{ "Event": { "published": true, "date": "2021-10-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-08", "timestamp": 1633737781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "06f6973c-1e33-41de-b211-180525c776d1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec3dd03-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633692620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692620, "uuid": "8bbb2f86-d2d7-483b-91e2-95410eda1c53", "comment": "Malware payload (GuLoader)", "value": "757c090c43aebcca3bf0c14b6a81cb41", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692620, "uuid": "105ba418-5757-4c29-8686-8b47e9a1276e", "comment": "Malware payload (GuLoader)", "value": "01b403806b100565f30cb0c41ed76a833f50aa62276461b19032f9c3a79b7795", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692620, "uuid": "ebffceac-58b9-4168-aa0a-dcdd72e57ab3", "comment": "Malware payload (GuLoader)", "value": "732c2cee62444ffa96d66af84439e55b84d1c60b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692620, "uuid": "6a3446e8-ec4f-449d-8012-4465cde32184", "comment": "Malware payload (GuLoader)", "value": "0ab5a81df93bc249b3b82662fcba4b85874f71682f58b0e0c57a2901bfd011a049b22c66d2338a59a0283e6fe37cac48", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692620, "uuid": "e282defd-d0d3-4d75-ac3d-7f2ca854165a", "value": "T1BB24FB78EA2DE8B9FB82460D24E5D58113146BAECE97E1F603CC9F6F15D58898B01D0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692620, "uuid": "d576ccaa-96f5-4ab0-8deb-35fd175668dd", "value": "1536:iEwkqaDR0LQhy8a8ooqokIcbwkLun4TmfQhHp8HLXQvBDCDyqTuvbp4zgMSqhZjO:iky24nhJWQ8yH4cMfuS+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692620, "uuid": "dd522bfb-6433-45a8-b4d1-4ddd43917526", "value": 227274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692620, "uuid": "d48626b5-036e-4a6d-842e-ec3c12f6bb15", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692620, "uuid": "3ae2608f-3871-43af-9eb4-fb3afb5808c2", "value": "Contract-No-AJ-1343CL-REFERENCE-837373HHYAAHYSBDDS3736362_OCTOBER-2021.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081a0a93-27eb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633665094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665094, "uuid": "ac8b53a3-4a73-4af6-bd16-43caf155d530", "comment": "Malware payload (RedLineStealer)", "value": "909d88235d78c58b802b626d3848a723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665094, "uuid": "8a644661-bf31-4caa-bb29-f1cb1d70d31d", "comment": "Malware payload (RedLineStealer)", "value": "01cee78809685f39cb8f139a99f4b3936c60f4d86cac5f714595c311b079e19c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665094, "uuid": "b64cade3-fb57-439d-a7e8-b577a62becc1", "comment": "Malware payload (RedLineStealer)", "value": "1784716422e801892997dfea3f1838c3e3b47034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665094, "uuid": "95471b05-dd0d-4e10-9a35-5443452432e3", "comment": "Malware payload (RedLineStealer)", "value": "fadd1c5e988d8fede58dc0f665673e8e507fea22716808e2dea95d8637c66f01bc45ace092ba3c2fc421419c74c14093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665094, "uuid": "ed3dff78-b70c-4af8-82fa-12d8d4761a06", "value": "T195556B1D77F0D3C2D3241170A0B6573B0E282E622866FB8C776CB9493F39D5629A1B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665094, "uuid": "b0d0db54-33cd-46b9-807c-09352b4e850e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665094, "uuid": "ace808cc-a3c2-49a0-83dd-45f890c780ad", "value": "24576:AjL4A6IUWe1MTc9nqkuGElJ+DqOP+pOJ:6UANUWe1Mb+j+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633665094, "uuid": "85bd4c0b-9419-499b-ad83-93f8142404ad", "value": 1371648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633665094, "uuid": "17de669b-582f-4a2c-bd7e-120c181bd1cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665094, "uuid": "e3122b26-20bb-4a99-a1f4-51339d763338", "value": "01CEE78809685F39CB8F139A99F4B3936C60F4D86CAC5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f83cfe-2845-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633703772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703772, "uuid": "a895b102-798b-4c5c-b246-965e26e71577", "comment": "Malware payload (Quakbot)", "value": "dffc2efa74ff57071273b910a048658b", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703772, "uuid": "e263738d-1689-46cd-aabd-a75bf6612622", "comment": "Malware payload (Quakbot)", "value": "01ee4773336bec7c4358a3c8b6d69e6fb30c2540e33c6f27f0c07585713afcf2", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703772, "uuid": "326a62c1-a0c7-4b4e-b639-760393545670", "comment": "Malware payload (Quakbot)", "value": "ba1836934a2c5694fe8dea463fcfa2757a70d37a", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703772, "uuid": "08dcb248-b34b-437c-b556-f0135d4d36b5", "comment": "Malware payload (Quakbot)", "value": "6216f81e2715329d7b125820ac36c0bb14c19f72cc4416e7f37e2faee17f6b56e01ef7d2909cc8faf3c313eca257459d", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703772, "uuid": "6e41d190-0c7e-4f4e-8d25-2117b2943817", "value": "T124056B013A44D432D7EA25749E2AD6E50A5C7D15DFB0A4CBBAD07F2F2AB94F39235302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703772, "uuid": "d874972b-cb80-4177-8fb7-1852614c3af9", "value": "f6ed57c140219f49a1adbd0334b819b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703772, "uuid": "e7932d1d-5844-4df3-bbfc-957d88a4f237", "value": "24576:yO6c3oCrVA7bEK7mJaW2eX8TvE81oIzsk6EzCUfk7yu:wuVeEK7mmeX8TBoIzsk6hUf4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633703772, "uuid": "bd6a5960-388b-4179-a727-5edf49cae690", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633703772, "uuid": "9e81a298-8b57-4480-8a94-ebc221100c6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703772, "uuid": "0663c540-80b2-4429-91cd-b7163656f402", "value": "44477.6882538194.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbf7425-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633692481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692481, "uuid": "401fc03e-ec26-4937-aa28-d29fec971a33", "comment": "Malware payload (GuLoader)", "value": "5c6b13933bed7533a037b4effa7f23c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692481, "uuid": "4263b7d5-7d4a-4836-9c20-4d9c0326324f", "comment": "Malware payload (GuLoader)", "value": "02181bd8a2feeaa9fbed05a366600e7edb06332b9ef2597568edd4076b6c35e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692481, "uuid": "f089070c-bd50-4a0f-bfbf-ba1d29f1166e", "comment": "Malware payload (GuLoader)", "value": "89bbdf33994e07f3101c77d757a8a8ee85b82f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692481, "uuid": "022c5673-cd8d-495e-897e-4c0a7af53ae6", "comment": "Malware payload (GuLoader)", "value": "5561979d3d5f0a4e6b4227b0ccfc5f18e89e2ace336be112c89b125e84be6f2bfc764721dd2f28cd5256aa49ee2c2255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692481, "uuid": "2ff4c873-21d0-4c41-8c60-5ce2550aad11", "value": "T1C6D305D5B68D8536D402E07E6F3FD457AB1D3C330A407A83728E6B86E7721DA29B5342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692481, "uuid": "5d40fc93-7820-465e-aca8-0ac62e37622e", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692481, "uuid": "5b231694-4983-438b-ada3-7b8459bc9bee", "value": "3072:tPULlD5ZhdIrq12wHE/aFgVAaS2yhd8l9YTHyTLxzh/jrVB:tPULlD5ZhqrebHESFg6aSYBLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692481, "uuid": "745bf6d5-f5c2-497f-b693-cf419a4878ef", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692481, "uuid": "095596fe-fe27-4d4f-95f3-cd9725de2da8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692481, "uuid": "7bcb0ccb-84ce-49dc-99ca-c1e0253e93b3", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91897813-2808-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633677780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677780, "uuid": "8ce1f982-d744-4e1c-88ad-f6d2bd5057fe", "comment": "Malware payload (DanaBot)", "value": "eb59b9b2f96817f32da02fb830aa02e1", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677780, "uuid": "06010db8-0f66-4b9d-bf90-51dd0b470ebb", "comment": "Malware payload (DanaBot)", "value": "0345531c814ad62c6c2c73de6fc6e540974fa5ddba3dcbeaa9a7850ad7929a76", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677780, "uuid": "39e4ac1a-5a81-402d-8c07-fbce8d53aca1", "comment": "Malware payload (DanaBot)", "value": "d4894ad6d38ef0022dca89747b3ab9726d8066ca", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677780, "uuid": "18ecff32-a1c1-40eb-99fd-7ea72cf549f9", "comment": "Malware payload (DanaBot)", "value": "671e942afc2dda58e98f906564bb970127a1cfdaab748ea4bb90e511430f616a327da76fc69b3ecf64ec75d72fb948df", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677780, "uuid": "58b7fe47-d2ca-4b8a-9397-65a55ccb9f41", "value": "T10535123071A5C471E62F15754D61CAA00E7BBC129A31C1CB2BB967BEAEB0AC5DB1D303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677780, "uuid": "1f6675b4-be67-4602-8ac5-60ac2a0a8964", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677780, "uuid": "2af8bfdf-bdb1-42f6-9b77-3a9d4287d19f", "value": "24576:h4t+LTKywYkiKnsJ+3xOQ8avKbw6GZV6aGo0HlAL4StUpNe:h4t+yyIiKnsil8cAJaYmL4SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677780, "uuid": "112bfc18-b432-4c99-a882-1292ca50caf1", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677780, "uuid": "821c53af-aa08-4044-b6fc-f64e662a63d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677780, "uuid": "751f867c-68d0-4b5e-a2b0-4047789c5ee1", "value": "eb59b9b2f96817f32da02fb830aa02e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd78cda-280e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633680462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680462, "uuid": "18751ffd-2eec-4854-920f-3f2490f09773", "comment": "Malware payload", "value": "3769639c17f0cd5045964b0839c9f009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680462, "uuid": "a359bdde-a982-40cb-83a4-809e362c02d2", "comment": "Malware payload", "value": "03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680462, "uuid": "0c5f6c41-aa02-4345-9079-ecd3a7ab72e4", "comment": "Malware payload", "value": "0fe3a16efd24b51740aed67e9e8cc9f4325151fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680462, "uuid": "88c4bc74-3eec-462b-a5d0-13159bf29c56", "comment": "Malware payload", "value": "44c47d124319680dbf483bb432f064a0cac359af94d7f8c2292b0ed3b96a7cae02900d8f10cd82c6619fd842442ef9f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680462, "uuid": "10978f82-5551-4ca3-bc4c-82527e5d600d", "value": "T10DE3D263EBFE49D3E859C7BD6C65F2E6202A50C92678C9EA0C3524F951C47A00CB17DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680462, "uuid": "cedf4a14-e0b5-4e99-bc61-263124bfbab0", "value": "74ca0972a11355b5be7db0402b575b89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680462, "uuid": "1bc09380-e636-4c38-a452-93794588eda5", "value": "3072:hvasxx/gxGvZcoO1HpNUA3sTUNoExZaHcDncDjdl:4JxFognscoEx8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680462, "uuid": "8189f125-a815-4092-877e-10289a758947", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680462, "uuid": "96228221-2bfa-4b1d-bae4-979bdb304463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680462, "uuid": "20ac1123-7c9e-4a6f-97c0-caa2f28d4ccf", "value": "03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7d720b-282d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633693640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693640, "uuid": "68f515e2-1cde-4c4e-a9a0-89e0b2dd0368", "comment": "Malware payload (Loki)", "value": "47bb84ee36b0cbc4da3ba73d2207a70d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693640, "uuid": "181d8fee-401a-4d7c-8740-2b9b3930d0f2", "comment": "Malware payload (Loki)", "value": "045a53fd5d0d3cc470490e06b172f5a267de171fcdade2adfb6b16e4ca5b2cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693640, "uuid": "c4501804-3872-469f-9646-0df4eafd04b8", "comment": "Malware payload (Loki)", "value": "d273a3a6ab81e031abb60969f0b8322475ad849b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693640, "uuid": "3b8d983e-7dc5-4458-8d4f-cd73656601e5", "comment": "Malware