dd8", "value": 5932634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677155933, "uuid": "430f7170-7ae6-4594-be8a-784d6e2c6d06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677155933, "uuid": "aaca9079-ed41-4bf8-9a80-f4aea9652f4c", "value": "yq5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dafc63-b387-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677163063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163063, "uuid": "35aa8220-fd97-4e8a-8638-be5440490492", "comment": "Malware payload (SnakeKeylogger)", "value": "bd1036d612b46367a00c2d1f0ea1128c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163063, "uuid": "227ce9be-1dc8-4d05-ab11-dc51ee2b5e46", "comment": "Malware payload (SnakeKeylogger)", "value": "879d23aa8e7e4f610d1b9f4ce019535cffff09b7cfb35f7b3d6d59857ab1d0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163063, "uuid": "f2687a19-a105-4770-a708-92f13c9838a1", "comment": "Malware payload (SnakeKeylogger)", "value": "4c0fe9f2ba1ff24e37a187fd1a2b4f80dfc39665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163063, "uuid": "395d788a-0f20-4bf8-ba56-770a677c108c", "comment": "Malware payload (SnakeKeylogger)", "value": "ab26882b3d40ccb8d35749bdb170dbb4f2196823b2faa6e0cbd471a7273ef5970a592f3897286abc2369afd620c9c91f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163063, "uuid": "9ee23bc0-6ee7-4700-904a-454c2f345103", "value": "T1D9057B46B7F09077F89E41AD023912CE5E31B253715CE22A5F3B79488D9AEFBB1D8211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163063, "uuid": "8fb6c315-c272-4b7a-8359-bef5f95741b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163063, "uuid": "164e34a6-dcd6-41c2-a1e8-f5d4545d5478", "value": "12288:TrDrYwYXyQBofAAZ6uMLyKUwQjMsASF74pnl7wpprt+Gf44Kzl+dtoPu:TrPYRJZTyKUwQtFHprIGf44KCtcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677163063, "uuid": "827b35ac-8e3b-4e4c-9f88-d79527fd75df", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677163063, "uuid": "abea2af2-bc96-47b2-8596-741879fc688e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163063, "uuid": "d9a354af-64d6-4f63-9c2c-067f5d25a9ca", "value": "Allaire Project FA2232023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac8e5c5-b3b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677180580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180580, "uuid": "51d6a0d4-2eab-494f-b1cf-54311d6e2cec", "comment": "Malware payload (RedLineStealer)", "value": "f2476773b5b834497826dbf52b3453cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180580, "uuid": "57535596-65fd-432f-8612-ab678806ea45", "comment": "Malware payload (RedLineStealer)", "value": "879f2f1584ebdadaca8f645280dca1b17b03a40f587b8de875e1f86b451fd3ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180580, "uuid": "2954cc02-323c-45e6-89a6-3dab63cb8383", "comment": "Malware payload (RedLineStealer)", "value": "b23d4823c433b95b16ca1827f95ab3bf4d61a3b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677180580, "uuid": "de1481c8-31d2-4a26-a4e9-e473cd7ee893", "comment": "Malware payload (RedLineStealer)", "value": "4d801ac1b90917b8f40581afb4c5692cd50a8205dc7019a9aa8105f64cde86fa850e16b2972851c0986e6582ff0f3065", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180580, "uuid": "a7bfa5de-b939-4dd1-a089-33cee07cec64", "value": "T1FB94F147E6ECC072E8F4577019F607E3063ABEA06A384766364F9D190C725B5BA3172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180580, "uuid": "1d5fa1ce-7c75-4eef-8b27-4f35a12aaa18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180580, "uuid": "c4105356-cf81-46be-8381-33763e6c7365", "value": "12288:nMr3y90+vWo3eFSq1ByTaysvn7C4LHnEgOML3:0ybvb3eFSqbyTarWoHL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677180580, "uuid": "528a738b-960d-4ca3-97a2-b105c20e8222", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677180580, "uuid": "038ed1a4-4979-4f60-bdd4-df56b65a69ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677180580, "uuid": "a9fa40db-c4b0-4cd5-ad61-4dffc3ce1ee9", "value": "f2476773b5b834497826dbf52b3453cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a254b94-b37f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677159614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159614, "uuid": "6fe78cf5-53d7-4e2b-bc41-93ec39b2f81c", "comment": "Malware payload (RedLineStealer)", "value": "49e00f632d5bfcdeed46d97002ea80d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159614, "uuid": "daf93377-a222-4315-b199-63ba30131494", "comment": "Malware payload (RedLineStealer)", "value": "87b73e834c2705c1e20ad08ddce868a8703a0f27d2e7749863bc06f55d0cfe14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159614, "uuid": "cceca5b2-75f6-4c61-bbf6-f26babe20871", "comment": "Malware payload (RedLineStealer)", "value": "4f7f44cfd8b75363737925e0e9b81bfe52ea5573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677159614, "uuid": "7ab47bea-00d8-4b79-ad7f-c7468b928435", "comment": "Malware payload (RedLineStealer)", "value": "b6cb9fb9584fe31e52edc33afbf94b094267322cfab176fcc93d568c1fd3f96289177bd96a1aa0fecf8d906c929dd25e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159614, "uuid": "e210e215-e969-4490-8d99-3fd6621aa36c", "value": "T10E44D8512FD04AE7EAA38EB76322D16DB11A447D960F1B5EC36AC9E1433434413B86FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159614, "uuid": "21927567-85d4-4d0e-86c7-b91501ef755f", "value": "4daca7182a967075c4a8cd470c438efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159614, "uuid": "0ba1ee23-9844-4d64-bd91-e76f1676fe87", "value": "3072:ntPh97ZRVptnGfx+iWTbyNiOvYJZXoR40f1wHn91WcVfFU:ntUf0iWxvMz1Q0c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677159614, "uuid": "d89a0c89-ece0-41ee-8ff1-afb9651b15da", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677159614, "uuid": "595a02a1-fd43-4c7f-9dba-bc45de84962f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677159614, "uuid": "fcc69306-ac1d-4869-ac56-4fd8ad003ac8", "value": "49e00f632d5bfcdeed46d97002ea80d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343ae5a4-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677141834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141834, "uuid": "beb01ee7-9530-433a-bb89-93c3c7e701bb", "comment": "Malware payload (RemcosRAT)", "value": "9471268066c94dd2b1c6b175078fc152", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141834, "uuid": "afbf3014-d420-45a8-b085-316813a1f43e", "comment": "Malware payload (RemcosRAT)", "value": "87eafed52359929755acdc011856239ba2ae55e88f76ba1b7d0bbbdc5c6b156f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141834, "uuid": "2a9242e8-fcb5-4813-b0d9-e264a077b48f", "comment": "Malware payload (RemcosRAT)", "value": "cab6967ef853d5bdd192686f4861a5d60b6d7330", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141834, "uuid": "c792ad77-5dd6-4aeb-8ddb-7072f9e6400c", "comment": "Malware payload (RemcosRAT)", "value": "637ff53ae29a68faa6a219491f54bf423698f08cfd9222cb0e785d184a572aeb690c16ec34468f19f7c41bd16989e58e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141834, "uuid": "64daacc4-2531-4e61-870e-74b4a8039346", "value": "T14FF4237A2D845F0BE7C75A314E4054796A820A88D83EAC7912F31573C9CF7B2BB9F244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141834, "uuid": "6187feb7-63f3-43b3-992c-223929b7e48a", "value": "12288:rCtA9qhVQUKbgimcUHvaBsu9htGj0ismIxw5hUm2qQP2dYarqSsuYYOQXcIejZmD:reKqhC0HaBsu960is37qa2dRqSaDNbmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141834, "uuid": "70d668cb-ed77-4f4d-aca0-99955b3f12d2", "value": 767988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141834, "uuid": "1a86cf74-244b-45aa-8b8b-3547a4c55536", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141834, "uuid": "03063ba7-9245-4fca-9631-e97448851c54", "value": "BLXCONFIRMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24007c52-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677158557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158557, "uuid": "cc14fb51-1c54-4c0a-993c-7c6de434f832", "comment": "Malware payload", "value": "d13110296c7f4c0e1b2742ed32039b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158557, "uuid": "747adf55-f8e4-4629-9d43-228e6c310a78", "comment": "Malware payload", "value": "88b360daf8d045817045dc5f4332c4236675bf5ef493e291ebc73acb189ca397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158557, "uuid": "e36a3e3d-78bf-47a8-8c0a-d99d46477ea0", "comment": "Malware payload", "value": "1cd9e1faa94e35356b0b4e3b939d983f9ddd5e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158557, "uuid": "16084547-28b0-4079-88af-3b1a86f7daeb", "comment": "Malware payload", "value": "99c422fd301b7ee5eaecf33e71f30da4ce9c39b4f92940e88b6b3db84f3944fd683a52947d91ffb203ca53b0ac92112a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158557, "uuid": "bf036ef1-49cb-481e-b163-3c87b2a222b4", "value": "T194255B6923EC43D8DA76E072FA12C707DEB3788A4674BB1B0DE04A762F13671161E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158557, "uuid": "e937c3da-b8d6-4c85-95ff-3a84d923b8e3", "value": "161c85364c462057ba28801ac1ad5404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158557, "uuid": "14dea6bb-692a-4784-811b-a9e48c40aa0b", "value": "24576:RfTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0Hjk:VG00SSgCmP/ZwYj48a0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158557, "uuid": "03c8c46c-7328-412c-9c1f-be881c26f723", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158557, "uuid": "0850ac36-ecfd-464a-ac39-8bb70dcc8dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158557, "uuid": "33a9dd65-7cac-4937-81bc-eb051e943c0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b192f1ca-b3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677173827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677173827, "uuid": "31ac73cd-7bc9-4b07-86d4-ab265f9b023f", "comment": "Malware payload", "value": "c40a8ec75d069fe91102223e06a24bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677173827, "uuid": "5b9e8055-8a7b-435c-bf3d-a6eff0c2fdf6", "comment": "Malware payload", "value": "8976a7d1980cc99b92b4a3ba0c83ad646c2db902ad128bcacf31eaf3e14f36c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677173827, "uuid": "807f10f8-e029-4397-9c22-0771412a4ae6", "comment": "Malware payload", "value": "00e2b4807280617bb1b72f16cffa6ca2778c6f47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677173827, "uuid": "51d36470-52c4-4beb-bfd0-079813524bc4", "comment": "Malware payload", "value": "b819c9baae099db2a30e65ec1815f1f06741ea209edba7dbf13839c13e10006887b68aed13ccfc450b3d0c039eaf7e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677173827, "uuid": "95f6c52a-a219-4b43-970b-9cb7543886ee", "value": "T1FB56D001FB97C1B1D96301B5046A931E9ABAB91507308FD7E3D81F1F5E213D26E3B29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677173827, "uuid": "0ad44477-c2de-47df-ac3a-045b0fed02b9", "value": "217e74e7aaf3c3c7f50580b08cc60724", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677173827, "uuid": "d1aa055b-be4b-45be-bb75-5b5bbcdd9241", "value": "98304:zEPtDCuJ5u9R4gkBPuaZZk8ymjcvnvXUU7uSmnhRZQZW:ECuktaZulnvXtDOhRsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677173827, "uuid": "8c2675ef-db26-409c-9032-c8fb84a5c680", "value": 6101352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677173827, "uuid": "cd828734-9248-400f-8c90-99973c62ef4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677173827, "uuid": "c2fb8b40-fdbf-443c-bf9a-1f2672fa8eb1", "value": "ECAT_20221109185002comprovante_pagamento_636bf65ac8c99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b13fa-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677142275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142275, "uuid": "d0a1502b-5097-4976-9704-2843cb9daf5a", "comment": "Malware payload (Smoke Loader)", "value": "97b9e5a042f1e7a2bfde4d4fe73c49e4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142275, "uuid": "e70baf56-fbda-4a8b-b389-f1ef76f7c9e1", "comment": "Malware payload (Smoke Loader)", "value": "8a7d1fbcf94d9893fdf8cfc28525dd77c328d4c9e24486b3bed38c12a151f878", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142275, "uuid": "f0703765-dd03-4614-9075-e71db9082fd8", "comment": "Malware payload (Smoke Loader)", "value": "321cbbce23997d77e71cede025c8e30044d82784", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142275, "uuid": "11027cd3-c16a-4513-a668-25f8fcb1a96c", "comment": "Malware payload (Smoke Loader)", "value": "9363f7788adbfa15507622dabd1f6b51b7335a14291bc330961858579285b9d64d4a64471f024b25c728e34596891b6a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142275, "uuid": "8724f303-7b59-46c8-825d-6d360dad8caf", "value": "T164250106E285C92BEDB34570A447548382169C6DBD59CB4A32C7732FA7327F10E7BEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142275, "uuid": "31852a90-7a1e-4726-aa83-775c3ac45813", "value": "24576:RFeCiaFeYLFRT5AmkmhYnea18TGB1rPXXzXXXXXXXXXUXXXXXXXXXXXXXXXX1J:D91fflYnr18aBIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142275, "uuid": "be37a864-b0f1-4c75-a858-7253b11bd7ac", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142275, "uuid": "6f6262e5-7877-4ed6-8a52-083558f8bbdc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142275, "uuid": "b63017ca-7587-4222-913e-93a03f05f28d", "value": "Order VVNC03023976.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a42245-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677142474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142474, "uuid": "5bdbcf49-259e-45ae-8931-441a12091151", "comment": "Malware payload (GuLoader)", "value": "903cde8a278d4c245e330382f7c1d1cb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142474, "uuid": "a8a87075-75f0-44d8-9d97-69de930dc15b", "comment": "Malware payload (GuLoader)", "value": "8aba632054b6b32ae733438f5facf421683e12b17ac62449318e7e4a7c4b9572", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142474, "uuid": "a69011da-1ca4-48e0-9b70-fdf8cb4c004f", "comment": "Malware payload (GuLoader)", "value": "ef820f0a8e16265b8da3ca4faa21528effd64ee3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142474, "uuid": "4fe3d7a1-9440-47ff-b04c-2f769ab3164a", "comment": "Malware payload (GuLoader)", "value": "76961978b9392126929940971fc8fe53d5570c3a8acb9064216172ab5662ebf13947bda51e180edecef6105c841f6780", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142474, "uuid": "49b5c036-6c89-4703-bf59-20903d729f3f", "value": "T17EE39D309E1506844E8B27AAEE461EA4C0394D7760225C78BDEDBB5E3D0631CE67F61F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142474, "uuid": "e2594ca4-f144-494a-8280-01fc9acb376c", "value": "3072:M4LiioNPtWNtfZlO3ZZbjRqFj1YgQLZwMByuDzNUzdfAIp:MeBgPtWv85qJ1slFYxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142474, "uuid": "fdfc36b9-1040-4972-a5f5-e2c8445d940b", "value": 144891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142474, "uuid": "70309333-99ff-41f3-941e-430f165859a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142474, "uuid": "a8caf354-b453-4763-887a-11d74c567300", "value": "EUR 123,730.44 20230222140234.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d860bd-b317-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677114755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114755, "uuid": "fa6fb1ef-70f6-415c-9d04-abf4372edf6a", "comment": "Malware payload", "value": "8830fe90dec02baeec496b9de8fef5af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114755, "uuid": "a07ce78d-6f30-4fb6-8090-fcdc3a217f9d", "comment": "Malware payload", "value": "8b47a00cbbb80e93fa4967fefe91cf76c0ebf6ddb50b49c488a86f00208bfff7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114755, "uuid": "018ca842-b222-4c13-8cfe-ad752a11b27a", "comment": "Malware payload", "value": "92f7dec08c1d03b94bd46da7d5a26e86e8a0448e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114755, "uuid": "17400dbe-9241-4df1-9983-e8358d2f5c0a", "comment": "Malware payload", "value": "6c4bc5415f669208a7bd197f92834fd7df1274b559fbd9191ffe3e13b29598f2d4c7d82183c74f7d1f8cca6e06a9b17c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114755, "uuid": "887bf348-7841-47b8-8c22-11ba40023701", "value": "T1B1251280A2A9C756DF6583F565B2800013FAA53FD521E32D2ECAF1DF35B276182057AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114755, "uuid": "07c1e1e2-4786-4611-9e3c-80f6caf04760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114755, "uuid": "fa09bf53-7ee2-4542-92d9-ae2687902743", "value": "24576:z1QwfK8yG7WrfdF+zEWkLQXqxO7O8ZNrYE:zxfpWpF+zEAXjcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114755, "uuid": "25d3d841-77d9-44e0-a151-5296966da6c7", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114755, "uuid": "494758c0-24f6-4a78-9520-b8cdd150e2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114755, "uuid": "240c1a9d-8adf-47c1-9269-d246d7a2dfb4", "value": "8830fe90dec02baeec496b9de8fef5af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19cc999-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1677128810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128810, "uuid": "b17c3199-0a08-4e4a-a4fc-4cfc85442640", "comment": "Malware payload (Chaos)", "value": "7db89ef8195831eb737b0a13cfbd8c60", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128810, "uuid": "0e77a4a9-913a-4f40-86db-fb75ea9d90aa", "comment": "Malware payload (Chaos)", "value": "8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128810, "uuid": "ef817aa0-27b5-4962-9b94-cb3d2c2b956a", "comment": "Malware payload (Chaos)", "value": "3c8d54c374bda8cc955cfc7477f9e385f24e9592", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128810, "uuid": "8b413a4f-db49-4d44-9931-23adaae345c2", "comment": "Malware payload (Chaos)", "value": "8f6796799608561132473488967a29a263ab54b143bca120e5724b12cba51c7eef9360e22851e7e7d65dcae00aadc6d5", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128810, "uuid": "a1809c30-9460-41c6-8796-8f5d4630c204", "value": "T176D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128810, "uuid": "dfec998f-edbb-4daf-b8c0-b2ede2842d44", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128810, "uuid": "fbbc97e7-0837-4ca7-aec6-e87b5954eec5", "value": "24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEzQ:BSy6PX3PpM+P5IdYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128810, "uuid": "3ce2ebff-5aad-44d3-9004-1ba906c647ad", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128810, "uuid": "a100f636-f0e7-409e-be0b-69fef5cc3301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128810, "uuid": "29258bd9-4dba-4b1f-ad9a-d23854e73f79", "value": "2023-02-21_7db89ef8195831eb737b0a13cfbd8c60_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34162875-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677143122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143122, "uuid": "38b1ce38-47a7-4b2f-976a-66c9e4d2365a", "comment": "Malware payload (Formbook)", "value": "919c0f851b252a6c834b5ba9470e6c0d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143122, "uuid": "426cab15-a1bc-41eb-a0b9-d36d5338afc9", "comment": "Malware payload (Formbook)", "value": "8be101509461d8954f93b6898c1fe407f6a95c78de3b64392e5b785ce55df5b0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143122, "uuid": "149f34bf-289b-49c1-be26-83e538292273", "comment": "Malware payload (Formbook)", "value": "df40f89bbc105c96aa93ce2465a3ed06cb7e065a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143122, "uuid": "42b2af47-aad9-4669-a91b-1dd7617a9d65", "comment": "Malware payload (Formbook)", "value": "b19cdb009bcf2076c0c80f58a9ce9962e0826c4d2cb6a6c26d78a8b69690bb9e53be48ad56c4651a1ee099df2d90c38f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143122, "uuid": "2bd73718-b59b-4e6a-ab42-738b07e967b9", "value": "T1F835020AE285D92BEC768570E487248392054C79BD55CB4E32C3731F6B36BF20E76DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143122, "uuid": "f50a1b63-2637-4852-805d-744e964bcfe6", "value": "24576:iFetUMdicm7bVFee59y5hm10LPHjAqbnpQ2IHYQRrGrdXXXXXXXXXXXXoXXXXXXf:ifRbHdybLbfnevHYQRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143122, "uuid": "4bd80c31-96d0-4f97-9e7c-42099dd71b94", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143122, "uuid": "24f80794-cd36-463c-b2b5-221fae34042d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143122, "uuid": "ccd10660-1bbf-4717-9d73-3e30afae3e45", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677cc888-b374-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677154805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154805, "uuid": "a871af7b-d195-4fd7-a0f5-7c29d20efde6", "comment": "Malware payload (Loki)", "value": "cff087693bb6ac0820662558c7d56c1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154805, "uuid": "4d7744e9-d1ec-4922-ac2b-26d87969476f", "comment": "Malware payload (Loki)", "value": "8be8cf5962e69abd5b6937cc5e6e9778a9457d291b946ffd3a921709fa7dd315", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154805, "uuid": "7f28f99c-c664-4b7a-9c02-378af35aad59", "comment": "Malware payload (Loki)", "value": "79693a1c57af7f5b3a50dceff74393e444b4696b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154805, "uuid": "60cb3774-b41f-44c9-9d51-8da429cd758d", "comment": "Malware payload (Loki)", "value": "ee0ecd1d6faa8ab363b8137cc0dff9bb3420bd04101b41d450b3b4b93968acfd1f8d7ca93be6949e718ea24e37ccdc01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154805, "uuid": "fa0f0754-30af-47cc-85cc-f90acbcd0c9b", "value": "T1471412212BE1D65BEC932B311D366BA2A7F6DE250431875F27500B4ABE71AE0DC4E371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154805, "uuid": "6884bdf7-d3a3-4e26-a517-fda5ae601ca6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154805, "uuid": "6b42a913-4ec2-4fb6-85af-9317784dd847", "value": "3072:XfY/TU9fE9PEtujbA7SPQ+vmngqJzFXeg1QJbd6fERlBjA41K+LOGkB7LOPDe8OK:PYa6tAQLmngMzFXP1QJbdCERlBjzXOVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677154805, "uuid": "210eaaae-03be-4daf-baec-76c434483873", "value": 193633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677154805, "uuid": "baa4fea5-9aa2-4858-99f9-bd0f9422852c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154805, "uuid": "1afd6efc-2f57-425e-ba0e-692f743a4170", "value": "cff087693bb6ac0820662558c7d56c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a9a34b-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141997, "uuid": "0d1dc4e6-b266-41b8-8fd1-0d8c5e0268e5", "comment": "Malware payload (SnakeKeylogger)", "value": "b09704ef785d2b84ffe39807b0e4eeed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141997, "uuid": "42e862b4-aedf-4b21-8100-1605307364b9", "comment": "Malware payload (SnakeKeylogger)", "value": "8d62706d58e8f761f2d007135b1e6c1a604ef6244157c430bea21f7a96ec182e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141997, "uuid": "70936943-e572-4060-9565-8aab2e82e63f", "comment": "Malware payload (SnakeKeylogger)", "value": "98f29185d346a3172f64b2b55dc57023ec891618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141997, "uuid": "3b0c3072-58b2-479f-bfdd-41cfcfddefe0", "comment": "Malware payload (SnakeKeylogger)", "value": "7aa58ae23ca1db68c4cc2e1dde2e39f28a91e5bbdae7b174c41ec9d27973778aa9840109ab0583195738a30fbd0caafd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141997, "uuid": "d9a15297-395a-4fe4-80e6-98c72b9cf1cb", "value": "T19EF46B8662B09033FDDE80AD17341ACF1E31B652710CE6675F3B6A988D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141997, "uuid": "4899b59d-875f-4fae-bc25-4477b81cd7d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141997, "uuid": "14ce0efc-1358-4853-bd41-3e6ae78d776e", "value": "12288:dJ8ejAn8jTAEwfL8L9r0sIKfDtOJQnUm4jSa9yFK9UTqoYD12AgU7:dJ8ejy8jkmFvrtSSUmQxUGoyxj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141997, "uuid": "1a1134a1-1763-4ef3-a769-d44a88447487", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141997, "uuid": "d58f7430-9eab-4322-b8ae-b140b2e04910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141997, "uuid": "6a056edf-cf76-4723-bab7-4931b77a75ea", "value": "AWB 5331810761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a6a01e-b335-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677127950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127950, "uuid": "cbd64881-c96c-4145-94c7-e80a7deead18", "comment": "Malware payload", "value": "f7ae9b90485186d4ae101979321215cc", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127950, "uuid": "7d866f9d-daf4-4437-9528-97c6067a9f1f", "comment": "Malware payload", "value": "8dce50e9945be58f1a28add9bb29f0774a1adb1f1e92a2f9c6f9fd30491260a1", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127950, "uuid": "09f94431-4ac6-4281-8bb8-4c4dec91a92e", "comment": "Malware payload", "value": "0d038f09dcb22f07305a856964d822df22a4e66d", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677127950, "uuid": "20d7bdf8-392a-4054-a742-00c5fd878efa", "comment": "Malware payload", "value": "4ac7621242c9b1f47da5c16965682de534418cbec579ba39c913462783037f4c44c8530570de8eb293f5db8e02f1b710", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677127950, "uuid": "5d1083e9-581e-4d2c-9d6a-58822fccaeba", "value": "T12E228EE6C346FD7AC3A958BC605A62E4EF994143E125648FA000F3FC9E015E34B5FE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677127950, "uuid": "f488b5ed-d9c1-43df-b0a2-1deb26c51351", "value": "192:VOWmMI+PMyH1LE9SU5bv/0AdeUtvkeltw1nLFoQab2l:JnMyHZE95NP81nkbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677127950, "uuid": "618a7977-8b0f-4a26-8397-676a3ec82d60", "value": 10481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677127950, "uuid": "05def72b-efc0-4a35-a374-4a8f59c4b799", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677127950, "uuid": "74241f6b-f349-4544-8717-89af3f9f7fea", "value": "P1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a61ede-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136327, "uuid": "7a2ab5de-a0a9-4f1a-a3a7-6e88d5cca445", "comment": "Malware payload (AgentTesla)", "value": "b40ea64de6374649f1c74cba734760aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136327, "uuid": "5de66fef-1aab-4a40-895e-df06ac587774", "comment": "Malware payload (AgentTesla)", "value": "8dde42f559b48a6ba626f3981dc84afc97a34f3906cbdc0f82c45122a420a22e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136327, "uuid": "c507a8c1-164e-408d-b861-ddb85e2af27f", "comment": "Malware payload (AgentTesla)", "value": "6b97eb58ed5585546f133d4b4ad1ad5e4a23e026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136327, "uuid": "f14b3571-fb3b-43fc-9fc9-cafa069cbbcd", "comment": "Malware payload (AgentTesla)", "value": "c0869171aad6986ef1068a3903b2a9425239d9f1e12815d8b6141f55d779134ef93af96331fb9b76bdd9360341ef9d34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136327, "uuid": "3eb194dc-20a6-4b2e-817f-909f2d96af4f", "value": "T1D4057B9672B09037F9DE80AC17341ACF1E31B252711CE66B5F3B2A588D1ACFBB5D8251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136327, "uuid": "ada5b50a-a38c-46c8-a3ea-0cca2e0c819a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136327, "uuid": "23ea5d26-bc6a-40be-aec4-370b186d88c9", "value": "12288:26J8ejk7KeOGaf+/uGejxkevbzPM2erngaRei0jr9v/s1ST:lJ8ejkg+/uh/zEnrgwa9c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136327, "uuid": "36edda62-1d37-453d-85ee-ce0e5e2eb5db", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136327, "uuid": "da9cc2db-86b8-48d9-9784-98ef70cdfa47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136327, "uuid": "408eb2ae-4e2f-4815-9f67-247178710786", "value": "TReUKYXNUcH9eSh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f964074a-b387-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677163210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163210, "uuid": "4bcaf1d7-439b-419c-aeea-0552ca65626f", "comment": "Malware payload (AgentTesla)", "value": "7d692e5e5774829bfa1cab4afbfdb466", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163210, "uuid": "259bd31a-0c29-4e2a-b456-ad0a1cca7322", "comment": "Malware payload (AgentTesla)", "value": "8de6f04788dbc981ab4e6045eeb2a92c18716580012fb85e0eac35b40c108d12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163210, "uuid": "9e39b688-2818-424f-8787-4469ed352aa8", "comment": "Malware payload (AgentTesla)", "value": "9bc8db715c0e7ab4e02a07778f2b248d6053edf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163210, "uuid": "6675b0a1-7e93-4f73-b5cc-48d57c9d69e4", "comment": "Malware payload (AgentTesla)", "value": "346e91d4608f859353385cd317a9740227f92c57e36920965babad83bca7bc9a555b3c8f66f55fc835124d611f282a2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163210, "uuid": "4223fd1b-8b10-44e8-89b3-ca205201b613", "value": "T1226412366D90C1F3F9AB02321D79D3618BE6CA512CF11B4B63812F4CB851D12A85E7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163210, "uuid": "6fc614bb-eef2-46a8-b508-9a98c5194467", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163210, "uuid": "d47cf378-446c-4643-8206-e11ece12cb0e", "value": "6144:/Ya6DsJYu4DOrKswT05pehZldTwFDsSSJTDz2OmXLbuq1i2SC:/YRg72g5gZC/cTiXLZRSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677163210, "uuid": "545498e4-6820-47b4-8b8a-42237a51a6cc", "value": 318035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677163210, "uuid": "080f380e-68ec-45a4-90c8-16a20d13a94b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163210, "uuid": "e75d4be1-72e6-48e4-a682-219e5d19f5b5", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d08e10f-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677142010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142010, "uuid": "a39cddcc-b8e3-4ed3-9b38-07cc16926e89", "comment": "Malware payload (SnakeKeylogger)", "value": "eec052afee0d8133b3a13b68d5e7f264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142010, "uuid": "695323e1-10d3-4ad9-8301-ddd542e45c74", "comment": "Malware payload (SnakeKeylogger)", "value": "8e450907def2cfc2f48a9ba638a915b8ccb4f2aba411e04d32ffab9e5f61a297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142010, "uuid": "7cbbf33d-ba36-46e2-8461-fc378c2c8281", "comment": "Malware payload (SnakeKeylogger)", "value": "15eb890eb033b22fdd20cddfc5cc0143e9366e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142010, "uuid": "844bc260-a71d-4db8-8cc6-839845cb6b60", "comment": "Malware payload (SnakeKeylogger)", "value": "faf8b5515ba3a5b93d2ccf300cbff2a909fa4d43912c0060426e7a4241cd56a43afcc13b5d8c4bd37aa1d37ce72f72b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142010, "uuid": "081cccd5-1ebf-4672-8f4e-46034ee3b746", "value": "T1E945AD47B6F09077FA9E40BD8A3816CF5D31A242714CE2225F7BAA449DC6DFBB9C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142010, "uuid": "b9f6957e-d97f-4ebc-8a29-abedaca3b276", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142010, "uuid": "032dd3cc-4ae6-447b-b9b8-3966f30f7cec", "value": "24576:541Z4VYyK3rc8yNgH+q7sU/cHqaf9bgooVXj2zS28DEtfJCtcuq:543HYtN6sUkJgoIh28DK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142010, "uuid": "6b49ef46-9ee6-4213-8571-fc44783abc84", "value": 1210368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142010, "uuid": "d71877b6-6d6e-4f23-b8ff-42542924ff44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142010, "uuid": "cb40a008-4323-4cb7-b246-b877e33b15ee", "value": "Final rooming list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6329ae9-b36c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677151608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151608, "uuid": "e865b4f6-5637-44e8-a92d-7fd89d1b9d59", "comment": "Malware payload (AgentTesla)", "value": "4eb876e8c60b5c6547c19b4e7dad500f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151608, "uuid": "39ccb6ee-a6e3-43f9-880f-dc175a5c95f1", "comment": "Malware payload (AgentTesla)", "value": "8f680961855c46cdb44bc6149bc3f27089f1fff0979bd72b558b8daa335dacc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151608, "uuid": "4d8d0756-6bca-4aab-b775-3a8b40f346fc", "comment": "Malware payload (AgentTesla)", "value": "d678c328c9cc186d9b68be57c26634fd38fe154a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151608, "uuid": "8ca3e4d4-5567-49f8-be2b-009ab922588f", "comment": "Malware payload (AgentTesla)", "value": "eaf87afd61245becf31b35a6dbbf6c8dfc908b18507b102560684e59367a00b10d309ccbbe6b3d14d56ca5c6590b5f64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151608, "uuid": "088b5aa5-6e5c-40aa-a563-21eefabe0c89", "value": "T1AC157A4BBBF09077F99E419D053826CF5E32A253714CE2265F7B29888D4ADFBB2C8151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151608, "uuid": "3cd109f2-5c45-4f3b-b4d9-cb37569ca9a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151608, "uuid": "5222a5fc-e118-4e14-9d66-7de7d48c5afb", "value": "24576:OTl1M4FUiMuMQ0EUDRoXJbvYRkI5GBp9XGYfCtcu:OTlDBMuL0EUDRoXJ2kIcBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151608, "uuid": "5677a3a1-f065-45ff-89ea-a352df4e10c7", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151608, "uuid": "5c04b57c-5d35-4f02-82a5-690a7e5ac77d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151608, "uuid": "7b4189ee-7209-46f3-bf76-1e4d2168ccb2", "value": "4eb876e8c60b5c6547c19b4e7dad500f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7241118d-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1677141938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141938, "uuid": "b9b91e73-54db-4516-96f1-283929f02175", "comment": "Malware payload (SystemBC)", "value": "7cbf389b3d3d7d0ac4fb9d1652c9b427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141938, "uuid": "5686efd7-315a-4833-81e5-bdba560698d2", "comment": "Malware payload (SystemBC)", "value": "938deb1fb95c5990b581fd5b988f8d5a980d0f4a117cc6957012602f0196987d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141938, "uuid": "7f12a09c-48cc-4817-bbb7-6f0a1338292f", "comment": "Malware payload (SystemBC)", "value": "f8db12a3fd8fc5d02c7e56bc727d5411702852c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141938, "uuid": "33fa6b8c-9411-4332-89ed-76be050c5224", "comment": "Malware payload (SystemBC)", "value": "7ed4e484c20fb0fed014a92de3d3eb50e1bd1b3f1473189bdaa2d88386e8793eaf33259e11a96fcea9a4661b1f43b99c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141938, "uuid": "c224b814-6351-4095-8ece-73f308d3d975", "value": "T1CF55020476B9B122C122D4BD915A4306D552B8F8BF8A1C55AB4F8F2E7F341748923FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141938, "uuid": "ccef3b48-2573-45c9-a97b-5e4e858a0b50", "value": "90aa300f8b98c30a131430c7f96d8b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141938, "uuid": "271fab72-8095-4c7f-9e35-c18d2eb03586", "value": "24576:IuTS4zbdAINM/2OLEJMVrxe+jRhWI7azyoQTz/fBU2Qt7XJjvo:/zBAmM/TAJM9vjvWp7QTr5U2+Vjvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141938, "uuid": "a3c85992-a6bd-4666-bec7-e5675fdf5df8", "value": 1356520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141938, "uuid": "79f0db0a-7a50-442d-b8ee-232661803083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141938, "uuid": "bf463d92-8119-4862-b4de-516b6f8facc6", "value": "7cbf389b3d3d7d0ac4fb9d1652c9b427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa47ead4-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677142461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142461, "uuid": "c7c036e7-4b53-4893-9574-3ce2fe7a41d0", "comment": "Malware payload (Formbook)", "value": "2bfd3598cc0bc60dfb191c422dc8b1d4", "object_relation": "md5", "Tag": [ { "name": "ABB", "colour": "#B346D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142461, "uuid": "da878d80-5bb3-4a97-b0b5-72075aa05be3", "comment": "Malware payload (Formbook)", "value": "94a833628759b13c4fa9edb3b0612ffbb4e49da640bbbc9a587a126dc06efca1", "object_relation": "sha256", "Tag": [ { "name": "ABB", "colour": "#B346D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142461, "uuid": "2b2d4b16-5577-40a4-bdd7-f559a49c5709", "comment": "Malware payload (Formbook)", "value": "9f4dafe112096e19d4e60fe30f7901c53cda11a1", "object_relation": "sha1", "Tag": [ { "name": "ABB", "colour": "#B346D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142461, "uuid": "70665ce0-7037-4b05-b774-27603eef20ba", "comment": "Malware payload (Formbook)", "value": "02f7c677b5e1b1b5967d94303c4ae56b31c7a9c3eaccec47ff3e29c5d9622e310da64eb19ae3e4013552019594c611f3", "object_relation": "sha3-384", "Tag": [ { "name": "ABB", "colour": "#B346D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142461, "uuid": "19c60beb-a6c8-4a5c-9f1d-581da9fb7029", "value": "T18D5412047A8095E3CBB68A723D7B27765774ED503C61AB4F0B504F5D7A22E83EA1A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142461, "uuid": "7dbcafe7-3144-426d-ba9e-09f435cecd47", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142461, "uuid": "9baa3d9b-ac36-4199-9ed3-81efcbb34b6f", "value": "6144:vYa6qRsigJG0vA+C2GZC14k7toqQGQGVNyxe5zpvtBOq5dTg1zoY1:vYM6vJG0IZ2v9oGx2eHvtBXg31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142461, "uuid": "b6e1441a-7ade-4d39-8e66-bac1b2cbd3fd", "value": 299286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142461, "uuid": "6e1ce52f-3ef2-46f1-825e-9181b029bcd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142461, "uuid": "1df35eba-f053-4d2a-992b-b19eb72f4ad1", "value": "ABB Inspection.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058c650d-b381-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677160224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160224, "uuid": "9213ac83-a82f-480b-aa7f-4cdf54ac7c6f", "comment": "Malware payload (RedLineStealer)", "value": "4be4fa96fca0882f20c11f0e5217486b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160224, "uuid": "f3d7fd24-8709-406c-8a06-8bd51ab645df", "comment": "Malware payload (RedLineStealer)", "value": "94c4cbafa8293577b9617a5e3f7f71041fb9f9b9251c1efbf5e70fe9a9b30b1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160224, "uuid": "5515739b-7abf-4595-bb38-15036b6af7e8", "comment": "Malware payload (RedLineStealer)", "value": "e5f16d07a554a1c2a4482a84b058f73cb9e757c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160224, "uuid": "795fcf6c-0553-4a44-bec3-4f040321cd70", "comment": "Malware payload (RedLineStealer)", "value": "f304fe46eb888dd1c9b14cbf87871880b4d0984fecf048ad1f789afea377855db8929e4efe0f1083fcb7aa2f7f746d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160224, "uuid": "3f160800-9417-40a6-b834-fc1a511ccc5c", "value": "T14D44D8512ED04AE7FAA38FB73322D26DB11A447E560F1B5AC369C9E1433434453B86BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160224, "uuid": "b2d99e16-bda3-4b19-94b4-a9b0a9c657cf", "value": "4daca7182a967075c4a8cd470c438efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160224, "uuid": "39d0a0bf-f572-4e70-9b6b-af3ba1673a8e", "value": "6144:GGCY4I6GKyqr9YGzoUQbTmvYcR+C+eEO7wO:GGCY949YGW4R+CBE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677160224, "uuid": "bfd00271-394b-4c9c-a806-1f905c6f286d", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677160224, "uuid": "40783957-9f25-479e-bb04-24e523bf5445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160224, "uuid": "9f65fe17-ba3c-4430-813a-7217be04bb13", "value": "4be4fa96fca0882f20c11f0e5217486b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3911d524-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142271, "uuid": "7979c7d1-7335-4f07-bea0-7253d3acd00d", "comment": "Malware payload", "value": "a0fef9fe0e016ae21f7594427f8af6cc", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142271, "uuid": "816a0b51-dcda-4506-969f-c0ebed210211", "comment": "Malware payload", "value": "955244b1f7dfdf5b16e4b07ee4b09d56f344c53862bb8186363175093357374a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142271, "uuid": "128ff613-a1df-4a58-8f4a-f7951ce69bd7", "comment": "Malware payload", "value": "c7e3111d0f4ed1cc83b149fc6d6567f8f8280ffd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142271, "uuid": "971aa9ac-be72-484f-98cb-3182dcb669ea", "comment": "Malware payload", "value": "558d04ceabd3ffb8f95b70d79290f75591c42ca38d957996b172559aff296f4b9acff75c97b127e578a17dfabe08f475", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142271, "uuid": "29caebb6-7e7b-4c48-a695-c20ad6b5b642", "value": "T1B894220136D8CF13E50649B9DCCFEAC31962FDB1169ADA13364A7B0E85727E0FAA7414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142271, "uuid": "cd7781f3-e133-43ca-8426-57f65764f565", "value": "12288:zPH2ftWMHkoiVn+6vyJ4ZNpoOkRTCR45sDq:KMMEVx+TJS4XRTCR8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142271, "uuid": "503eb117-0cf4-4f0f-8ea3-171f3cac90a5", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142271, "uuid": "7bc586be-1056-459b-a994-c38332803df2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142271, "uuid": "ae40ec89-5118-437d-b78d-f20d7f4e92c8", "value": "invoice_2103006.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4e04c6-b32a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677123250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123250, "uuid": "c4027c00-e480-49d2-844b-5803aeb0eeb7", "comment": "Malware payload (Mirai)", "value": "59668e3f345f20e8e752bd6e0398e9c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123250, "uuid": "5c0b01d9-e550-490f-b430-b12ccc481aea", "comment": "Malware payload (Mirai)", "value": "9566435c08128e0d56283526fdba62cc1153bd4fcb5154b41d445de748e56853", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123250, "uuid": "a80afb15-3e9e-4db3-8f9a-891a06fb876e", "comment": "Malware payload (Mirai)", "value": "6eadce25e13b3758b37ae18a27821cc5f87cd090", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123250, "uuid": "c33816a1-dbd4-49f7-b191-587089defe57", "comment": "Malware payload (Mirai)", "value": "7440f437b3a9fec8ad2669479fb289f3c21bcd98fcfdbde2817ac22346aa947e87e29838343b177ef80a71fc68369683", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123250, "uuid": "70b34357-3931-4cdd-97c7-90bf330c53a4", "value": "T166331A0272280A4BF5E65EF0293F0FE097BFF99024F0B584695EEB458536F761486F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123250, "uuid": "489a0c16-2895-4d07-975e-a06d209e4910", "value": "768:JTHz+ANmmo1oRze7TPRItebzyhBsIn3Z6BU8VbOkhA5LNv:R4mo1oRzkjHfyHH3Z6wKAxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677123250, "uuid": "c936cf81-1708-401e-94ca-d4abca88c58f", "value": 50964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677123250, "uuid": "53cd95a1-0acf-4f08-9e4d-3bbf78255585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123250, "uuid": "a84138fe-81a1-4bea-a4bd-393cfc12bb37", "value": "59668e3f345f20e8e752bd6e0398e9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c983b0-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142318, "uuid": "f550deec-dc3d-45f5-9c9b-2703158cd5a2", "comment": "Malware payload", "value": "f51ec6357ff52b463fe26e35d7d7c0fc", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142318, "uuid": "dfd5e029-39cf-43a7-96f6-27bb0b28345e", "comment": "Malware payload", "value": "99a81305fbf558539c8809c2a04deb0b013cfc77822eecda99a88f49586a27bd", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142318, "uuid": "ceb63d1b-23dc-4a88-9a28-8c4f30b6ee1f", "comment": "Malware payload", "value": "20ed1cf57f8a95663a15697c43c7fa03c8b3b410", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142318, "uuid": "3e4aacac-bd57-4b17-a1b7-195f2977350b", "comment": "Malware payload", "value": "66d3d874588937f315c49289412d76e612a66f155ec3e4df3a7e85305bda2b9d7268d466b849cfbd9f7c8834ac498319", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142318, "uuid": "610737ac-23d6-4c5f-99a0-d6138cbd448b", "value": "T16435020AE686D927EC364530B447649382168C6EAD15CB4B31C3731FA732BF14E7BDA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142318, "uuid": "a3b3334f-07a2-466f-8730-fe04f654c900", "value": "24576:KFelVFnum7jFe7EezjoRBmmwSYQDyXwwQmIlXXXXXXXzXXXXUXXXXXXXXXXXXXX8:KG3hHOuFwYDygwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142318, "uuid": "52c8f3f0-b8d5-4106-80e2-b30e2d84b711", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142318, "uuid": "0aba6c14-49e3-4548-81d4-3bdbd7f057c6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142318, "uuid": "5c84174f-a601-4000-8149-83606d6b1de9", "value": "DOC_NEW ORDER 548886.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede32b31-b351-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677139998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139998, "uuid": "f749cc58-dcf9-42bb-887e-3a803b3f08eb", "comment": "Malware payload", "value": "9e36f3be11487905143c49ba9cd45d77", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139998, "uuid": "65f50a55-3ff0-4411-9a50-5b7ffb761f64", "comment": "Malware payload", "value": "99b52aee9fb4a580ead91250fff9f930484c53f69de0f59ebf51e2aec08376e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139998, "uuid": "9af297be-f31b-4f58-afb1-40cdcc19265b", "comment": "Malware payload", "value": "92492491c099548f7a4aa72e13591346aa9043a7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677139998, "uuid": "165d7a0c-de05-4368-9f3a-a235a756424f", "comment": "Malware payload", "value": "6795bc08d8444902f337301447d9a2e14948daa426c68694e3ba07e690a5b758edabf2bc741dac49f55ae7bf05afe696", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677139998, "uuid": "6142210a-a923-4f22-9be7-97023c7d45be", "value": "T1C875CFF1310BBE4E5B672DC7F90436324C5CAE6F5B65C248FFD80EE412A61199DA48B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677139998, "uuid": "c058e94b-df97-4cfd-b4de-a29180fa268c", "value": "24576:q1LqY5nbY/2D2wHRsdOsFLgr1eX1ilxf6fDrykBi/3dm96Td833t9gydJYo8+Ecs:yUTGT233BM1cTkNwZdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677139998, "uuid": "9c882a0f-d4cf-40b4-8749-910724212dd5", "value": 1693184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677139998, "uuid": "80f0a0ea-5650-46cc-8f49-aa2cbb27fed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677139998, "uuid": "9cc1bba6-39c4-4be9-8192-a3fcfda5f471", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507c6ac1-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136298, "uuid": "2ac8c63f-2964-4434-ad80-da1ba5f91dd3", "comment": "Malware payload (AgentTesla)", "value": "ee05fc44d0ce2299065d06dae7a4eeaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136298, "uuid": "ca69d351-a7b4-4ad7-9884-61b019011728", "comment": "Malware payload (AgentTesla)", "value": "9b1aa498a16cf478562274d57611677ef226c09aa64b878c6e597cb8c2471a3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136298, "uuid": "9d1f4833-1e62-4f54-b68a-ae2029b9d81b", "comment": "Malware payload (AgentTesla)", "value": "2167e2837d7c518bfbb4229bcf59c974c10f3826", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136298, "uuid": "a22db5fc-279c-4929-a1d3-4d35c7a6f1ae", "comment": "Malware payload (AgentTesla)", "value": "21e71cfed3a37bde0fc4d8a2214aaabaa7ecf07661cc983084aea21a01d2a364479e194f9e2c829b17f8d10a1172db40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136298, "uuid": "45647a8e-2654-423a-8185-64891f7b193b", "value": "T1FA158B8BBBB09077F89E519C063916CF5E31A243764CE2265F3B39448D8ADFBB1D8611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136298, "uuid": "1094d36b-5360-4223-ad80-d2da5d88e65d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136298, "uuid": "5ef8ddc6-c396-42a8-b359-ec416646fe53", "value": "24576:UL1ATeXK6Q8qM4QPJEVDBtLtU+2uKGXTzpD4KCtcu:UL2TZc7PJ8HWFuKA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136298, "uuid": "cf364c06-2770-49e6-9b8f-a76083310512", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136298, "uuid": "0ef5e7d9-6513-4f8e-9f9f-127e473a67db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136298, "uuid": "8312872a-e620-486d-a111-d86171470257", "value": "TTres2222023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3035ba40-b371-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677153423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153423, "uuid": "95c6e7da-b08e-416b-9db6-859834ffbfe7", "comment": "Malware payload (Formbook)", "value": "5de423db35f950e1c7f656bfea1268d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153423, "uuid": "7fe1d62d-3ac5-4fa0-a634-67e700c7e556", "comment": "Malware payload (Formbook)", "value": "9cb575e04d0358d14c8799cd77beaabfc776fcc0362cfe74ec3eea240ec1bdb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153423, "uuid": "0a0b6b3a-b8a1-4f26-8b15-8ad0327f3309", "comment": "Malware payload (Formbook)", "value": "ccd4e74250dc59afbc04ad5e6bca6052a2a50cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153423, "uuid": "64c9e5c3-e1c9-4351-82cb-858df8bf7eac", "comment": "Malware payload (Formbook)", "value": "ec7c7ec7ef383c2bedfb9b0eb4b6ff7194cd1f33a9d094beae9e59b7d7fa993d2f4d7d2ebbe0e888bf5a39398c0b1caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153423, "uuid": "ae0beb0e-0c29-4f34-b351-b13e41bbef07", "value": "T1AD158B46BBF09437F8AE41AD063912CF5E31B253715CE2265F3B69489D46EFBB1C8212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153423, "uuid": "ebe5f181-0136-4613-a729-9f2f70b81c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153423, "uuid": "c7ca18fe-2679-4d57-bc2b-eec07751bd4a", "value": "12288:NwHgC+2SWNx9lyEwOszrlGRsCB3M/LLg3tNCRGJMaOp6z0ysPJqLfv44zl+dtoPu:NSg7Ve0r8CCBG+rLWv2xM0n44Ctcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677153423, "uuid": "179c3a36-ceef-492c-ad33-1c44ae15bf7b", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677153423, "uuid": "eb8e4b8a-9abc-4046-8806-2e6e6d9817dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153423, "uuid": "ac948b47-e1a4-4326-bcdc-e265bc23106b", "value": "NUEVA COTIZACI\u00d3N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3135d777-b3b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677183490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183490, "uuid": "ca319bfb-2d38-4a57-85a3-57629db4ad66", "comment": "Malware payload", "value": "b2c8f2eaafa7f026b389a51f785a16f7", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183490, "uuid": "4a785e64-ae69-45a8-ad7a-72fecb41defc", "comment": "Malware payload", "value": "9e28cff8966bbacee0d1644f157ad3f6c96c7c1dbf04c993f868603db58ec34a", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183490, "uuid": "f540a0e5-6496-4486-95bb-95402dd9e086", "comment": "Malware payload", "value": "10d73606ae1748b373ef96e0e76a6198ca484ff9", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183490, "uuid": "b778542f-1717-491a-a243-58570d856af2", "comment": "Malware payload", "value": "87e89cefcd1176476c39acdc09bd1e0e93880827e6c279a0708039c8bda76a149b665c32d0daba376f629ac4f4b70ef5", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677183490, "uuid": "d2e04c6a-900e-4d11-aec1-3a1517baa6c9", "value": "T1C414F1926BE44211E96F9B311FE2DFD71607FAA06727833725C6220C4D917C0DE5868F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677183490, "uuid": "6b2447e1-785d-4303-95e4-ed0dee3e68f2", "value": "3072:YhGtY6enoukFuaYXtfAO2eZMJiE+uSPHROxjHyN3Lik:YhGtvBxFuXVd2tijTPHROxSNL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677183490, "uuid": "152ac984-9d90-4913-9d74-4addc2959861", "value": 192983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677183490, "uuid": "4ca3bab8-ed11-4331-9a12-6c04e13d0a48", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677183490, "uuid": "8772c821-30ca-4f92-9246-5cd4136b1f2a", "value": "Contract.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c02220-b32c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677124098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124098, "uuid": "4843828b-5f4d-49f7-a2e8-2fc4a0d64044", "comment": "Malware payload (Mirai)", "value": "8eaa94648ab78369081c303b733ccf13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124098, "uuid": "a0e2d89a-4170-44ff-b305-1736279527a9", "comment": "Malware payload (Mirai)", "value": "9ee6e51aeb096bc22e7bff0f75dc677518bae7c1f37ad157b57a196c1c9df1f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124098, "uuid": "d08be2d8-708a-4045-931e-4e072061b35e", "comment": "Malware payload (Mirai)", "value": "644c034f53cfa74d0df19ace82990379c2d36221", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124098, "uuid": "456350f2-f66d-4866-83ca-ce93ca04d87c", "comment": "Malware payload (Mirai)", "value": "155a7df1312535808d517017349f6d3bbb4b8dc113ab8397bb1ac102e765c681dbf268dc33a6f0501fbc8f770cbd39a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124098, "uuid": "a8d45f01-8c95-4562-b1aa-6fb6141dbba0", "value": "T15963B506BF614FB7E86FED3709E91B05248C541B21A97B3A7E34D818F64B25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124098, "uuid": "1f11e760-db5f-4ea7-a7a2-77021f1b04dd", "value": "1536:xic5msW0d/JnzwIFIzUP8UTtDOPHtb3c3S:xP53DlEOYtOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677124098, "uuid": "edd0ddda-e9cc-4fd8-9b3c-432fce71af75", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677124098, "uuid": "13e6c848-1c87-4bf9-b0f1-9410f087427c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124098, "uuid": "0b3c6e14-7129-4812-8713-2e93996118e2", "value": "8eaa94648ab78369081c303b733ccf13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f541faa4-b39a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677171363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171363, "uuid": "c66146fa-0fde-4210-abe9-cb6cfbcaccaf", "comment": "Malware payload (Mirai)", "value": "394621b97848f0fceb6709e6f998f299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171363, "uuid": "ea93c1ea-30ed-4e23-9d84-cba0d750cec4", "comment": "Malware payload (Mirai)", "value": "9eee8dec1d86a4e28ed5697168546a906e9b8a3fde71b0442b8c3283604a5bff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171363, "uuid": "7900443d-fcd8-4509-810a-0199aca31aea", "comment": "Malware payload (Mirai)", "value": "65243c56ada40c936d79ae4712df74977786a6a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171363, "uuid": "99e65ae6-18f5-4c90-b960-df1f4a0cd29c", "comment": "Malware payload (Mirai)", "value": "ec8cf522dbe4755e24d234f352e10f98ee65cf1efb9637d6667e5d6bfc8d98e951d3e92d7f52fd59dc61434443c14983", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171363, "uuid": "3c61511e-9688-408c-b36a-fa3de46b8d3a", "value": "T14C63965D2E219FACFFAC863547B39E20924C33A626E1C944E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171363, "uuid": "05ef9e74-5f02-480f-adca-27053002ae39", "value": "1536:YkJrDD25WpoSBvfvbxvbiMvb5nGmbU0fN2vYvLsCF6YPEDXV:7dDDkW2UJd2vYvLsi6YP4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677171363, "uuid": "1f60e45e-0c46-417a-9884-b61a61cf494d", "value": 67560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677171363, "uuid": "d75960af-a0b0-43bd-a971-744bcdcb134a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171363, "uuid": "ad65d170-6551-4059-bdf5-9f488493f72e", "value": "394621b97848f0fceb6709e6f998f299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04cc8cb-b3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677176053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176053, "uuid": "24b87ea0-7ec0-424d-a03b-7101f964e009", "comment": "Malware payload", "value": "7993e831f60f56b3dc3ee1d78ea6acd3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176053, "uuid": "04e127b6-ec88-49f4-9ed4-27c8df57b833", "comment": "Malware payload", "value": "9fa2ae6e837df78a6fc28000497b2ef792a91f0ef93b07e2d05311d9857e4245", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176053, "uuid": "ab3eea22-fb4b-47ef-8957-16e241d65977", "comment": "Malware payload", "value": "df4bc12811ce2120c498350c2c5a93fe4535a0be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677176053, "uuid": "1585f397-42ba-42e5-b485-f5562681b69d", "comment": "Malware payload", "value": "4a0d152d3a1f4aca93cf02e65b304480456d36e4a28d99dab59d3e8097f8409f8dfc3c06a2aa7121a3820fd3c41230a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677176053, "uuid": "09d2e546-70af-4264-b2df-e8800e2152df", "value": "T1EEE02364770E59F475401A3888B05712CDB02E9818426C845D140DF43F44DC74AC234F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677176053, "uuid": "aa000781-0572-4ea7-9879-97c82df631ae", "value": "6:DbCY5quDYNe5gj4hIpnAR0GN7vyl8Bz30/5MzcAIULdDXehU+z1jJP6XMtmtG3VF:HtYNeQ4qndGN2l8Bj0JAIwQUUrtmtKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677176053, "uuid": "83893143-329e-4154-81af-5f4b544350f3", "value": 423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677176053, "uuid": "61c27450-230d-4755-9c84-163b45b24f0e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677176053, "uuid": "e240074d-a1eb-4d32-bcaf-698b2a9d1c5b", "value": "ce.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b706e03a-b36c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677151502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151502, "uuid": "fb69cec5-56a8-49fb-b303-78ffebcc82a6", "comment": "Malware payload", "value": "240e4fa6302b33399160e759bf7c541a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151502, "uuid": "3a45f1a6-8b03-41de-9d66-2358b2ec61ad", "comment": "Malware payload", "value": "a268eee4a965590989eae0b4b3c303899fda269b43f25d382d5ccb572efcc05d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151502, "uuid": "769c935e-476e-4ed1-9849-d49584a1eef6", "comment": "Malware payload", "value": "d887960ce4a314645a52bd72c8f78d055bdadf1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151502, "uuid": "819bbbf8-9790-44b7-8c33-8356eab19b1f", "comment": "Malware payload", "value": "fea15b6d5e35701d580f9a051eb86a983e4d576686cf22ae95fd375a54efc1bce1015eacd2b9a5fc00f8b3bb546d74a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151502, "uuid": "5af2ca07-3b89-49c9-b151-079eaca0bfe8", "value": "T13E938D1179C6C073E51611B90896C7B28A37F8745B269ECB2BC0566D4F363E2DE3638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151502, "uuid": "159009c5-56c4-4c09-8bae-0f1b8996cacd", "value": "2c399d381d03e44b02e91ad01ca3c756", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151502, "uuid": "c9de9603-d608-4e56-92df-9f680a145c3d", "value": "1536:irvaT+0U3WWawqAMbKHjowxA5t0I5Jk5R:irvai0U3QZt0I5y5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151502, "uuid": "d3dc30ca-607e-499d-af0c-662cebf591ef", "value": 93827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151502, "uuid": "ec1389aa-ffa4-4fa0-93a9-be3e13c3b559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151502, "uuid": "efb7b469-d57b-4c00-a9a4-3629c8763f62", "value": "240e4fa6302b33399160e759bf7c541a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b862c69-b336-11ed-88f6-42010a9c006e", "comment": "Malware payload (GurcuStealer)", "timestamp": 1677128183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128183, "uuid": "763424a2-1356-46af-b395-2339f7af3139", "comment": "Malware payload (GurcuStealer)", "value": "716d01d18140ec5e18b1a15c17fb213f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128183, "uuid": "a2898f1d-d778-4e06-8ce6-72fbff13dd1a", "comment": "Malware payload (GurcuStealer)", "value": "a4191e00cd9dfeda78901ef9dae317e23c73408e7b4c1eeef8de6a8c70fe9db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128183, "uuid": "15320132-7ae1-42b6-b2ce-9b3fe741e81c", "comment": "Malware payload (GurcuStealer)", "value": "b4f2063ade43a0c6ddd15f3f34dbfde348e3eecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128183, "uuid": "bd42dd09-ba4f-4fa0-b0ba-fea38928fffd", "comment": "Malware payload (GurcuStealer)", "value": "8f7cd805bacd9f96ce855052fc50a698db79d8df2e7b7c323c2a5da5aa33cad07c2acea814927cca8d10fc35bd3ca81d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128183, "uuid": "526cc1b7-516c-4330-a5f8-35694c3f7fa9", "value": "T157D20816B364E734EA6F0F31E8B3235043395703BF569F0E1C8AA8542DD32D95A93A6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128183, "uuid": "4a7ea877-c749-44ba-a9b5-5abb66793507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128183, "uuid": "2397a50c-f753-458f-beb0-cc58a3744365", "value": "768:4u3dYXhvK1Wm2k7/fwL1G8u+Y1mFcCbwh0:4u3ShK15WfY1mFcCbwh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128183, "uuid": "c931a15e-2fb9-423b-84e1-e57ddcf959f6", "value": 29196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128183, "uuid": "6608254d-a670-493d-9952-50fb9db97c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128183, "uuid": "cc50b7b5-e042-4180-9a4a-fd0025a21d01", "value": "a4191e00cd9dfeda78901ef9dae317e23c73408e7b4c1eeef8de6a8c70fe9db7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33f6e6f-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677136517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136517, "uuid": "898cb0bf-0731-40c3-bd95-6be6f896b1de", "comment": "Malware payload (RecordBreaker)", "value": "07ea6ce17f1fac30f77ad99ffb7582a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136517, "uuid": "31c9ca2b-4e6e-4ec5-b1e7-7b5d91357114", "comment": "Malware payload (RecordBreaker)", "value": "a4f514bf67510744f1389f5457dfd45b501b5707499d4d6dfcf65464c2421c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136517, "uuid": "8845cba8-c7bc-4464-9059-bc79f75faa4a", "comment": "Malware payload (RecordBreaker)", "value": "b8c9cc0b3fdfde16eba62f8c9d2f0ccb1945eff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136517, "uuid": "6c1d5159-d86e-4ba6-80da-fc0efe641d3a", "comment": "Malware payload (RecordBreaker)", "value": "fc8c98e2d2115b0a76582d89148ab93f55f4c761e31c601abc04db8935d8c6a636f364ec66bdf56b53c93e28fbd28bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136517, "uuid": "a7b4882d-b38d-428e-8f8a-cc3d0a92b858", "value": "T17324D010B5E2C073C6D34574142DDBA52E6BB8629A70898F33A417BE7F203D15A7E36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136517, "uuid": "d2bd763a-d684-43ee-a283-8b3a76151f68", "value": "01caa8f7715260f3abb607c5b1af7bb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136517, "uuid": "4a1a0db6-7997-4c3b-9b88-4dd8b60966ec", "value": "3072:Ds51GLsUlYX6qdg5YZ1DRMUBb0kc6SI+m+u2+C2bFtRHPLGjUD:weLsj6q+5wRJhP+F+C2R3PLqUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136517, "uuid": "5226714b-db95-4815-9f57-b5e174e27c46", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136517, "uuid": "f831267c-d064-4fe1-87bf-b660c73bbe3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136517, "uuid": "18994e1f-1d5b-464c-ba9a-fba97a67986e", "value": "07ea6ce17f1fac30f77ad99ffb7582a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187970af-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677158538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158538, "uuid": "4ec0a620-bc35-4a74-a490-ffc590ac6444", "comment": "Malware