payload (Loki)", "value": "e9ad6a7dba084ea67c0c942a1cfa7f823ac207266b6a801d4095e3d9c132e50404fc933a0e44fa7dd8ad8e57a1dee122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693640, "uuid": "4430d904-121d-4ca5-abf5-e41ca0fdbe32", "value": "T1418402349F978B27D9550FBD68B00AE0B7F5C15C889FE7290F9408BA6DDBB8A4700467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693640, "uuid": "3e71c0e6-c980-4648-ad7e-a65a52e162ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693640, "uuid": "12f275ab-9c19-4adc-a1f5-b5704a2a1d43", "value": "6144:/sbtnCHP1B4+1FaTNA79X5D5lxDBIbuDB88v+M46T5hiTaF9dCJL9mERt9RGTtKj:/shCHPh18u79ZYbUHWMXtDyL9pD3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693640, "uuid": "0e5de796-2de8-449a-9a6e-d2b8a4be38f8", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693640, "uuid": "413af554-f5b7-45b0-9e2f-8e2652401b52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693640, "uuid": "78a83aa1-990c-4cfe-a397-deed69332bfb", "value": "47bb84ee36b0cbc4da3ba73d2207a70d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eeedcb9-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633667844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667844, "uuid": "2e11f892-bd53-4f5d-be28-14c23947b86d", "comment": "Malware payload (Loki)", "value": "621bc723b4f604ba06a6fa17520d242f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667844, "uuid": "d5d63a97-99f5-4ecd-9b5f-afc9345f428e", "comment": "Malware payload (Loki)", "value": "06d5a2a350636cd353220a77aad4a7122fe9965377ce95afd612cfe8c19ac994", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667844, "uuid": "ebaf07c6-6c49-496e-a675-09d14330f480", "comment": "Malware payload (Loki)", "value": "6038c12636c923b68f7e2ffb457dbde019db5841", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667844, "uuid": "00deea7f-6f74-43d8-809f-8e5cc23be5c8", "comment": "Malware payload (Loki)", "value": "2a7af4cbc644e07a83f75166b689d342f18a5f08d6148d9b463dd94a182f2d0ec1cc3b1b90cb26c376f67a4da4da0866", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667844, "uuid": "a4c00ea7-c566-413f-bc2e-3b8c6742721f", "value": "T1ADD4237272F12F22E3DB1CF5A1351598689EEE3D8A0AFEF3089676ED1438716604D4C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667844, "uuid": "51dbd090-9836-43d4-a919-f3d319a5d096", "value": "12288:PHE7cLM2q+ou1Cws87K74NOzDnkdNqB4Zw2wRRM89e:igoult4fnkdNw4ZkACe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667844, "uuid": "64b75adf-ce31-4b7d-b12e-23c2e472140f", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667844, "uuid": "2f65ad02-45ad-4302-b82f-94e617d52e9b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667844, "uuid": "bffbcd62-361c-4ea0-99ee-a967ea7477b2", "value": "payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7467d3-27f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633671356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671356, "uuid": "174b82d1-f89e-46bf-a31c-731b71aaff1e", "comment": "Malware payload (Loki)", "value": "77e721db501f94bbcbda5a9924741a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671356, "uuid": "8a4b39e0-f26c-4471-aaa8-421a87c1cc49", "comment": "Malware payload (Loki)", "value": "08251a10cbdda0388e4b22db9e060e996d505082c786469b4e0ee85350fdc8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671356, "uuid": "4aabe22c-340b-4dbd-a173-1a28832d3569", "comment": "Malware payload (Loki)", "value": "3f492937ae696cbbb086a3319a40ca7dca5a93ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671356, "uuid": "1c83be68-56e0-429b-80ff-2cceb4d69601", "comment": "Malware payload (Loki)", "value": "e689ea0f49b8ad6067dd1c24b8ee2823cc42768ae078ec7e42d2e2867642b331af76405562e33b5ab9177d64022b5a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671356, "uuid": "12865f5a-5fdb-4bf4-91b9-ff2d5c933814", "value": "T14E8401286F888B27C5550B7499B10FA4BB7DC16D880BE24A8F6604FE3EC7BD69711067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671356, "uuid": "d58b4f59-b456-4898-ae59-050204eddecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671356, "uuid": "ad8734db-607e-4280-b4f0-b61852a5088f", "value": "6144:q1nIWAkzEm1owGNmxNslavrY3bi948ipyZRr6EgS4DbXhiTaF9dCJL9mERt9RGTj:6IWAkTGNmxNkMY0iAR2TvDyL9pD3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633671356, "uuid": "7313081e-10cc-4fe9-a8e4-7c2dbd734648", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633671356, "uuid": "bb14eebf-e685-41a8-883e-d4822e50786c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671356, "uuid": "40691217-2913-48a1-85da-c9af01a339d2", "value": "21038315RI0007903596242.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4a1e83-280e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633680268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680268, "uuid": "87808712-7c94-4b95-b583-160cfc5cb9db", "comment": "Malware payload", "value": "d65ea91f123d5c41bf776f2cdaca035b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680268, "uuid": "e2cd22cc-a2f7-454b-b342-b5f2a390b91c", "comment": "Malware payload", "value": "08527f8c3243bef71794390dfdc5c897ef93fcce83d6c0ab3de8bcba158f9c20", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680268, "uuid": "96ea3bf7-60d2-4132-90c8-bf15f0627a05", "comment": "Malware payload", "value": "127f7d4279cf4068fe74a87b1775bd3740b129ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680268, "uuid": "e64c1c7f-28fa-4948-ac7e-9d16022d1de3", "comment": "Malware payload", "value": "08e487800d9692282c87a9505a4f5e24e236a1606893dd93bf8121130c64c45fda83693ab7e0fe10652cd645cd4516d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680268, "uuid": "f480e94a-76b9-4aab-8816-15233a08b2e2", "value": "T1C6723A5EEA50C1FAE76480B75677647F78368611230B05E38AC0691D6A5E8C77D31CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680268, "uuid": "b87c9a0c-70ac-4b2a-b8c4-86543fe445f3", "value": "1012e3d61be99d46aef011bffb14c725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680268, "uuid": "c0a728af-940b-46ad-88f1-d5af20c3558e", "value": "192:Bp9LxTzUXfgWwzhkDGYICfn9dys9RnwVpeTIbuKmlz3+CPKnnrIQCMLtCIsgB87D:7r1ch90s9VwbkhKmlzuCIrICsgB87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680268, "uuid": "136a9a2f-4fd4-4568-b381-abbcc128a2b5", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680268, "uuid": "74119aef-44a3-4501-a4a8-6652990028f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680268, "uuid": "e22ad0f7-909e-43e0-9c77-0a34080bd138", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.12020.7290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7e3c20-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633660005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660005, "uuid": "5018186c-58f1-4598-befc-d0fb26962dc9", "comment": "Malware payload (Mirai)", "value": "2c48d48e778ada09a0ffbae2251a9a13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660005, "uuid": "c5eb3731-bb5a-445b-88fe-41e868f02f5a", "comment": "Malware payload (Mirai)", "value": "085fa98f7b964dc2bbff4adcc00f6a51d2f5e7bafe1b7b62b2842749a17c894e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660005, "uuid": "19d1142a-77a3-4eed-b599-0a7beb3b6cd2", "comment": "Malware payload (Mirai)", "value": "a8846628a8ca2624f53717bcae7a8ab80b76ceb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660005, "uuid": "a1d20abc-7326-4ec7-b1d9-241feb8e9ce5", "comment": "Malware payload (Mirai)", "value": "44c9cec5f25a80e06935a0dd1f6fb7a996ec5a9b0f8d47a8179e7c09dd730bc00c9710860053bc1ef41eb90c49b4ad69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660005, "uuid": "6c0ad8f1-f4a5-4c8f-b63c-f4ff0b994695", "value": "T129C2E6D6F802AD3CF81FEBBE9412490DB960375551830B2763B7BDA7AC322584D27E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660005, "uuid": "f118cb33-710d-4cf0-9862-5de4e97808a8", "value": "384:CD0eliSLOFVqBtUrF3xadD+dyxcRE8dCA0TT7tFU/rI47oZ8HAFXZR:q0eli8gVOvLuUACT7tFU/kWoZ8W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633660005, "uuid": "ba3dccdf-0af6-4b68-8c28-d97fd023b3b6", "value": 26324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633660005, "uuid": "ae96dab6-cc27-49d7-b580-ab22dcd5e201", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660005, "uuid": "d1a6928c-adad-4d72-835c-d37f4354f465", "value": "2c48d48e778ada09a0ffbae2251a9a13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b3953d-2805-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633676309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676309, "uuid": "2e857191-0672-46a1-b22b-6c8fbb57d8cf", "comment": "Malware payload", "value": "bb7ad76bef5c5a974ccd0c1b94835830", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676309, "uuid": "d513df69-f3db-4b8e-84a2-c943f7724829", "comment": "Malware payload", "value": "098347223227886f16bb1ee42cb1ae51e0ced90e7c3aca1c24f15376711349b9", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676309, "uuid": "28802837-6d7c-40f0-9360-0060082ec552", "comment": "Malware payload", "value": "0afe421bf897c4f7ada01a9c021938ef09ef8790", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676309, "uuid": "52be7b0e-16ef-4611-a611-9a877de878da", "comment": "Malware payload", "value": "14dcf80b7127b3d6c536574f09da81281d2927a61c6a633b8e478acaa4030dd3c7c49949a657e381e65db2b6e5005aa7", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676309, "uuid": "e88357a4-c000-4064-9ba4-6c3f9d624d89", "value": "T1354422456C0310A528BA53F1849E9F1E66E1E9B140FA92F8C4BDEB8F78E51019E0E58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676309, "uuid": "8ef7bf98-d6d0-49ae-90e1-05e25348f5e7", "value": "6144:VekDDl4fjNw3EOrnBZAtNbWqxwPEO2J3by9fPvZMo+VGkT1py/z:Vek14g3UtNyWwaqnRMo+ckDyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676309, "uuid": "38549fb7-50d5-4b6b-8ca5-5b612165cb59", "value": 266448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676309, "uuid": "8ac1498b-ba80-4703-b4ba-68a990040786", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676309, "uuid": "fdfafaf2-82d2-4baa-b219-cb8aa49b34a5", "value": "\u0421\u0431\u0435\u0440\u0435\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0431\u0430\u043d\u043a SWIFT.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56bea33-283c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633700282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700282, "uuid": "476f9cfe-fcc7-4297-9f3c-4ddc2d1ba313", "comment": "Malware payload", "value": "89b7f49dc44d763a8404811553075eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700282, "uuid": "a6066b2d-0897-44ab-8af3-3dc3558c3798", "comment": "Malware payload", "value": "0a13f11eebfe71510c4053f86eeb02e98cbf05c7f4e32f6e1ebed88a3b0829e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700282, "uuid": "a5596ac4-da80-450a-b117-cc2f561573b3", "comment": "Malware payload", "value": "cc4550fcd2929d82d3911d3a70cd0f9290f9c640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700282, "uuid": "826d4b56-241c-482f-af7a-663e121ac27d", "comment": "Malware payload", "value": "295df65dd99b3bec69fd5d4d823d2267f63f43a08d7d1bb8ce721fb2ccd8b0c11f62b07318e2047ae40e0c72e66228f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700282, "uuid": "afc0218c-ab71-4f12-b8b3-597a3bde0072", "value": "T1A6057C07BBF180B2D463C1358A979737F5B175694B3042C727848E5EAB32AD4EA3DB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700282, "uuid": "d65d5c5a-5b8e-44ec-97eb-f8b992d7616f", "value": "c4998075f1324ce0f644f12a548d76b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700282, "uuid": "6902d324-93b4-4866-9346-8343952d6087", "value": "12288:UtbftbfeMlPtZJnguczzBV00LuCfT13USV0La/:U9f9fb1ZJguSdV0yuCf53USVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700282, "uuid": "cf137e27-b325-4fdc-a1ed-549318efb4d9", "value": 836084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700282, "uuid": "e8755522-92fe-488d-b85f-3f4bee5c17a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700282, "uuid": "3fd27cd2-9e1f-4099-be8d-1eac6052c290", "value": "0a13f11eebfe71510c4053f86eeb02e98cbf05c7f4e32f6e1ebed88a3b0829e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b30428-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633706676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706676, "uuid": "082b377d-323a-4389-95d4-ae10f2d708be", "comment": "Malware