payload", "value": "6e337888aa5c07faff4710391dfbb741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158538, "uuid": "23839dae-1fba-4ad7-b31f-c5d2fd95fabc", "comment": "Malware payload", "value": "a6d7099551c98ccb7612ba94329521d4f40f34eac9cd45512f7f72d9dad96f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158538, "uuid": "e4b42430-d33c-4e7d-8247-68ee0e2676be", "comment": "Malware payload", "value": "4f55d68e05009427fac843208f04df37054f425c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158538, "uuid": "794b8217-32e6-4e25-b043-10602627c902", "comment": "Malware payload", "value": "6e3c25055ac8918427a4e8eb4db6b4b4b60e730de782e2454ae712d5a3dd289aa304cb6d12d8e8c724f2edd5dae3d702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158538, "uuid": "1f115c01-0e8b-48b6-93c7-d0b82c89b84b", "value": "T15FD506C0F9DB45F6E2078D7288B6922F9B30560883B1CAC7DF682E59EC1B6D5057B718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158538, "uuid": "d508e278-0346-4fd6-b253-39131d1ae0fc", "value": "e724bea03515dde29f2b2b282d64f822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158538, "uuid": "1e8fb47f-6b65-4027-9212-b7dd80c3737e", "value": "49152:91TJ9zePB4262LMFVXSUdg9GbpueIiyXKdzCQWfB+qzeM1VvmaerxyQG6473V8Ww:91TrzePB42VLmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158538, "uuid": "824be613-c25f-4183-9489-c28855994cd9", "value": 2912256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158538, "uuid": "07d68dc6-333c-4bb3-8ce3-9e38d4f51718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158538, "uuid": "c434e36c-e212-4f6c-802c-0b51ced3ed8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fe4eb6-b3c9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677191368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191368, "uuid": "86ba04ee-7e8f-4653-b271-9355db5a0a3c", "comment": "Malware payload", "value": "c65b2427a7224ac3545857774c12ff0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191368, "uuid": "27c0b3d0-97e7-48b0-b097-2c731946b056", "comment": "Malware payload", "value": "a8dea152f0d39d4b1102b23a8d367d845a819a84e8caf8a3177e7821dde1c65f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191368, "uuid": "4f4cd240-e42d-4ce0-9950-a236acf3777d", "comment": "Malware payload", "value": "b8ea3ea7b21f896fad4e6cbf982a455bd756fa05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191368, "uuid": "fa8f7f15-e322-455e-9df5-88649d64fcf0", "comment": "Malware payload", "value": "68898d6c925383912f6fa23a95265cc2acf74a87f4023f20335ac38db3e391080b3d84819b6e5ddd0a119b7ea614ff04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677191368, "uuid": "01d8cdf6-f574-4408-a196-2ebe53793a2d", "value": "T1E8C623C5199453E0E4EB43306186079DB8816E9895F85E0E7DE13C532FB1EFE214BAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677191368, "uuid": "eb012680-a9cf-4cfd-80e5-701ab1dc6ee5", "value": "397fe34ab13aed1ba8b91da7d5a4441c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677191368, "uuid": "3f2bdf22-c098-4486-81b0-7dde163da6ad", "value": "196608:3ryw/ylaUbctrf+01mvxYJVJISgaZKpZrwlgKGOy/Hz1BIg3abghpU6ZOj8closl:ewn3wvxYJLRRZ6r1T13bpU4psl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677191368, "uuid": "cc04658e-f4a5-4d5d-ab76-dc6980395175", "value": 11895296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677191368, "uuid": "56c3a60e-2843-46fc-b676-e540f34c9625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677191368, "uuid": "d7f011b3-7ec6-4ea4-9f9f-44e81104cc34", "value": "c65b2427a7224ac3545857774c12ff0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5473ab9-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128816, "uuid": "f63b6e09-352b-4b28-9b47-eaf1aecf1985", "comment": "Malware payload (WannaCry)", "value": "28593ef6b71cb06b04a179e911c6a059", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128816, "uuid": "42d9569b-9164-47ab-b7ef-c5e4bd68ad01", "comment": "Malware payload (WannaCry)", "value": "a9b267ea23a944e317cbae01826907002dfbd2ec28b05960f3bfbb7f61b33948", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128816, "uuid": "6bb15c40-6b7c-4fc6-8a4f-0a0215fe6aae", "comment": "Malware payload (WannaCry)", "value": "9fecd695a1ce5fe33ed461f23811f3c0eda80d49", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128816, "uuid": "e78f6db1-d368-4c1b-9798-a6f1e6ac89a5", "comment": "Malware payload (WannaCry)", "value": "ffe59dd4b2171b35ad6147d67492214f746ecc31493834d092416515d9f6a016a3d35abc4499b82d495fa25b3bcacabc", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128816, "uuid": "e60096f9-b4f2-405c-aaa0-685b62a7b368", "value": "T124D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128816, "uuid": "4a9afc8f-0355-4ebc-9970-9cafee0741dc", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128816, "uuid": "5c402462-9096-4dbb-a65f-14243dc852fa", "value": "24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE+W:BSy6PX3PpM+P5IddW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128816, "uuid": "f66ff0f7-7627-4554-af94-66ced964b8a5", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128816, "uuid": "fc5a28ff-eb3f-4d0d-8d0d-3b25cb0cf77f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128816, "uuid": "babef7e5-737e-42b0-9f16-dcc55cd30c7e", "value": "2023-02-21_28593ef6b71cb06b04a179e911c6a059_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e099122c-b36c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677151572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151572, "uuid": "c8b4004b-2b52-4e0a-b148-12582d40c18c", "comment": "Malware payload (AgentTesla)", "value": "848e527c6afcbb4d6d7ea941d4fa7e84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151572, "uuid": "ca94ec16-0560-489a-b2ae-a92e73c60226", "comment": "Malware payload (AgentTesla)", "value": "aa140d9925e583d6b52f755beff163adc0f6b04c5cb36647dd666295fb4df704", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151572, "uuid": "d2b0a043-7cd5-49eb-b5f9-91f5f632be59", "comment": "Malware payload (AgentTesla)", "value": "d920ebaec6a3c146d245612d68b6ca9298a8fec8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151572, "uuid": "9a54a475-46da-4611-835a-290264f0e3fc", "comment": "Malware payload (AgentTesla)", "value": "6904eced76fcae89aca6106b90b29918b61f3fb466f524f573be7ed9f4bab670630273c4e55abddf4b2f44bb8c905331", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151572, "uuid": "18256ecf-c298-4124-b120-80a24cf840ae", "value": "T1D9057B4762B09133FADE50AC17381ACF1E31B652710CE6675F3B6A989D1ACFBB5C8241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151572, "uuid": "20b74da7-ccca-4b26-ad30-a6692abbc42b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151572, "uuid": "edf83e02-f090-47a4-a71f-81b171b87178", "value": "24576:bJ8ejhWmNiovaSU2Yzm/qQDr8ObgoVTIIh:NWx9SU/oYWRzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151572, "uuid": "d97cde04-022c-4bc0-af80-c81810f2afac", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151572, "uuid": "c4a81171-5a50-426a-9510-6156e5388dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151572, "uuid": "6411b1fc-8010-4e68-ac75-9fc82db93f8c", "value": "848e527c6afcbb4d6d7ea941d4fa7e84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b2a5c5-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677142479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142479, "uuid": "b78ce836-b09f-4a6a-8389-c8ca6a479f97", "comment": "Malware payload (Formbook)", "value": "0154c3f0f69c20bcaf419dbd47ac340a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142479, "uuid": "4fdaac26-ddb6-4666-b8ba-f8817c8d9279", "comment": "Malware payload (Formbook)", "value": "ac1792b9ee7d64684ec2c559801e4f22a6c74876c24969385fa470265adcc260", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142479, "uuid": "9a9216ff-f074-4b87-9476-4bde2822fb12", "comment": "Malware payload (Formbook)", "value": "7dbf48cec787583c1a5e5b25a33985eb91b328cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142479, "uuid": "82d4bde8-3eaa-4ccc-a957-4128af991d8c", "comment": "Malware payload (Formbook)", "value": "7ea69339dffc27e84c2f683807a76ef68ffda75ca4093c7ec5b7ba3bbd5a1c2d30844e7fe80849af2bf139e8205f9883", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142479, "uuid": "3dcb99bc-6995-47a7-9a49-327a3bbc5374", "value": "T15D825C467023019D9B0E3F7A27573A046CDA4AD7E032EA0A34ECA3CD5F56EBD515B58C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142479, "uuid": "dfd86c6b-01f0-4ffc-81da-4e093de28af3", "value": "384:JnnyS3v09IpPiNNcIlSEuBdBVznv50LvyzujSSAXjTp:n0SPizcI8jL0LvUujSDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142479, "uuid": "3a145d01-d453-4ebc-82a2-6eca2eb90554", "value": 18389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142479, "uuid": "ae452cfb-fbeb-4ae1-a9ef-30848dc88727", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142479, "uuid": "e1894ac2-7bf0-4284-9d33-b767889ba6a0", "value": "TBC-770385659090_001230223.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86196c7-b371-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677153732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153732, "uuid": "0813bdc1-213f-48de-a2d3-a81abc8ef71d", "comment": "Malware payload (Amadey)", "value": "6bbfe8d4f4aae27633634f1b0e4d8cb8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153732, "uuid": "09b06b92-66f3-4395-9c4c-781e1c4fdcdf", "comment": "Malware payload (Amadey)", "value": "adb452d5dfe248e6e2b12103bd57daaf2749aab3d6a75f53068d4e96b0dcf747", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153732, "uuid": "1043bea9-6de5-4974-9193-4c7eede8055f", "comment": "Malware payload (Amadey)", "value": "6226923ff7fd4e361c8ca75c3e65f5bae8ba30f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677153732, "uuid": "fa91ebee-da5c-4dbd-9b84-817f60eb5790", "comment": "Malware payload (Amadey)", "value": "422faf24af2f3ffc95a2ca68d51b3157ae51652ffa940c910c3cfe72afdadfd0cdeacb9e8bb1a03ea3cab6b63b135170", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153732, "uuid": "4636523c-dde3-4886-bee7-d95deb8612ac", "value": "T1F6252347F7FC5822E4F56BB01CF647E3063ABD614A399287338FAD4A1871994663036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153732, "uuid": "fb7e0453-cff0-47ff-80dc-fe272b2da8fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153732, "uuid": "aa5e967d-af73-4725-947f-404627cb70bf", "value": "24576:9yNZbL2ffJ95XPg7UWRwrSckzYGanfF5kfW5sbB:YNp2ffb5XP+R+SckzYGa3ku5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677153732, "uuid": "3d64b9ff-09ca-4616-906c-7c84429849c2", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677153732, "uuid": "60cd89e5-089f-4ac0-9d4f-64fd77adbb21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677153732, "uuid": "c90b7f54-3adb-49cb-90a4-99b41a9a7f2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c087457-b39a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677171053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171053, "uuid": "aa2b33d2-3119-4dfe-97d4-8312dfd89051", "comment": "Malware payload", "value": "1c18970bb799f2a03eb69310eddabfc3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171053, "uuid": "787fca30-3761-4b49-bd18-f44c607d8851", "comment": "Malware payload", "value": "aee3ce577e43f036952eca4c8ad5ad9ef196d715af1d605b8addf06440f223fa", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171053, "uuid": "726996f6-b8d2-452c-a4e8-4fed3905c846", "comment": "Malware payload", "value": "919e010e65c85e7761cc4f58410246450cb4777b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171053, "uuid": "7830bb0c-76b3-4dde-a5f4-dacb10a32d3a", "comment": "Malware payload", "value": "46244ee8d2354c3a0a836b42a2130bd7916de42436db06d5e5cde38bf1e3947290f4a2490fec1b963953d9aa9d5737b1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171053, "uuid": "b2cb33f7-32f4-4f81-8e22-5a53bc08fecd", "value": "T13896232172955126C5FEC2794F37BFA521F1272983A240BBB5D81BCB34F26E09772A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171053, "uuid": "6e24a414-2d55-4afa-80d9-d0c9d4de5cb8", "value": "98304:EYFtMGAJJZMl1A8rXbupfZTFc9Io1K1mFb0YWiD2B0jdjMCwkYjQI7wI+Vmi1scC:96klOSbiu9leKND222byeY19HX3QDEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677171053, "uuid": "68b78d91-9a53-4ff0-acb7-c7bae7771693", "value": 9026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677171053, "uuid": "bb399c8b-6d6e-43c4-942f-11ff8c4b2b66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171053, "uuid": "9fb7fe2d-74ab-4251-9162-58ab2c67f673", "value": "FACT63f72.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e98656-b32c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677124090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124090, "uuid": "bf39b583-4c7c-4d0e-b74a-c16d507bd45c", "comment": "Malware payload (Mirai)", "value": "53dbf7dbbb67017cd9493523c733c619", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124090, "uuid": "e4e433f2-049d-4319-835c-4d3836675a18", "comment": "Malware payload (Mirai)", "value": "af3960004a286bf3cbccac6f2fc8e8c15bf417576d606dc61678448466760cf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124090, "uuid": "8662f485-e823-4f71-82ed-022e5bccec8d", "comment": "Malware payload (Mirai)", "value": "dfc063161a36fa354987764cbe436e32aa389e50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124090, "uuid": "8571a152-e7e7-4bd1-82dc-41deec09ad21", "comment": "Malware payload (Mirai)", "value": "1c8f93a3a190ad5f245a0b406ded45f9586721d0ca3c031176bf18de4cb3a68b83585b9cec8bf219e1748c67c5a522cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124090, "uuid": "d52565b8-1bee-46e2-b5dd-d7988e481429", "value": "T128332ADAB402AD7CF88FEABE80660E08B63132145193172777ABFDD37D32154D912E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124090, "uuid": "6430bf44-484d-487f-9f01-88e74f93af2f", "value": "768:RoeXICIhoO1KG0X9r8QBfjjgFHe7EGU7cKGJMf0w972ICO8pkY:aCI5hokKtliF0EGUcLMf0wB2IJ8OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677124090, "uuid": "36fa42fc-1625-4956-a5c6-a000aca077ca", "value": 52356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677124090, "uuid": "d2ded4db-52fe-4f97-9a84-38e5bb8f1286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124090, "uuid": "f7ddec93-3d75-4298-9239-266e9fdaa351", "value": "53dbf7dbbb67017cd9493523c733c619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6340e2-b374-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677154816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154816, "uuid": "76be3de9-353f-47e8-b464-795bda555799", "comment": "Malware payload (AgentTesla)", "value": "63473017568aaaa115361dff9aaa8b92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154816, "uuid": "21f95bbd-e1f0-4e46-ac7f-79a5f2e3f519", "comment": "Malware payload (AgentTesla)", "value": "afaf95c3abfaf5c45250e22bb5b87a6125771ed440be05e51d944ec2661df07f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154816, "uuid": "d988bbc1-4126-443d-a6f6-157a453898ae", "comment": "Malware payload (AgentTesla)", "value": "0e88ed60fa3df0859b3e3d59e5562c1cf1dbd498", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154816, "uuid": "ee52bf0e-fb43-4db9-9bc9-2df241ad5956", "comment": "Malware payload (AgentTesla)", "value": "ea378e8af048199bdcf295c8cf6339b20ed58798fa1aad6482ccacaf2ef2700f2fe91fb9883d6171326679feb07bbbd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154816, "uuid": "779a6bee-9fca-4e09-8c97-98e048f9f406", "value": "T1E0F4D37D39B796D2C234FA7386E3E520F6BD81923303D91999DA1AC04F42642BDCE95C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154816, "uuid": "d0edb238-15ad-4628-a5ed-406fca60909b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154816, "uuid": "bcfd5dfd-0757-4910-aa37-48fc36aeb030", "value": "12288:c40RBXIkegET9jsIBMNjnNNOhAe/S0G5qlRfIWSlBCXvfLq52jYikScUhYVHS5Uk:5BTsIBMNjnNNOhAe/S0g7gHaikSc0KHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677154816, "uuid": "b3f34931-0fc7-44a6-b02c-7103c75e32ad", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677154816, "uuid": "1d6215f9-3ffb-49f3-a399-5b7c8ddfe5f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154816, "uuid": "c356a301-da69-4fd6-8943-f89c75538998", "value": "63473017568aaaa115361dff9aaa8b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be20c727-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142065, "uuid": "b442d10e-978e-4df6-9408-911e4716a84c", "comment": "Malware payload", "value": "8474f06cd077d6ed5033864f965c243a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142065, "uuid": "b133a01d-d1f0-4f92-8d95-7f3bdf1d6cfd", "comment": "Malware payload", "value": "afcb8d6558a7eb44807a9918bd18e55bd0b1fa6fd617dd8477c848be42ff04d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142065, "uuid": "b3a96fc6-7a37-417f-9c09-c274d2ba4364", "comment": "Malware payload", "value": "7d82f7f179d3a4aad13a3a6b3af733a1c581b9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142065, "uuid": "7d19d439-914d-40a5-a6d7-4b2568c74f71", "comment": "Malware payload", "value": "ab0f805ab16c6da1834a9bd8f0720e853119195748d74e10e33dc292e7509b20314154f0c9435c894cc0e25f411ecf9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142065, "uuid": "c75ae728-5084-4e72-bd54-e030d3ebf924", "value": "T1717633A13F8400BAE48B9070C1DB6F44C96BFF3D8E328557978D593E27A84E19A193F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142065, "uuid": "377fa6f5-293f-4bfe-bf6a-e4b399a5ce99", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142065, "uuid": "190818c7-6068-4921-9c30-c1fb9714941b", "value": "196608:91OGSDZQA6y3WMlpVyjrwOHFp6o98UZDkysMcB:3OGS2Aa6awOHFp9zkbfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142065, "uuid": "7599f240-3433-4e22-b46c-a5f769d1edd3", "value": 7614102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142065, "uuid": "62f9e4e4-b6e6-4ba4-a9cd-efb58d9db24a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142065, "uuid": "8eac0c40-564e-4c79-bb2d-ef694d4b87dc", "value": "8474f06cd077d6ed5033864f965c243a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa39eb3-b397-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677169690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169690, "uuid": "b836bf59-8595-4758-98a9-b089ad632c05", "comment": "Malware payload", "value": "0658e9ec72a2a6f52f67f863e1a0168c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169690, "uuid": "4c116ae0-949b-49b6-bf08-a22f256d2963", "comment": "Malware payload", "value": "afcd9a2b94d0109f2265259b07678cdb45d31378aa94f251f36b4185d02a19e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169690, "uuid": "e32c32e0-aa4b-4f46-a247-d4d76858e006", "comment": "Malware payload", "value": "973ae7f17feccaba087132e02f3a15996abf6083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169690, "uuid": "69597ead-17c6-4b74-8c6f-9cfcccea6e8f", "comment": "Malware payload", "value": "0b6390548e03921f93a4f2546ae8dcd41880e2849b80d54a80eaeb39827b68c874bdb2c46fd29ff6feb53cb906ad1e66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169690, "uuid": "96629f4d-d416-4f58-800b-82a97c9ba2d1", "value": "T1F7135B6186D44831DCE379B091ECF6236A7FA3B10B50C2D7510AC6E98E917C1BE396DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169690, "uuid": "91240225-1e15-47e6-a2c7-f03f7fc66420", "value": "e8903a91fac478cd21d705b88ceaa8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169690, "uuid": "77caaffd-9b91-4935-8dd0-fed24b692725", "value": "384:gNVC+Vz6CIoj5obaikIjXcVx9SoFABb9G0CMF0KgC+pN4rng0N8qYpzlnh3HGlGb:glVv/ICLSBR9NCc3jJYp33DMEQh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677169690, "uuid": "9b42969e-8983-4acf-96f1-4fe7a38fe0be", "value": 42848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677169690, "uuid": "5253e5b7-6577-400d-a2d0-b700d5e8fb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169690, "uuid": "c13ff2f2-323f-42f9-9760-80e490b70597", "value": "SecuriteInfo.com.Win32.Application.GlarySU.A.599.26521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edb4caf-b394-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677168588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168588, "uuid": "59b146d7-43a2-4d46-8472-290760ae6753", "comment": "Malware payload (RedLineStealer)", "value": "953ab406845089cb7925a8926aff3b59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168588, "uuid": "8b7b58bb-b0ad-46ff-a052-fbada9149cdf", "comment": "Malware payload (RedLineStealer)", "value": "b0627436faa99e47e4bb04f588fd047986147887a03c25a92cbd2348e0fba4cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168588, "uuid": "77443f4c-8cab-4f19-8f89-dff1968b00f3", "comment": "Malware payload (RedLineStealer)", "value": "47a5f2408f6b424667a71160cbb9ae558e9f06d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677168588, "uuid": "d050d2d2-ee59-40cc-9295-dca37e0c5551", "comment": "Malware payload (RedLineStealer)", "value": "a6d1fc16a59a089409bf3f667153512621056d5866e94da7958daf0af58c3d2678b176eea72a0aee4c52994202a81904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168588, "uuid": "d7aa1654-6257-4cc0-9d4a-4bc70587e40e", "value": "T15325234793E88136DAB9473018F743E309327DD0A57843963B5AAD6E4DF36A4A63133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168588, "uuid": "d2cfa248-2634-4713-9a48-485b4b240fbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168588, "uuid": "488ba8d5-8a80-4f87-9d54-54aa64880c16", "value": "24576:0y8RfFSbdGz7FhwTVPM51mKJBQ/LJmpqyhTP1+T7U:D8vSbdGQVPg7fKLopp1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677168588, "uuid": "d286faf7-3cf3-48d3-90e3-deee0ce15545", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677168588, "uuid": "6ecf9e81-5947-48b2-af88-14c1445e1b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677168588, "uuid": "75417447-5832-454c-ae5f-6df305e04a1b", "value": "953ab406845089cb7925a8926aff3b59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac286e9-b315-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677114035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "d253f690-ba46-4dc7-b2e9-90353b9ae934", "comment": "Malware payload", "value": "ac64f6ed06ca35a575827d0dae1552f8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "a80ceb78-41f8-4109-8946-88e744d0b859", "comment": "Malware payload", "value": "b0e6efc3b70688bd0240fa6b0406abc6a308f12bf365af35d1c7845676239ffd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "d0b9522b-903a-41ef-bcf8-a99302a105df", "comment": "Malware payload", "value": "c2f413cdf8ca94073f1a3aeee2eaa0a6fbf66f1c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114035, "uuid": "d3d2773a-f405-4d39-93b7-a283bbbbfd68", "comment": "Malware payload", "value": "f1c613071878eafe6ccffd0495bf5907d2ea274f04d948fd3438f8d5beb89d7433a780d89d9ec1d8ccc7b428950771ea", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114035, "uuid": "5f051701-0f4f-4894-b29b-e4bde4216838", "value": "T15942C5521B8C59F1C368E0734225540B14BDB1AF33961AF9B89ED5A237BD30D5AF82F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114035, "uuid": "afab206c-7dc0-4866-801b-9cf6123c7916", "value": "192:Q4QDtHyXSkmYNGrdwamVdEOmaWBt1UDGY/GCfOFxFOHGTLeLBJ5qw7AUDL8RgsJy:Q4e0CkNWwHVeMeUBfuxMYeLBDqwEI8Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114035, "uuid": "2d60f7de-d039-4e6b-8873-59cf3e28f574", "value": 12061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114035, "uuid": "32468900-80fd-4f04-ae28-7043e15da33d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114035, "uuid": "a1ae047c-7ea5-4f0e-a298-180c8846cf5a", "value": "ac64f6ed06ca35a575827d0dae1552f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cba7b49-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192046, "uuid": "94c32744-aae8-4885-a6e8-c9775482d703", "comment": "Malware payload (Mirai)", "value": "8f2162b9e9cd9be2d5627835faac46b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192046, "uuid": "7c2ff6cb-01e5-4b17-935a-007582c2c602", "comment": "Malware payload (Mirai)", "value": "b17794e8f997edcaaf927f2ba856f4d1d17e32d86049f50601bb4c8cc88dd5f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192046, "uuid": "f1763e75-cd93-491b-8f25-9e88def908d7", "comment": "Malware payload (Mirai)", "value": "dd3177f11067efbfe3c8acc2bf5b8f61ba3e68f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192046, "uuid": "60ff7adb-79dd-4985-a19a-6cc370bcc77b", "comment": "Malware payload (Mirai)", "value": "b4cffeb8850356ea56bb6dda4200cad4de1b63e1ac193a6b971954f2e35df833e39155ddfe678910b161fed4aad99f5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192046, "uuid": "7dce85af-06d3-4f87-8a15-33db19aa798e", "value": "T111A2E019BF28818FCC36297555E9E5D21393FC62F2ADCC096940C16FB5A33A96834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192046, "uuid": "b3de34da-05d8-400f-b9a6-53ef62a6c824", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTY:O98o08kxofBE+ZkXaITbp2F2TWul0c5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192046, "uuid": "8b9a9afa-7f02-4d36-85eb-8a203db7171c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192046, "uuid": "7cf9186c-6f69-4f5b-9085-44e4cb08873e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192046, "uuid": "d7cefc6f-ecd1-4376-b817-97e43adbb535", "value": "8f2162b9e9cd9be2d5627835faac46b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5799fcfe-b346-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677135021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677135021, "uuid": "40742bf3-9a90-4d7f-9b8a-9c23cbfb9c99", "comment": "Malware payload (njrat)", "value": "4cb86eadbadba68752d539597e6ab5ad", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677135021, "uuid": "6bba1761-cfbc-4c51-b903-6d391f6e9e47", "comment": "Malware payload (njrat)", "value": "b1b114c09344edc0be3459e3a93f47ef584df37b58500b7f420f8232e7cac6f5", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677135021, "uuid": "c4c15a85-d8d2-44b6-8c4c-8f59ea06f1cc", "comment": "Malware payload (njrat)", "value": "3e1682855ad4035134f6ebd68d56824535b4ca03", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677135021, "uuid": "9a28cfaa-2fdb-4ee7-b01c-46abbd6eb00a", "comment": "Malware payload (njrat)", "value": "e8ad4053de87dc57170a119e749a0a39e402ab673634600414620e4ffcf40921968a423e851f1340046042c9689e4f46", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677135021, "uuid": "e78ba635-33ef-4571-b2e2-44b9770b47a2", "value": "T12324A511BEAF204976D31013A7FFF5F58B3EE1927B19D49A289C074847D5F86C8A0A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677135021, "uuid": "9898d820-35a8-473b-82a1-6e2352a22d8d", "value": "192:qEo4cwiS9RSBzHqlBZFrtzKZ1eNEQii1WEjiX1vq:oUidzHqtKd1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677135021, "uuid": "1e39d258-96f0-4e36-8f9c-6a12453f4d20", "value": 222878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677135021, "uuid": "8d46a7fa-8ea4-4abe-ad0d-4b5c80c97cc1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677135021, "uuid": "6fe271b5-247c-4ad7-9986-c0f813bcdf3a", "value": "DOCUMENTO (FGE).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0040b1b2-b3a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677174388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174388, "uuid": "3d658a88-36a1-4fb9-a308-9d7e04540ae5", "comment": "Malware payload (RedLineStealer)", "value": "d208ea886f61e27709f86bd14ac5c301", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174388, "uuid": "279f1aad-7973-4e61-87d2-5a99dd4c7fa2", "comment": "Malware payload (RedLineStealer)", "value": "b1c87ef62fa53f053801cb96a105fa1e3164f11b110babe210864181b3620614", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174388, "uuid": "b4e3c888-d590-4c69-9238-60ec64625c77", "comment": "Malware payload (RedLineStealer)", "value": "475bcaaade5105a21acd8490c5b444314b1335d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677174388, "uuid": "7d95c1f1-9345-4ca9-8159-1f19aec09f68", "comment": "Malware payload (RedLineStealer)", "value": "412502eb6d85c1f637b53d3951ed2aa795c0c6a9205be370ddc5d9272a19cc15d9f2fc4f1a5003bcc4542fde397273c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174388, "uuid": "8edbcf24-6433-4b4c-9a14-0c38c72209f8", "value": "T16094F20BA7FC4026E8B567304DFA03D30A36BD906A79935A634F6C5E1C725B4AA31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174388, "uuid": "fec6bbf9-20a9-413e-8725-09508a695acb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174388, "uuid": "f067e6fb-d1a3-45f0-9dc0-019ac2166918", "value": "12288:SMrJy90/ZhMgDbYNLOBHiZ1nqn08Z8bmhTsQ:zyoh12LOBA1qdhYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677174388, "uuid": "d8be304b-5f92-4195-87b9-563b766653a8", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677174388, "uuid": "bdb57010-9b76-4a74-811f-5cc47231a7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677174388, "uuid": "ec61b0d9-dfcb-4666-b36e-83af577312c9", "value": "d208ea886f61e27709f86bd14ac5c301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9cf08b-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192124, "uuid": "1eee05ad-a04a-42a1-9dff-f5e4ab9ce794", "comment": "Malware payload (Mirai)", "value": "1cc8704c4cdf00a30197cf2c3e2396b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192124, "uuid": "542ccbf8-8d0a-4d87-97e1-cd5b6851a6d3", "comment": "Malware payload (Mirai)", "value": "b36371c796728607d608cc75d0d0ba0fa629758ac127a184c53495d9e6b9abb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192124, "uuid": "2cfe36d8-0e74-4e24-9632-f5295d6d2eb3", "comment": "Malware payload (Mirai)", "value": "7cfe687c546017d5e550dec742e7c9b9dd9af027", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192124, "uuid": "8a4a5e2b-191e-461f-86d9-ffbfe5d85bc7", "comment": "Malware payload (Mirai)", "value": "f0e8dfbd97648df85812fb560452576293127005012bae6d1f2b8994bf149512367c89e8dc0a6b1e7f74cd123385cd8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192124, "uuid": "7fc8868a-7807-4895-b65b-29e30b6a16fa", "value": "T12782DF3061AB74E8CBF10430EEEECEC6971A0BF8D1FC36D216596B78895510661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192124, "uuid": "1d430b7a-2a66-463f-b010-6500bc7112f1", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMathymdGUop5h5lK:2dV0P6+kom0tVAoNvm+to1ts3UoznlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192124, "uuid": "bace534a-ba34-4a92-99de-0bf353484666", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192124, "uuid": "487a2398-a5ca-4831-a59a-377c90f4d9de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192124, "uuid": "9b703294-d726-4b1f-8601-ad72d4be961f", "value": "1cc8704c4cdf00a30197cf2c3e2396b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57d8e00-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128709, "uuid": "805ba345-7446-4ea3-9ea3-8eb07d55aa08", "comment": "Malware payload (WannaCry)", "value": "d2e6347bdee37c922cfeed0e2c5c27c6", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128709, "uuid": "e75f827a-7848-4bcf-ba49-cfbb4096952b", "comment": "Malware payload (WannaCry)", "value": "b3be7cf75ded8a3dec4a78a9dcf32ff433ac5fa5743d5c27b77dd67f9d6a427b", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128709, "uuid": "4eb7f20f-4ea9-4e86-b937-49ab26ed076e", "comment": "Malware payload (WannaCry)", "value": "02a2f5c503e63e9999e41418becb0f315dad6021", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128709, "uuid": "abde7de8-3bfe-43d7-9729-6d3bb5c76f1d", "comment": "Malware payload (WannaCry)", "value": "4bfd83e6d1649f283c859e5fb7b158c632250066dad9d6bead52d358a92f344506467fadded6ac496cfa08b9ae23ee0c", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128709, "uuid": "409f6c61-2f5f-4acf-af00-e2c86011776f", "value": "T1A1D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128709, "uuid": "f49f84fe-91fb-4cd9-bc0c-adbfd2e4ebfb", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128709, "uuid": "560eeafa-0dba-4b9a-90c5-0f931fd9e844", "value": "24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEJw:BSy6PX3PpM+P5IdOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128709, "uuid": "8281e96b-05c8-4a35-a6fa-292bacf65a7a", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128709, "uuid": "498b9fa0-8ce7-406d-9522-d750a995e4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128709, "uuid": "f2c694d6-c3d3-496f-bb01-fe4faca319ee", "value": "2023-02-21_d2e6347bdee37c922cfeed0e2c5c27c6_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec42b1f-b37a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677157448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157448, "uuid": "de01daeb-3b00-4426-ad5e-ccdc5ebf4551", "comment": "Malware payload", "value": "be91688259bce9e527e03f71f38e72e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157448, "uuid": "34d868df-8abb-413f-b95d-68bba34fbd30", "comment": "Malware payload", "value": "b50859d6de2a8b9c85dd84f0b19a956ba2029fd833639f20226baefb8b82ed0a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157448, "uuid": "df5eca1f-e722-4b0c-8530-a3f96225c5e3", "comment": "Malware payload", "value": "12b1cf1e8d1149734395038ebca455fe108c8ccd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157448, "uuid": "57e81788-091f-4151-87f5-3f32a401a1da", "comment": "Malware payload", "value": "4a059ee2abfdd131f85a3b72c703469eceb6dd07646fabff0ce491e141cacb7c5090ee734194511f8522435ae016a103", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157448, "uuid": "fe808177-eac1-4894-999d-a885747c3b4b", "value": "T18F227D2CD501BA2AC171447DF02946B4FA1B40BBF652BA3B205577ED0BA13C747CAE6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157448, "uuid": "46afc2b2-e5e3-4a86-8ebf-99f2a41335db", "value": "192:ScIMmtP0xfUW70vG/b3kgOi4OYTZus+1pReDnc37+Rl:SPX+si10ni4OY5yeDnMin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677157448, "uuid": "81a01092-257b-45da-a1f1-cb704de91768", "value": 10373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677157448, "uuid": "0431f5d0-8d23-4b50-bec4-748a47c93284", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157448, "uuid": "d28ebc2c-d206-420f-bd0c-cb1fbb3aa723", "value": "Purchase Order No7000008677.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b137421f-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1677128729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128729, "uuid": "ebd05b4d-8214-45e9-82dc-7812f15573e7", "comment": "Malware payload (Chaos)", "value": "fc8f90d54cf4a276022ae891f1bc49e8", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128729, "uuid": "88d2bb90-78be-41a5-b87c-665f5c3390ec", "comment": "Malware payload (Chaos)", "value": "b586e6e1dd405982901351980cf6d32f9ff3702887508d253101136b325622d6", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128729, "uuid": "b2ce54cb-c70d-4cc8-af07-bab76be960c4", "comment": "Malware payload (Chaos)", "value": "96f0583c5d4acda892f963159f955135679157c0", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128729, "uuid": "ac9d33dd-3047-4f27-9d90-7136de86f579", "comment": "Malware payload (Chaos)", "value": "a714823a18ece10ccdcc7b11e801d7851f9b918c70b3bd9c6d6158d5b49c903f5a8d93fc50ec706079a6eb0036f9c76b", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128729, "uuid": "12a20a07-4089-41fb-bb07-54026f12e1b1", "value": "T160D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128729, "uuid": "70a1685b-3ac1-48e0-9022-ad8bba2fdd81", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128729, "uuid": "d52013fd-020a-4866-9833-0dc277dfda5d", "value": "24576:WS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfERZ:WSy6PX3PpM+P5IdgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128729, "uuid": "1ede9568-f476-4ef9-9e3f-536c2a1bd363", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128729, "uuid": "d855eaf8-b20f-425c-b3a0-fa8a4d9c3de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128729, "uuid": "423cdc12-68eb-45d1-b270-05be048d3e32", "value": "2023-02-21_fc8f90d54cf4a276022ae891f1bc49e8_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e108fe0-b35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1677145743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677145743, "uuid": "e98df7bb-ae7d-48e7-bfd1-1fe24c6d8cc9", "comment": "Malware payload (AuroraStealer)", "value": "cc1ea92ccab2960cedad3783799f56bb", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677145743, "uuid": "a899f3b3-baee-49f7-bcaa-1f06c2d76757", "comment": "Malware payload (AuroraStealer)", "value": "b5c486b05ed054bf9433bbfcb3d26e02eee06243435adf105307bc0d193af4d8", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677145743, "uuid": "d279b65c-b09b-44a4-b231-263b8916a73f", "comment": "Malware payload (AuroraStealer)", "value": "08c93ee33fc4c4486b710781da848acb259233c8", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677145743, "uuid": "5bf70dcf-35ba-4022-a854-40aa6286c391", "comment": "Malware payload (AuroraStealer)", "value": "4eff757b27d8fb7a1a9f084f505f6fe33597d7bd9272a521db3e20cf5d598900e63314791e1972680f1f51f9fd02ca81", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677145743, "uuid": "9cca7c3f-8a86-4712-96ad-35fa584ed131", "value": "T1A486BFB979047CE6E66F427BCA96ADD8137139224B97A5CF4060B7D709733F4EE22804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677145743, "uuid": "59452b08-1a4a-42d5-a2ef-27c522f1f72d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677145743, "uuid": "bebcfeb7-ed8a-4bee-9792-3ddc0f8aee70", "value": "24576:mATqsCp2Y4QpiwrVFwPteCpZTbceUIqzjoLh+joixy//qE522wuZ3/cRDJRkAYq8:pqsCpx4RwrVaoCrgk+lK1EbMz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677145743, "uuid": "68705a50-8b27-4ee4-af32-49287e2ed4f0", "value": 7854592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677145743, "uuid": "b3bc27db-dc7b-477a-8184-d425c90c5670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677145743, "uuid": "1d3d7e50-dfd7-428f-9c44-778043a7f8ae", "value": "cc1ea92ccab2960cedad3783799f56bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060bc01b-b358-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142615, "uuid": "614a214d-0be2-4077-bcdd-1f5b02b44102", "comment": "Malware payload", "value": "4de4b3f5e51dd6957ef3044baba3db7c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142615, "uuid": "0aa6de99-a786-4d29-b828-db923a38968e", "comment": "Malware payload", "value": "b65345186c0259851a4c3fa827bf8616b6b98dd04f3e427888378b751e929dd5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142615, "uuid": "464443a1-46cb-48b2-a15a-6a2b445b6880", "comment": "Malware payload", "value": "e92941ce86e4b573154b509a72bab2442b8257c4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142615, "uuid": "c32e75e9-768a-4c68-80b0-e25254f42ecb", "comment": "Malware payload", "value": "d191a35c18f8f2c3646268594a7fb528fd0bee80ba4d4f614a0c69f231514c49e1ebed82b517d9b12bf1fa11c3dbc65a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142615, "uuid": "a0990c92-86ff-4b80-87c8-808985ec704e", "value": "T186173322A2C7CA32D11E027BF529FE1D0538BE73073111F7B7A4395F59B58C1A6B9A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142615, "uuid": "57fe9498-5a08-47b4-9e67-8876638904a8", "value": "393216:MPwXMT+bs37l4T2rOE8M0aa2vytYC+/7ntvCrGtUtkSuwx:DXEYa6At8M0ahyGZjZCrGatPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142615, "uuid": "bb5ceac6-978e-4370-90ba-83de68d03460", "value": 18899456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142615, "uuid": "2bf1b2a6-44cb-40fd-b756-4f3412c7dac6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142615, "uuid": "8be84957-c5f4-4815-abed-9f723c379193", "value": "NFeNFCe.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c311ef-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677136179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136179, "uuid": "3d315e13-1d3e-47e7-a3aa-e36cc0aeb9eb", "comment": "Malware payload (Formbook)", "value": "67759cdef5bc28e30e5d626fc262faeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136179, "uuid": "73e2cfc0-a1f9-4c09-bf25-016f7ce1fbbf", "comment": "Malware payload (Formbook)", "value": "b6b4defc23fd79807ed6c5a4e2a111465c3e444a6efd07e837fcfffa4a19b688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136179, "uuid": "88db8261-658f-4734-9857-40ad3f3b7d5c", "comment": "Malware payload (Formbook)", "value": "be489285f6b746d48a9f4eed0bd2e7303a0d225a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136179, "uuid": "49483081-2f87-4732-906c-0fce864beb19", "comment": "Malware payload (Formbook)", "value": "e483e227bad6cba0172f53586f526bcf95775b0b0cef70fde1baad1f732d15a8d988ac11b9b99e4158cf0165f7b9608b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136179, "uuid": "7285ff32-4a6f-4eee-9f84-d714c9bf08e5", "value": "T1E094D0C58D8DECC2F81312F07EB6DB9A714FBCAE45A046093627BA15A4331532A37767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136179, "uuid": "90495592-3a7d-40f9-9112-939b8df279c3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136179, "uuid": "fba12d50-70d0-4bf8-a41b-0be927a8daa0", "value": "6144:SYa6/M/p5HwVKSmyjUJdxNMaXJz0uU9D+lpZ2vqC7FZ9TPIPNsIuypA6o1h:SYpM8oSmyw1XpU9D+rZ2CC7hgPN5g6Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136179, "uuid": "d84040d8-fb04-4228-a435-97cb4d66d2d6", "value": 424029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136179, "uuid": "7e77cd35-4088-4745-a2bc-19075f4897b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136179, "uuid": "9ff1ef69-eb4a-40ea-a98a-9e0047c42cad", "value": "HSBC Payment Advice _pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e088b3-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141996, "uuid": "a225ccb7-a9db-4b28-8fd1-6a04e052da8c", "comment": "Malware payload (SnakeKeylogger)", "value": "b155baf70f03778b09755663f21a95af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141996, "uuid": "5ba06d41-8d56-43ab-a601-e06d7d215723", "comment": "Malware payload (SnakeKeylogger)", "value": "b932e7ec61f1cc9b3c858a55eb883accf378580572077c2676adcf2a0aa8dde1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141996, "uuid": "455ee47a-8030-47e3-984b-1a1f8882eb51", "comment": "Malware payload (SnakeKeylogger)", "value": "37a097d4c0b14aefad2f0bd04a048362992ff539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141996, "uuid": "f1d6e23b-202c-4912-b2ce-680e5d7d3b5b", "comment": "Malware payload (SnakeKeylogger)", "value": "a566ab6c37b7a3a0c840e1a1954f7b3cf0daf76979b8b7ac70091b8919f43bdaf516622933208f2bc06d06cf6c036224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141996, "uuid": "7c2a4a2d-2ffb-4cf4-9889-363aa3391b2d", "value": "T1FC057A8BB7F0A077F99E41AD063816CF5D31A243728DE2265F7B69488D86DFBB1C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141996, "uuid": "1ae30b74-d86e-4578-b2f5-cc3d166275bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141996, "uuid": "97493990-e382-4898-a334-98c0940594d0", "value": "24576:k1FsULby1hDePmvRwR2AMYKjVV4iCtcu:kzy/DMR2A1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141996, "uuid": "963fc00c-ea1e-45a0-b491-44f4683ed3f2", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141996, "uuid": "0b7f5311-4741-46ec-bb8e-44f2b0a230b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141996, "uuid": "0037bb1a-b40a-4fa0-b149-6e349eefcb9c", "value": "FATURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef76b12-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1677128537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128537, "uuid": "ced0f7df-2345-4d47-b6b2-4c4e85dbe888", "comment": "Malware payload (LockBit)", "value": "1e9e399b7a31cc85062cb039bae72a44", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128537, "uuid": "71772a0e-e1a3-43e4-a328-b2f950bf42fd", "comment": "Malware payload (LockBit)", "value": "b9d3d54532bcc21e9b05754ae0a2f81df5434e4dfd1fcbc840e5466ca38d3060", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128537, "uuid": "4dde8b18-4258-4999-9aa8-ec27f1f70147", "comment": "Malware payload (LockBit)", "value": "3702b81069cbb9251be59f85d25c54b55443ae72", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128537, "uuid": "b78b92a2-ff3e-427f-83f0-120e0e0b7b88", "comment": "Malware payload (LockBit)", "value": "aac3edbcd86d62ea22db2d4b38e216a3a2479b248b8326fd75758179671d03910e4299a0d86d85d7b58fca712c8192a6", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128537, "uuid": "eb7fca9c-9334-495e-8001-96c17414c790", "value": "T111253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128537, "uuid": "f125d558-0fdc-4a22-a06b-32bb0c5363da", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128537, "uuid": "7ac12107-50ab-4701-88ed-19431cf8cbd1", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdxF:Ujrc2So1Ff+B3k796n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128537, "uuid": "67aa7acf-203a-4476-b256-8883a0cc7b54", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128537, "uuid": "1d17b2c6-3496-4f1d-9fd1-065b477c0155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128537, "uuid": "0b2a65e0-91f7-4eba-ad13-ff5a2b95a9cc", "value": "2023-02-23_1e9e399b7a31cc85062cb039bae72a44_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b43ae1e-b349-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677136235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136235, "uuid": "36dc0155-0b68-432a-9345-bd8c897d9556", "comment": "Malware payload (Formbook)", "value": "f9ff9c94038d929c42683d68d497b031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136235, "uuid": "3c9dfeed-0f74-47e2-b557-f3a2d78d920e", "comment": "Malware payload (Formbook)", "value": "b9fb6cc26328ecd1dfcd7f7296d3a5da0bbf305bbe86484aebc0a03c7162e876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136235, "uuid": "090671c8-44ed-4d5c-9088-53620f96c6bd", "comment": "Malware payload (Formbook)", "value": "4f9b0b2c5a835f22ab69e1803f0ebfef86dbead1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136235, "uuid": "2889e286-e58b-435a-b81e-77471f098235", "comment": "Malware payload (Formbook)", "value": "4a0d7a45005f2ad9de2273d4b1dd5273f9050071dda4c5f2388f05a562dba5b492c584ceee05fd48c1486fca3c3ab3c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136235, "uuid": "9fc4391a-7c71-4bda-beb9-9e41a6b10ad8", "value": "T191D42356AE85DB77D4574F3C8E306F067EB2D42340385B9F1712118EB8A1095EF2EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136235, "uuid": "e74c9436-1c6c-46c0-8e7f-194a819e1642", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136235, "uuid": "9caedde8-f90b-40a8-950d-03ddaae73b80", "value": "12288:PYZ3BRR8m5LyoWMxOcgViQO7qpNX/cK9EzIs7T7mdfaqyCZBImaq9D4CFFmvNmEh:PYZ3n5GDMXQiQGS/cKCUs7T7mdPkmaee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136235, "uuid": "e673fecb-9589-4d10-b06c-d6c72a13afc5", "value": 642052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136235, "uuid": "f93ff94a-8c17-4330-b1e0-643bbdba13c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136235, "uuid": "11b764f7-e5ce-4128-8510-39457e32285d", "value": "Materials and Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af329a45-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677142040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142040, "uuid": "821a728e-a28d-478d-88a8-13b07ba32878", "comment": "Malware payload (RedLineStealer)", "value": "1d41d93fc053f358872aaea55309e034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142040, "uuid": "b5e8fd6e-aeb0-4a19-9e31-4b33981903ba", "comment": "Malware payload (RedLineStealer)", "value": "ba0c6fac5914eef2831c584d15b99f8c2a0e16026ace23725ccfd5eacf3a2697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142040, "uuid": "9b4f6261-d938-4c49-b25e-6c002bd0b9c2", "comment": "Malware payload (RedLineStealer)", "value": "47129f9d239382505476e37ee334f8a2afc8a4ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142040, "uuid": "6f64590a-8a6c-4d73-9ba1-b84fc8c23431", "comment": "Malware payload (RedLineStealer)", "value": "acecd3911e762073030247bda7d1e8fe4bc7c33c3690b5793ae3e32dd89098604c0b4d783aa81aea978015cc5bce0449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142040, "uuid": "efc7780c-0db5-4a5e-88a1-b5c8a386a708", "value": "T160252207A6E8C036E8B457701DF202D309387E515E78839E275F9D2D8A725F4B1367AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142040, "uuid": "4b6943fb-1285-41ac-af8a-af8140e98626", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142040, "uuid": "f8f4fb92-6bd8-4dc6-a590-d1912aa288ee", "value": "24576:4yOG8Bxj/2ICzsS/dkpI8vk/CYsxl3tpjPoXAhy8w:/OG8Bxb2ICQSFk1k/C1xlbjQX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142040, "uuid": "e0153e2d-1f40-47b3-b585-61deb7a438ec", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142040, "uuid": "dd68b8f5-7c0a-4e64-b107-10ebd1d400b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142040, "uuid": "1d67f3d3-612a-478f-8fb6-c1e0f1ec96fc", "value": "1d41d93fc053f358872aaea55309e034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd0bd8e-b381-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677160236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160236, "uuid": "f4b96144-667d-41fb-9587-ad582b928b15", "comment": "Malware payload (RedLineStealer)", "value": "df2f77184f6c16c244f84b5d22cbbe82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160236, "uuid": "93c4aa95-3486-49a0-932c-c36819bd6537", "comment": "Malware payload (RedLineStealer)", "value": "ba501ddba67983ad4f5e43bf7788235e702f5b758afafb8ddc2cb610dcb1b11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160236, "uuid": "52360653-7d84-46bb-9225-fafc786c7e9a", "comment": "Malware payload (RedLineStealer)", "value": "057cccdbdc472bbc8fca0076d9af1900ddfa5182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677160236, "uuid": "9c40f917-b221-4f32-bf08-632ab7a1c89d", "comment": "Malware payload (RedLineStealer)", "value": "6e8c1ff29f02bc7899793b833511b8b9f3190abf5362d697a929a93e98b00df065a796f4a47479636e211e8297705235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160236, "uuid": "733e900a-74cb-4c8e-9737-8af05288b370", "value": "T1A1251247E7CD9036D4A92B305CFA02C30536BE905B748A8733CA795A1C636A9B63573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160236, "uuid": "09c917d3-3c13-4478-bb9d-d74001d0131e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160236, "uuid": "379b49e1-38d2-4ab7-9f91-81d0256ccbf1", "value": "24576:vylW62/2aRtNBB2bsbeUh62ynykEQvBZxE2Xu:6lkLBB2wKUlvdQvBZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677160236, "uuid": "c6d054ef-fa6d-4c72-a23c-d91871f9ec38", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677160236, "uuid": "6da8caeb-a81c-4dca-b015-986905a7ff53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677160236, "uuid": "93011d81-d05d-483c-a70c-370064db529e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436d26c1-b377-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677156033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156033, "uuid": "04038eaf-80e5-42f3-8c44-540e1bf9af19", "comment": "Malware payload (AveMariaRAT)", "value": "117d45a1a70dba08bd9f49c581717d62", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156033, "uuid": "1da4c8ef-3225-44f5-a74b-886dac6bc844", "comment": "Malware payload (AveMariaRAT)", "value": "bc7dad4c86fbdbe3bc632b5aa8c75b3719ec38aa70ec63bb55845752efd01350", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156033, "uuid": "a36a42ba-f41e-4f22-85ec-3e83e4b5deb0", "comment": "Malware payload (AveMariaRAT)", "value": "5d9f304c36677dbc50e225c53ed2daef0718f4bf", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156033, "uuid": "66fc9592-7441-4609-9bb9-cabb334ae36e", "comment": "Malware payload (AveMariaRAT)", "value": "4c2ef5f3c9809e7911a005e44c6bd57400a97f230f5b9d6b7012506534612e0490001ae33afd3fa45f4cccf1f837e10c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156033, "uuid": "593deff9-1079-4eb0-8723-1cf13b001a2f", "value": "T1AD541203A3A8D6EBFDD25A334D658F6586FB443124D6971313C0B79EBA31B40962DB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156033, "uuid": "5b80f056-b3e6-450c-9ddb-f795af02aadf", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156033, "uuid": "0ae5873e-ed2f-43c7-9638-bb1a8ff8cd1e", "value": "6144:2icFyL6SgUo3Mv97fqEJHvbR02vN79QD8CchMehu:pP6I9TPPbRFV9UeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677156033, "uuid": "70e4b0b1-f83f-48a5-831b-fb0d36ffe59f", "value": 294728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677156033, "uuid": "8693724a-d572-4ac2-80b2-1657b1a46b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156033, "uuid": "ac9dc723-526d-414c-8009-902644b500ec", "value": "Quote request (Iberia Express Aircraft).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908a7af1-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141989, "uuid": "b4383943-5d09-43ed-a952-daa6115c6efb", "comment": "Malware payload (SnakeKeylogger)", "value": "1c27f06522add031c2bd73a3ed87062d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141989, "uuid": "65377e24-0a5a-4aee-a658-05d8ec6169fe", "comment": "Malware payload (SnakeKeylogger)", "value": "bd5a7a6a82bed775b46a3511b6c62f765a2aca7c1c73a3b2c1e1fa2bc5476664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141989, "uuid": "225c5cf2-667d-495f-9a54-252a3513a829", "comment": "Malware payload (SnakeKeylogger)", "value": "cf3b3ca2c0e4de765455ee4667561f21b03c3333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141989, "uuid": "2ad410a5-18b8-4579-8626-fd7c12ad4882", "comment": "Malware payload (SnakeKeylogger)", "value": "e0d9d966ded377727958e5a966dd573282a96cb1553f92f5110feac0c1608e010dc2e1f122d2213e2ed611a6466723ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141989, "uuid": "9226a4a0-0c2a-44b7-bc6e-1e6b182afcf7", "value": "T1C9E45A9CBCF2EA3ECADA8AB92F003D340FE575C36920D9E5E3A9F6C11B35152095D425", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141989, "uuid": "2b32ead4-00fc-4cae-bbe0-4ec0c74c67d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141989, "uuid": "2bf6fa64-5633-4558-98b8-1034393a9888", "value": "12288:nzWqDSuvDsv9tWJy/Yr1kXcBQOlknl+eAXS362ZgZBSDsv9t:KqDSuhHr4fAilKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141989, "uuid": "2625c6b1-21a4-4d06-8fa8-8ff09e0dba32", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141989, "uuid": "f97396c4-f6af-44bf-aaca-6be869c2e751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141989, "uuid": "3f849fdf-7c15-40f5-9870-3a693e3f27c0", "value": "1c27f06522add031c2bd73a3ed87062d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cbc107-b3c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677191359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191359, "uuid": "75f5f0c9-73a2-463d-8317-6c68cd2692ae", "comment": "Malware payload (Mirai)", "value": "de597c2bb94b110e12273b5170d54f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191359, "uuid": "bd413c76-22b0-49a8-b676-d41745caf32f", "comment": "Malware payload (Mirai)", "value": "be7430397b5bdd898a25ec1337e684022d1083a222e7d7ed2288e4f1603a370e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191359, "uuid": "64c6616e-b02b-4b48-b717-28f440bdf626", "comment": "Malware payload (Mirai)", "value": "cc682a95a3919df694cf541ac79644818099a268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677191359, "uuid": "4c7a2218-6b61-46e0-92f5-9e9c5e2aff55", "comment": "Malware payload (Mirai)", "value": "e3a75d8ea296ab1f5e4c21d498805d783705fb7f18ddfd3f4889988371ce9bc1ab18f74a19520c33ae7c56e11c931c0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677191359, "uuid": "9ff4e6b9-4535-4a2d-92ef-1846718d59aa", "value": "T15A336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677191359, "uuid": "59fd328c-c33a-4f4a-9ed0-66ceeed8d6c4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677191359, "uuid": "e5cb5a58-da13-4eb3-a3c3-dff24270c90d", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677191359, "uuid": "1c2d3bfa-5519-4d27-9e13-38e8faf83274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677191359, "uuid": "deeec3fb-dbec-473c-a9da-0a078306ed10", "value": "de597c2bb94b110e12273b5170d54f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d11604-b373-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677154445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154445, "uuid": "7d609412-5088-45fb-8d8f-4ffc67fd63b8", "comment": "Malware payload", "value": "1d3b317289677597a95df0ad88e928d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154445, "uuid": "09930804-db17-4ce6-bd1b-94254ad29e29", "comment": "Malware payload", "value": "beee646c93427134256f98093e649e165734e9ca815576c3badbf63def684aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154445, "uuid": "eb5bcd38-97c9-4156-9b5c-92b664d58c05", "comment": "Malware payload", "value": "cdea8a53be2adc6bf752e451297660954f2db33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154445, "uuid": "a7e26d3b-f09b-4bfb-81a6-26c341272788", "comment": "Malware payload", "value": "60882d58822d1649f0ad60bcde9631300c1268e41e3c72e973609606f6beeb832308e49001d317d556618e32467d9680", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154445, "uuid": "c0898013-28da-40cb-9b17-4bf84497acd3", "value": "T168D4F0A1B918A956C3E4A674CF66C5B0933A6E8C6868800B79F13F4F3FFD6E3D510215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154445, "uuid": "0b340545-fa94-4cdd-814d-e0b9280ff996", "value": "5bdeef5c000c0b43b0fe9486378c6347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154445, "uuid": "a8978d79-96df-402a-b2b7-88fe203de447", "value": "12288:Pi39bezK7DzX5zX3wZLeqXYZwsx7GwScnckNGmHxYnqNPe2+gHE:PiszKvrZgZLVnO7tXGmHxYnMPe2+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677154445, "uuid": "8d0f4ff9-c7a7-40a8-bac2-1ada43abea13", "value": 608144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677154445, "uuid": "6dad54cc-583b-47ce-b28c-fdb3bd4a7c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154445, "uuid": "bb729f71-67ff-479d-b1d6-51d83745674d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c0c1e9-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677142316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142316, "uuid": "d6f76812-b9b2-486b-8c10-23a46e5aa1ea", "comment": "Malware payload (AgentTesla)", "value": "6fe3176008039bb02bcc490ad325af05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142316, "uuid": "f98b1b38-49fe-48bc-9cdf-75948994c72f", "comment": "Malware payload (AgentTesla)", "value": "bfd75ad1b1f63c1e17cdd07093294806114c4ec9864082947362c0d6eccc9daf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142316, "uuid": "6d453310-058c-41fe-8b11-fc67e6c0fe33", "comment": "Malware payload (AgentTesla)", "value": "5345fd4479215f059d2b14562ffe33ce5f9798f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142316, "uuid": "db3e6575-ceb7-40ee-b68a-740a14af99bb", "comment": "Malware payload (AgentTesla)", "value": "1c7603b513ebe74a97b1f70d3ade6c44760c2f4ccbbfa3ce854601f39c1edc4adbc49785895e764aa20419f0db1f719f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142316, "uuid": "3b594bb7-9c7c-4a1f-af01-4d8da3b03bc9", "value": "T1C9432B56F7819477F5490775A8D2819322A2BC677A62CE4622C7B31F1B77FB08D32E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142316, "uuid": "790ad63e-aa13-4f8e-b83f-d4ab89b74296", "value": "1536:cRj51Z+RwPONXoRjDhIcp0fDlaGGx+cL26nATQvHKHCkNWZ3c3ayDznzH:ij51Z+RwPONXoRjDhIcp0fDlaGGx+cLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142316, "uuid": "f6cf67c8-0c45-4b16-9008-34937432e0a1", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142316, "uuid": "476b1a7e-a4d6-4e30-9193-4378d752ff82", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142316, "uuid": "eb31c275-6c31-465d-a248-7f385a6c08fb", "value": "AL Khair Unitac Invoice for the Month of JAN 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86646f1-b396-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677169651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169651, "uuid": "383312ba-bae6-43b1-967d-d22382f0be75", "comment": "Malware payload", "value": "ff8c377bf0f63568a64ca020f770a173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169651, "uuid": "f500f72e-3eb5-41c5-b7dd-6afd8a5cd2c3", "comment": "Malware payload", "value": "c092ef4154e71dcf4b3172cebb3a40b4217081620f2c103f2c2d70f5ac671bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169651, "uuid": "29951dd4-b268-4d26-a053-c9e8d9986a2f", "comment": "Malware payload", "value": "d9a962bd25d5beff368a75e2361d983591213d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169651, "uuid": "13b10689-169d-4b66-836b-0bb5968eb531", "comment": "Malware payload", "value": "2423d1a8ce72250a5ccf92a803a9fc499a3904c896bab02d33653c074c1e9041ef0ca8813c02bfefec3386f268afe51c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169651, "uuid": "149acb1c-2e41-4b1f-abde-9361f7588f75", "value": "T1E6063A20B6529C36F5EF353159B9A6A9EB68BE60470420C3A3F4366C57704D13EF2F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169651, "uuid": "e89b1105-5a68-4c08-ac94-f134fa56b6df", "value": "ab638bd39cb08aba0e7174db41068fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169651, "uuid": "afd81936-d554-4351-89d6-04c36cffcae7", "value": "49152:bIwUayNucQ84Vgb0XVR00nySl9QAzYxczW9:MwUF8zqb0FR0uOl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677169651, "uuid": "fdfe830e-f42c-45a7-b575-8e05685eb62c", "value": 3711025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677169651, "uuid": "950c8010-7c36-487e-82e4-72a0fa077e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169651, "uuid": "3f1231cd-99d2-41f9-b21a-3f956267662a", "value": "tmc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4aac69d-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128815, "uuid": "52bf5942-fef2-49a8-aece-44d76d897129", "comment": "Malware payload (WannaCry)", "value": "80f50b7407550d9e9eb55f16bc3fa0f4", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128815, "uuid": "45793dfa-cf69-4b97-be65-f6c49087155b", "comment": "Malware payload (WannaCry)", "value": "c1aa3e51afee0bd1358018badcb31484d0c4d743281b350fee18ef4bf102891f", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128815, "uuid": "da58829e-e402-4ec0-97b3-e454814b0e8f", "comment": "Malware payload (WannaCry)", "value": "30fafb65b45b2a760f52c6608cc3467127707cb2", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128815, "uuid": "47411297-1d53-4451-bf24-6f7b7898409c", "comment": "Malware