payload (AsyncRAT)", "value": "ab78a8680dab6e434191131e5eed30f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706676, "uuid": "710915dd-58ee-45cf-aef5-0bf5880c5f30", "comment": "Malware payload (AsyncRAT)", "value": "0a8aee95ba6b97a223124c92a6b0e9a3486385ec6ce38f13d83c6a53ba9ba7d2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706676, "uuid": "299d68d6-6b42-4493-bb87-acd5375aca09", "comment": "Malware payload (AsyncRAT)", "value": "d5507439b7fe3d2cb17a8f6cf84d9f005f441f40", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706676, "uuid": "8ddf03f6-e7af-44cb-b5c3-562ad5e4b5c9", "comment": "Malware payload (AsyncRAT)", "value": "e478c6c7187656aa60359233f59bbef239f59c03839e9b2d3b116a7780b71028855d6709eecdd223fd2023abfdf82d5f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706676, "uuid": "9a29dbf2-7f3e-4280-aa95-b4c344159acc", "value": "T101017591D5ABEABB604377364ADEBC18B23405C207A0DA4770D4F1119C2C07C4EDC892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706676, "uuid": "b53483eb-03d1-4663-bc1b-1843d0b9aa67", "value": "24:Jh6SrKeR2EUMg2OYbCuxvcrzpH/lXoeMguJ:JoLfEUM2qcrzN/KeMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706676, "uuid": "dcd65233-9106-4030-abda-f5af205c6933", "value": 785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706676, "uuid": "1626efe0-9235-41a3-befa-f2c1569ffb13", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706676, "uuid": "60aa10a3-f101-4ff2-a02c-e7d2a8fb2c51", "value": "ALBOLGFJTYAVZ.xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5572e9bf-2836-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633697436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697436, "uuid": "d7ca538f-055b-4d18-9a7f-c597cf471ed3", "comment": "Malware payload (RemcosRAT)", "value": "84898ae9f7f56573cddf53a72e985a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697436, "uuid": "7fdfb715-6436-41ba-bf53-cdcc2d00dc37", "comment": "Malware payload (RemcosRAT)", "value": "0aa3cc090418e3658f6dbe4276c597a5d07df3dd6c2738277b3ad32a99ee09ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697436, "uuid": "5ab4db4e-5b0b-41f0-aa61-7f08ab6a9f62", "comment": "Malware payload (RemcosRAT)", "value": "3d90422c55b85792e267083031024f57450e552a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697436, "uuid": "7d0afb6c-98b2-4d49-83cc-670ec7081d7b", "comment": "Malware payload (RemcosRAT)", "value": "4fb39abee2391c35e07b704d355356e60f95fae60741ce877a707d2ec3637d6c8ef66dd91a4200e333483437588c7b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697436, "uuid": "00245d29-a1ff-4cfa-b267-7ca1e7160afd", "value": "T1D1E48E26F3F1C531C562273CAC174354DC237C9AB92C9521BEE57B0A6E26B417E3938A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697436, "uuid": "3f450e03-5350-49a4-ade2-50d44bbeefb9", "value": "8ba7b45407a54e1cc2cb82bc2d24f0c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697436, "uuid": "f69f9ded-2c66-43b6-a800-02f823cdd8ee", "value": "12288:dWHQioUx/2JW1hxrQe+IguVZRFzODnJz0+NpYuJTquMvC:dI52JWhZvP4W+NpBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697436, "uuid": "ef339685-3f5f-45e2-99be-8874e587a584", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697436, "uuid": "03aef459-16f4-4d85-b31d-cb4b25c102eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697436, "uuid": "ea373ded-0306-40e7-854e-c43c5450718b", "value": "0aa3cc090418e3658f6dbe4276c597a5d07df3dd6c2738277b3ad32a99ee09ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebdcd9a-282d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633693479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693479, "uuid": "02482647-fbf8-4520-8b5f-3a6bc734e2b1", "comment": "Malware payload (Formbook)", "value": "4409e2201e897419028a58a9d41e1e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693479, "uuid": "f9a6a045-96ff-4c65-a45c-daf4be20ff63", "comment": "Malware payload (Formbook)", "value": "0b2d1bf2ca75ec2f3db69659158e685cec6efb71e4be9e277af99b3ad0508c11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693479, "uuid": "9e2ead9c-1427-41e7-bd1c-2e40da202064", "comment": "Malware payload (Formbook)", "value": "41f62fb8e11de4e2b93a05cb806dc5574b40ae99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693479, "uuid": "59a72105-0e36-46f0-9945-fec8059b02b1", "comment": "Malware payload (Formbook)", "value": "984212ef0f90977d8729bf73f9d47d353f63e1ff9ab9b9926002c2a0b9cab4031e171bb05787f5e4213e07e749c96467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693479, "uuid": "ae514767-f52b-4b8b-8617-37d7c39a701a", "value": "T179F44A21E792C435D0376934184793B9ED2DBE81FE5899AF2AD5BF8CFD31213211A24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693479, "uuid": "dcb07ce9-5fa2-470a-a9e2-c1db46fc9236", "value": "a85da29f7c79b749e46738d8b965ea53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693479, "uuid": "836b17b2-dd68-4017-a188-b30d660bb8b8", "value": "12288:5siTtPf0MEakNE3XqKkjY2Nu4kY7CE5L0S4rrMGdMpGyS:KaF0MEakNMrkE2DkY7CE5L0S4PMGdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693479, "uuid": "d9f00264-7b6a-49fd-8d7c-b899f3a7f52c", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693479, "uuid": "105ede5b-0744-4ac6-8bc3-7d15d1813241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693479, "uuid": "d23cd1fb-0577-4a74-9664-c01622c71a1e", "value": "Untitled attachment 00032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952974d5-280b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633679075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679075, "uuid": "47890320-edf1-43d9-ae79-1e29653e680b", "comment": "Malware payload", "value": "7201884e2b338a79b14892911c14a7f0", "object_relation": "md5", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679075, "uuid": "4f9e8f9b-9aad-4fd7-83f2-690dcf53164c", "comment": "Malware payload", "value": "0b36693f3ce4197006131e3f127e83807c8afc175da08f18dc0aaa454e6790e0", "object_relation": "sha256", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679075, "uuid": "6243f723-2bab-4d20-b968-e2a375f5f1f7", "comment": "Malware payload", "value": "adb9c2dacff8386cc54eac3f96d28494c3fe68c5", "object_relation": "sha1", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679075, "uuid": "7f15fee0-682c-47b2-ae4c-92563894cf5b", "comment": "Malware payload", "value": "2e5669aa5b16d6a0f36c94ab3e2ac8d17707c504306a4d0fe59409f07578a7d4bc8184dac90ad783541e2aaf075e6b91", "object_relation": "sha3-384", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679075, "uuid": "127dd827-3b11-4df6-9d53-20db556b95bb", "value": "T1C065338CAE49CCABCF8512763C4621675A70EB5208418C81FCB92FE5CF4F75C6EB6189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679075, "uuid": "cfc64802-269f-4d52-b2d3-ea0ab36a8801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679075, "uuid": "b6cb290b-e0f0-4834-83ce-53c8ee3c1eba", "value": "24576:l+t0D9jaWAsmt2AbKd051/x6Osdu21Xq04SoQ6h/Aijym1LvbuhZUTdQn:+0gWAsmwAbKy1/YTdu21Xq0nJo/3JbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679075, "uuid": "1b86561d-dd03-4126-be34-0940966eb4fa", "value": 1491968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679075, "uuid": "df196d44-2d10-4713-8c37-84c307c76537", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679075, "uuid": "b949185c-3181-4424-9856-337e29f28008", "value": "0b36693f3ce4197006131e3f127e83807c8afc175da08f18dc0aaa454e6790e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f48417-27d2-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1633654588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654588, "uuid": "738e431c-d130-47ab-ae7f-a36c2aac330b", "comment": "Malware payload (AZORult)", "value": "ca1717e1105c4b43fd87dbb4b182cd82", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654588, "uuid": "2100230f-9300-49c3-b566-2753c10b0d8a", "comment": "Malware payload (AZORult)", "value": "0b8dd43b217b3cc309e35f459e6a0e011b65ba70492e7b5a566584815c312727", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654588, "uuid": "79bad223-ed66-40c4-b8c2-7301aa17ec9a", "comment": "Malware payload (AZORult)", "value": "d098f769c7caefd771ebf9e069e4e65c8af09866", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654588, "uuid": "7c905990-fad9-47e5-896a-c82e16a0f881", "comment": "Malware payload (AZORult)", "value": "4a4caa51670810ef8bfc26df976d4c72546b31ff4ee50970126fd4d8c9b148ff44f43c2f01c8624029f0f8ab4c270816", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654588, "uuid": "b5366a4e-3cdc-48b5-94f8-a92e4525d0d4", "value": "T14A05ED5363AC8ED4C06792B4DFC1C4B96C19D9EE421A53B4AB12AB60F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654588, "uuid": "a8c34430-1d36-4dfe-a763-4dcc375aa52d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654588, "uuid": "e92a4cdc-0207-436c-9a59-db19db7abbf1", "value": "12288:d4cU/G5R2GNu/sTRocPHhxpnWMOndK+t:XU/G5Wk1wPdK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633654588, "uuid": "24f42985-4023-4d59-98cb-86c1c7480f9b", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633654588, "uuid": "00b9ca1e-67a9-4cb2-a7fd-2b5845e24ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654588, "uuid": "ecab49aa-e258-49d7-8214-71ae27c3597a", "value": "PO#88600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae391316-283d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633700592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700592, "uuid": "27d79f57-3414-4d4e-86b7-e0ff60f9ab16", "comment": "Malware payload (RemcosRAT)", "value": "629f60cc2fe0f834e8cf2af83fcb1e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700592, "uuid": "2bd6f358-de3c-4104-8687-9072d10ea56e", "comment": "Malware payload (RemcosRAT)", "value": "0bb25dccd5ee69b35f2c03c04b50ec23573929d193739becb1c623d32db64e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700592, "uuid": "100bd6c3-3031-47bf-b02a-6a4a54087d7c", "comment": "Malware payload (RemcosRAT)", "value": "d64fffdffaa1797f46acb549897617900bda16dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700592, "uuid": "47e8e2cb-8e2f-4d7f-93d1-eaaa33011a7d", "comment": "Malware payload (RemcosRAT)", "value": "23252d90d4976ab6f71465a4ad6f36880bcc3dc9d6ed45910056d8f89a80f9d255e694605d0a1b7d788c67908460161a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700592, "uuid": "c2c121fe-0695-418f-8d09-37d4a024abfe", "value": "T13CA49E11B991C032D17212740D29FB759AFCBE212A22497B73D92D5BFE710D0FB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700592, "uuid": "2d67ccdd-4462-4df8-adec-462d5aef803a", "value": "5b3a7ff4c096c62bf847fa169c79c586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700592, "uuid": "e317dbb4-9a9e-4b2c-880d-ca5c565bac52", "value": "6144:6a4YiP1U/VOKRUz7mxE3oEhxv2gYnCLrbLM9iHul+jZ5mv9Qoj8lAOZZlvXI2FE3:6a4RU/U3AVE2gNrY9iH8+1YMfZlA9eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700592, "uuid": "8c7442d7-8270-4d09-94cf-e36d4ca42fd7", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700592, "uuid": "3a6bf5f1-626b-4569-a5c2-4d478a6accb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700592, "uuid": "2a171e54-475d-413a-8b2a-e38344a0930a", "value": "extract-1633590973.340585-HTTP-FxbP4DpEZShB8PfQ4__1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ab3ba4-2838-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633698569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698569, "uuid": "8bccbb90-75fc-4395-bedc-2b2753fa483c", "comment": "Malware payload", "value": "6e36dc0710756dd2fe5354873418a5d8", "object_relation": "md5", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698569, "uuid": "faa4d1fc-a778-4d03-bef3-d38a0144af9b", "comment": "Malware payload", "value": "0e179d44066e33d35b3fdb50b37710dfa4803bad4a5006e4e8e666a997ffff30", "object_relation": "sha256", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698569, "uuid": "49df1101-bac8-4fc9-b1a8-77d26d1c1187", "comment": "Malware payload", "value": "1ae7fb15df19cb38dc72092e036076c5b878d4bd", "object_relation": "sha1", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698569, "uuid": "81fec9f3-d3bc-4c60-8e8e-77514864f016", "comment": "Malware payload", "value": "cde5a1942385deca02aeacc99e3717d8f71650796c5c2d0e18af6109d5934d138c12c4df2c56a040e06f41ca18af2667", "object_relation": "sha3-384", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698569, "uuid": "a73aba28-e138-47b4-b06d-959fcc16ab36", "value": "T1299302B7A1AE2458C5BBAE738324CB6AF33C592B01171649420A2FC7DE415F07F6B15B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698569, "uuid": "0d98f6b8-5957-4385-940a-f199234d12f7", "value": "1536:Q+jmAN1dvsOaJzamQSYciJXSc+wPv+Q+0iHgqT51L4Urq26gMHTTfL2XP0Hh2Wv5:Ts5QIm3+/govqUMHT/KPah2T8mdHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633698569, "uuid": "f25bde11-f1c6-4cbd-a72b-b210eb2c3138", "value": 96265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633698569, "uuid": "361950d0-bc12-4450-9b74-7460ac2904d7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698569, "uuid": "71a7a3be-df76-43c4-b71b-c46b819b8358", "value": "a.