payload (WannaCry)", "value": "e15255f5c2ae36a9ebd496964bae8e9f90a00156fb8973beee3f51f510c1b12721e8a41701d4d19120233c984f610c33", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128815, "uuid": "3c9f43a3-54a7-4f58-b37c-e7d04299df01", "value": "T13AD52D3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128815, "uuid": "64d412a0-fd47-43e7-b320-0418be0ed819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128815, "uuid": "9a14ae21-74dc-4ef9-bf99-b17f1ddcd289", "value": "24576:w/S4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:w/Sy6PX3PpM+P5Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128815, "uuid": "a964d78a-4356-4b53-abf8-6c47fe9b66fb", "value": 2843136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128815, "uuid": "6524a8ef-76e4-409c-a0be-49166df02ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128815, "uuid": "0fade8a5-71f4-47e2-81f5-9b1960c79f79", "value": "2023-02-21_80f50b7407550d9e9eb55f16bc3fa0f4_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f54d6fc-b3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677175944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175944, "uuid": "8636d0e6-9ad0-4a40-ad81-8e33c57a01bc", "comment": "Malware payload", "value": "c5c1650b2681820ee0c7f7d99733e610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175944, "uuid": "e5461102-3661-4b72-a48a-84384dc30c57", "comment": "Malware payload", "value": "c1b12882a5dc494bbaae21bb5c6bd49c93e01f652b0b2a200d39a336befeb8d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175944, "uuid": "6b61acff-579d-420c-95be-bd75d2c199df", "comment": "Malware payload", "value": "8fa08baa7085555f43e66170ef52c3f4a85e5420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677175944, "uuid": "dd18ba61-18f0-43c0-b63f-2a67b16a5db8", "comment": "Malware payload", "value": "99fce6e096604809284dd2dc6e19131c5e08c20a87b21c4de732a5876b797b798d1f52b9e67e02b661e978354adf4933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175944, "uuid": "dd053bfd-580d-49de-b4be-1a0f049054e3", "value": "T1FCF64BBBB261DAD9C0CAC1B594C28BF15F30BD2449B5134323D5371EDFB68806E99D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175944, "uuid": "3de54aa1-f4d1-4d35-b6b6-1afef084a206", "value": "6c68a5d9d3f028bd8e8b517aa28b4f17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175944, "uuid": "e9c4608b-4d51-4fa2-8263-b080fa62f7c0", "value": "196608:Td9uReeUlaWFzcDVbqjqQOwAomFdH6ayTTkwniUOoZW:T2ReeUlaWFzcxbq2nwAomHHinsMZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677175944, "uuid": "bded6754-90c2-41bb-86e4-ed6ddeed610e", "value": 15349168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677175944, "uuid": "2597a907-55d8-425f-9dac-9c788e9da51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677175944, "uuid": "779d4778-2019-4d69-a19f-ea95a0c88bc6", "value": "Reksativ5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca71d821-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142086, "uuid": "17a5b4d1-3e76-4a43-9fee-5e8cfa395e0e", "comment": "Malware payload", "value": "63d648f02dd600ac05a96a552314ed26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142086, "uuid": "177c3db4-d967-449c-943e-9cc67f25e0eb", "comment": "Malware payload", "value": "c24962c8842befd9bcf577ab074dca4b360ef80f54b1e4546af33fe5217b13c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142086, "uuid": "d55513c4-ca29-419a-bcd7-fcaa93bc3da9", "comment": "Malware payload", "value": "1946fa49196d7ff386700ee5a75968bd1b246849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142086, "uuid": "8aee3774-2f98-4e4f-8823-75053425e648", "comment": "Malware payload", "value": "d98de240bce658cc7e238b7aaa4de31883ccf3a8ca47274c9df8da0b1889061a85e6dd98ca7e299336586b14bd8731f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142086, "uuid": "946ee1f1-a6fc-42bb-8305-6766819bfbd3", "value": "T191C623E5189512A0D4E64334B1871B9DB8C13EAD46F98D0E7DE07C532B72EBE35026EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142086, "uuid": "1ad13734-8284-4a10-9175-3d05e82d620d", "value": "397fe34ab13aed1ba8b91da7d5a4441c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142086, "uuid": "80c517dd-2ea4-4ad9-a3ce-975eeeb3f1ca", "value": "196608:trM4vHWfuPF7taNX3ZlhmIje3PcbWLUSWVrgA/EmLGcI+UNKg94r9VmlnFsS2r0P:t/2fuPFWf8GKcrNDUc7it4rfmR2ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142086, "uuid": "3b0460eb-385d-4591-9b36-7dc7604fa558", "value": 11879424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142086, "uuid": "2d7d203f-df8c-4190-ad95-bcbea26b5da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142086, "uuid": "5dbb83f8-7341-4cc1-b261-b55463d23bd8", "value": "63d648f02dd600ac05a96a552314ed26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3787a59-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1677128813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128813, "uuid": "d3a16a35-ad7b-4dc1-9c6a-d0763e4d42bd", "comment": "Malware payload (Chaos)", "value": "6a16f337d3315623f0d40b26572b8abb", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128813, "uuid": "4d8dd69b-ac55-4de4-b598-2b87ae914bbc", "comment": "Malware payload (Chaos)", "value": "c2dd89a5116214f44214380e06bb86158f67b8148ae1cdfb4dddefe444badbb0", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128813, "uuid": "d5558aff-85ca-45f9-a7b7-5cb8a101a62f", "comment": "Malware payload (Chaos)", "value": "0b2990ac885898ffc4bd3a63d469f63090cd7c27", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128813, "uuid": "f4fdf526-0458-40dd-ad5d-93c24e6b9c10", "comment": "Malware payload (Chaos)", "value": "b812e076ecc787d1a0bb9f6535104c8f9d47ff1a9379a35c2c72d91514f93dd36c525c40ae6f72c57900b7e6720221e6", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128813, "uuid": "13b58dc8-3a13-4447-ab6d-5947c4335280", "value": "T179D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128813, "uuid": "d91c12d5-a32e-43da-b608-377ebf51d4ed", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128813, "uuid": "600cc186-019f-4a88-ae99-dedaae47032a", "value": "24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEC/:BSy6PX3PpM+P5Idp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128813, "uuid": "d343f963-a2e0-42f3-a026-cd5b96b212a9", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128813, "uuid": "8f4c100e-726e-4ac1-ac91-9c0adface105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128813, "uuid": "2ac2e1d1-718e-41cb-b49d-e6bf4bbf1478", "value": "2023-02-21_6a16f337d3315623f0d40b26572b8abb_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f0f8be-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142051, "uuid": "2618efcf-e56d-49b1-8ac6-38c9439f34d5", "comment": "Malware payload", "value": "89804c60741a1470048be3d7d01955fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142051, "uuid": "315bd7c6-7dd2-4176-baa4-ab02eeafd5f3", "comment": "Malware payload", "value": "c35ba0ec8d213ec665d9bddfe74ac39c82d4f0bd17bb772d443762549f66234e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142051, "uuid": "c7da39e7-92ee-4172-8112-115b4094b256", "comment": "Malware payload", "value": "8a979ba6eb0d45c02d76d83170fc2efba2df6f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142051, "uuid": "dc87293c-7c88-4183-a94a-5c46a6ebe96e", "comment": "Malware payload", "value": "6e197dea521a8908e65b3ba2b20df76683a61c747f173188f9e2b10408b91b50e0514a6c07d9c2583d27b7bf00f0af53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142051, "uuid": "2087b90e-48e9-44ac-a881-6d9e353b7b6d", "value": "T143C6B0B875047CE6E66F537BC996ADD813723A628B87A5CF4064B7C309733B5EE12804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142051, "uuid": "15592267-53ed-4466-b0f6-f65a96302789", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142051, "uuid": "e78bd4df-125c-4919-aafe-57605d48ce3a", "value": "24576:7hvsEWGLW6t3F48zvBo3FjCN+09Gvtj/GV4kwbCjBfv00df7e/KViX+1b0pM01Kv:VvsEjLj3F4q23FjC8gk+lKHEs6z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142051, "uuid": "bdbe53fb-ea73-478a-b4af-dd4d739b8803", "value": 12374016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142051, "uuid": "44d492de-66fb-4fa9-a1e3-0b7b8c83062c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142051, "uuid": "133d3ea2-4ffb-4fc3-a632-5755093ee4fb", "value": "89804c60741a1470048be3d7d01955fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea07b46-b383-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677161340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161340, "uuid": "4557c352-90c4-4d80-8974-c21de37135f0", "comment": "Malware payload (GuLoader)", "value": "1e830533f1843fb1ad6b034112b977a1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161340, "uuid": "d032b49e-fef1-4b9b-b96b-d9a5b32d960e", "comment": "Malware payload (GuLoader)", "value": "c4097b12d24937befe26127150d5d530f030d121afd66754574ab53af85d3bb7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161340, "uuid": "aae7db91-754c-48e8-8392-3992c18dd9b7", "comment": "Malware payload (GuLoader)", "value": "74e9585c85544afccb6df3213a6d71772a3261b7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161340, "uuid": "8670cdbd-5432-46ec-ac57-6ecded1d5ae6", "comment": "Malware payload (GuLoader)", "value": "b25b9777379bd77f3c3c794316bb170023f703555dfc3c89a1ea1c417f4db46bc6da91e7ed18e76b2b0cafda7e8f5fc5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161340, "uuid": "5d832e11-0156-4875-ac89-60cc85b03222", "value": "T188E39D70DE94055D480B27ABDC599DE88CA941FBD22D1934BC8C73DE18023DCD6FE6AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161340, "uuid": "a7283c15-b1b2-4413-9500-c981adf6c14c", "value": "3072:6Y5AyNjvQH0S9XGqQSA+rz2GVPm/PyygKP8aqjULSzQyaxuS:/6ydurbrS/PyygKEwLSzQyan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677161340, "uuid": "b45b3cdb-da60-4c7b-9c9d-52f1517aa250", "value": 146517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677161340, "uuid": "f58970a5-d2bb-43ed-9e97-f77c6cea4f43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161340, "uuid": "6387678e-b9c0-49d7-b5bd-f46cca28ad6f", "value": "Faktura_11F223.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1ba478-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677143213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143213, "uuid": "405caadd-ada6-4adb-9f2f-4a523f15eaed", "comment": "Malware payload (Formbook)", "value": "9ad124bf22839603024a373ba636532b", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143213, "uuid": "ccf67b3c-3cf1-458d-9f3a-ce06387f0593", "comment": "Malware payload (Formbook)", "value": "c448049c359c9ada55dbdefbb772020aa3962804d485ccf52adefb3a2030e3fb", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143213, "uuid": "b1c0f990-43de-4e92-8299-248488cb09f4", "comment": "Malware payload (Formbook)", "value": "50f0b83d0deb5b40e8b306e4122ae3c1173eda1e", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143213, "uuid": "32d30b0b-3387-4d96-a851-c3d4ccebf941", "comment": "Malware payload (Formbook)", "value": "ef16a6360befe4fd5325da5277e4e59cfc37bcd3b7f7dfa544812815b9de2cf1d11970debe834aa50ade36d0439dbc87", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143213, "uuid": "64a5177c-597b-4612-aacb-87977adbd228", "value": "T1515413C93790D3B7C0BB02F13A2A6626FFF9553509A4461F570177ADF5B1A42EA0E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143213, "uuid": "25335bce-d692-480f-8d97-594698412b7a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143213, "uuid": "7484c4bd-5975-4bf6-b233-a0eeb0c1d588", "value": "6144:PYa6+qrPPkjGY0tiVyVtCqNJNMxUD7W4POTptedBjmI7bLbp5Z:PYAqrXsGYQtCqNrRPPuedhj7bLbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143213, "uuid": "4bb1f7e8-efdb-4209-8875-38f61e1c8f1c", "value": 299068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143213, "uuid": "3c5522e5-1197-405a-bcdf-5bbfdb9bef59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143213, "uuid": "706c9c24-d8c2-41d6-8307-7be0c67f0fc7", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0590e846-b386-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677162371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162371, "uuid": "5af9d61f-7744-430e-861b-a918f5c09d1f", "comment": "Malware payload (Amadey)", "value": "630ced327669ea15a036397f4d853101", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162371, "uuid": "95971d3d-3dad-418f-b49b-6461d5fb4e28", "comment": "Malware payload (Amadey)", "value": "c475c191f7c78516f6dfaaf2364a40ce06b5b2d565b83e353309c1fc20b5ac2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162371, "uuid": "6a42563e-a36b-44ce-a124-8e4f4eaa1623", "comment": "Malware payload (Amadey)", "value": "d1b10f567ffa82c542a905bf0d8a2fe704bad541", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162371, "uuid": "96fabecc-da32-40bd-b8af-014fdfc4ee35", "comment": "Malware payload (Amadey)", "value": "acb853a8510d16e31d563ea9f8e42cbc8a43fd6381606f2e8a14c736c7ef821354dccfe712a4bd6b8f2237606b364f68", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162371, "uuid": "5cc82362-8118-4c6b-9c17-8c2e4f5b9a5a", "value": "T185251207E7DC5031D9A9977008FB06C30636BDA18A219A57B34BE82F28B3674B775376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162371, "uuid": "526967ed-9974-4632-90ae-767b6ba09875", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162371, "uuid": "e4036e73-7e69-4479-9aa4-8ae6d6a881b3", "value": "24576:KyEzeuYWEYesc7pbFf8t1up6o/yDeomgrL97QpiF:R+enWl0FE7uFYeomwBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677162371, "uuid": "9ebed816-5d02-449c-83b9-315726c4bb0b", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677162371, "uuid": "b5eb21a4-4fb6-4bb1-8e08-243dacc4c0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162371, "uuid": "6f81443d-af46-4ec5-819e-15c2e5f827ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3012a364-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192078, "uuid": "b0bd83fc-5ac3-4aef-803a-d543bf428011", "comment": "Malware payload (Mirai)", "value": "217e799e3a3e0b4235f563f4caa35e69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192078, "uuid": "db6a2f89-2bf2-4473-9d04-54c42d94626d", "comment": "Malware payload (Mirai)", "value": "c4a6231b48ad46eabec26a985dd58a4e66186daa223180b4b4a2c413f63c513e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192078, "uuid": "133efafe-0f0e-4f90-947a-5168ba4a95df", "comment": "Malware payload (Mirai)", "value": "8db64e250bd07eaa9e6d6838294a69d5e26d47ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192078, "uuid": "74cc7c11-e24e-4d18-b40a-1ff5c04ed6ed", "comment": "Malware payload (Mirai)", "value": "4ffbe6e0f9d75ef81dd1167a236c1c682893c8c8491082913819368322e6caadd3a7e0bd05fdd449a881292a82fb748a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192078, "uuid": "16f11b72-77ed-47cd-9a5a-5c15cacb0416", "value": "T176B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192078, "uuid": "338df64d-9850-4bbe-b660-994d328a3ac6", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1D/LWy:c9sSyzz36YaWWgg1Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192078, "uuid": "e93f2a0a-99be-4f0a-ae68-20aa6bafe682", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192078, "uuid": "10b2f487-bf8c-4be7-9006-d28b2dda2607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192078, "uuid": "27b31a65-d502-4806-a2e0-0a3de836e48c", "value": "217e799e3a3e0b4235f563f4caa35e69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a4fe6b-b30d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677110454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110454, "uuid": "d2d5d4dd-cc5d-4caa-a2c8-6fe5e214f97b", "comment": "Malware payload (RedLineStealer)", "value": "4a20e1a41a119f4d5dd77d333db5a5e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110454, "uuid": "247d48c7-6698-42f7-8244-0f7458fab2b7", "comment": "Malware payload (RedLineStealer)", "value": "c5288933ebf71c0cf99a0593bbbc103d4a84f82dfa38fafc0f957712799fb718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110454, "uuid": "c241abbb-0e7a-47bd-864e-0bb6f39b2c37", "comment": "Malware payload (RedLineStealer)", "value": "2add22515b33239e45d55e918add63ae3cea0e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677110454, "uuid": "de3190aa-e4a1-469a-9994-3a2c3c1aaae2", "comment": "Malware payload (RedLineStealer)", "value": "367d03b05cc4c06da5f211566343b7926dfc1c24a091d15c8aad8f59457dc4b744be6811d28eff502a1a048c692086e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110454, "uuid": "463c043a-dd07-43ae-a3fe-efac6a87521b", "value": "T16A74FA987670FD9EC857C87F8A581C64E6636466970BA203B05313AC993D79BFE130B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110454, "uuid": "df73f196-5437-474b-9d29-6eecf145e88b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110454, "uuid": "4c7d383a-cce8-46fc-8686-1b89c405349b", "value": "6144:0bUlO6ppZmaSzY3xmUbaXml9L+89TNaQ8WqO7sE/r+X7w+e:nFppZmLKjK89TNaQ8WqO7sE/r+X7w+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677110454, "uuid": "cd618957-65ea-4454-a1f4-eefaa19a448d", "value": 344280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677110454, "uuid": "c82e33d3-820d-4d79-8ed6-6760735b69fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677110454, "uuid": "4046d468-19f9-4be1-82b8-0dd0a61f885d", "value": "4a20e1a41a119f4d5dd77d333db5a5e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c147633-b389-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677163724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163724, "uuid": "e938af3b-acf0-4621-8cb8-371c91872ef0", "comment": "Malware payload (AgentTesla)", "value": "cfd1269e7d4b960b073676659faae065", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163724, "uuid": "f9780987-2b58-4718-b597-d037b0813e01", "comment": "Malware payload (AgentTesla)", "value": "c5891ece9e4a6c2894a98d71250dc90a4d45dbff90a1938c614c8d36f6c5eea7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163724, "uuid": "2155246f-a47c-4c48-a9c5-42a2700eeb09", "comment": "Malware payload (AgentTesla)", "value": "50b96852ced6614b94d3ea9c85e66a0f65d21a38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163724, "uuid": "bbd382a4-2239-45b9-8258-19bc71a86e57", "comment": "Malware payload (AgentTesla)", "value": "64a0df4c654e4a61417e814adf31abb99809b95dfb5c53a2a53e344b70969db3e5fa107afe07b8faa0113554352a840e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163724, "uuid": "b73a5a9e-7ade-4f79-ab27-1c3a342b800c", "value": "T11A057A46BBF09077F99E41AC063916CF1E31B253725DE2265F3B68489D86DFBB1C8212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163724, "uuid": "9850c88a-ec6c-4864-9ead-56e04bb15f7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163724, "uuid": "120ee016-7359-4772-84a2-9f3820156baf", "value": "24576:hY4H+vEc8T2Cxco1FhJosn3K+eftBcaCtcu:cvEXnxcQFbosO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677163724, "uuid": "a82dab4a-c4e0-4bc2-a4a6-adbc8bae578a", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677163724, "uuid": "2861f854-2b68-4d1d-9480-79b62011bbe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163724, "uuid": "1847dc50-b763-45b1-b9a4-b6c6ef5be31c", "value": "2023 Catalogue_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f3fc1e-b34e-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677138345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677138345, "uuid": "a18b7388-b004-41cd-ae8c-e2f85b91bd66", "comment": "Malware payload (CryptBot)", "value": "7620c335360d315a494ce50f4cc0aff3", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file", "colour": "#780C49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677138345, "uuid": "9a83662d-3164-46a7-acd6-48fac048078d", "comment": "Malware payload (CryptBot)", "value": "cd491a9108cbb6e062e8c37055290ae331f1e3879614d59771f3c8bd87868d91", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file", "colour": "#780C49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677138345, "uuid": "864075b5-67cd-4e7a-975c-19c6a896d231", "comment": "Malware payload (CryptBot)", "value": "adafb31933a63af7ab4856a5638d725c15d2c64b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file", "colour": "#780C49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677138345, "uuid": "c76f24e1-c51c-4b6e-81de-c5d13a68d26b", "comment": "Malware payload (CryptBot)", "value": "6ea78d995316b2850408abfbfd5eabe975551666e31dc2e4df2ef04bca1b3cfc0c6b95748afb93c1c2574eaf92eebe41", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file", "colour": "#780C49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677138345, "uuid": "51b4a996-eee8-4f72-95bb-ba2093ff1075", "value": "T1F4050122FC92987BE3335171863A80B21A34FF1BA425A57F72D93DB8F67D0529367241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677138345, "uuid": "5af40ec0-e88b-4272-90ea-8b843105b5b1", "value": "24576:Lesh/En0U6Exr2T/NNbEyNfQWq8bCOXS1QOA6MNrOH:j864+lHQTOXJTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677138345, "uuid": "8a0ef9b1-8090-4738-9cad-5e35863581c3", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677138345, "uuid": "f3518bf5-0b95-42e3-8887-83e6f1ac193b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677138345, "uuid": "ba89bd32-9ba1-477e-a205-3adf26dcc0a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1434e3c3-b3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677181723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181723, "uuid": "6201e20d-e331-4813-b4d1-d42d4fba2d8f", "comment": "Malware payload", "value": "9697f2b39a5febc432aa1cdcbd52fcc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181723, "uuid": "ab37fb66-2d74-4fa9-9854-4e1291c586c7", "comment": "Malware payload", "value": "cd7d9d33acc69d04a3abf51d1a00591bfde79d43a98e2659bd1137a179cc0b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181723, "uuid": "a2e6df22-c7bc-4961-8df3-f3047f4a05a5", "comment": "Malware payload", "value": "0f312e0b0cfcffed2e1807b8d06d70527fea8960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181723, "uuid": "11f505e7-caea-4346-af4f-e534be02ef1d", "comment": "Malware payload", "value": "fb5e000b2a380da54cdd92e865e04873b68cee34efbd560f9b19a680ff8bd94ad6f80529c8d1e8a362e4b783986c606b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181723, "uuid": "c3ac53a5-4d37-4e4d-90bc-70abf63dbd77", "value": "T172554A2439EB5019F173EFB94BE4B5E69AAFBA333B07645D10A103864723A41DDC253E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181723, "uuid": "902489de-9150-451a-93f8-3563a1fb4963", "value": "12288:aR/enzBq/J0mByAXWwHcOORULkg01MH6F2Ws9/Nh1GPjaHzdfAhpYAa6Q+owZgIQ:aLBErOOqGZycphNn9b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677181723, "uuid": "53aca7bd-22e5-451d-a96a-4b62b0c881d0", "value": 1380864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677181723, "uuid": "3823ea32-3393-4903-b56e-63f3974608e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181723, "uuid": "68414461-219c-4393-93db-339d579f3fd5", "value": "2023323027336553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5c550e-b387-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677162871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162871, "uuid": "194999b5-18ff-499b-a5e0-a3e72a8f2042", "comment": "Malware payload (AgentTesla)", "value": "b50eaa75e463272f10c05232b128f917", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162871, "uuid": "652e7e8c-c33b-4796-bccd-e7f8d6003c16", "comment": "Malware payload (AgentTesla)", "value": "cd85308e42a0cdf1e7a057348be86381d48b87ae17b066e53b3ffa4c393de9ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162871, "uuid": "88d122ed-0155-478b-a697-6ca0fdee5199", "comment": "Malware payload (AgentTesla)", "value": "8889a0bdfa2705cf3b41ece173f06bfbb3c6a519", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162871, "uuid": "9bb8614f-caad-4446-9d9e-9f3cbd355d37", "comment": "Malware payload (AgentTesla)", "value": "bdeb8b7a7abfd86a5a79dff5f41648f623bd37ebc4edabcccda73ab657bce394f3d0cff820c7e53b9747f5c820a6d4fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162871, "uuid": "ca254fad-8bbd-46d8-b561-e1d855b39633", "value": "T1F8057B4672B09033FDDE90AC17341ACF1D32A252710DE66B5F3B2A989D1ADFBB5D8241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162871, "uuid": "6f142db6-7069-4bbd-970d-b9efd351a240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162871, "uuid": "7b43da73-94e6-4cf2-93d7-59f67a2669b7", "value": "24576:lJ8ejX63vnLXqXiWhx777PRE4R8QIY4P8vwQBLY:Z63vnLqXiWhxP7PRh8dY4P8vVBLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677162871, "uuid": "1ac3f650-4409-47a7-8383-0c91f612359e", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677162871, "uuid": "718b629e-84da-42d4-8bce-94100dd8634a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162871, "uuid": "27056347-6a8a-44f0-8fda-7aa4bcb43af9", "value": "TEKLIF ISTEGI HURK75BSLl_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491488ed-b38a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677164203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164203, "uuid": "2d938a15-973a-4d17-a662-11bd38047b94", "comment": "Malware payload (AgentTesla)", "value": "e1f25673b10cc409524cff9706c9464f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164203, "uuid": "f3a72439-091b-4995-8679-5b354bfb2184", "comment": "Malware payload (AgentTesla)", "value": "cf23126344cd6bcc9e808ae088847862115684b9a05fcec39464c5e2f33d89c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164203, "uuid": "212ee339-12ff-4668-b991-cd40792acac2", "comment": "Malware payload (AgentTesla)", "value": "4d75047eb778d508a00b6d3bf734ff875c0796c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164203, "uuid": "80688a50-b5ce-4af6-8524-07359d925592", "comment": "Malware payload (AgentTesla)", "value": "5b570fa841570e82e64caa86af8a7497691eec622ed4dac1f734a747eabcd67450d13f07c36bdaab91b70252793c7684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164203, "uuid": "0156357c-c648-4795-8e9b-1bf9e4cb7e87", "value": "T18A0590203DEA801AF173AFB55EE479969A6FBF733606A45D109033470B33A42DD9193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164203, "uuid": "07587b3c-2712-4ac5-89c0-318839c7f8a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164203, "uuid": "42f5e935-adf5-4faf-93da-bf6e1f290c71", "value": "12288:6069Pk2Tpn5Y5BT2S6/ISJA/XQ1qC6a0hS/k1m+K9qTpL1U1NXC:6bH1rfErsbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677164203, "uuid": "341008b8-4dca-4397-8306-42606bd6a6f2", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677164203, "uuid": "483a079a-f9e7-4020-b29d-04ef4d7e3311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164203, "uuid": "563f2e24-80da-4789-af45-f96a0d32be6c", "value": "SC-0567111202pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e19ece-b348-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136070, "uuid": "3ebaf1b5-6bc9-482b-87e2-6541384a7453", "comment": "Malware payload (AgentTesla)", "value": "1d80c56b129beeea2dc026bcdc12fbf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136070, "uuid": "6b74e02d-5148-494a-b3ca-05b6d2b931db", "comment": "Malware payload (AgentTesla)", "value": "d0a1c1a60a1fc6a0760ecf3db863a5586002fdff169bd2baff06fd91c7d14ba1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136070, "uuid": "e1a518ba-d133-4a6f-80e4-794abf528708", "comment": "Malware payload (AgentTesla)", "value": "4a14723d19b30cb91dfbecd3d497c44ed0099711", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136070, "uuid": "d1a8c709-47d8-4b5f-b9f9-e3aee34d270a", "comment": "Malware payload (AgentTesla)", "value": "bfb27bc4bddb9ac204355181776aa4ee4e88ce6e6b7e85746147dfbdb334e96001cc32b6da4c45b15e6a15167ab8478e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136070, "uuid": "59b47d8a-824e-4c21-8ad0-a075102ac77b", "value": "T17BD2F659D74F02A5CF465377931A0A8846FCB37EF24550A234AC937433EEC2D822A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136070, "uuid": "3a497a12-4802-46b5-980a-ed7182a711e0", "value": "384:RL0AbZSZvTqBHm5hxsiAjRRRFGpH2V95BcJ/bWHSizf4IO86g83t:RwAbZSlTqtm5fTAjRzIpHz1bXo4fgEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136070, "uuid": "6f87173d-6c16-4613-96c8-9de07571b934", "value": 28962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136070, "uuid": "8b218bea-7905-4f4c-a8ff-9ed30ffc4456", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136070, "uuid": "f477832a-316f-4bd6-81ae-910dd17c67b3", "value": "498443222203.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3418f39d-b317-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677114775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114775, "uuid": "4c9d3c9f-42e0-4ecd-a26b-3770078ab2f3", "comment": "Malware payload", "value": "e9417c69cae2642f334d6666a4fce376", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114775, "uuid": "5f689b6e-b75d-47bd-9905-e064c2be3a89", "comment": "Malware payload", "value": "d38eb1926b1fede7be353b6eb2f0655fb795129f790a849e3454ba22cc7755b1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114775, "uuid": "82170ae0-0792-4de0-9319-9e2ee2f0e891", "comment": "Malware payload", "value": "c1829ebb53ae2cd39dc2fc7dd7edfc70ed1b8326", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677114775, "uuid": "8e408956-e590-42a2-80bb-d578e5903cd3", "comment": "Malware payload", "value": "35a3cfdc7e96eb57f1cf1b2c2e63f09be1b3d1fc0f3825a65c0a1ef7336e05fc6c95ced50276c044f1d7db4e2c6604fe", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114775, "uuid": "2a874e5e-558e-4814-9996-c3880e553ef9", "value": "T1A07228211BCDA8F08251F0338269A01A543EF6B6349A16EDF58DE4A537FE60C85FC2F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114775, "uuid": "f9dd74cb-60e7-4a48-bdaf-32da8220a235", "value": "384:53EMbaDAcBc618d58k5JMkwyFMAPjdQV2H9KI+DV:5vbkp2k8d75xwhAbda2olV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677114775, "uuid": "54675589-d249-4874-ba47-443b0cdf1112", "value": 17047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677114775, "uuid": "07079392-cd1f-450c-938e-f290f8a8de51", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677114775, "uuid": "01f26c29-09f8-482a-a262-2ab194d320f0", "value": "e9417c69cae2642f334d6666a4fce376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dd84e0-b386-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677162768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162768, "uuid": "61140362-ae68-44f7-97e8-8c467669bff5", "comment": "Malware payload (AgentTesla)", "value": "60789b577917e086f3d6c59225d8b8bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162768, "uuid": "8c540fbb-f031-4a2b-b557-8cefb4b5acf8", "comment": "Malware payload (AgentTesla)", "value": "d3cde2174f9799d957210cd054bee35f092e5480bb7019ca10e7b7f5abb116bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162768, "uuid": "4a50e812-5b68-4ab1-92f4-113f5372a380", "comment": "Malware payload (AgentTesla)", "value": "b21aa9701b2632929032727b5b3f474758a34ec9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162768, "uuid": "fbd8b0f2-5db9-4402-a336-303371cecd95", "comment": "Malware payload (AgentTesla)", "value": "0fda4619693cc82e7a518c3456391f98c7e0e6c93c10d750bdc00f70996854a0302cdb1fc5dcb002f5c01742fb9dca2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162768, "uuid": "25e3746d-55b2-4d7b-9770-696f1baf87e5", "value": "T152F4E47D39B796D2C234F63386E3E520F6BD80923313D95999DA1AC04F42682BDCE95C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162768, "uuid": "ec146941-6831-4af6-910c-124a24fb3e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162768, "uuid": "fd9cc746-dd92-4942-b37b-162d0adfdb91", "value": "12288:hMr03FHFB38seQQTcXV7IkegET9jsIBMNjnNNOhAe/S0YFYnCmXRNKzh6GH1v35j:lFHFB38seQ+WVETsIBMNjnNNOhAe/S08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677162768, "uuid": "14422d4b-691c-4fc8-9fdd-0002c1e1ddb2", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677162768, "uuid": "150aca37-4e03-4eac-b609-a78ca39b1bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162768, "uuid": "7e921420-56ae-499f-9787-81bb10b8cea6", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f447d5c3-b3b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677184247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184247, "uuid": "8c577a55-7cf6-4deb-9249-1977360fe5ef", "comment": "Malware payload (SnakeKeylogger)", "value": "e1a605850cef0f8e3c750d014c72da94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184247, "uuid": "54c7c773-b809-465b-a926-cf1b86c2b131", "comment": "Malware payload (SnakeKeylogger)", "value": "d4447315ca06e33ed59b76db2aa5710198414dc50c28208ed309cbb365922c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184247, "uuid": "cd28fb76-eac4-4ee4-aca9-610a5782d1da", "comment": "Malware payload (SnakeKeylogger)", "value": "e8596dc6e771afd0ed0cd58084d8a6a3cfffe3cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677184247, "uuid": "36f6c833-aeaa-4ab1-9ab1-3615a590ec63", "comment": "Malware payload (SnakeKeylogger)", "value": "5d5339b29dfd1505689de4c093921b4bb3e5c133c647f8ab06b07f8570d8f9fc718c5b35a62783e45fb446fbd9a41137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184247, "uuid": "64799b06-e019-4d0f-8e01-02275463c31f", "value": "T19F258C4772F08537F89F52BC067466CE2D36B253712CE2265E3B39488E16DFAB1D8261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184247, "uuid": "75b97806-afe8-4155-9474-90400fd4de30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184247, "uuid": "9a848d57-cc2c-49b6-ad4d-fc2af211fed9", "value": "24576:4Zllp/CBiLh2qbiXJ5CjWh2sAyYGW+AF:EH/CkmMjWQsNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677184247, "uuid": "7df92fed-b885-4997-b23d-1d6d1add614b", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677184247, "uuid": "d3d8d2cf-cf54-47d2-b8e4-a983d3630070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677184247, "uuid": "3f94e08d-2e2d-43c9-b597-c8a2f1c7d5e7", "value": "SecuriteInfo.com.Win32.RATX-gen.29653.8961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c94951-b39b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677171738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171738, "uuid": "0e6a8693-e437-4ed4-8c0b-776309bcff92", "comment": "Malware payload (Amadey)", "value": "7cc2350471b6f58e7c36675a2e766900", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171738, "uuid": "69aa6f2f-ab70-4c5c-b7d0-d2dde4490425", "comment": "Malware payload (Amadey)", "value": "d4f0b5cb717636ae26e08e9c2249ec6b888372effdf8fb0eabaacb77edfd0102", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171738, "uuid": "a92691d7-3f5a-40ff-9542-a4beb0fb0b22", "comment": "Malware payload (Amadey)", "value": "3318648e4fa1def04da5ac59304b10e2dbb90066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171738, "uuid": "038dd122-7607-4834-abac-309906f860a2", "comment": "Malware payload (Amadey)", "value": "e813d4e1845b4d48724673acf70f62c265ef2c4529451ba340b7afe882d8c4737cd0da3c20077122fde4e75c47e6d44d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171738, "uuid": "86b29077-98d3-4552-8c2a-3c85382fa0ef", "value": "T1BB45225BBAFC9579E8B1637099F247D319377EA0056DC69B139E9C220CA21B0B13137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171738, "uuid": "f904d7be-510f-407a-beba-aa4c043122dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171738, "uuid": "cdb56327-5e1b-4934-b4c1-e7c93f856658", "value": "24576:XytOMlCM0kyuKhrxvxlFgwU6RqiA+zNmqKWX47WPOR6Oa6/fc0gf9:itOMlCM/FKhNZHgRgqrZqKWoOYZa6nct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677171738, "uuid": "3de5a047-1cc1-4ca6-b20e-86b49965f428", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677171738, "uuid": "93d01d7d-15e2-4715-a098-5eb5f74a4afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171738, "uuid": "c8f9bb04-fdf9-4932-9d63-e8cc772a5aee", "value": "7cc2350471b6f58e7c36675a2e766900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112589cb-b397-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677169692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169692, "uuid": "70d4eeea-53a8-4bcf-bf10-01e1ba105a4a", "comment": "Malware payload", "value": "6bd2d969f317b44f55a8396ca344208c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169692, "uuid": "3020e24b-a408-4c8c-8931-b5d588a23914", "comment": "Malware payload", "value": "d5d1fdb0d8be3edfbd0fb1c0e787970d79c90decbe0b3ae3afe63ff07689244d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169692, "uuid": "b784b5b1-6926-4cc3-8563-83a8348b1e71", "comment": "Malware payload", "value": "6c3f0ce2c42e96e09989ddf9c9588fd6d04f8dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169692, "uuid": "b74e9d95-f4f7-496a-9c52-cbcafc44e47d", "comment": "Malware payload", "value": "32e70b002a15d1f6ba4bb760f09326df50b0368614c5a8df011ce7ab9de6b323f488cf07b0cc80f8fa905d3a373d3cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169692, "uuid": "62b1d414-3107-49fa-80f4-7d573d560ec6", "value": "T16A034A9609546432EDC369F1D19DF226597FE7B04F8595CB106982EA8EC0BC03F3A88F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169692, "uuid": "47bf471c-e27b-4edc-96d1-23869524757e", "value": "e8903a91fac478cd21d705b88ceaa8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169692, "uuid": "f2ecb3b2-91e2-45e7-9140-9c5e44e1cb40", "value": "384:gxVC+Vz6CIojS4baikIjXcVx9SoFABb9G0CMF0KgC+pN4rng0N8/nYPL0NGUHeM1:gxW//ICLSBR9NCc3joFu1V3hhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677169692, "uuid": "5ac47514-dddc-4538-bec2-1e650bf3a50f", "value": 41104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677169692, "uuid": "ceabcead-7291-4888-a53f-df947f6972c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169692, "uuid": "fe954c3a-319e-4a02-ae50-02ae454007c4", "value": "SecuriteInfo.com.Win32.Application.GlarySU.A.30625.23064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17813a93-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677128471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128471, "uuid": "d0d5adef-adcd-416a-9082-2877f605c46f", "comment": "Malware payload", "value": "20a19dba72e3a2567e42d56b4eef0cba", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128471, "uuid": "be2d5b8d-9ef2-45f8-b32f-bb678224d0d6", "comment": "Malware payload", "value": "d6a03fe8312fd36c711d3d379db54b9c1d20aa754dde24b2d156644be71a17dd", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128471, "uuid": "13f937d6-67b0-42a9-bff9-330ece5a7980", "comment": "Malware payload", "value": "8c98e6f02e9f28f18d3a59746882364955d33263", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128471, "uuid": "542d7605-5fea-42d4-bf4b-32ee31d14c51", "comment": "Malware payload", "value": "d10037122aebc26a7e11fb946ae83cfef72147f94c26c00f88793edc3eb68b5fd6b4d377badfbc95d18017bc2d68b6b5", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128471, "uuid": "45f373cf-e731-4795-b1f8-552e8be10b75", "value": "T1E483CC10BF92EB06D0D94B3D8CA7CBED5A217E88DD25450BF1A8732F18BB9D0A954F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128471, "uuid": "e242c50c-d86b-4682-bea8-b3b5c07b988f", "value": "384:+aJ2bA1i38hOzYt60zAOwPjPxBhs+2QicQw/YnePXE0HRZnvSaDr0JKDNctwWAq0:pGcpE5R5LTqcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128471, "uuid": "32387104-9029-46e9-9314-0e776b26a0f5", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128471, "uuid": "40f3754b-b2ac-44b8-9bf0-1393d05d37f6", "value": "application/vnd.ms-office", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128471, "uuid": "eb6ffda9-aa5d-4944-8bee-61dc573c2cfb", "value": "Update.PDF.pub", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096f99b8-b357-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142192, "uuid": "302b60da-73dd-4a5a-a180-3517d6a35db6", "comment": "Malware payload", "value": "05d4a7e80be5defddcbe9ea4369e8cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142192, "uuid": "4c493a04-2d9d-4989-bb25-61fb9e9f098c", "comment": "Malware payload", "value": "d776fd570d18038d184a5d3d937c0fd660e8002a5fd6a51840c4e5ea6aa49782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142192, "uuid": "d6e64600-2c9c-432e-8274-fdf55cc86772", "comment": "Malware payload", "value": "81d3db97d72b45a3b31513aa6a19d7f4d89ef2b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142192, "uuid": "daf09abb-f71b-489c-b74f-06c0889d5920", "comment": "Malware payload", "value": "831b493817a35c50925c67bdf88948bd8fe39de77d564a432d502fe57d2ec0cb52c2ec21fc90f6aeb1002d3372fca4ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142192, "uuid": "30dd265b-d22c-4ea0-a09f-5f8a01ab2229", "value": "T159D506C0F9DB45F6E2078D7288B6922F9B30160883B1CAC7DE682F59ED1B6D5057B718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142192, "uuid": "e5fc7f43-ba3b-4607-89fa-6e44502b1a27", "value": "e724bea03515dde29f2b2b282d64f822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142192, "uuid": "afe7aab2-479d-421f-9e25-c94ba6de7c96", "value": "49152:R1TJ9zePB4262LMFVXSUdg9GbpueIiyXKdzCQWfB+qzeM1Vvmaerxyab8y258WxW:R1TrzePB42VLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142192, "uuid": "fc7db0da-38ec-449a-a118-97b4de602626", "value": 2912256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142192, "uuid": "9d5f6402-6b37-4305-b098-9d24f99e8099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142192, "uuid": "39eff149-6c9d-4184-9337-3409a27fece8", "value": "05d4a7e80be5defddcbe9ea4369e8cd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c92790-b38a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677164115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164115, "uuid": "659d33b3-e2d0-457c-9e9e-47239101e000", "comment": "Malware payload", "value": "e0fb32cda5597b5feba30a8ad54cd555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164115, "uuid": "d4947711-f742-4914-9659-e305636011a2", "comment": "Malware payload", "value": "d7c42165fa7492a009949e9215003a22792aa8a1483ec9d4f82d6b288a2bf610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164115, "uuid": "f3f98a30-741b-4090-9544-f2dc1c74045d", "comment": "Malware payload", "value": "817bf454e69c0256b39b1a7b5e9a99b83e859c69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677164115, "uuid": "3d409d72-2c45-49da-9747-4efdb229e50c", "comment": "Malware payload", "value": "5c21e0d9bc4bec8683610c180e43038df41e885115cff7b71229279a44d4784194bbbe6bb557378e9232408b459d29db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164115, "uuid": "4c73974d-6577-4e61-b50c-d6d34d684f70", "value": "T13F45F12BB56A8921C3C81B3AD4DF4A040B745D4575EBDB0A78C803D659033F7EE8BA97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164115, "uuid": "d435d4c4-af90-4936-b554-a8b75962b207", "value": "24576:8tp3dDg6ZgLMRZXs0zqBa6rk65+oCyhKv+mGF8omJ:8tSajNoCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677164115, "uuid": "5ebaf67b-5418-4f82-9451-66a2a00949fa", "value": 1223263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677164115, "uuid": "abe16f02-adf8-42a9-b9aa-4e0a8086beae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677164115, "uuid": "4d0eaa76-97af-4b11-95ef-521c5f092fe0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d78bc7-b3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677181835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181835, "uuid": "9be30c2a-7c90-4606-8c3d-1e1f693fdd3e", "comment": "Malware payload (Formbook)", "value": "0992a79502277b43711eb406158d83ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181835, "uuid": "fa7b8b5a-c7b4-4048-9b7b-4623e6bcd72d", "comment": "Malware payload (Formbook)", "value": "d81949804bc29604ac2de2ac9f2d360deae54a39d28edfbc9b323868b619b059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181835, "uuid": "4c93b0fb-cb88-496f-b162-f885bc5f64a1", "comment": "Malware payload (Formbook)", "value": "e6feddc8db40536b28f91643a6474f25d061a093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677181835, "uuid": "e80f0561-b899-4b2a-b89a-71650063733e", "comment": "Malware payload (Formbook)", "value": "9cd5864b2ca39363ca22e6f37fa24e3d3efab9508d52ca8438cbd584a119ee66edd5e7f0e6c1820776f74dd34fc2c049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181835, "uuid": "5983377f-e3ab-44ce-a196-7733a698036b", "value": "T137259C4B72B08577F89F41FC063466CE2D32B253712CE6265E7B79488E06DFAB1D81A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181835, "uuid": "f98860bc-be82-4927-89b2-81a175e9761a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181835, "uuid": "c1abc369-59b9-4748-99eb-35a54200af02", "value": "24576:Mllp/jRpR5sDrNgBXqOfaTVKAcCf9SZW+AF:EH/jTCIfaxKyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677181835, "uuid": "4ee7352c-5f46-4a57-9bf8-f31fbe59a18d", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677181835, "uuid": "c82d8ad5-8ce1-438e-b3bc-acb9fa1cfd7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677181835, "uuid": "1175a31a-d865-43dd-981b-10fb53b19ed5", "value": "rBmsc_AvisodepagoSwiftFIN103Ref1056489539230223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea2bec4-b32c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677124081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124081, "uuid": "f0bec925-a1d4-4c61-a4d1-9e07f9dc667c", "comment": "Malware payload (Mirai)", "value": "6a4b9551770d992a01b096aa20be6b4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124081, "uuid": "6215d082-f924-4d17-a53f-654a35e334cb", "comment": "Malware payload (Mirai)", "value": "d85fe58ac792863441c5e6e74bfb0e7e6245dd2bea50296b4b4f6e6600b1c549", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124081, "uuid": "867de5bc-b74b-4858-b3b0-689228b9cae1", "comment": "Malware payload (Mirai)", "value": "148ff2a60ca0d7a2402da2148da9b55f6bd6ec8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677124081, "uuid": "f6b8695d-acea-4947-b0f2-7b3f82990583", "comment": "Malware payload (Mirai)", "value": "0bf677f6418c8151e80bc788c12ed3571ed1dd0005a9ae6d96f08281628cdf56c67f9ee81e1d051fc160ee4f283f55e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124081, "uuid": "aa6fed05-9c30-4241-8e47-575963257122", "value": "T18653F886B8819A25C6D117BBFE1F018E3316975CE2DE73128D141F647BCB95F0D2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124081, "uuid": "4141007f-754c-4164-9cb5-3156db1fd9e2", "value": "1536:4dnd2Gvoqc/Ljzazt9otOFzVLp1pvCMLZIticljoQ6/:bVqGXzst9QshLpPWljoQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677124081, "uuid": "12e8232b-3775-4c73-8397-9820243b3919", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677124081, "uuid": "af54195b-bdd0-4327-92a9-26bb39ca99bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677124081, "uuid": "d55bf116-212b-4f06-835e-102003fd1750", "value": "6a4b9551770d992a01b096aa20be6b4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60655db-b348-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136039, "uuid": "5ced407f-56bb-434e-922c-d2bd0b14c791", "comment": "Malware payload (AgentTesla)", "value": "d9d58d3a5ac25de8bdd3d84524190284", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136039, "uuid": "d6a24e12-c7fa-4f4c-9cbd-412c38280a34", "comment": "Malware payload (AgentTesla)", "value": "d9031317ccbbce3f1d361d1569a44d7001ed7fba70c78321be147cfbd3edfb14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136039, "uuid": "b72feb0c-53c4-4aa4-8992-d31d1f922c42", "comment": "Malware payload (AgentTesla)", "value": "b50ed5bda4f9edf0c681d9a14031a11e2b1a6b16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136039, "uuid": "5c225564-ddc8-4fee-bc38-8374db168842", "comment": "Malware payload (AgentTesla)", "value": "9a0b1850847713d607aa30f31dce7214ec1dde6cfaa4af5269ebc9918e37eae6bf1b35fba0a20c1424dd6a17c4a9e0b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136039, "uuid": "c9c7d457-04fe-4e39-8adc-fbb15091c309", "value": "T1E8D2285AE74F02A5CF426277931B4A8942BCB37EB34511B1346C933833EEC2D85666BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136039, "uuid": "04a904cb-1ea4-42dd-b44e-ed4ddb9e7bad", "value": "768:6wAbZSAygRO3nig3bRw3/f+86xh/3WNT6w:6wAlfygR2v3Vk+Zh/3WNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136039, "uuid": "b2082c3c-84de-49a8-b6f9-8d1dac914ef4", "value": 30336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136039, "uuid": "915133f2-968f-4f6c-8ea8-7cffb452bba1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136039, "uuid": "7beb1c8e-44ea-42c1-8dd2-6b9ea979138b", "value": "PO20230222.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b4a6f7-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1677158580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158580, "uuid": "08ca1c44-34d4-43c0-870e-880b3c32a416", "comment": "Malware payload (PureCrypter)", "value": "d40448b5ac56cf8f2a4bbea8d22982c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158580, "uuid": "18ec1e6b-7590-45cc-a05b-4d012de15691", "comment": "Malware payload (PureCrypter)", "value": "d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158580, "uuid": "b05f72b5-127b-4732-b270-66d1c28ba38b", "comment": "Malware payload (PureCrypter)", "value": "ad405a4f3ea892a80b696f7460de70bbb6b082f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158580, "uuid": "a4118bb6-065d-4d84-8ce8-d50ea41195da", "comment": "Malware payload (PureCrypter)", "value": "18f89c314b048fac285536ac0720704ed03bc27389e37a82a7ffcc9875e127a33e56a2daffaa78694f301a88854134a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158580, "uuid": "c481443f-74e8-4b9b-b19f-e9ef618bcbe7", "value": "T12F93E9763718C972FA49AEF4096E8290406DBE423D53CE25B11D7F8E7F712C81A11ADD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158580, "uuid": "ab9d1e17-8f6c-437b-b9c1-02ac47275f97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158580, "uuid": "27054d74-2807-412b-ba36-1c0225462ce7", "value": "384:IiZHmh0O/Lrw+Ke8QEoDeJisnDPnFw5sglcMhQM0u+GrCPHFYgMSXA:IgGhHzr8e8B1PnFusmcDCXrCPqEXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158580, "uuid": "3230ada0-64f0-4977-84e9-d91fe9e60855", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158580, "uuid": "803dad6a-f723-4c8b-9ca0-fb0c7c2bf867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158580, "uuid": "9d77edb8-afb9-476f-837a-5a028145b23b", "value": "rR40P23D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3496475-b336-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677128330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128330, "uuid": "8e902761-938d-4fb8-97f2-52432d401fd0", "comment": "Malware payload", "value": "bd19c59dd5861a3283fc6b534c51e3c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128330, "uuid": "5f2b8a07-9a9e-4bc0-ad26-538cce9086fe", "comment": "Malware payload", "value": "da4955a26685b3284397ffc3991437a456b0b07bd1b7074074d6380a73c67ca6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128330, "uuid": "0accd4aa-27bd-4beb-af4e-6d5c27327511", "comment": "Malware payload", "value": "0b5faaab0109950149e1cb2fccc1ba83e510efe4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128330, "uuid": "27326ecd-b9b0-4421-a064-35fff54bde14", "comment": "Malware payload", "value": "9ff96125f08a3a46a46d96ba7d6c22d4ad4e1d8e12a73752cabfe647ff347db51f6abd3fd5d26a42374185bfc6a17072", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128330, "uuid": "3c2aac5b-4d64-4299-8af2-f06302beb7b8", "value": "T1D603093596667DD49B7A3CC001083A940C983A1B83BCE57DFBC608B5787A564EF6E87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128330, "uuid": "d3240520-c10a-4feb-9ad0-868bcd97f391", "value": "768:Cq2TdYf4zxmpRsSgFl2YMBmWYM2HPMW/doB7LwgBziWrsbkiZJ82S:STdYfMosSgFl293YLHP1M7Lwqzbrsk5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128330, "uuid": "7a73af51-13fd-4530-a868-701fa23df2a8", "value": 40407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128330, "uuid": "983fd573-d300-4beb-b9d5-6c06b8b2560e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128330, "uuid": "5edf14f9-70af-43af-bfe4-0ae50f59ddf0", "value": "da4955a26685b3284397ffc3991437a456b0b07bd1b7074074d6380a73c67ca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b05e87-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1677143262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143262, "uuid": "55e10d43-ca8f-459e-bc5c-4cd9a33204eb", "comment": "Malware payload (Vjw0rm)", "value": "f8a9117d4c4217fd4cbab1da6d3359b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143262, "uuid": "f3f9a596-35c8-43e6-8156-b106086352f0", "comment": "Malware payload (Vjw0rm)", "value": "db99c6255bfd1d06c6a103e4602715c069039c140389d33d2909912e1b58158d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143262, "uuid": "636b2e2a-2b0c-4bca-b813-1e8889211af3", "comment": "Malware payload (Vjw0rm)", "value": "f3ea387aeaf9e587d135d797e0468904328c291a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143262, "uuid": "149d9474-3007-458a-ad20-5ec65ded2b0c", "comment": "Malware payload (Vjw0rm)", "value": "0ae624714a6b37ccf11083becc5590ec097f3bc597d2b6112465f716503244bb2a71b1590e7cc0c6473d940f76bae79a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143262, "uuid": "27093230-0690-4835-860c-4431969e1754", "value": "T14BA532D8138A8D0BEB8ED973BDD47DB661334575E6C97A83C219B84C3668793C3048B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143262, "uuid": "db53bb08-3b03-4aef-b40e-fda0dfc56865", "value": "192:aZVhB3qe3Ju2l2ZUCz1ZNWDl01tHY8T0:cVHaLRZcmXpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143262, "uuid": "1df564d6-6b60-4ba3-b3a7-fa7e9866eb90", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143262, "uuid": "a60053c7-c6a0-4536-840b-11f020fbff99", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143262, "uuid": "2cdabbde-43a5-4054-aa9a-52de573735d8", "value": "T817630494847_Payment_receipt_Pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17082daa-b39b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677171420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171420, "uuid": "d1c30638-5b5e-4860-a6bb-3f71b30fbbb7", "comment": "Malware payload", "value": "6eb92b8dae5730ff7d6da2cab832c3c3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171420, "uuid": "01c7e71f-e24f-42ec-834a-feb2adca4163", "comment": "Malware payload", "value": "dc3885a6d719df87955bdb33a9e41bed998bac9d800d7ae2362ded6923b30f60", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171420, "uuid": "ac19e750-4e07-412e-a200-1982ef7d0a4e", "comment": "Malware payload", "value": "fe81cf3ad9040f75e4c0bce8ce1cb4ddea82ee54", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677171420, "uuid": "8863c32a-3e9d-4369-8570-103671fbcccd", "comment": "Malware payload", "value": "72e2a23147baa60c54219b5dfeb76d662a9aa77722ad8200ec9a0975154f80049cfcab04fc5021422f165e0f83874574", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171420, "uuid": "d7e8debb-01c6-461e-b4aa-779d48c9c523", "value": "T1CB31C7247D033681DEAE89F02C7A2969816DB405C23A39079C0D3EAA9E222547BA2086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171420, "uuid": "836a83a5-ded8-419d-8631-6c2f6c8a17ea", "value": "24:9jtQY3LJC5EBHqAi2JWm81CLrXNsICT2YpH0xdCrzF1+jLVGsKsLyRnZJ7w5fhwg:9BxbEaBHPiIWY1JI1pHprzwLVGs1LeHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677171420, "uuid": "fce7b8e7-9f70-4174-b44e-bfc277936174", "value": 1497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677171420, "uuid": "94b96cff-ce4a-479b-8b65-d2b717b310cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677171420, "uuid": "5deb33ae-3434-42ba-b8c8-c1fc59d0568e", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b648f6b-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677151778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151778, "uuid": "cd5931be-eb02-4be3-9716-031d51b84076", "comment": "Malware payload", "value": "1527251a41cdc828d97c14a01c7bd864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151778, "uuid": "72a11a44-4240-4a73-bd2a-6aa8362c610a", "comment": "Malware payload", "value": "dd60edc1cfdf154399cc683be783536227aa75eb152078ba2fa9465dd9d6c560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151778, "uuid": "c6a688ec-ed76-453a-81e6-1ce480bf12ee", "comment": "Malware payload", "value": "1fda75dc53adac3165a715cdc928cc758ae6d91a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151778, "uuid": "fb9c2383-f9d5-4c0b-b350-007c526450de", "comment": "Malware payload", "value": "a9a878ae60fe1d249f5dbddd8e486579654b79035bbbf399939d82681793ba169fe291e9b52089ea690daa1beb41a144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151778, "uuid": "762a0903-b9cd-493d-a42f-64694b959c74", "value": "T10E94020763F440ABE4FA07B494F606531F31BC928B7D82EF2391A55E0E33685A57275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151778, "uuid": "f9a7a5da-4a2c-441f-8ce8-0e5122e13692", "value": "5b97b699960a77468209fbdfcbcba9ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151778, "uuid": "9bfd4ab2-39d2-48a0-9123-e67c7f5af21f", "value": "12288:Uy90g0vOKDxRr/4fDYC6UGKjk1CojVCNhM4juwfN:UyivOKVt4fDIUyoojVMhM4DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151778, "uuid": "25f04d7f-4940-4f34-895f-4b6a996d048b", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151778, "uuid": "a3f53da7-2c40-4e14-b1d5-c6e11bb22924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151778, "uuid": "03ac8964-6158-4f85-9322-6ad83318d323", "value": "100980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a350cebe-b384-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677161777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161777, "uuid": "d5c3cdbf-2679-467b-8bf8-a30df9ddaf08", "comment": "Malware payload (RedLineStealer)", "value": "1f5402b75d8bd69d10df11c82135ea78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161777, "uuid": "09fa0005-1e6b-4ecf-ae13-13db989b2cbb", "comment": "Malware payload (RedLineStealer)", "value": "dd7f62abe0f84f0faf049995ec5a9062092d169e73810688202d3d7a84eb77f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161777, "uuid": "b3a35ffc-dce8-4062-b25b-fda98574f9f5", "comment": "Malware payload (RedLineStealer)", "value": "ce68e402412e532f78f4f19ff28f978229e79209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161777, "uuid": "2c826d79-6522-4601-a3e1-1efad01d6ecb", "comment": "Malware payload (RedLineStealer)", "value": "20ac0d6e049dfadd74f96641efa1164741fc1befccf0a6ab1b3e54bbf79742467e04c54774fa5c1d239bb241260a0bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161777, "uuid": "469d2a1e-457c-4da4-b9cb-83fcb52d7729", "value": "T111251247F3F84031D9B5477008FB03C31536BE905B245B6A1A9EAC7E2DB25B1AA31B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161777, "uuid": "1e1e780b-6983-412d-9f6e-0dd1260edfb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161777, "uuid": "60d29799-3dfc-41be-8b4d-225c62cab1a3", "value": "24576:Oy0kJxjvbq19ZRT96zTVT8u6rPfprTr6Y6c:dxJxTm1x9618lrTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677161777, "uuid": "87c7ac44-fe01-434e-a404-1f608a040cdc", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677161777, "uuid": "9c95a5d2-2b10-4fb9-b00c-2ddedfa38bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161777, "uuid": "7211731b-6895-4093-baa7-04a10de21add", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d148cf-b3b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677182739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182739, "uuid": "d46142f3-8c85-479c-a295-222aaa3db967", "comment": "Malware payload (Mirai)", "value": "d2daf9bdd579ec6b43b10997a4848a8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182739, "uuid": "6d15a3d0-20e6-4c90-9f94-b5dc4b25fafc", "comment": "Malware payload (Mirai)", "value": "de6780e43fddade30c55bf52fa3bf5ea95e71bfcc8e3ec3f4e4d1e13291baeb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182739, "uuid": "50fdbfa0-cfd3-4ee2-977c-d85deb5d3868", "comment": "Malware payload (Mirai)", "value": "39628ab472f2171e0639c7eacd08ae13be517d20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182739, "uuid": "2065df16-773c-4915-b6ff-6444056d4ac6", "comment": "Malware payload (Mirai)", "value": "4ea58ed31b61505555daef9d25e8c78be7ff81ec2b50018cc517447bedd9fe5e7402914e7900ad9fa691dff590856ad2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182739, "uuid": "67df54a6-7f99-4906-b2d1-cc455fc4850f", "value": "T1BE3302D3938D8604DDC6E039248D22479E40EB2FD6918740DF9872BDED6AF0E0D7575A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182739, "uuid": "77361f73-04bb-42d4-89e7-74cc052688d4", "value": "1536:PJ1fJSFXS2FEcVRu2PKYSW8A+X2Qrnnouy8mqv:PJyhZEcVw2yjAIoutHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677182739, "uuid": "71b924c2-18bf-4191-8286-0b307f2d8785", "value": 50420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677182739, "uuid": "05c00330-99aa-4407-864a-cbe469f31ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182739, "uuid": "47683938-3df1-4f2b-b997-49e4de7e556a", "value": "d2daf9bdd579ec6b43b10997a4848a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e52557-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192113, "uuid": "ce797946-bd71-4b23-8146-59ac9ac0b6a3", "comment": "Malware payload (Mirai)", "value": "8bac5b19fac9e6cb257f8dafe2e578cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192113, "uuid": "32b6cb4a-4b96-4c02-bb62-4a0f11697437", "comment": "Malware payload (Mirai)", "value": "ded2c410c36b13731a1a0ada39461a86816055002e7e4b64960de0bd1f18c91e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192113, "uuid": "72e3f78f-0c2f-4ebb-9ea6-36ca98b8699c", "comment": "Malware payload (Mirai)", "value": "f0fea7a58573120a9070119e708825c20d69be10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192113, "uuid": "294adad7-0ba5-4055-b411-791c4da765a8", "comment": "Malware payload (Mirai)", "value": "b5e170233e1c316988bb39325c1453f1c34faa9a7ca63e58ac3bfc9f7aef4c91cd4d507136d4bc031e867515d57e3aae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192113, "uuid": "19f83fa2-290e-4aea-949c-fe9d51fb444a", "value": "T1E7330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192113, "uuid": "085112b8-d6ce-4b74-8201-fdb5c72f7c10", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oG4:r/hqaJMDg9eqK806MHdkfQX6HuC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192113, "uuid": "a280d9cd-969a-4b28-ad1a-01baae8b4963", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192113, "uuid": "828dc576-dbd1-4552-9c24-98b0e9a655cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192113, "uuid": "b5c19440-4bf9-4684-ad70-ab84fc6bde24", "value": "8bac5b19fac9e6cb257f8dafe2e578cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc97f54-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677158550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158550, "uuid": "afad5036-1de3-4a5f-adcf-3c773b5aaa85", "comment": "Malware payload", "value": "140c43410706b66b00e0a232a6b42465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158550, "uuid": "3e8d494a-e784-4fd6-b673-2dd23b9cbe1e", "comment": "Malware payload", "value": "df028bc1650f25df0e73fad8c238148c90f5f24ac24f88d94b4659cda9f27633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158550, "uuid": "60391b79-69aa-4c2a-a6d9-77ce1ab91d04", "comment": "Malware payload", "value": "6d3477f3639b6401b2908941c141de584aba8959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158550, "uuid": "6ad26704-1e2b-4d1d-9045-82315914c070", "comment": "Malware payload", "value": "15a01580579e4daeabe62d9fbc1bb6c561583193732325a7828694467383590c9c672bf1d453c8f0e1e78e366966dd67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158550, "uuid": "f684fd71-7607-41ea-bfc6-8e004bd1fa16", "value": "T179D506C0F9DB45F6E2078D7288B6922F9B30560883B1CAC7DF682E59EC1B6D5057B718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158550, "uuid": "cd2b4760-b55e-4a77-93e4-d1ed5f8ed35c", "value": "e724bea03515dde29f2b2b282d64f822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158550, "uuid": "13114487-e830-4738-a41b-cd8e37945fd0", "value": "49152:b1TJ9zePB4262LMFVXSUdg9GbpueIiyXKdzCQWfB+qzeM1VvmaerxyXMrSMLk8Ww:b1TrzePB42VLmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158550, "uuid": "29624ac3-30e7-4ce2-8e12-ea8bb6f3d0af", "value": 2912256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158550, "uuid": "e73a685c-24c5-4f0e-8f93-c42d6871ece1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158550, "uuid": "6973dfca-1c32-4116-8559-eca5b509f47d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c763bc-b398-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677170133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170133, "uuid": "11d7f689-0678-48a4-bcdf-dce0fb68e19d", "comment": "Malware payload", "value": "e109be482e82d1bd14af64d070d2670c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170133, "uuid": "7ccdb37d-bf5d-484c-a20f-12b8dac25f81", "comment": "Malware payload", "value": "df9f9bed6685eeba38defa87a755a0c8120f7b572094368e3aef41829039980d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170133, "uuid": "2482d172-e956-48c6-a6a1-97efcc9820fb", "comment": "Malware payload", "value": "30532b7ec2fe340939a18e8f328c17ddfa3276ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677170133, "uuid": "6c87268d-d0f8-4e6a-925a-1333051f4c3c", "comment": "Malware payload", "value": "63573b119de20b50c24353f35cf930eb155435221c5683c8c450a70a3a59fb17b70a954c35d2f4b36ab05f611a36d695", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677170133, "uuid": "8dc0b96b-483b-44e9-adec-166c8ee5c3a9", "value": "T187A1ADD7AE54A4EEF64FC53E015E84A7A34D4204A2C1717E6D6C10BFFD1C0862F9622E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677170133, "uuid": "79f264ae-762f-4e0a-aaf8-3c7b6b2c006c", "value": "96:pJpDQKSK6aetXennFi0A/Txzdxh40jV4/b23r/wF5fyY+zCGiM5oEo7k13e:p0KT6aetHfNz7iMVh/wDfyY+zCGiMPo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677170133, "uuid": "63d186ae-103d-43a6-90f2-49cf4099b985", "value": 5000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677170133, "uuid": "a7ebf907-7dfe-44df-b933-471d8fe6cce8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677170133, "uuid": "66acb745-92a1-42c9-8aa7-ead58359ae8a", "value": "factura.