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc1d3c2-283d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633700702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700702, "uuid": "5a0f3081-7bd8-410d-b59a-ff4e38d1a9a0", "comment": "Malware payload", "value": "3320276264427f63d8478b9b79e3a380", "object_relation": "md5", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700702, "uuid": "51d6e876-e740-40ac-8b65-d6f0d8d17211", "comment": "Malware payload", "value": "0e242927eceb9af6c0d5be7a11a4a9eb4eefa9699cd8a156ddb10af03b95e3fe", "object_relation": "sha256", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700702, "uuid": "7e3a0cde-8529-4a29-a628-6eded2e1d45a", "comment": "Malware payload", "value": "cbd4ec44a5afa7f918a1edde28dc7bfb5017d057", "object_relation": "sha1", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700702, "uuid": "1271e457-ed26-4a76-b755-a206afc1f65c", "comment": "Malware payload", "value": "458634b068a6ddcff6564a70605c935fec81dd4c29e081aa9a1e0f6da2b70b5f47478d01c8b6eeef858d03195faeb455", "object_relation": "sha3-384", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700702, "uuid": "705d5833-abce-4c3b-8928-051f0f31e0ed", "value": "T102A2BFB8B0EB89D4F40FA44165BCFDB6117239E3ADC91D60537CA6444FEAE893E4904D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700702, "uuid": "db1b4587-01c6-4424-8b52-ef308d276733", "value": "384:mkRC6fPquL4BiSRVf2yW+kTGJdguHo/B+87x:mkRl1SRB2yW+GQdgio/B+87x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700702, "uuid": "92c89aa2-d4fd-47dd-973c-e798a6422a21", "value": 21342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700702, "uuid": "f77a197f-59de-40ca-8828-cf0469cb6a4f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700702, "uuid": "2eba1327-7aa0-43ff-a25f-15f3730f9c6a", "value": "extract-1633590973.340585-HTTP-FxbP4DpEZShB8PfQ4__2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1635ae5e-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633659964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659964, "uuid": "deb8bad9-95fd-418e-b9a6-97837b19814f", "comment": "Malware payload (Mirai)", "value": "40aa208e41ad1e076fc0905292750cc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659964, "uuid": "d3b2635f-4856-4fb6-8bef-3c1a6f6ffef7", "comment": "Malware payload (Mirai)", "value": "0e248455fadca9b06b24c25303899da90334ba06cb8443ffed4107d29690c2e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659964, "uuid": "dbf329af-d992-479c-962e-14238529569e", "comment": "Malware payload (Mirai)", "value": "04a9a7dc43bc43e73aad006b8b2ea76c0502559f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659964, "uuid": "a9d82acf-0897-4bd2-b80a-029c05c98d1d", "comment": "Malware payload (Mirai)", "value": "4505f3c3eeb3f5162b00cbf1875ce5612a030b5b5e6ccc1ff9b03f2a17f0f988249c73d8626a8a87ddd21b59e07c9761", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659964, "uuid": "2aa0ccc2-d9fd-4b8e-a7d5-b0d912e16efa", "value": "T19203F896B9C18F12C5D5127AFE1E114E3313176CE3EFB3129E116F20778696B0A3B91A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659964, "uuid": "149d853b-deac-4e12-a2de-9bb6c65107c8", "value": "768:lFnbGC7+QLZXv9Q3cCSf7iqXGLe8tx76U4tfumpbEdIttPDi42+8ufDoR9VUv:lFnbGCvLF9QWfHWCM6tP6I3ri42nufD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659964, "uuid": "0c2affd6-a21a-4c77-96d5-ecdb88cc0485", "value": 39228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659964, "uuid": "631b07e9-94d7-44aa-8651-e364a53d4af2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659964, "uuid": "bfcd7e50-9159-4427-90a0-1cd0e4714257", "value": "40aa208e41ad1e076fc0905292750cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6179be-283d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633700347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700347, "uuid": "bea79247-da7a-4cbd-8ecd-0e6f4e26030e", "comment": "Malware payload", "value": "a8a1065d88e6dc95d87edbac1fff85aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700347, "uuid": "a093b3e0-b735-4b3b-989a-c5adf290067f", "comment": "Malware payload", "value": "0fa4ee9b30775190d58bee8aa7cfa813c8d4f139d8b35d15aa4098386669ba3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700347, "uuid": "e641b598-bd11-4faa-87df-2e2f80aae6f1", "comment": "Malware payload", "value": "4bfeab4ab6e65f8152cf003a16d52405680f2ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700347, "uuid": "e8e9a280-23ab-4eb4-846a-8f15aa895d41", "comment": "Malware payload", "value": "3e92d77c969e275f555f60d3d2a0f1b892817c8790f819f0733cbea46aa261cd68fe9e6dcef7fbb461b60f63cde86e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700347, "uuid": "288e4f1e-b943-4f2a-8bb1-fb5c91e281d4", "value": "T1C8376BC6A7E803E3E06A8A74C97683B2EA71BC831D32970F4574F25E2F376918D15761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700347, "uuid": "c8c781f0-347e-4e2b-b3c6-9f727e875b03", "value": "c4998075f1324ce0f644f12a548d76b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700347, "uuid": "ea5bb2cc-116d-4220-939e-cd7846a8893c", "value": "196608:xlrB3ytPqVxUQVmBDTSWhaBnvjeApaAvktF:10PqbsBDTkNvjtIAvk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700347, "uuid": "4b03faef-f02a-4e6e-8882-93cd55a2d668", "value": 24463454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700347, "uuid": "a3a44020-092c-400b-a77f-b456ea866f2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700347, "uuid": "6ce6a0f5-8f35-4de6-bc7c-c5b1c3af3361", "value": "0fa4ee9b30775190d58bee8aa7cfa813c8d4f139d8b35d15aa4098386669ba3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3c19c5-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633668757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668757, "uuid": "2eaef925-832c-4967-976f-d56cb2262525", "comment": "Malware payload (Formbook)", "value": "be0281152dd46fe8092bedb89b227959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668757, "uuid": "f52a813c-1d30-4853-83aa-d2969ef8b0d3", "comment": "Malware payload (Formbook)", "value": "0fdf7d71205b22f118f035eadd183c769c80cd916e41228252494ce59658aad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668757, "uuid": "5423fe82-b1a7-4fd9-bc84-3067af1196c5", "comment": "Malware payload (Formbook)", "value": "f298e69c909e2e6e7f0e5d18ff578545bb359e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668757, "uuid": "a6149776-3c7b-4f5f-a7be-e8605166cd66", "comment": "Malware payload (Formbook)", "value": "8a3c5b73a3695099096bda4f7ab28ee5f6887a34f6b4c14cb50139f40f0e9d52b53107c56fca9aaa2aa78124d7df6a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668757, "uuid": "98fca44b-c60c-4085-a303-135296972ff3", "value": "T1053528103695DA01D1763BF2C860CAF09265AC0ADA29C15B2DF1BEDF39B1B87CD11A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668757, "uuid": "77518117-7b7a-4fa3-a5b9-f5f64d91ac38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668757, "uuid": "520d7f84-0082-4204-a778-b97c12ad28c0", "value": "12288:VHHifz5vDoh2F9+sCvTqfaFNDlGfJTgUkRlo+exEDyL9pD3:Apj+1LqfaFNhGhuRQW+L7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668757, "uuid": "32442847-eea2-47ba-abeb-814b11a0c3ec", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668757, "uuid": "ea8fd14a-aab1-45ea-bf89-8ce9bfa41ef3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668757, "uuid": "d8dd9743-b549-4f96-9ce3-d26689038729", "value": "be0281152dd46fe8092bedb89b227959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d770ec47-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633677039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677039, "uuid": "8bf364ab-3ac5-41d1-a80c-83165e7aaaa4", "comment": "Malware payload (NanoCore)", "value": "cbb6b1a5f45354d7da5f029fe5a8f876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677039, "uuid": "48cce06a-c9e8-4103-a044-405293f15d60", "comment": "Malware payload (NanoCore)", "value": "1074a1781e89272bf9ca4a12bc09c3cf04aa3c1349761e9ada0ee2b1de3bd727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677039, "uuid": "95a78113-24f2-4a26-afc7-fe5b97b0e90d", "comment": "Malware payload (NanoCore)", "value": "e673fd3c9f036e75fb20f7e3be3d424d1e75feaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677039, "uuid": "2ce66439-fb5f-4a2c-8fbc-4a37deb81dd2", "comment": "Malware payload (NanoCore)", "value": "9f2054fb1e65bc6b4e771cae032e345d6f9762a62a738e86aecdc275de4485f03cb148b68eb4f4ec9088c9a69c3212d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677039, "uuid": "c450e019-ee0a-424d-b5a3-6421d2881666", "value": "T124D40161BFD44762E9FA0F31997506601B3A7D1EC82AD70EA4C474A51EF33958322F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677039, "uuid": "743e5aae-bf08-4f6e-914f-cbb1186a2722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677039, "uuid": "c00962b2-81d2-4c6f-846f-f375a7c3ab54", "value": "12288:SLDyL9pD3v0n0D5+BVqfg37p1ND0ogMt9r5FbnVe:A+L7Dfg0DYxLpHgoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677039, "uuid": "1179fc20-7296-4a2d-9489-615f91bde91e", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677039, "uuid": "317e75e6-de12-477c-9bc3-eb6d54032f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677039, "uuid": "8b5f25b8-7854-41d5-b718-680512d2914c", "value": "Proof of payment.jpg.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fe81b0-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633692580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692580, "uuid": "9e985d87-c5da-487d-b205-8ca52e705bbb", "comment": "Malware payload (AsyncRAT)", "value": "a8f9589782201b809e723059e7c0ca15", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692580, "uuid": "f49f4c9f-3093-46d8-97c7-e68e89d3863f", "comment": "Malware payload (AsyncRAT)", "value": "11e9dff933cd3ab46bbfd45b0cc58ab1785c62a857c4fb8cdc0fcff2577b0759", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692580, "uuid": "34f13ef7-a785-4bdc-a2be-faab17a9e3e1", "comment": "Malware payload (AsyncRAT)", "value": "f56ad8babbd8b3258983275fba37e4316adf5409", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692580, "uuid": "598a095e-a166-4846-864a-f29041ded609", "comment": "Malware payload (AsyncRAT)", "value": "a6aafa20fffe329c9e6b41d2e80d8a2904786159429b488246e3a6dfb97c8af58402044d623e06a6d5c9eae35dad60de", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692580, "uuid": "6e277d26-6308-410a-8678-8af2849c65c6", "value": "T10C02C67886B004A2FE27C8A69579FF3445E1F27AC5CB1A90733DF8700BB67259A27485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692580, "uuid": "4833408f-d79f-4956-98d8-f9688ff80caa", "value": "96:cIBR8mvOX6YaRJ+Q4n/oywQsWn6YM+s65SjoFkSX5or2A0:TRjOXJEJ+R/okn/Mw8oFkEir2A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692580, "uuid": "174e87db-a9be-45b7-8804-70b038cc333d", "value": 8733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692580, "uuid": "f01f08f2-8c11-45ce-aaa7-d3438423d9cd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692580, "uuid": "563e6f39-9dc2-4d58-812c-5bb217ca5db3", "value": "Food Inquiry 08.10.