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25cbd64-b384-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677161802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161802, "uuid": "2a5bcab1-3b45-4d40-bae8-a9d0e949740e", "comment": "Malware payload (Smoke Loader)", "value": "89b224d64307fa73e533059cfd4aded2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161802, "uuid": "f6898c86-cf75-4f5e-a522-d0c30ba66087", "comment": "Malware payload (Smoke Loader)", "value": "dfe026cc1af602df44802fc2931704e13a7dd5d08979e4fc33c77d3805435f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161802, "uuid": "115e347e-2329-4ed7-80b0-3ff9fa7ff8cd", "comment": "Malware payload (Smoke Loader)", "value": "833bed8e9f7f5e9b4a5f458484ceb5556144336e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677161802, "uuid": "f928fb22-3180-43ec-be6f-3c20d2013d3e", "comment": "Malware payload (Smoke Loader)", "value": "19cc0cc675c5661d74eb123b24aaded484dcd28c1926e6b17e3e80ced0da672e2bf1ebf6595b48ae99027d2e5529831b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161802, "uuid": "a2b9e6ca-7c6d-4264-aa22-7fb458eb2966", "value": "T18E66E1F0575DA590E5BC6C70C8D96E768313B736BC26EC33186479C06A9210AFDEB48E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161802, "uuid": "332c5d81-54ce-457e-a5a4-f68898ba9115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161802, "uuid": "555a541b-8dca-4d61-9107-b3582e0cc425", "value": "98304:Y5I5x3omArylYOI5CAaT+dPas2Yv0zcBWc1fldTRwaykXf1DW4:15xqyoaT+dPB2mwq7T5bXfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677161802, "uuid": "017dbaf4-a641-4086-93d9-2e524699200f", "value": 6757348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677161802, "uuid": "72c9cd22-79c5-4b8b-bace-1ca8acbe5724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677161802, "uuid": "e75a20bb-f4ce-4232-91eb-db9d37e5a366", "value": "Setup_Launch_Win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b843b5c-b38e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677165925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165925, "uuid": "6cea42f5-3e67-44a0-ae1d-467356b34a17", "comment": "Malware payload (AveMariaRAT)", "value": "5ef276a7d78356769c2f5158b631366d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165925, "uuid": "ee232d00-4d27-4f80-bcf1-1b554e971c7e", "comment": "Malware payload (AveMariaRAT)", "value": "e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165925, "uuid": "09eabf05-ede8-445f-baa6-57d4b32055b2", "comment": "Malware payload (AveMariaRAT)", "value": "16843874d6ba640b5e3cd484fdb6c5519c215da1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677165925, "uuid": "899aa552-082c-4613-a1d6-1a77c67c7c51", "comment": "Malware payload (AveMariaRAT)", "value": "6da111f15e1a0bb34416eaab0b330acdc111d063511cf1f8d26b75ed7d416eed280579297ec3b561f227eccad1b346e7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165925, "uuid": "3502393b-82c0-4f4e-a23b-094abd2710f0", "value": "T1D7058D8977B460BFF48B45FE58382BCC2D203553760AE21F93377B91A2299FBB684151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165925, "uuid": "3c6a9631-8208-4c9e-ab42-b1224bee8e7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165925, "uuid": "efa1d9bd-1c4b-42f3-8ebb-05e44edac251", "value": "12288:ARqKnlpgIuS0A3ROhx5sC0olr28mdJ2sDttfU31gWybr2ay4eaIXSPJcHs3JzVvO:ARqLIuAR4x5sChlqBjJM3mWy7ILMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677165925, "uuid": "5d54def8-29c5-49d6-8f51-76a3e3a13ce9", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677165925, "uuid": "9b00d12d-c2e1-4b60-a077-be2052412218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677165925, "uuid": "e4457ed2-c367-4fa6-b3ca-82b204a6fae8", "value": "5ef276a7d78356769c2f5158b631366d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec83a1b-b374-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677154790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154790, "uuid": "f791db8e-18e7-4e83-afba-26e015096b3e", "comment": "Malware payload (AgentTesla)", "value": "30b5426ee9183f43fba9a8a6b6b32b97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154790, "uuid": "66b41e33-2833-445a-aec7-12df9ab60447", "comment": "Malware payload (AgentTesla)", "value": "e18cf6502122b168dac6c932cd89739e313154ee9b73d6ddd692d4ad990aceb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154790, "uuid": "01c6e0c6-cbca-4b0f-b792-35c9733b78fd", "comment": "Malware payload (AgentTesla)", "value": "d0b8cde6d8c38e294ce6275b0f935677b07d2202", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677154790, "uuid": "1d586935-559d-4741-8794-fec08c2455c3", "comment": "Malware payload (AgentTesla)", "value": "380fbf476a12581443a2d3759480a56d4f09dece947e8b64947643a37cfb98d5ffbd8c8a238c43b72a16c8d9c613cf58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154790, "uuid": "926fc654-907b-425b-9ace-d70ff44272d5", "value": "T187B23F05A398D278FC533A34AC6713B04BBAEDC98C22AF9FAC40B5DA7D79340C556354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154790, "uuid": "212f5b9a-b361-48ca-97c8-d90583a7bde6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154790, "uuid": "01c035f6-2be0-44d8-a602-43442d73ab0d", "value": "96:jFQgbeIBVLyrgoJ/sTfNILBevmXR5MMRWnwLoLEk8LfjNiRB4e3T3ew5tvEzNt:jFhyIaUo/sTfNILwEfdRTLat8LLGTvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677154790, "uuid": "cd57d6ce-d985-4509-9f4f-eb0636a20580", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677154790, "uuid": "43d9f8b4-929f-4f7f-bdf1-a5516135fccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677154790, "uuid": "737a1c61-a1ef-4ad3-9f93-a93c7aa64f86", "value": "30b5426ee9183f43fba9a8a6b6b32b97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb69b0a8-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677142168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142168, "uuid": "91d39037-baf9-4877-96e9-d167f8b6dd3c", "comment": "Malware payload", "value": "3b06d52581e6b587af7b692507959f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142168, "uuid": "f293583d-3a66-49f3-a651-744923689bcf", "comment": "Malware payload", "value": "e47fbb0068d66c7b41fe7890258b97a950e43aad5990aeb35ea45a37e762036f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142168, "uuid": "3bf49c5b-c42b-408f-b1bd-640a26ce7527", "comment": "Malware payload", "value": "15280df7bf6823c057f1a2538a12715ca82535cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142168, "uuid": "2c57c33e-9d60-44a0-a0e8-3ab609775ed8", "comment": "Malware payload", "value": "44adcc9792e7099c21a678ae9ac20833873fce539429a610e23e710a053e1897e379607b8c650a84d9de364ca19e790d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142168, "uuid": "5ef05e30-6434-4f44-b86f-53699647f448", "value": "T134E1A415E7E80733ED6F0B7988A7570207B4E311D813EB5E2CA8A21B6D177540C63BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142168, "uuid": "1bb9c187-a595-47b5-a0c5-d60892ede6e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142168, "uuid": "9edf99df-f313-4b10-afd6-c11fbcd9dda9", "value": "96:s9LiFjBSG36KypWLiUIBWcxk+/G2na08aPzNt:s9LiDZFyL7OeG2naoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142168, "uuid": "34be49cd-42d9-45f5-83d6-f212a6cfa5a1", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142168, "uuid": "210539f8-33ab-4869-a2e1-d60855e10890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142168, "uuid": "7e811485-938f-4205-a7b4-ba9e146e4320", "value": "3b06d52581e6b587af7b692507959f46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cf96de-b379-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677157084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157084, "uuid": "61c97126-79b7-429c-ba64-a01eab34ac9e", "comment": "Malware payload (RedLineStealer)", "value": "e8314d8aab3f1b3a7606f36144bf82be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157084, "uuid": "42588512-e7f2-44c0-91c0-794c33b4cce6", "comment": "Malware payload (RedLineStealer)", "value": "e4c09d0bb0e60ba3ea57069423f27f8e45cb13c863352a78aabaae58fcf645b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157084, "uuid": "cd5700ac-8a06-4824-8731-4487b5988fd5", "comment": "Malware payload (RedLineStealer)", "value": "5a3fc9934c4a547aba50134571e6c35e86286a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677157084, "uuid": "9f5ce3c4-d1da-44f3-b112-932ba086f7b8", "comment": "Malware payload (RedLineStealer)", "value": "b6625d6a3c1c575a1616d968cb43a44307991815dc5a364d781e74dc1f4c3bcf32e04e849a7d38420779ec7c51a715a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157084, "uuid": "df83ab7c-fedf-4b03-80fa-14c85055d41b", "value": "T165251207E7ED8022E87A67B01DF303D302377CA56A7847D7228AAD2A1C725E5B135767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157084, "uuid": "5640d985-0a74-43ce-8ccb-4f83d9497525", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157084, "uuid": "f1453252-22c4-4e66-b360-114a4aca1b7b", "value": "24576:tySqrDbSl1TIcqGGebR3+iuYOYEdSKFLUEp3Gm+:ISQDeXTIcVRp49FN9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677157084, "uuid": "d0b67477-1d61-43b8-83ec-bf061091795c", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677157084, "uuid": "fa6eebcb-2e55-4cc6-be50-6fa444fb2b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677157084, "uuid": "74d84f89-ba26-4cdb-8029-b1a7d8678452", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebe4a8a-b396-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677169527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169527, "uuid": "ec0aafb8-b25b-47bc-9f03-615d228a6950", "comment": "Malware payload (njrat)", "value": "67e7aaa460b5b409e48ed29e6dd4de20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169527, "uuid": "d2a6911b-e14d-41e5-9647-2b487ace225e", "comment": "Malware payload (njrat)", "value": "e7297a8bf540a5166506160f23842657602240595680c7e880d7d1a49f1e9091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169527, "uuid": "3d62cedc-df7f-4795-a5a3-7930a963f937", "comment": "Malware payload (njrat)", "value": "d891d5ba0fa75fcf8c547bf20c8a5f950c06dcc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677169527, "uuid": "1f5e9e51-8453-4057-9d9e-d1c0eaabefd9", "comment": "Malware payload (njrat)", "value": "888e4c43f6e255d219f456d37249fd6bf23f52b5332a89364229899bccb7414ca753d3988e2fe07059c1d5eda30ad4b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169527, "uuid": "bf6befd2-53a8-4421-9c3d-0eea5ca5c7fa", "value": "T10FB21A0E3FB98856D57C1B7486A5965003B492470423EE2FCCC950DBAFB3AD91D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169527, "uuid": "34c512c4-f1c2-416d-a82d-9135dfd3761b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169527, "uuid": "4967cb4a-d6f6-4f6f-812d-3675e5e26e16", "value": "384:ewz6+T4IjWZFNwXU0eiNUBdvt6lgT+lLOhXxQmRvR6JZlbw8hqIusZzZAo:9TbC81NgRpcnuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677169527, "uuid": "30032db4-979f-41cd-a3f3-4f226f46b91d", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677169527, "uuid": "7486fabf-582f-4e29-80c2-2075bad860af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677169527, "uuid": "a23a39e8-7e31-4830-ae37-1e836c30c056", "value": "67e7aaa460b5b409e48ed29e6dd4de20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edd0a40-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128671, "uuid": "c14c664f-4e96-47c0-adca-5fc202b76d1f", "comment": "Malware payload (WannaCry)", "value": "f7b5f2070c6aa8605a16be99c476cdca", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128671, "uuid": "ce194ade-6310-4f05-a3cf-fe8ab1f9a2aa", "comment": "Malware payload (WannaCry)", "value": "e7865bb92711d9564c275ab5c4ca927e1d59f0e5bd66b97248b56805d806a166", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128671, "uuid": "574371bb-280f-4ff1-8d02-c7e879cdce4e", "comment": "Malware payload (WannaCry)", "value": "6d50778a151070ed3e43e3fee0dbd778de6f33eb", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128671, "uuid": "f60c6a71-b7f8-4cdd-b0b6-f518ab55a7b6", "comment": "Malware payload (WannaCry)", "value": "113c5c29c47b95f5d3f07e4b71c024030068eaaa700b377d3af6e30dd559b5e6f423fb445a5048c3e423428a422ec716", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128671, "uuid": "1fe2b1be-09ae-482f-bc2a-11a7cfaf8760", "value": "T111D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128671, "uuid": "9f77b421-89c1-4ce7-8bec-53e29304840c", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128671, "uuid": "9a517b71-aaea-4a17-8aaf-e5eec3497bbb", "value": "24576:BS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEpo:BSy6PX3PpM+P5Idko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128671, "uuid": "06887631-aec5-4964-9e1e-efbc608ff423", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128671, "uuid": "57724215-cec9-4e83-b609-37d90f406a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128671, "uuid": "aa713836-c2eb-474b-a164-477161e8e568", "value": "2023-02-21_f7b5f2070c6aa8605a16be99c476cdca_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301d14cf-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677151705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151705, "uuid": "067a7a86-51bc-4361-99db-f4f2d756ab9b", "comment": "Malware payload (AgentTesla)", "value": "d61ea438a50599b93b855d160256f994", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151705, "uuid": "4a276cf7-760b-437a-9bd3-db5535510480", "comment": "Malware payload (AgentTesla)", "value": "e82d940033891932405dfdeedbd283a3be9dcea92d0a4d3cda675abc3345dfc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151705, "uuid": "3b9ab97e-5ef0-44c6-b198-8d1d043ed8ca", "comment": "Malware payload (AgentTesla)", "value": "4b72f7a667de8c7c287952e44a9b7d0227c05d81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151705, "uuid": "674ea812-b34c-4cf3-8a81-d300cb1ec794", "comment": "Malware payload (AgentTesla)", "value": "4a1b695f96e6e11d32a54a9fbadff2858ef19fdb8b5f8824c656c33d3047475c3eddb4068bb1191c2e85f007bc12e3e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151705, "uuid": "c55dcd0f-1939-461b-be7d-55b9337dfdf5", "value": "T100159B8BBBF0A077F99E419D063816CF5E31A243755CE2265F3B29489D86DFBB1C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151705, "uuid": "e9094450-50d7-4263-b668-8252741ebc83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151705, "uuid": "5f8825ff-662f-45ca-b0b3-537d3de6139a", "value": "24576:NA1n4SzZGe7IImUf6IAe9M0iUCBmeMWhsSfPVCtcu:NAvUInAmVUsSfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151705, "uuid": "dbb01e62-e277-4023-8be8-2de747d93071", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151705, "uuid": "76e0df94-c1ea-4c9f-a48b-dddbdfb7dfbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151705, "uuid": "5ef273b7-120f-41ca-9f1a-b0ee40480791", "value": "d61ea438a50599b93b855d160256f994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1573cd1-b3b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1677182416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182416, "uuid": "26557916-6adf-4488-ad46-8aff5d2cecf6", "comment": "Malware payload (Mekotio)", "value": "97f533a5e991609ff73d91aee99acd94", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182416, "uuid": "7eaf2328-f47f-4aa6-a38d-8533159aba79", "comment": "Malware payload (Mekotio)", "value": "e90311853d164e701ced87192e7b43f8d8192f9adf1f2fb241e5f33c3fb97de5", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182416, "uuid": "208c763e-b5ea-4273-bbe3-4ebe6e810824", "comment": "Malware payload (Mekotio)", "value": "a150792e0a2f2192b4350c4b4c60ddf279948006", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677182416, "uuid": "23094525-5a9a-4259-851b-dfd7954e7f67", "comment": "Malware payload (Mekotio)", "value": "36b8733b53c826cf8af17cad302915ef1b8b2102bc030b947d29399495fcdca2b9aa65c2369b8d26d157012420012bb2", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182416, "uuid": "954dce58-41da-4737-9585-e39765ef4175", "value": "T1CFE633696CCE72B52E3F668C260E45991283F276388D73B25205E9E7990587B07FC18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182416, "uuid": "b53ceb11-30ad-49d8-90bc-85ecb04226c4", "value": "393216:WkPaGasRy9QeycjKzKSL+evB9B5Zdoj6z6m+r0uKJ:Zzy9QeycjCXvBv5ZdIpzAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677182416, "uuid": "68cd245b-f919-4960-a584-301e972a9ff7", "value": 14584659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677182416, "uuid": "1c58199c-c2c2-4af1-96ee-f00c21af19ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677182416, "uuid": "d74373ed-92ec-47fa-8210-c7c34df1fa79", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac10fdb-b328-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677122303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122303, "uuid": "449d77a0-7973-4ef4-9a0f-4362ec40fce1", "comment": "Malware payload", "value": "2065649fe80048cf827f8aba79aecd6a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122303, "uuid": "a3218d63-4b0b-4fda-b997-2d822b0768ce", "comment": "Malware payload", "value": "e988d2f6b190e19b34fff369e820cfb3cd251d6f3b4cc557292a28f7968c1c97", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122303, "uuid": "ee3ab7f5-5d6c-46fd-8332-829e483b59ff", "comment": "Malware payload", "value": "8602b7da47b15340670482ebc5d6e4ce4e9b0488", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677122303, "uuid": "08f0c1c7-8817-4b37-9b5b-12445674a7ef", "comment": "Malware payload", "value": "9931a451fedea050321d66613044f274919a587eb05ddf130d43de4dc6d7fb40a636e6f64d4fca760c3a668c07e02cc3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677122303, "uuid": "be783219-44a5-41bc-acc1-9d21feab9787", "value": "T14AD31337BF39499B70192B782125814D84DBE68B8310F897D54F7ABBBF07A40229973D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677122303, "uuid": "357416a8-ce21-421b-840d-b69cf2669898", "value": "3072:LkRQfyOJx37ZNM7lqN1o0DHHDbo/2VQlsJ2ALkiqC:jPxHMH0DHH9T2ANqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677122303, "uuid": "844d9b1a-a40e-4610-bbc0-acad6ec0e563", "value": 139624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677122303, "uuid": "226acca2-3b08-442e-ad8c-ad1c4a6b2f4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677122303, "uuid": "40dca6c6-7b70-45c0-af7e-2fc3c2d01a74", "value": "9292029551.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7f3c4e-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677151671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151671, "uuid": "7c2fbc84-1988-4e64-8f59-09f241d7790b", "comment": "Malware payload (Formbook)", "value": "421bfa7c4bc7f166ae9f9ef581671476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151671, "uuid": "08cee8ad-12f2-42fe-b154-9fa77a8d40d0", "comment": "Malware payload (Formbook)", "value": "eb621c444f0fe81e7008bdc13d86466230e99deb1b0f21b77c70d3256687e730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151671, "uuid": "5f6f15f1-9319-4f2c-a112-c580fa5d434c", "comment": "Malware payload (Formbook)", "value": "d59ae060316a95e4b4fcfee92cd020886d590f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151671, "uuid": "6d4f64b5-3b9e-4bbd-ad43-d0434491b400", "comment": "Malware payload (Formbook)", "value": "393c13c59be6fa0c7040b20ac6b1cee09de5df74422305462b0d6387fd4875ee6b5593798d3b035515d8ed0b7dc19a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151671, "uuid": "b8737c91-a009-4ee2-974a-9370869d2c96", "value": "T19664125166A0C127C6A50A725D7A4AB2DFB5EC224874574B17B03F2FBC363E2942F372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151671, "uuid": "8283ba8e-5650-47b3-87fd-980298cb5b83", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151671, "uuid": "019f3bb2-f1c4-48e9-bc55-5886e8646a58", "value": "6144:GYa6GXMM26PWfUSoCqX4LuWBwwyjvW9ol0RxcZZ6vFzR0rKye+:GYIr2kavBwwWuoijcZQFN0zR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151671, "uuid": "b8377bb5-90c2-4a97-97e4-7f2697692ede", "value": 319545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151671, "uuid": "f316a0c1-563b-4b09-8541-1430a291537e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151671, "uuid": "8167dde4-07df-48d1-9ca4-d6190ab90263", "value": "421bfa7c4bc7f166ae9f9ef581671476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa00c6d4-b348-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136018, "uuid": "734d0fee-bd2a-4016-8b2e-a715a3468a4a", "comment": "Malware payload (AgentTesla)", "value": "2fbdba172f5390b41212ea5430d00844", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136018, "uuid": "842a2720-ea56-4b65-b3d5-25fe25f5c2cb", "comment": "Malware payload (AgentTesla)", "value": "ebb3f203a22c8abfbda5d25a2390f86b4d57a5367e83a245d14dd4ef52bc9773", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136018, "uuid": "f984a7af-017c-4ec8-a550-d0d4b9bc6fec", "comment": "Malware payload (AgentTesla)", "value": "4adcfb4fc91310c258afeec217fac70a976d42d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136018, "uuid": "0aff51a6-0517-43d5-a111-50cb7a1f1b01", "comment": "Malware payload (AgentTesla)", "value": "f11da2cd6e5f0e34459f55d5693b87098a6442acc9e1d37d195e8ec6fb5637db5d156059c123ed70808d5683db8355a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136018, "uuid": "a6ce4f4c-0781-433c-8871-a4afea4a97e1", "value": "T130E27E5DE78F02A58F465277921B0A8942FDB77EF34501B1346C933433EE92D916A27C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136018, "uuid": "7bf5b663-2c89-4b7a-927d-f1e50a35fc15", "value": "384:aL0AbZSVoRFe8bFIMb/qGH/l0Y3dexgV+XwudYY+5zB:awAbZSVyF7beK7H/lp3Yx6+Atj5zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136018, "uuid": "a7460bce-d82b-4819-8d3c-1aaf06a2507b", "value": 31888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136018, "uuid": "62e005f3-e5da-49b2-afbd-f3352189c2d6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136018, "uuid": "ddd7e15d-b979-4749-a0cf-101d239c66d1", "value": "Doc_di_Trasporto n 5093000 del 23022023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35247fc3-b377-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677156009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156009, "uuid": "538ddb7a-09bf-4b8f-9761-661e03885b7a", "comment": "Malware payload (AgentTesla)", "value": "f83cdc4f967d66ccaedc5984d22b444a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156009, "uuid": "b1afa2b7-ab11-4483-8eb6-6899a3796403", "comment": "Malware payload (AgentTesla)", "value": "f022b03b270b8b1d9cd7d8770cad609e7fb14f88220455f7f35f1010fef4d44e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156009, "uuid": "6c6f2542-b98b-4431-92f0-dd7f38a00f88", "comment": "Malware payload (AgentTesla)", "value": "5f515f7b4691701b343d6fdc2babde88e1ecd4f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677156009, "uuid": "17fbc2d4-be5c-4642-a51a-114768261829", "comment": "Malware payload (AgentTesla)", "value": "a0dfcab0ec7e24af6b5b55fd7e2310b57a4c690fe86173c5fd9ea8f2a25ed0068effb7f3c34f1a3b4b361996e15458d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156009, "uuid": "27badd67-4187-46ac-aa13-6ced0c0f1b21", "value": "T1696422A01A81C8B3FC6155766739552BA9FBF4125DB0935B07610B2EFC27AC1EA4F3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156009, "uuid": "9637a0f0-bc36-4dd6-8e90-1a2c481fd58c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156009, "uuid": "fd46ba65-37ba-4d85-a784-ecb357c2433d", "value": "6144:/Ya6uzZGGt4cxY6bMXRnTJCuzxc4gXluqYiX2iW5qGb9Z:/YIzx5yRTJCuxc4gXlFmi+3b9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677156009, "uuid": "69615e67-3732-4cc3-a55a-83d92dc074c6", "value": 319770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677156009, "uuid": "ab945958-efb1-4f95-bfc7-c15ab4c28a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677156009, "uuid": "e6500a54-074e-416a-8ab9-ca59276114a2", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0149127d-b37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677158499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158499, "uuid": "06b5c09c-f1fb-4651-9b60-062b64d189c8", "comment": "Malware payload", "value": "9b51187055b3a1fe0a0a7f924efd5ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158499, "uuid": "e68ba2cc-cbd9-4900-908f-be95d64a8cba", "comment": "Malware payload", "value": "f302d77ff99ef6acef9d133de19fc8b72f638d67f8c4a40ffb2ff306024fe4bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158499, "uuid": "0d388a17-3967-4e0d-a41f-190f9a4e9c66", "comment": "Malware payload", "value": "9f1067d45faa8ee1c5f9b003d224ed53a16d5a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677158499, "uuid": "a5c516ba-1953-4e59-9974-75be352a204a", "comment": "Malware payload", "value": "f16937b54ef3554b2c17ad584f06cfdf7b6174980796b3e8351b3f6ccbf9c52725903096939495ca8474df9e57e808c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158499, "uuid": "b551bec7-f056-4351-80ff-171ed3ae3150", "value": "T1C1254B9963EC43D4DA76E072EA128607DEB37C8A0674BB1F0DE07A756F33660161E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158499, "uuid": "b295b65e-875e-4d01-a93f-f53da89a22e4", "value": "161c85364c462057ba28801ac1ad5404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158499, "uuid": "78289fbf-91ac-4967-b706-f07e6ba10e0f", "value": "24576:7fTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0Hhx5:7G00SSgCmP/ZwYj48a0Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677158499, "uuid": "dfacbffb-4d28-438f-8869-a740fc5a878e", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677158499, "uuid": "a216448e-d1e1-4d0b-bae7-e490a7368836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677158499, "uuid": "795d6cc9-2330-4716-886a-71924f4d6aec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c32c2eb-b319-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677115728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115728, "uuid": "6bcfbcc5-a6fa-4f72-816c-512c252aa3db", "comment": "Malware payload (Formbook)", "value": "8b01aa45b4a9bdc067e4c5156a072a8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115728, "uuid": "1f91c625-1919-4267-945c-768dd0823ffd", "comment": "Malware payload (Formbook)", "value": "f34101ff83317586693f070a42c11d7e09f5588f4748258830f5475b3ebf227d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115728, "uuid": "146ec215-0000-437d-9f97-673fa928637a", "comment": "Malware payload (Formbook)", "value": "01148ded80f5ae5599b5ce70a768d3ea2d7451f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677115728, "uuid": "677a2f4f-6305-4003-ab70-96ee00d36652", "comment": "Malware payload (Formbook)", "value": "043ff2165332a2e35660eed06e65d31931f808c2a862b940256174996b204f41434920cc8926f6ac312f78a96c063eeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677115728, "uuid": "83e232c6-7399-4ae3-85b6-9ea013d04b5f", "value": "T1B1056BCCB1F0F67ECA0AC936AB103D146BE0654367268593E263B6D99F3D4539E1C4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677115728, "uuid": "f1087170-4960-4fa8-8a18-cdb82c95df1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677115728, "uuid": "9d23faa0-f057-4846-857f-a0fc2b13812c", "value": "24576:PKqDSuEigIkqiU8Ibvpg3WCyIAN8+Yj7:/gIrSIbhgz48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677115728, "uuid": "bba556d5-161f-4fa6-9995-a93fbc45986b", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677115728, "uuid": "3c35a3ae-04bb-4205-9898-a71ba3c61e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677115728, "uuid": "1347665a-c675-4733-9499-2923861fc85f", "value": "8b01aa45b4a9bdc067e4c5156a072a8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bba6e0c-b359-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677143108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143108, "uuid": "fc423d14-fe53-45ac-9780-181c89010c65", "comment": "Malware