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0725b2-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633692243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692243, "uuid": "add7d377-282d-4069-aa95-0cfbd826ef1f", "comment": "Malware payload (SnakeKeylogger)", "value": "2674084c931496b4e952b9fbbd84b7bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692243, "uuid": "7616e1a1-5b5c-4fff-8cfa-ca7f34945398", "comment": "Malware payload (SnakeKeylogger)", "value": "11f41e33b5838ae33d571d80019027792ce0fe2c58e8a88e78441dc346fc85b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692243, "uuid": "d2e4df8b-4ffd-40bb-8765-d36f7bc2f369", "comment": "Malware payload (SnakeKeylogger)", "value": "70e36e8647dbe91ab48bee69eba9b4dce507cbb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692243, "uuid": "55e15193-2e08-421f-bdf8-4d7f02ca71ab", "comment": "Malware payload (SnakeKeylogger)", "value": "49cb641f540a28daeb867a97d4aea6c562741d29f4d0684a1fc1179ae7327b362cc12ce4170027caf24d56e52b949adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692243, "uuid": "cf7e4e82-8e0c-44da-b593-d3d40fbc7663", "value": "T110537D1177866F23E77E733609A3C48057F2E2A65E22C62F7FAC20F90B877448692755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692243, "uuid": "fbeae500-125a-44bc-a416-890b1ccf368d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692243, "uuid": "677dcae7-0afb-42ac-b4cd-91faac20a7ac", "value": "1536:AaR/lZAzoo7npx05FWUJYI8UyEN/9uQsxmov:AallyzLp4FNJYIB1uNou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692243, "uuid": "31cad65a-95fd-4e72-b11b-7eecf6c3d5a5", "value": 64440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692243, "uuid": "b3b8558e-a669-4e1b-98e7-f519e3f03df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692243, "uuid": "4ae49148-10a1-419c-82c6-74044320a827", "value": "2BABA FFFFF (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e5848a-2861-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633715877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715877, "uuid": "d75c22bb-e473-45ec-9db2-b9cede4f1203", "comment": "Malware payload (Vjw0rm)", "value": "a31982d00a3a562bf83d278381faf93f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715877, "uuid": "cf17e9ec-3f94-4252-ae2a-04f4db1ae8e9", "comment": "Malware payload (Vjw0rm)", "value": "122fd7c3913dfaba9361882a48ad391f14dfcaa978d603e80620ddc204eb73b0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715877, "uuid": "0ce66960-b85a-481a-b65c-340395364227", "comment": "Malware payload (Vjw0rm)", "value": "91f492ec2722df91bd4c97a1eb4446e62f9822a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715877, "uuid": "10eb8c6d-62c8-4bde-a625-ec565ae22f69", "comment": "Malware payload (Vjw0rm)", "value": "69f6358b88e66ec49fd81a8a606fd6d5be120453ef02f020e3e494010d3f9abba58261c115fb911bb81e9c652113bc0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715877, "uuid": "47dd89c4-1150-4f25-a42d-c081daa0b3b3", "value": "T198838F059EC01D4AB7B4D69A10E80C24EE17A2F5CF6FB45BD04149CC0EEB3577797AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715877, "uuid": "aa2e0904-093c-4ef4-8ecd-ff76aee58bc7", "value": "384:wvnvI1AYT7hA55m/zJAOribX/g/W/W/w//a/N3p/wS7Ymaw0Av:/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715877, "uuid": "a8cefe40-30f0-4e21-971c-d5e46f1e9680", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715877, "uuid": "f8f29a39-25d6-4c9d-bcdf-138b72638549", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715877, "uuid": "47defead-1087-486f-8e4f-b2a27bcda693", "value": "H6A4X3S1N9Z.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b77f53-283c-11ec-843c-42010a9c0014", "comment": "Malware payload (FickerStealer)", "timestamp": 1633700262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700262, "uuid": "861543a0-76bc-489e-abc6-07ab5a1ab8de", "comment": "Malware payload (FickerStealer)", "value": "b73194a81a9a57c97c6615faef5c4415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700262, "uuid": "662a29a9-c8f4-4bba-b834-31c0caf19631", "comment": "Malware payload (FickerStealer)", "value": "12bb8ed4385c0e52f3e43b54a87f1ce80c829e3de44e1586dfabfedccf67ec2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700262, "uuid": "30448ef5-9d04-459d-9bd4-73f86cf53e82", "comment": "Malware payload (FickerStealer)", "value": "68c6474188f587dcc146898543e564566b646d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700262, "uuid": "b68f2fdd-125c-4d26-8325-9c58fe768a79", "comment": "Malware payload (FickerStealer)", "value": "87fd22fca1ed18932b9d2068e0ead404e38371b0ffde6a636c1390d4e8481a50805992312291573eff6259b7293795f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700262, "uuid": "e22b8f77-e074-4123-ac56-f63fb159e419", "value": "T1F1948E6064F82C25EF8E227D489B9356973E7E505A33C3D34635A5B5CF532C3EA68382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700262, "uuid": "1a06b208-6680-4032-b592-99a765bf2ee3", "value": "4f9c7d0d3671483fa7b1247d926d59c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700262, "uuid": "f30e8da7-efa7-4c40-a601-5394484115d1", "value": "6144:9BshZeNLwDLlKC0uv292QxV8bKkSwnrYAYMW0rLAb56dpLN4XQKJ3:rAsNUKW0TxmtrzYMW0rw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700262, "uuid": "d1250a1c-ba4d-45f6-a500-b4eae0e1f7dd", "value": 444940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700262, "uuid": "bdc9192c-e6cf-4a8d-a2c8-519625de4d4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700262, "uuid": "d293decc-eb3f-40db-8f62-dad65bb1a2a1", "value": "mixsix_20211008-150045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058d72a1-2802-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1633674968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674968, "uuid": "83ef7946-0d85-486e-9206-a069eba82415", "comment": "Malware payload (CryptBot)", "value": "4309f4b4bb455f998d1fdf310cd83484", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674968, "uuid": "5b081ede-a954-4736-9f91-b7e99a1b1ec8", "comment": "Malware payload (CryptBot)", "value": "131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674968, "uuid": "0a37acd3-214a-414f-b4d8-10d115c3d0f0", "comment": "Malware payload (CryptBot)", "value": "4ee10072d4dff28efcd64d8dcd631760868d644b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674968, "uuid": "c223c827-4e5d-462c-a2dc-fbd92bc925b8", "comment": "Malware payload (CryptBot)", "value": "659483c57622c147a2c673fde80fa6aac471c8b971e9bdb83df9c56f9c8ffe61b9169639674560719edbe3d2aa4aa7d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674968, "uuid": "e471c1f0-9216-4723-9cdc-0002c5d34b33", "value": "T1B764D01076B2E436E39F5B358D7187A16B3B7CA25971858E2BF016FD8E35281CB26307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674968, "uuid": "285de2a3-2b86-4f01-81d0-65aac9a4d3bd", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674968, "uuid": "0183ef5b-5cf3-4eb0-9e8c-e2e59631b9b5", "value": "6144:zWmk/wokUNpuDoAVUx99rpABXHxjdgwJids6m+8suhyiP:NswuNpQv299rpAVHxJgw0dsp+dTiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674968, "uuid": "ddb01d83-aeca-44f3-88da-c65baae34c24", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674968, "uuid": "cee62384-838e-4c9e-ad07-9813e1e0161f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674968, "uuid": "b7b18969-ab7a-491c-a36e-ea09dfd1186c", "value": "4309f4b4bb455f998d1fdf310cd83484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1820a0f-27f9-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633671365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671365, "uuid": "ac5f6163-2f41-47cd-9f94-ee6d9aeef8c7", "comment": "Malware payload (OskiStealer)", "value": "7f1e82a4456f08a250e231978b611ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671365, "uuid": "8f9f062c-5e21-419d-b9c5-1d0ac12bd65e", "comment": "Malware payload (OskiStealer)", "value": "136a24bbf74b38d2b898d3188864ff81134d05b1a7ee7aa4cf566d127a04a4ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671365, "uuid": "3d2c7c9e-8b6e-4a9a-a0b1-a28d1c4b4c40", "comment": "Malware payload (OskiStealer)", "value": "08e7c174a514af301bb59bea22ebf54f64862c85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671365, "uuid": "8e44636f-9193-4232-81f1-ba37ba877f63", "comment": "Malware payload (OskiStealer)", "value": "4dc87045645f5ad3847b70a2cc4bb2df7f4c7f0cd041d953973a77fece240efba0c6e5212a885f470a159921117d2f10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671365, "uuid": "9fab7c52-7cb2-4670-aaaa-b2e36fced4d4", "value": "T10344CF1176F6C432E3BF467449F4D7A54A77B82F6B2194BF2BF106AE4E312918B61302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671365, "uuid": "33de2658-7984-4c73-9977-34d8b47c9d8d", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671365, "uuid": "19efecbc-4b72-47cf-9fd3-caea90a2a1f4", "value": "3072:9Fzi9RdkUewY90QNIUdM4xatOTUftb/LGrz4VPWLD8/Nhadsb1vprctZPwdTtShP:9FzWGwY9sU24Ut3ZGr0QH8/NRKtSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633671365, "uuid": "582a9bcf-f808-485c-9886-26f16ba7a807", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633671365, "uuid": "0a915165-1eaf-43ac-bde2-1ac7b228c9ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671365, "uuid": "b182bcdb-86eb-425f-8740-e0b9f34e6530", "value": "7f1e82a4456f08a250e231978b611ced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11373a59-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633659956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659956, "uuid": "b9278fa6-1717-42f6-8720-bf4ec2ad0119", "comment": "Malware payload (Mirai)", "value": "7835aff35d89a3505ebc27eb20b83651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659956, "uuid": "d6ce3b62-31ec-411e-b3ee-c3c6fe0e89bb", "comment": "Malware payload (Mirai)", "value": "1385577108d69d0adb71896efa67c89a4c749c51fb9c9524367b88cc6a1de28e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659956, "uuid": "4e91f239-8f06-4538-83af-bf5d8f37233e", "comment": "Malware payload (Mirai)", "value": "1fa44e0c52066a6799cadb1dcde925376d79a6e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659956, "uuid": "668496eb-113e-42a9-be22-3b25eefdd983", "comment": "Malware payload (Mirai)", "value": "7ef51199d0d38d4ed6cabe350add8b2bd157d8d5d947c3a69df237ca08b7bd699d9dd0ce7749ad92e4dca2e9e6151912", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659956, "uuid": "97b24ec9-19ca-42e8-887d-fdb500a95828", "value": "T193F285592E728FECFBAC8A3147B39E20675833A626A1D644E25CD9401E7034D745FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659956, "uuid": "ab5e7c85-b505-42a0-8b69-ffd1c011ec0c", "value": "384:LkbJXc9z3wyBdB0u0v07cPph6zJvDpdegDVRHcaOxUCwTP4/80AUPf/ALP4n2MEd:K03wyZ0u0vY57degD/chMmAUn/v/j/jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659956, "uuid": "0ab935ab-df7f-4e91-8058-cf94f45e5ace", "value": 34500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659956, "uuid": "739ce955-3f04-4c2b-a644-2a75472abad5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659956, "uuid": "cdd51071-2eab-48e2-bdac-811b8138bb23", "value": "7835aff35d89a3505ebc27eb20b83651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7531f7a8-281f-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633687611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687611, "uuid": "75da06d9-78a8-40ca-899b-af68a5b9c175", "comment": "Malware payload (Smoke Loader)", "value": "b293bf84c970cc01fa50ac1006f0c6c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687611, "uuid": "944b9f22-de47-4384-b465-439419196f97", "comment": "Malware payload (Smoke Loader)", "value": "13a5517621cba2e12901a41a5e2da8e9e92c890492a02b7d74ba0ca52e75a88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687611, "uuid": "50de6bf3-26ed-416f-83df-4fdeabfd03ff", "comment": "Malware payload (Smoke Loader)", "value": "eba879bf9eb2c61f6c8f815825307ea8e290fd8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687611, "uuid": "8b164423-f45c-47dc-a64c-88a1d53b6eec", "comment": "Malware payload (Smoke Loader)", "value": "e3928a0cf64503f2e3a69be6e638c7b9ebb4341d93c0610b44fa5f9d361b8c71b8709696c416268289cedffad9cd20ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633687611, "uuid": "38746606-2093-46f1-8775-98f0426adcf0", "value": "T106149D203AE18479F36F29340D71DBA14A7BFC624D35958B3FB156FE5E6A2908B21343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633687611, "uuid": "6c16f1eb-c487-47de-8f15-d4952d8ad935", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633687611, "uuid": "8a0e7518-bb75-414e-9463-35f92cd1c6ad", "value": "3072:V7SpOkCll9wKhPDDVX1FUVehRVN+0wbrx9KZPwcx2mLvOshgC:V7SShwKh91FRw9KZMm64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633687611, "uuid": "2b45f7f3-2067-442c-b5d6-723743377f81", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633687611, "uuid": "2890491c-5971-4c53-a1d8-1ad0a309cb6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633687611, "uuid": "07e3bd31-aa65-41f7-b9b6-496e3711b42d", "value": "SecuriteInfo.com.W32.AIDetect.malware1.30918.17763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34988419-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633692657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692657, "uuid": "da6ffe82-0e5e-4e1a-a7ee-3b1979da1b68", "comment": "Malware payload (RaccoonStealer)", "value": "256a1a52b691f3564d7ceaa9f6a1eaf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692657, "uuid": "5f15d5d4-14b6-47ba-934a-5fd03aaab608", "comment": "Malware payload (RaccoonStealer)", "value": "1748b08304d248899ba482858932847ed7b07258edc30ade300a021a622b10be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692657, "uuid": "97e4ab4a-e0cd-46c9-95f5-70315b0fbc6b", "comment": "Malware payload (RaccoonStealer)", "value": "e99774740b4d1076c3fd0f686274d678cda1a2b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692657, "uuid": "26a64a36-481c-417e-8039-161310d8a0fd", "comment": "Malware payload (RaccoonStealer)", "value": "2fdaf86addb717c925041378a709532c8d9ed0774539f8f01341f5c09218fbb7bb84532b2b23c5cc5c7124dd2b8cc691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692657, "uuid": "f95996d0-25fd-479f-986b-56acb33b98af", "value": "T18F250116196F0493F00109B14FF155F95F7EFC23B4D2AD1FEB45BA080DB1A4AA8E167A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692657, "uuid": "01d63e78-4ad0-48b2-b3c1-03744df8617e", "value": "31fdddb41123508749dd6c9468f73e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692657, "uuid": "c56292b1-eb84-4fab-9a50-4346411757e4", "value": "24576:zBrF5E3A9TcdekDnFjQohahKgXjZaj51ldq6O2aZeKBpFtlp32aky2avr:9c3A94gkDnFjzahTXj4HqgUXLmdfer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692657, "uuid": "604de6f7-26da-4742-98c3-8d7be880faec", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692657, "uuid": "c3bff3e2-87fd-4065-8315-e4c5d81036ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692657, "uuid": "da487dea-da8f-4035-9157-e89c1b24a000", "value": "256a1a52b691f3564d7ceaa9f6a1eaf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5f92a2-283d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633700483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700483, "uuid": "3fbbff93-9e67-494c-ac54-747128743bed", "comment": "Malware payload", "value": "b9a08b54fa7c8ba6346d8e09e9cefde2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700483, "uuid": "87b4bd68-19a5-4644-bfba-d428a00a7837", "comment": "Malware payload", "value": "177933daa7c70acb314af202af504056670acc73fe4734b0825b3de81847d1a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700483, "uuid": "fd0db7d1-3ce1-46fb-8a55-47147c939fd2", "comment": "Malware payload", "value": "1272118cd0059d9b65053a387fefcbbbd08a4c16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700483, "uuid": "931d135d-c658-4104-a77b-54efa539a09f", "comment": "Malware payload", "value": "bebba0fcaa10440ae0c9191616048daa1541a223d4a899e4f8e47b7fd51662268bdcd58e5ccd2fca569289cc0fc4c82b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700483, "uuid": "d209e604-b341-4306-8dac-e9b71972010b", "value": "T1AA06B9E29A5182FDEE5659472EF9B81CD229341610C7E03B1FCF9389FD8B7D26E14980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700483, "uuid": "66f7e286-ff40-47db-bf04-4f33306b5142", "value": "12288:6txKlojBYHrkdX2rG1VBrIinuNm6w925zi6HmhXvrHQrEzIkFb64:MtQzi6iBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700483, "uuid": "2e106de7-83b6-47c6-b2cf-0574fac51501", "value": 3938816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700483, "uuid": "a7378cce-62dd-4d2c-90e5-b0fd00517d89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700483, "uuid": "e73ea86b-a05f-4652-932a-b4892fbac481", "value": "177933daa7c70acb314af202af504056670acc73fe4734b0825b3de81847d1a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce67877-27e0-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633660512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660512, "uuid": "a34050be-f8ba-46b6-a44d-f318ea3f71e3", "comment": "Malware payload (OskiStealer)", "value": "c7f1a6e7e78911d10ffb18e61c089905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660512, "uuid": "8460d69b-d843-4512-9318-7530fb4fcf38", "comment": "Malware payload (OskiStealer)", "value": "17805cda1591f72ed86901a7408743bd3f3511c4705a52b9b120387e12bfa60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660512, "uuid": "3fb041b7-9de5-4930-88df-63e0301af7b7", "comment": "Malware payload (OskiStealer)", "value": "bf62ab1c3684485e12b3e9a6ea5387a7fb7329c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660512, "uuid": "433720f2-1e4f-415f-b899-99b59f28b0b3", "comment": "Malware payload (OskiStealer)", "value": "ad5cceecd127a7bdfd718197c27c8fa2013530e3125737e26966ba161bd5c5b372a8f6d9ed39e627f9b467fdf764c7f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660512, "uuid": "5683add7-87d2-4eb4-a5f0-9a97581c6fca", "value": "T11B64CF931DA0F996D829E57721A3A91D98C64CBE7DF6B7030BCC3A18D7375D2A40B087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660512, "uuid": "058a62d5-5f42-4dcb-8287-62853207df9a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660512, "uuid": "b849a6c8-215b-400f-a594-d15a786ce4f2", "value": "6144:78LxBrWzUnBA4cBSd+SkdSnaC5plrJCZ4wfeIXvGOje:5UnYUdpkwnpH5JYXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633660512, "uuid": "ad2f55d7-3d58-45a3-b604-d537e4a13031", "value": 329780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633660512, "uuid": "eecb9101-2a1d-4f4f-b117-71b6a4e2458e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660512, "uuid": "b8b2d2f3-9f5e-4652-9add-d5a1aeff9a23", "value": "Becan 57826190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c176f80f-2807-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633677431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677431, "uuid": "b29c9fce-f127-44b8-ab43-ecbf764c5302", "comment": "Malware payload (RedLineStealer)", "value": "c8a3391eeccbbd0ae2af021b0d38c776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677431, "uuid": "76c0ec59-5b47-4070-a0fe-5dfcd1b7e964", "comment": "Malware payload (RedLineStealer)", "value": "18403b00868e13b90fcb40ae99551b9f36abe972dd4bfed49d24b4f6807f8d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677431, "uuid": "c6ab55ec-25ae-4967-b29b-259455e4aede", "comment": "Malware payload (RedLineStealer)", "value": "3d61d8a02e31bc2136b8b75003bc6e73a4d6755e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677431, "uuid": "8191e9cf-108c-496b-935c-309ee1cbadc1", "comment": "Malware payload (RedLineStealer)", "value": "e7c88c658a9f1b02f6adfeea1ebb863fdc84cd5c4fff19d9e8c7b900d20ac7a2a54711de1e41ea73e1881433c287301f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677431, "uuid": "a99b4e59-a8a5-4cbe-a603-cc58f6b4635e", "value": "T17BD4021536E6803AE6AF11744A709B604B7FBCA25E60858E17B647EF0F352A0DF74327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677431, "uuid": "8fb582d5-820a-4aff-8907-50fb31f01dd6", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677431, "uuid": "b40ac29b-f6fe-433d-97a9-bc2b153499b2", "value": "12288:rxwgddhxbVD1YyXEEP8tkUoAQvab3GFLgE+bS7SOnuWreLSr:rxwCV6IP7bS0LgELbb60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677431, "uuid": "f2e644d2-1898-47e7-b867-30cbe5bd4961", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677431, "uuid": "9e35ddfa-988a-47c5-97a5-7748d9a32cb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677431, "uuid": "d42ad96d-6b1a-464c-b537-c118e02b0082", "value": "c8a3391eeccbbd0ae2af021b0d38c776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c6818a-280b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633679068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679068, "uuid": "acb626ea-4113-424d-8b2a-57104febb39a", "comment": "Malware payload", "value": "370050d967040f4a4b0dd71bee533089", "object_relation": "md5", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679068, "uuid": "a5949208-1de6-4781-bcd3-b6d8ae2669d6", "comment": "Malware payload", "value": "186ab2a5662c5e3994ee1cbfcf9e7842f1e41b1a4041c67f808914dfc8850706", "object_relation": "sha256", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679068, "uuid": "6010a9cf-fe1d-4253-b2ce-9c3c5ed4f83e", "comment": "Malware payload", "value": "5bf29e7c3b1e3c6743af039689da102f0f877a9f", "object_relation": "sha1", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679068, "uuid": "a00d55de-aa18-4397-b2fa-387973050ad4", "comment": "Malware payload", "value": "3d92251a9085f1f1746be994f08bfe0911cec558813e4e7200f292aa64ad774017f51dadc98796b86b5052bb33a9690f", "object_relation": "sha3-384", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679068, "uuid": "0334b3c1-1805-4b40-b17d-92797076deb4", "value": "T1BF13071233ED8327D2BE1BB454F283014B71BA6AA433E75E5DC5509E2FB3B809511BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679068, "uuid": "3b8210ec-76ea-40f0-a2ff-b7fd208ed2bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679068, "uuid": "9e5520b9-07a9-4e9b-bc37-cd28f764303a", "value": "768:N/VqoSB7bMGq/7GTIjeKgmd5/DB2fXe8bb0wSWb+0eKZ2hJgpw:tVqtK7Lv5L6bbBSWxU0pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679068, "uuid": "02effec4-4aca-42ce-a688-18b328dc74f0", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679068, "uuid": "ec6aecb8-db7f-4775-ac82-985998acf62c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679068, "uuid": "761bb5bc-9f4c-40a8-a29a-9b9751537bc3", "value": "186ab2a5662c5e3994ee1cbfcf9e7842f1e41b1a4041c67f808914dfc8850706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df33131-2847-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633704725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704725, "uuid": "3ce8b81e-7158-44ad-a515-059719a1d7e4", "comment": "Malware payload (Quakbot)", "value": "0d603d6eea773285f63c9e02a7537ec0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704725, "uuid": "3b4447a8-8764-47ab-a6a2-d74fb2a926e4", "comment": "Malware payload (Quakbot)", "value": "18e9ba2795e067e5a9e30076502c3ee9273a8383fec636844db992a857a201ea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704725, "uuid": "919826d4-921d-4397-8ac4-2a44b4ad6375", "comment": "Malware payload (Quakbot)", "value": "65a9b84f8bda7d964d726905b67fb3c376859ab6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704725, "uuid": "c9f76c6a-3fa2-48a1-af23-96e9bd2599bf", "comment": "Malware payload (Quakbot)", "value": "a00caa3136e15aa67ee0649faecc32d68d2066b4aefbed50b8f90e1f35f254d3688e790ade43858ed19af4eba0adda62", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704725, "uuid": "272420e1-7f02-4fb4-8091-bd6579e374c7", "value": "T144D38C467797C99BE58903398EE3D69B3B72FC20DE32430332457B0E5E7A6A18C16752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704725, "uuid": "112d7529-438b-408f-9cc7-3eeba2fa9780", "value": "3072:/k3hOdsylKlgxopeiBNhZFGzE+cL2kdAmc6YehWfGvtUHKGDbpmsiimati+RLHc:/k3hOdsylKlgxopeiBNhZF+E+W2kdAmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633704725, "uuid": "8be104aa-89dc-4d7a-b7a4-ff10437d8d6f", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633704725, "uuid": "9bc464c8-71f3-455f-ac7d-39c0fe5a97cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704725, "uuid": "6f0145b1-19f4-4a66-a8c2-5c5dab0adcf2", "value": "CMPLN_721134832.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8aa02d-285b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633713420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633713420, "uuid": "832bad27-7867-4026-9eca-623c25f15ed7", "comment": "Malware payload (AgentTesla)", "value": "d1e5ef46e121c5fafaabc1535442e3fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633713420, "uuid": "51324cb5-4c7b-48e6-8692-320f5e125ce6", "comment": "Malware payload (AgentTesla)", "value": "190345737c47a2bffa425829776cc50d131e3024d1d00d2a412c8b06b4853a94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633713420, "uuid": "aa21b7dc-9995-4cb5-8dd4-30aee9b97bca", "comment": "Malware payload (AgentTesla)", "value": "3fb559a1c6afaada026d323997e40d66c5653891", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633713420, "uuid": "9f97d604-d281-4d4f-9fd3-ca24b64e4c5c", "comment": "Malware payload (AgentTesla)", "value": "117d37879794c9381ccd01b351ee64008e86c69b3dfd587c374bf0f05ee2c234c6d3103d79e7cbac7a25d19da3b8a683", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633713420, "uuid": "0555221a-27cd-43aa-99e5-544ed013fd99", "value": "T1BCB4CFEC725032DFC85BC4768AA91C68EBA074BB531F5217842365EEEA0D997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633713420, "uuid": "381a2741-e1e7-47b9-974f-5a0e0b5628a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633713420, "uuid": "2023bae2-6322-41df-95bb-96e1b07b2d79", "value": "12288:F8iA4G58uNO9dOcU+RUBwsmQry57UNmwXelBuwYxFcN8ncPJDK4higu:F8im8uNQU+W1y5oNzuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633713420, "uuid": "3569f4fc-86e7-412b-952c-06d6168325d8", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633713420, "uuid": "68b41739-9a0a-4e73-b4c7-89e53499502f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633713420, "uuid": "95ae1098-062f-4ef5-9aad-eda617018c5c", "value": "Q215483-KNPC-Kuwait-MAM-CMC-EOC_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833f94f7-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633706962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706962, "uuid": "f191006c-3dd1-4097-a531-c92311bf2003", "comment": "Malware payload (Formbook)", "value": "f3cfacb645a896421d6f9083897e8887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706962, "uuid": "81c10283-c5f0-4cf9-aa5a-747f37cdf94c", "comment": "Malware payload (Formbook)", "value": "1960c78dcdbb4d893abeaf5220fc7a9c53ec0aa43389aa75146d7af4ce5707f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706962, "uuid": "624e61b1-6ec5-4765-88c1-6260ab2df242", "comment": "Malware payload (Formbook)", "value": "4cdd98fb4d53c0f0a067be140f79c43dd873358c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706962, "uuid": "1df7b850-7f55-456e-bd72-4a710311788a", "comment": "Malware payload (Formbook)", "value": "229dcdc3f2c6024eea964a9bbea272f9f9179595de2041403e7e5c2a724c0cc1b87618fa611d77168a3a69562ee4ab81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706962, "uuid": "b39f7de0-d655-4f15-b82f-2690c3c4777f", "value": "T10344127547C28CEAF6D01776457BA77AF77F926810034B430BE06EEF1A2686782D421E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706962, "uuid": "de3afbc4-be92-4f00-adf4-ce4be8c15247", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706962, "uuid": "3f01a005-4356-4082-ab73-8626ca8551d4", "value": "6144:F8LxBsUEl4908Xhq7BJMMuvtr+3Iv5d5TJgYZIm4u+PvulK:/cGEklJCvtiI5TsnulK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706962, "uuid": "4a94a11d-8c00-437b-8230-a618b9e5bf9e", "value": 260773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706962, "uuid": "ea403229-c06c-4dd1-a108-8aa20a5f4201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706962, "uuid": "04fac725-302a-448a-8c17-7034a6a44c94", "value": "f3cfacb645a896421d6f9083897e8887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f87205c-280f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633680703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680703, "uuid": "71852ee8-1d62-4d0a-9d04-75022beb80c6", "comment": "Malware payload (AgentTesla)", "value": "3720a6f94c82aa5e6c6242b8fcd49852", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680703, "uuid": "997d6787-fd7d-467d-9f37-c4a61c06b3d9", "comment": "Malware payload (AgentTesla)", "value": "1ad5465041a91aaa3c3c2a925dc13dc149a3aeb7087f39a3c93ce69bb7984d7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680703, "uuid": "2a57b56d-5547-45f0-84ef-6aa7347896bf", "comment": "Malware payload (AgentTesla)", "value": "d2a751129eb7838484f8058bb382b2c9f46c080b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680703, "uuid": "83247f80-f57f-42ca-af4f-48d4154e343e", "comment": "Malware payload (AgentTesla)", "value": "9b7f4235136d028b57faaf8f09a79328167fa615aae686ff5d32e32fa890ebc30a974b6aefea0deddbeb58410a092b79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680703, "uuid": "d49de491-2342-41f3-a7ed-f3ad4a465282", "value": "T17FC507002695C701D1B637F4D864CAF093656C55EA29C28B2DF1BEDB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680703, "uuid": "82dffb41-191d-488e-aa5c-7d6b0ce847a3", "value": "24576:Jx+L7D3+1N8wL0R1ldX8k88Bd+L7D3+1k2ayKbW:PWn+1N8wwdX8EWn+1k2hKbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680703, "uuid": "e4d5cba4-f6d1-4d37-8d00-4d4871000af4", "value": 2686976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680703, "uuid": "81ee9e2e-0678-4f8f-b967-3daf8220a7d8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680703, "uuid": "4c1e1312-6faf-4159-a63d-2fd08861abb1", "value": "scan-copy.tar.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328efe21-2862-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633716276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716276, "uuid": "412bcd5f-47f2-413d-9e31-e45e200dd056", "comment": "Malware payload", "value": "acd9035ffd488b6b1cc6d126fe5a32ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716276, "uuid": "bf9c969f-9926-4700-b43b-737c15dd83af", "comment": "Malware payload", "value": "1b7be680d7951622cdd31760ceeb9211a7abac2ada25209919e0d8c720a550c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716276, "uuid": "4f30c5cc-877c-43d6-b1a3-22f65ce453ca", "comment": "Malware payload", "value": "e3858403393c4e6c378f31501f456afd04024e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716276, "uuid": "b2f508fe-317b-465f-aa89-51e81924bf58", "comment": "Malware payload", "value": "6822f4729ce539313113b9e76d8b2d6e35dbe7f988b0bb5e7dcc0b50811f25eb0e2bf237a6a2920b3d559e5331be4cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716276, "uuid": "56207a26-ac7a-472d-ac0f-bf2fe8f36343", "value": "T17C2523503E81C4B2E9E69EB0DE775A525877FE221D34C62E2340B6DE2873C41D926F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716276, "uuid": "39dccd28-a02f-486f-88bd-b4424ef87db8", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716276, "uuid": "79a83d36-3a18-4fc5-a7a0-bd15d426d757", "value": "24576:HizM1ZtNZNFk66A13kOl7LLj1g6Dt8yXPYcHjtghE:CY1Z7F35fLjHDezcHjGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716276, "uuid": "63da6f9e-54b7-4881-8624-a78f46aa6e87", "value": 1039060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716276, "uuid": "702b31f0-5ad1-490e-929c-09c3b54f2a8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716276, "uuid": "2f2d07bd-f38f-4790-8f61-068f276326c2", "value": "acd9035ffd488b6b1cc6d126fe5a32ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ef7a02-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1633676987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676987, "uuid": "5df975bd-c55a-4534-a84b-613df62967b1", "comment": "Malware payload (Hydra)", "value": "984d3c66b88d5cc3bab7fd57a7da2ab1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676987, "uuid": "e6d48396-ab31-477f-8e0a-91965a9beb92", "comment": "Malware payload (Hydra)", "value": "1c279ba2eb463c0c09223142f4a3502db314d3c1b07638d68c10ffd02bc45633", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676987, "uuid": "f7f4b14d-b8ca-4f5e-a96d-4c01b2e4b774", "comment": "Malware payload (Hydra)", "value": "27313e8f593ec89ff27006161873c06d554fd438", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676987, "uuid": "5dbc8163-e8a7-4dad-8942-c385086c6765", "comment": "Malware payload (Hydra)", "value": "e7415208c59790ef2c0446b9ccf042b0c444c362312040e9e2ef15990da09852948980b5b034033bcde8dc68f55b3357", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676987, "uuid": "cb32bf68-0d9d-4c63-a50e-0cba870052f9", "value": "T1DC963397E2C0616AFF258A3A4AA655C535A25B7B14C3C81FC3586FA00CF4ECE9706D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676987, "uuid": "825e4ba1-3040-41e4-bb5b-9e5ef337f2c5", "value": "196608:l8YWu8fTmIHwVHxmFDrg9OsxlHUZyNWWoDWx0RiQdyjynFAL9d:lY9Hwh0e9nxi2WWUWabyj40d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676987, "uuid": "a64ad0b9-0652-4270-9dc6-d4feabc26acc", "value": 9002043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676987, "uuid": "f31649dc-38ff-4326-b1c3-94d074b1c3eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676987, "uuid": "10a00e02-d0e8-41aa-85ee-a6b3b3ead7b6", "value": "santander.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d46c162-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633667895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667895, "uuid": "9db359d4-5e4f-4f2e-8dca-e310a8c678ec", "comment": "Malware payload (AgentTesla)", "value": "fd9e2be891f7269e78a1ccec96bb8c3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667895, "uuid": "b1fc81c1-01c1-49ec-ad4e-22f8c3105c05", "comment": "Malware payload (AgentTesla)", "value": "1cf6e6d2cd094e334d611402dd064b2fb83251df3f0ee101fad121303aa809d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667895, "uuid": "3c55eb22-158f-4e71-9443-bb4afee60478", "comment": "Malware payload (AgentTesla)", "value": "00a6de1e89abfe2dcb2edbd071a049586b9b8ce6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667895, "uuid": "698868b6-0f56-4dd7-85c1-b2d991d0c9e0", "comment": "Malware payload (AgentTesla)", "value": "da8877babc7b41b9905f6c29d2e70a325f82cddd6cd49323e9ba764b7c74b631b8a65a3e14a38c4e55666ae692504e7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667895, "uuid": "fd0a586f-de3b-410d-82ca-4685535acdf9", "value": "T1053507003295C611D1B637F4D864CAF097656C55EA29C28B2DF1BEEB7971B03CE01AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667895, "uuid": "cd7eacc3-5382-42d3-9b2d-b80422f77392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667895, "uuid": "e269f44b-f9ee-4dcc-bec2-4d4f96ac6b9f", "value": "12288:abO0cDyL9pD3n+0S5Ih+BoPJaaeW3Q+98Z6oz04xAVs:I4+L7D3+15tSaZihW509", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667895, "uuid": "8233a1fd-0abc-4e3e-b91d-c0aa18343465", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667895, "uuid": "4a0968b0-a6d9-475e-a523-6910fe8ea9cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667895, "uuid": "2a503f24-3d2b-44da-92bb-5a8d6a338b0e", "value": "DHL Documentos De Envio Originales.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbcc46d-2807-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633677264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677264, "uuid": "33c5b42d-f755-4620-9742-e991ee9ec4c6", "comment": "Malware payload (RedLineStealer)", "value": "612a7ca440022770257ea2471c8cb04d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677264, "uuid": "64a44d28-8c43-40bc-93dc-79f3b15ee793", "comment": "Malware payload (RedLineStealer)", "value": "1d9f9b445634e6bbe6eb9999d39c2288ec33ad8559c2d6526cb498250353a7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677264, "uuid": "d6fb3d32-d9a2-4ee6-aa66-0bfd41c75c93", "comment": "Malware payload (RedLineStealer)", "value": "339c68769736f4d2fa5f461a10392e9bc0fd06a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677264, "uuid": "00c8076a-3956-4a2c-8dfd-6bd95bab41ef", "comment": "Malware payload (RedLineStealer)", "value": "9e376c001111f49830a3cde1960d7e4888f4b240ccba5ac584671960ddd2676d31bee8f731287766fddaca0e6027e526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677264, "uuid": "4c007f5f-a9fb-44f5-8b1e-cf438d2a8419", "value": "T11964E02136F5C471E66F59384E7187A28A7A7C219E3189CB1FB0A6EE6E353D1CB14703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677264, "uuid": "8c49fffa-0905-4203-8dad-b23403130b99", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677264, "uuid": "d1b67866-c02e-43a9-9f1b-e0c3dd809344", "value": "6144:N53OsTwXUBorymujNJ3AB1vm+/+FlRZ1wNQaPXUfywwpxopfBR:LTwMoryBJwB1uk+3VwlnNpxyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677264, "uuid": "d3176da6-e7ed-4c86-b519-e79d40ed6d59", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677264, "uuid": "c42b1058-313d-4697-852b-0def46f44246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677264, "uuid": "89b4e796-8345-4ab5-a9b7-3f997cae5e14", "value": "612a7ca440022770257ea2471c8cb04d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19158e51-2852-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633709361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633709361, "uuid": "9ad8df46-c646-4921-a0c1-3710a80d7fa9", "comment": "Malware payload (RaccoonStealer)", "value": "015017a29e3ce8fc0cd3416eedf923b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633709361, "uuid": "aa51c79b-e398-4bd9-8781-3e9c9278db65", "comment": "Malware payload (RaccoonStealer)", "value": "1dcf4adf105e5c9f1e61e0120cb639804234addffbcbb320e96931d242d42979", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633709361, "uuid": "82340e7d-f696-4841-9bad-f0cfbca82386", "comment": "Malware payload (RaccoonStealer)", "value": "c28b8c4caa9fe62fe5e0a5bf94853d84af6add18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633709361, "uuid": "20f0fb6b-d347-409a-aae3-77cd5a1e00b6", "comment": "Malware payload (RaccoonStealer)", "value": "18731ef59aa218d3c7e27ea08cf44fdc54eb563dcdb6c16b662e0fa6d1c6a6f5a006773e3441cc19a7dfdf657dbdc4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633709361, "uuid": "81ec83b0-edd7-4064-88da-263bbf59f767", "value": "T164A40250F6FDD5F1E1EF96300DA0CAA146B7B81216B1418B37B85AFE4F252D0AB65313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633709361, "uuid": "409a5c2e-c029-4607-ae06-2311fcccf5eb", "value": "4f9c7d0d3671483fa7b1247d926d59c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633709361, "uuid": "cabc00e7-08a5-464d-875f-940071d5d708", "value": "12288:2+9mYlQ5ZaX8EpkkEcavTwa+6d72xF2fYOpD0F:2LIQ5ZzbVv++82ppI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633709361, "uuid": "197d7ef5-0ae8-460a-a6ab-1b24fbac52f8", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633709361, "uuid": "0cbc414c-4e45-4136-a632-4c356b5729a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633709361, "uuid": "6637143d-ab0b-4962-96e8-a664c45af733", "value": "SecuriteInfo.com.W32.AIDetect.malware2.29430.4407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615faa4c-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (QNodeService)", "timestamp": 1633706476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706476, "uuid": "6dca5fb2-0bc0-4d71-9a15-936b51df8e33", "comment": "Malware payload (QNodeService)", "value": "64ec09d7e74066e8464975dd63f0e8d0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706476, "uuid": "85d3eb8c-0065-4505-b6a3-900cc9c16a1e", "comment": "Malware payload (QNodeService)", "value": "1e055fe11cf1d5603bf1e824538e26a042ebc1f890a9e5a41d414f3a99a37ff9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706476, "uuid": "e772fe6d-aebc-491c-bba4-7013c416fa2d", "comment": "Malware payload (QNodeService)", "value": "c888cf2e545f8261069120c71ab574fa0a9dc5d2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706476, "uuid": "3f5a7818-f7ba-4dd0-b550-54d2cb1056c7", "comment": "Malware payload (QNodeService)", "value": "2a2d46846ce5ec2ea3bfd09df20d1252e4f8aa6992b35f59b4883eca7b246c660518d1264627c7095ab81523002bcf23", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706476, "uuid": "180d3b3c-c86c-4481-8caa-319b195fcd84", "value": "T174B412E7BDC0D47AD4E355325745921AB94E049CA54EF4272BFA088F18F4CAA5B02FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706476, "uuid": "5a3b8a55-04ce-423c-b87f-1dfb9a901525", "value": "12288:pXQtDqh+hPaPL8iqk6V6ZYbxBu1gfBl/tj+o89KQSrw:huDqhGBJk6VTL5fTZV89KJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706476, "uuid": "2ad64214-7feb-430f-94ed-61646f38bc5b", "value": 507694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706476, "uuid": "3e6cfffa-423d-4c36-a0ee-a4747b87b8c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706476, "uuid": "a7fe2904-9a72-4a2a-9697-b6309da4b6f1", "value": "IMG-08102021.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca3ddca-282d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633693637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693637, "uuid": "ad506953-7414-4d75-b3d3-314a28325ed8", "comment": "Malware payload (ArkeiStealer)", "value": "a721c7967d416b13879221ac4606ef9f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693637, "uuid": "f3526a53-2d71-4f0e-95bb-cfeaa6201367", "comment": "Malware payload (ArkeiStealer)", "value": "1f019e696ef61e628db0eade29c627a38f562ae95c135b9d79ae17e3c8e56149", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693637, "uuid": "4db19f07-3adf-4779-81b7-34fd501de8d3", "comment": "Malware payload (ArkeiStealer)", "value": "2928265a3dd72bdf16737c53b9397a55d0c3353d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693637, "uuid": "0661bd52-260a-47bd-a620-7870712dbc01", "comment": "Malware payload (ArkeiStealer)", "value": "a4a6212197586689bc864ff1a034f5e3b42d19cb5d41659778ea020a2abb2b2b9acbf70d67ca3b7c8c39c7dc893d1db9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693637, "uuid": "c32e91e1-d2df-4b99-8019-e94a676a42d9", "value": "T1E3E40121F6E6C436E27E46304DB183A14B7B786119B2849B1BFD36FE0F3A6D19A45307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693637, "uuid": "1752df38-92ec-428c-8484-ff176446f66c", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693637, "uuid": "ff5b4435-3daa-4449-abdf-bb561df11316", "value": "12288:jexekBIfJ+TfoyGtXgnppl9gMd13CBSkss77SpNqklD7c:jexoRUGpEpl9USu77KN3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693637, "uuid": "ff0cc78f-7ba2-4241-8219-5a8809ee9f98", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693637, "uuid": "4b0a9b80-1387-401f-b07f-2cc47b9cbfbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693637, "uuid": "e24f63ac-e00e-4fb8-bd87-6e8d18fbbdfc", "value": "a721c7967d416b13879221ac4606ef9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae262fe7-2860-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633715624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715624, "uuid": "f7e9e06f-63dc-45ae-8bc4-cb8d657a20a1", "comment": "Malware payload (SnakeKeylogger)", "value": "e96e659365b5bcf1e6d2eac613e70192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715624, "uuid": "b7887add-8ecc-4df9-bb22-7ff0ab4efeb4", "comment": "Malware payload (SnakeKeylogger)", "value": "1f09f994dea08c9e49df5a4373cef57bd72c90cbdce400d0ea065be0280a4ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715624, "uuid": "22c6a8c4-e8d9-4653-bc8a-6fae652856da", "comment": "Malware payload (SnakeKeylogger)", "value": "535d056b1045ff9f926f33da56108fa42102a177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715624, "uuid": "ff0219b4-f0ea-43db-b420-b3653b3cca85", "comment": "Malware payload (SnakeKeylogger)", "value": "a982323d7ecc1c7d97579a5097e7accbf3fd6c10c705130ee692e9e551e4c1729865499434d59f0f7fbd48c99155f24a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715624, "uuid": "86795af7-b118-4b91-8af8-008a36f73dc5", "value": "T12A641286F2D589B7E05602B44AFABD22F73A9304D57A1503C738FFE22D751C68756E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715624, "uuid": "b8c996c4-97a4-4f65-95a0-6ee7493182b7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715624, "uuid": "e042b09e-5ea6-468a-b8f9-c8f2334db75a", "value": "6144:b8LxBqt6QVBlJen/rulpG9yA6kxuI+iNIQWjWRWveI6rqG1OD4/:nBvdzAlM/iNaSI69OD4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715624, "uuid": "b9a0407f-23e3-4f3e-bb02-2397d9393750", "value": 323936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715624, "uuid": "35f48e0a-1288-41da-9e87-6ecbf1a09949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715624, "uuid": "321693c6-e377-4131-bea3-2a79f165a0fd", "value": "e96e659365b5bcf1e6d2eac613e70192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf817349-27ec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633665832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665832, "uuid": "87253bae-0baa-4c5f-8c2d-c7725fc1c9a1", "comment": "Malware payload (AgentTesla)", "value": "dde63ba692e93d2a3b842de8e79298ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665832, "uuid": "38da0e87-329b-464b-8c6a-1c982ab024a9", "comment": "Malware payload (AgentTesla)", "value": "1f2c5bbf4e24b8a53941763b570843d3ac01a6add3d86b94300f476c98238f32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665832, "uuid": "e9327d0d-ffe8-4dba-99d9-23a9c5c672d1", "comment": "Malware payload (AgentTesla)", "value": "d22137644bdf26dce1e598e75ce6ca21760596d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665832, "uuid": "3c904131-6bcf-41ea-8ce9-891ce00145de", "comment": "Malware payload (AgentTesla)", "value": "11781a222de8d22ee05ca1fd7783406a8e8169ddc9385d01f5a85a2d63c442407ce7e414b6771237e2a2995dc7232146", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665832, "uuid": "4dfd08c2-cf43-42cc-9922-a26af916cb08", "value": "T1DCA40194636B4248CD3947F42829AB41237ADC2A247AC37C2AD9F0BC6F737B509F551B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665832, "uuid": "524a56fb-d90e-4ef1-b38b-773c27b01e28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665832, "uuid": "bf8a8590-5fa9-413c-8a00-d336baa713f9", "value": "6144:mE2zZfZPDQ+3HwONZWwcWHj2xrh5ZZXA4GgJPYfecn+EtyiXjrV0x9xBqxRG/YY8:EkoNZoIqXwDtRXP2JYjGDn40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633665832, "uuid": "010e0a7f-dc60-4257-a50c-60ace24c8bcf", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633665832, "uuid": "2f4bddc6-3277-4cc3-a80b-3f539ef906e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665832, "uuid": "cc60eb5d-4f1e-4087-8326-dd13e5db9e6d", "value": "nuovo_Ordine-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e688fa-2835-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633697038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697038, "uuid": "913da156-9e4e-4c5a-97ce-2149dbbd9962", "comment": "Malware payload", "value": "5365a06702baf62ee80d31b53c4b4fb6", "object_relation": "md5", "Tag": [ { "name": "212.192.246.191", "colour": "#15A85B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697038, "uuid": "e57a088c-2214-4dc1-8856-a533ab581ae0", "comment": "Malware payload", "value": "1f58b242a980ee24d0960138b387c7019663e7b5c85761a64d6bea9722caf31e", "object_relation": "sha256", "Tag": [ { "name": "212.192.246.191", "colour": "#15A85B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697038, "uuid": "0626c34c-ddc2-4757-b46c-cf8298469d42", "comment": "Malware payload", "value": "386395e11560c4729095130fb97e464ebbf0fb5b", "object_relation": "sha1", "Tag": [ { "name": "212.192.246.191", "colour": "#15A85B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697038, "uuid": "913f40c9-585a-4a78-8ecb-b0b5095ae983", "comment": "Malware payload", "value": "2662f2e69f8434352ad0185bdab3a34536c05878938f6e227e451ae2f4719135482fb817047649438928ecbf171fce84", "object_relation": "sha3-384", "Tag": [ { "name": "212.192.246.191", "colour": "#15A85B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697038, "uuid": "75058f65-de25-40c6-9f5d-549c19b78838", "value": "T12912B429C33CF911E589889CD428BDE40C6C43AE1B6DBEB1778D74682468A5FCFDC465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697038, "uuid": "51534602-d1d2-4146-860f-5366822bee4b", "value": "96:g2+dz8qVsVulmO7UIO1mWO7UI3myA2+rz42+Jz2CHDuCXDWVsS+BMFTdWGqvwmnO:IWAmVMyGHlrkxdtY97iFlhYt44i3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697038, "uuid": "8bd6fa16-db5a-4630-96e3-96e87fc454b4", "value": 9853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697038, "uuid": "0c6c8f5