payload (Smoke Loader)", "value": "bd6124c01eec7a336108d248b6f2f832", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143108, "uuid": "5c26ad15-5045-49ba-a53b-6d9fe5492c4c", "comment": "Malware payload (Smoke Loader)", "value": "f378774bcec1afa3ebbf3516a9ebf046095ff8b9f7e56deae5dc51bb115fb520", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143108, "uuid": "d4a19c90-3d2a-4b8e-8832-853ba2583f98", "comment": "Malware payload (Smoke Loader)", "value": "68704d8e6d860e24bb2b284dbce3efcf94283684", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677143108, "uuid": "c43e2803-fc53-42ec-94ef-3fe8b4c9aff7", "comment": "Malware payload (Smoke Loader)", "value": "7407ceb4382168840fa716ff31a6c4aaeb115a3cd742161a1b62a615a5f0413bc5af20d0ef9288297e1f294736e95e4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143108, "uuid": "1221113b-f836-445f-b425-de9c807323f8", "value": "T1A3F3D012B2A2C031E167153054B4C2E15E7A787236348DBF37AB2B2EDFB47C1597936A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143108, "uuid": "79b85912-ab40-48e5-96fb-bae1728ba3ee", "value": "189ca79e6e12df6fc809dbdf8aaa93ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143108, "uuid": "a1df0507-02f2-4684-bd80-0e5e962f8cf1", "value": "3072:TXz6yaA1Dz5uDxdgoZI2opn5PxMZoKVn0uf4STWrPqCfb:H6XA9zEDxdBspnkZ7vYHfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677143108, "uuid": "e2b34f25-11e2-4c41-8045-689721231c25", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677143108, "uuid": "0eac9d74-df4f-47fd-8a6c-914fe239abab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677143108, "uuid": "aacd353b-7aa1-4cb6-a25d-2529ec0866bd", "value": "bd6124c01eec7a336108d248b6f2f832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27d720b-b337-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1677128812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128812, "uuid": "96b10e61-b7f5-4545-a73c-cf47c32bd891", "comment": "Malware payload (WannaCry)", "value": "5c7c31269c0c71f930f49abc07964fe3", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128812, "uuid": "62f35ebf-6020-44c1-9de7-cf17c94b113d", "comment": "Malware payload (WannaCry)", "value": "f4b76167992b06ef01238be808140de25c7b0490538e848aeed890d7fdfd34d8", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128812, "uuid": "71b7315e-cf72-42b1-9d63-adcc99eac369", "comment": "Malware payload (WannaCry)", "value": "4d941f68c7a7e2ba00a88b98d55a46397d1837d7", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128812, "uuid": "68b1a3af-5fb7-427e-a7a3-e6cc5a5ef8c9", "comment": "Malware payload (WannaCry)", "value": "9f964eb1d452b290f42a2de07840c370b370996eda648792477b792c826b5715d4112b389d3d4421404c4617801031f7", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128812, "uuid": "d7ef6f07-c739-431b-9333-8c498f37fd6e", "value": "T1D9D52E3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128812, "uuid": "548a6930-c054-4019-80d6-db242dbb4734", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128812, "uuid": "ef7ee68e-2e93-45de-9153-bdbae02ef0d6", "value": "24576:DS4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfEy1:DSy6PX3PpM+P5IdL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128812, "uuid": "85380069-7493-447f-bfc9-fdf2bd51ffed", "value": 2884608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128812, "uuid": "1baab689-ed41-41a2-82e9-ebb73c0b9070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128812, "uuid": "d3793728-b089-4328-bcfd-9833e1c773a2", "value": "2023-02-21_5c7c31269c0c71f930f49abc07964fe3_neshta_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0437cc83-b32b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677123285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123285, "uuid": "2926db59-d08f-4db0-9f66-5bc335616994", "comment": "Malware payload (Mirai)", "value": "9e0a59c38a4dde6617b5c1b0eeec4e73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123285, "uuid": "c0ac4dfd-6422-478b-aa73-0e4bfda21058", "comment": "Malware payload (Mirai)", "value": "f530adf3db5e575ccecb03c0b5c7eebfbe077ffb4bd92d58fb32d07d835abd70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123285, "uuid": "22d67b78-fdb6-4944-8e1b-e417685e9095", "comment": "Malware payload (Mirai)", "value": "d8a6540949a0040340de522dbdfbdc886257ea1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677123285, "uuid": "3f20d3c1-0ae6-4aa0-8b35-dfebab9c7842", "comment": "Malware payload (Mirai)", "value": "3ed5a8de4e7fd410c45809884973a6dcc6597200803ad78105a93655fb81b87d27e1ac1444f920101ddf28e656c002e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123285, "uuid": "3f21438f-b548-4c04-bb18-5979c3e16ca4", "value": "T1C8431925AD792E26C0D8A57E51F7C214F2E2620E25F4C65E3C720E4EFF04B4069673BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123285, "uuid": "6d282791-4232-4f01-8bc8-425ee9f934f3", "value": "768:PaobQ3Qfq99aCWNvzsXWJyaE36WsYP2M94ddlAv/FqO+2UrFC:PaKQ3QfS9aCWNvzo2yH36vYZxF4PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677123285, "uuid": "46a02fc9-63e2-4ffe-8004-0052a27601fe", "value": 59828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677123285, "uuid": "bc1ed896-e7a3-4bbd-b9d5-f4ddc98fadcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677123285, "uuid": "7f55b114-4b5c-461d-b1fe-5f60269e666e", "value": "9e0a59c38a4dde6617b5c1b0eeec4e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2735f4d2-b36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677151690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151690, "uuid": "69bab6f4-0d75-4a99-8660-2f1edebf952a", "comment": "Malware payload (AgentTesla)", "value": "357672c5cffd689e8ba0b32e6aafd80b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151690, "uuid": "4076fdc4-f3d6-4e37-8c93-365ba52f7216", "comment": "Malware payload (AgentTesla)", "value": "f651afc8738f0810f0b6eb4fd595a5115face71e1903370cc1e4594a1993f77b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151690, "uuid": "dcfa344b-037f-4dc1-a2a5-b2cd5f143503", "comment": "Malware payload (AgentTesla)", "value": "b0b35cd1a9c34d420745b00fb7a725a7b84568c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677151690, "uuid": "fcffcff2-ba10-41a5-9559-8a703bec74fe", "comment": "Malware payload (AgentTesla)", "value": "4f1a4a3dbfaa0cfb0001c5d154c19abf311c9cf7286cc6f409c21343a1d9be61940f236b1d4b4dc533e0dc88fc75a737", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151690, "uuid": "8cf6b4ba-e7f9-4c6f-93ed-73e976bd66fd", "value": "T1BE057B47BBF09076F99E41AC063916CF5E31B253725CE2261F3B69488D46EFBB1C8612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151690, "uuid": "1b5c6ad2-94d4-40da-9eaa-0696357b48ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151690, "uuid": "61f9eefb-b4b5-4d44-b149-3c11b89ff020", "value": "12288:ItFpb5PHF/EVIX5X69J7BhLg7OHY9NcUUMv4Azl+dtoPu:ItFV5PF/EVIX5aPaNBD4ACtcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677151690, "uuid": "93150e65-edbb-4e00-a213-7018a7d9bddd", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677151690, "uuid": "6333c1fb-02b3-48cd-92f7-e806f81e66b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677151690, "uuid": "908d969d-f54b-4705-b32a-28749f4027b6", "value": "SecuriteInfo.com.Win32.CrypterX-gen.22083.9217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242d8fd0-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192058, "uuid": "a445388a-4985-42a1-8794-a19953b1e3c2", "comment": "Malware payload (Mirai)", "value": "feb3f89b6ca6fbd95e65d851c04a3986", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192058, "uuid": "2bc0ac90-3d6a-4f74-a82e-aaf658124bb0", "comment": "Malware payload (Mirai)", "value": "f71a83349e634f8ebb93f6a94cb43f0c2eb10656d46d37ae7b8089f1b8bea866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192058, "uuid": "b89c4b77-6ccd-4728-af91-1a0659d33c5f", "comment": "Malware payload (Mirai)", "value": "105972d84470fd6d4008fe0ea8ccf509ea449ddf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192058, "uuid": "ed38208f-9f35-4857-bab4-ffe58ca2b559", "comment": "Malware payload (Mirai)", "value": "4000f4fce2ec43990a50f0545d1b6e380614751e20a093c686aa18572ac3bc4b14fe668648c72122445eec28024d42e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192058, "uuid": "d2b9c140-7945-4623-9286-8eb60377241f", "value": "T17F431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192058, "uuid": "947cd62d-f32b-461c-a758-43bbdc79de85", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw4:RqtmZPuutfbltZFBSJsBcfDSTFI+BE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192058, "uuid": "bf6bd9ce-d94e-4fbc-8df4-9dad3dedd909", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192058, "uuid": "095d9c69-2a4b-4569-a585-9ffb13526e7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192058, "uuid": "383b6822-e540-46a6-95a2-62691e3534bf", "value": "feb3f89b6ca6fbd95e65d851c04a3986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b133bc70-b348-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677136031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136031, "uuid": "76dfd88b-6383-4247-8ed1-99f53009c120", "comment": "Malware payload (AgentTesla)", "value": "d4aba954c8db703ab8ac6957828741f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136031, "uuid": "a3d46480-1be4-4cff-9f6c-2b77755c1fca", "comment": "Malware payload (AgentTesla)", "value": "f76ca1c66b642f4b2c052a23791595f779e2696c664f69e735ab549aa627d21f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136031, "uuid": "600540e1-c263-4e41-b261-df77a350c4e0", "comment": "Malware payload (AgentTesla)", "value": "d2216dc6aade2242b8527bea6f262a22b04c0ffa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677136031, "uuid": "8b834621-6468-4f30-ae32-f3d5da55d6fc", "comment": "Malware payload (AgentTesla)", "value": "613452107b0ebd375a84f4ad9cfc8202831d701e489abcdedd112ac04cc843e1972fb3977226f0f23172cb66e04be66b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136031, "uuid": "cd2d47fe-91eb-4b9f-b468-e747609192d5", "value": "T171057B4762B09133F9DE40AD03381ACF1E31A257710DE66B5F7B2A588D1ADFBB5D8241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136031, "uuid": "b7ab53ab-687c-4c0b-8ad1-ff0da2084a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136031, "uuid": "6ab6bf82-96bf-462b-8c17-9862653fb9a8", "value": "24576:bJ8ejGDzSkCrLg5jhcns98ReX2jFfAGF:DG0syIX2jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677136031, "uuid": "061a1b86-ed45-4962-9994-dfe491f8a7a6", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677136031, "uuid": "b7e63d3c-c2f3-4082-86de-d5d93396804a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677136031, "uuid": "49736369-a33f-446a-b075-73fafc25dae3", "value": "prosperzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae948d8-b363-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677147348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147348, "uuid": "1bc51c66-71da-49d7-9dd3-06673ea19b29", "comment": "Malware payload (Formbook)", "value": "8a06791059a482faa0cf845d2b953351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147348, "uuid": "10857580-e824-4426-a54b-4d8dc20a46cd", "comment": "Malware payload (Formbook)", "value": "f9b608b8ea15f9e8148eaa73ea96e2eff983b808f9d0cb2f27d833ebebc165f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147348, "uuid": "46eca355-bc67-4cc0-acc0-bf862687fc08", "comment": "Malware payload (Formbook)", "value": "37a236b4bea30fd46aefed9f8095b8c7989f0243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677147348, "uuid": "9bab0001-3595-4551-bed9-1889a2233bb0", "comment": "Malware payload (Formbook)", "value": "00d1458d27146213b1c12077c2ee6bc1fa45c15dc48c5ef9685ebb6f98c14e0ec1ee27b16be384d02178a579ead1a9d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147348, "uuid": "e0c3971f-5446-4a95-99f4-19bbd6880054", "value": "T1EDF40101B7494F55DEA410F084E3811923E2994F3EB7DA967C881BF6AE05BD7CCCD28A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147348, "uuid": "80502c36-f937-4197-a539-2a8e0a8fa8cf", "value": "12288:SPJGinDLjolG1e+ASVTsirGDGFyhMfJk+2EEQLYb/voPDNstJpbjoA:eBnDbZASVTsirGDGFyKk+A/v22zpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677147348, "uuid": "7f1fa383-3614-4cb3-84f6-75241e1333f7", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677147348, "uuid": "f5c9abe7-1a23-49b7-b98f-df283445396d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677147348, "uuid": "4ee4d1e6-ca1a-459b-a199-f768aea62d6c", "value": "Requisito de pedido #23022300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3498312e-b388-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677163309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163309, "uuid": "05270e3a-ee88-4321-a606-5788ab3544e7", "comment": "Malware payload (AgentTesla)", "value": "5c065ec4bc03f6ce783da91e937b01ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163309, "uuid": "291afa51-b3c1-4749-a790-7adf28b2c749", "comment": "Malware payload (AgentTesla)", "value": "fae100c65ebd2186aaad55877ec5fdf2cdb171a458f1bc675722e8e1e488e370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163309, "uuid": "13c645ab-ec5a-47b1-bd70-645f35210647", "comment": "Malware payload (AgentTesla)", "value": "523f947eee81eeaccccb0e0353e78e58d7322e83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677163309, "uuid": "6a7d130a-5abb-4fcc-8008-b41ac82e94e6", "comment": "Malware payload (AgentTesla)", "value": "90866f845fc85a183e6333288891d5b26185bd029deae9e31fce0aa795f8f34b5dd1123ef2b04c3e1dd35c3b8270db97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163309, "uuid": "40d1bddb-ce75-4633-9dda-b78aae7175d4", "value": "T113057A46BBF09037F89E41AC063916CF5E32B253715CE22A5F3B69488D46EFBB1D8611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163309, "uuid": "6d643966-5f94-43d2-87c0-d3148b3fa71f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163309, "uuid": "dfefdb8c-c848-4ca4-9b72-9a757bac45e0", "value": "24576:Dn4UhGHsTWg0yA5H6u+qmOvh+u3eEUCqF/BB5Ctcu:HIHI0yu3+qXoAgCir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677163309, "uuid": "e2e26785-6d14-4b55-90e4-eb73901675d8", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677163309, "uuid": "78421b8b-9b11-40b0-9b53-5d135a2cdca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677163309, "uuid": "26bb5873-cf47-44aa-a1a7-6839ff271f91", "value": "shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92698bce-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677141992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141992, "uuid": "88cfbfd8-2e86-4d05-bfbc-7cb7d5a3c756", "comment": "Malware payload (SnakeKeylogger)", "value": "f7ba36e67b1d48cbf70579e3e5b1e736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141992, "uuid": "928c4781-369a-4f19-9a26-6dc36714566d", "comment": "Malware payload (SnakeKeylogger)", "value": "faf4503a0fc8c04099cb58151b308a2586bbe923bfcc78531198973995b8c536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141992, "uuid": "9d8280c8-bcc3-4adc-b4b0-a361adccd291", "comment": "Malware payload (SnakeKeylogger)", "value": "203366aaf38385a57429f4d374289562905c6822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141992, "uuid": "33802b4f-11ae-4404-8504-f249d2ddcbfc", "comment": "Malware payload (SnakeKeylogger)", "value": "b72678395c5ff28f444f0cca9b04a0ca9351d32442281c35827f3d4fe0341a4406db1df0d2a52e67567856572b2feb31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141992, "uuid": "b2851bf5-09de-42df-90b8-d901a6e8b03f", "value": "T1F0F46A8662B09033FDDE90AC07341ACF1E31B252710DE6675F7B6A989D1ACFBB5D8241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141992, "uuid": "4c206a96-4399-4f0b-87af-93765ce664c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141992, "uuid": "43b4bd3e-9e5b-44ab-8deb-ca2d493eb1f6", "value": "12288:19J8ejNG/ALZHTe8LmqTqesAoaWn7GupDwtXsw5v76P/u3XSAs1:LJ8ejiATLmqTnsAoao7D0cS+YXps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141992, "uuid": "1fcda0bc-94ac-4a70-a82b-fec2c1c53a2a", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141992, "uuid": "2afe6e3b-e7a1-4d23-97cd-0279fc60a078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141992, "uuid": "bdf8ebdd-9667-490e-841f-fc63da1fa5e6", "value": "SHIPPING DOC + PROFORMA + PACKING LIST +AIR WAYBILL pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8d238c-b385-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677162251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162251, "uuid": "1fa2d3c0-d31b-4aee-b9da-cedb5a1b40ef", "comment": "Malware payload (RecordBreaker)", "value": "4793fa973d42a231b51851475b2c809f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162251, "uuid": "c418ff61-a1d3-4622-a35f-7d7d2701b92d", "comment": "Malware payload (RecordBreaker)", "value": "fb21cf43e0b74989b863f7f483e0fbbae7204c254651690fe55f41cf215da8c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162251, "uuid": "5ab2c672-36f5-439e-842c-a0672879c59a", "comment": "Malware payload (RecordBreaker)", "value": "dd2f1064142b3e61bf8e383c0b8592bec5dc83dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677162251, "uuid": "8016d669-1fe2-40bd-a1b2-32c06d7b6868", "comment": "Malware payload (RecordBreaker)", "value": "78f134d7368d47bbc59d412efcdaec9604a997a65258a0f8eff55326c9fb28056f439391b0ca77da23c0344b26b2f529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162251, "uuid": "af7a5479-9d0b-4402-bb51-e23e0c35454c", "value": "T103D6332AA129598AD9F559375513FE4030F8BBAD97C0BCB938DE2ED809375D0BA01F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162251, "uuid": "f0897f3e-dfe6-4ff2-a921-8618b5875ed5", "value": "e0224bb1f86777b26682b150d90a08db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162251, "uuid": "f1f89c9a-9b41-45e4-af0a-7702efdeb296", "value": "393216:0novXVXa9YXq5dV3DMgOZrEuGJQjgyfmT:guZa9YXq5dV1OZrvGES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677162251, "uuid": "fc15ff34-e341-4737-8a1d-0b76cd6a05eb", "value": 13289364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677162251, "uuid": "fc8ac893-1792-49df-8bb9-fc8cb7b33a24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677162251, "uuid": "a039ed63-0094-44ff-add3-4702e2e367d8", "value": "Setups_Full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e371416-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1677141931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141931, "uuid": "f984f82e-4335-4f5b-be4e-01a910aec1c4", "comment": "Malware payload (SystemBC)", "value": "0f8a225d45dc2dccd1f68f11166ea280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141931, "uuid": "6d5f8179-eaca-4e21-969b-64708c84c794", "comment": "Malware payload (SystemBC)", "value": "fb7ce83b1f46d3348eddbe69216889b1547fa349b7ad0973fec5a5156b137d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141931, "uuid": "c1e4b095-6757-4d47-9d3f-325571bab264", "comment": "Malware payload (SystemBC)", "value": "0370cd3c83b49f233cb831b1fc17df749949b8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141931, "uuid": "52a566e7-949f-4209-bb81-27e4b5305a91", "comment": "Malware payload (SystemBC)", "value": "44d0d60610dff530a1e12c08db70f218753763dd7a094666537b78239f5e7f693e277461bbd7c412f3646028435da2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141931, "uuid": "ca9f3166-16fc-48f9-9675-43c7036a8ee6", "value": "T1A614DF21B9E2C4B2C45705B29075DEA46E7FB96157705ACF275812BE2E303E087B632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141931, "uuid": "55c54be5-f18b-463c-a1fd-d6bd67dab593", "value": "1dc9c32af2b0d0927717a78648d34c5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141931, "uuid": "fc4f72fc-d828-4e34-94be-83fb3762b0f6", "value": "3072:t6DqRv6nPcL8N/1mPQfHUy84zklGrmWHoA7jatZvXq8xXwG9Ar:R96nPcLamntGTKWIA7+ZvaRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141931, "uuid": "16c4c5fe-7cf6-4158-ace4-7679dfb263a0", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141931, "uuid": "c03e7541-368d-4a76-9ea6-6f24884b0a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141931, "uuid": "72de1b8b-4552-4875-816c-ab86385ea38e", "value": "0f8a225d45dc2dccd1f68f11166ea280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b8b45f-b336-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677128201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128201, "uuid": "85fa1bd0-5c80-47c9-81a7-b432ed6ab6c2", "comment": "Malware payload", "value": "3a3c8ba4930ab8bb0bec564e9a785698", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128201, "uuid": "4497eba6-dee2-4e78-ab61-5919851aab19", "comment": "Malware payload", "value": "fd27966e1056986659112875d6f4cb0119ca86671424383c9145359f0e91855e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128201, "uuid": "6c0ef1b9-b468-4922-b589-e79c2ecbb3c9", "comment": "Malware payload", "value": "5231997fef3fea5fbdec60ea9677f21698820dae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128201, "uuid": "ba40b474-644b-43c8-a70d-8f2aefd529b7", "comment": "Malware payload", "value": "00106e9f7fc363211e807f3527ce161c8abf090a4c53686ca0a98e3d6e4b60a56528bca73c6f10520b961dc759510cee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128201, "uuid": "ec4edbb3-b46c-4095-a4e9-3f31714602d8", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128201, "uuid": "6bf0f7b3-0f1e-40be-8fd8-1ed8d3acaf9e", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128201, "uuid": "11b6b788-ce4c-41ad-a564-20b6e5b3c1be", "value": 40407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128201, "uuid": "69378831-8988-4863-bd47-880dd5487ac8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128201, "uuid": "097737b3-1b49-412d-a7e3-44ae3da4515b", "value": "da4955a26685b3284397ffc3991437a456b0b07bd1b7074074d6380a73c67ca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b47cd8d-b358-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677142758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142758, "uuid": "3c3b9010-ddd2-4dfe-8cb8-9e53a138ecf8", "comment": "Malware payload (DCRat)", "value": "316a273b07bbb61f73758eded4918a79", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142758, "uuid": "7e982dac-6283-409d-b02f-7a0fae70fe90", "comment": "Malware payload (DCRat)", "value": "fd5460a5bf5fa33337175b1ea11cf6a8194600098363395ef927973001250fad", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142758, "uuid": "94bce022-04a1-4825-b1bd-87d517c9266f", "comment": "Malware payload (DCRat)", "value": "45871f13cd126cc80501232c81b89a3a33b26aff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677142758, "uuid": "a98591a6-b149-4eb8-93e9-27b856e847f0", "comment": "Malware payload (DCRat)", "value": "832713c6c992356748b6e9299a490e83080654d46a3d3acac928b0f16e28526a8d54068463a0fa5400784969fed0d2d8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142758, "uuid": "f0cfb804-1530-4e12-9011-8a62517559d9", "value": "T1F304C04723E120F9E1328A39C9A12555D7B6F8260332DF6F4754429A2F27AD1CD3AF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142758, "uuid": "cad8993a-f154-4871-bdad-6b2edc8b1e38", "value": "75023d1aaa9742c3badde875bddd15dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142758, "uuid": "363c348f-eeba-41ff-8188-5796f72d7a97", "value": "3072:D73rlojEOQTFL7sQ8mAU1grhV/hsn1UptYEeDUvtSjoHFe04bc7:D7WAOQTNL8mkHGFOtSUHic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677142758, "uuid": "0cc85d03-38ef-4833-893c-3d8bd803c84f", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677142758, "uuid": "6de7f2b7-7ac4-4b63-8f41-fc73c4964e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677142758, "uuid": "ba0747c0-6bcb-40f3-b041-1c36fbbea22d", "value": "316a273b07bbb61f73758eded4918a79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1ab5e8-b356-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677141924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141924, "uuid": "1d45bf72-1c78-4f30-97f4-42626ac66d00", "comment": "Malware payload (AveMariaRAT)", "value": "fc9afb4b234dd6aaad71a89261867049", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141924, "uuid": "25abdb85-5381-4ed8-9f46-f98d143459a5", "comment": "Malware payload (AveMariaRAT)", "value": "fe4020d80a71155f6d6f490b3ff6d5699cf839c815da0e077b476ab0ba6b375b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141924, "uuid": "eceb85fb-f59b-4d61-89e6-9622b328de33", "comment": "Malware payload (AveMariaRAT)", "value": "ae6fcb43d6d152865ed9b689f2f21a5eb45defb4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677141924, "uuid": "a8ede146-3eb2-4872-822c-5ca9bf643050", "comment": "Malware payload (AveMariaRAT)", "value": "adf172cabfed7c986da9f43a098d059339199f379d16c612e910d5a970254b59cf309f2c73e05550d21c720a99cc1602", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141924, "uuid": "a1088af9-2980-4ccc-9d48-7cd72d52ee1a", "value": "T18B54121612A0D08BF9D00B714B36AF76DEFBA2122055230B27D0771CFEB5BD2DA4A395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141924, "uuid": "8ac83610-8b1e-47ff-8563-19e74013f6f1", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141924, "uuid": "6aa729b9-1a3b-4f47-bbc9-2948d4d6de97", "value": "6144:xicFyL+j3bJdUdTSu7NZoK4lq5nxfrh3RJWWvDYZtoKcxo48hyWZdXFjbz:MPEbnUd2uxCKDXLMexH6yudVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677141924, "uuid": "3ba326e1-cab9-4e44-9b70-193acde81317", "value": 294824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677141924, "uuid": "a8591fe2-0648-4c09-b0a6-60a96db5c43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677141924, "uuid": "bd628e50-f2bc-4728-9d2a-e29b7e259020", "value": "Ausschreibung (ETH Z\u00fcrich) CH0824-2023-02-23\u00b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486dff3b-b3b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677183529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183529, "uuid": "29472a60-bd7a-4a14-a2f9-82774ade59ef", "comment": "Malware payload", "value": "28273688fc8815ab723902b7a729121d", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183529, "uuid": "1064a251-8794-4a55-873e-7fb37f1dac13", "comment": "Malware payload", "value": "fe6d4c5fb28f7a3379322d4314d31d8227a3356c2992b2bd4b47922f97d3e315", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183529, "uuid": "99772978-6d35-486f-a1d0-15d4de63133d", "comment": "Malware payload", "value": "5a22dd6805c378ac788afde84e5be8d7609294bb", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677183529, "uuid": "cf2514fe-fa50-426f-83b8-1d142dd6b5c9", "comment": "Malware payload", "value": "2aaaff15499c3f7a2b08c7d771039690fd0fe42aa0b755b0ff5243665fada4fcb3463c0c7ccc239538b4394c0f4b3944", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677183529, "uuid": "8b627223-bca1-4017-a14e-172ca9672160", "value": "T180F3F15627A45211E6BF8B325FD29F971617FAA06637833B66C3220C4DD23C0DE5868F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677183529, "uuid": "145293a1-bad0-4f0b-83ae-4429b76dcf2a", "value": "3072:khGtY6enoukFuaYXtfAO2eZMJiE+uSPHROI63OzS:khGtvBxFuXVd2tijTPHROIeOzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677183529, "uuid": "de1363c4-02ba-4a3c-8466-d7fa4178ded4", "value": 169890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677183529, "uuid": "acdb3b4d-40af-429f-aa6a-ea6763490a3d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677183529, "uuid": "6a578334-d6a5-4cb2-a395-badd86dad50e", "value": "Document.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7d6224-b336-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677128423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128423, "uuid": "614cc3a6-af14-4d7e-b34b-b1c136a72dfc", "comment": "Malware payload (RedLineStealer)", "value": "82b7d20aac746aa17b5c6915f04d9923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128423, "uuid": "fa05446c-e750-40aa-85df-9e27312b551a", "comment": "Malware payload (RedLineStealer)", "value": "ff319557c57ce45ad91941bf77a731c8b7b7b84d2454b26571f234afa3309724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128423, "uuid": "31d5e8a7-8c2c-41e4-8b29-54456a0bf25a", "comment": "Malware payload (RedLineStealer)", "value": "cbbdb865941acf1a6edf6ea29f23fef2360b1035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677128423, "uuid": "b41a6c8b-1be4-41ef-b25c-2f36f3747cff", "comment": "Malware payload (RedLineStealer)", "value": "8f8e6701c2ae438f3e8f2b3a53734436704f818b4278736b32b607148a175962c66745a45efa695fa467d7105828d07c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128423, "uuid": "a59fe516-65ec-4421-90a3-e3310bd2003e", "value": "T18274FA987670FD9EC857C87F8A581C64E6636466970BA203B05313AC993D79BFE130B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128423, "uuid": "20762db9-4036-4acb-845e-8f6d53a62f35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128423, "uuid": "c71e6837-eb42-4eef-b421-08a01aa3e1d4", "value": "6144:0bUlO6ppZmaSzY3xmUbaXml9L+89TNaQ8WqO7sE/r+X7w+e:nFppZmLKjK89TNaQ8WqO7sE/r+X7w+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677128423, "uuid": "9e8a63b2-00ab-4cda-b183-9ed39aabfb38", "value": 344278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677128423, "uuid": "9f8287d8-41fd-4dab-be84-8b3eae088510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677128423, "uuid": "51c0b518-599b-4f5c-983a-77266ba5dca7", "value": "82b7d20aac746aa17b5c6915f04d9923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af9e7f3-b3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677192069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192069, "uuid": "e2db376d-ab67-4691-90f9-95a30d295a6e", "comment": "Malware payload (Mirai)", "value": "0d27f2de73e58bcaf21f26e2fa0b25e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192069, "uuid": "e18f09f9-7cdc-408b-a9b6-ed2294027d2e", "comment": "Malware payload (Mirai)", "value": "ffb9e7d101027f5373d0aa299093b5f77c15c8d0d13e9569f2cea99599425722", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192069, "uuid": "f401e447-c459-4132-94fe-5807c714b48d", "comment": "Malware payload (Mirai)", "value": "469a918d8c1314a4a7d5ae0dcc9fdc1fd791c703", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677192069, "uuid": "587f76c5-ef25-4e52-a212-ee59c18cba98", "comment": "Malware payload (Mirai)", "value": "8f2cbc51d59ef44a7b884cc26f3a8551a6b418d5a731af8faa7c8d3ee9ec1b32c0673c9a2d3b31ab73581decbb1e2700", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192069, "uuid": "33aa19c1-8e03-4868-a2bd-fb89105dcf2b", "value": "T18223F271890E8EF125703C72DAD59793B6F02AB1C6672013D6290E3C2F797531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192069, "uuid": "ef128921-1e38-4e61-b8cb-2ef413fab118", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3g9q3UELbUXfi6nVMQHI4vcGpvt:DECFd+A6YHAxpLRQZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677192069, "uuid": "bdeb2e3a-a397-41ce-ae82-9a10f2162b72", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677192069, "uuid": "1f964664-2d3f-460f-b843-1960189762f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677192069, "uuid": "f8781e18-a662-4869-982e-1a9b86fb8ed5", "value": "0d27f2de73e58bcaf21f26e2fa0b25e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }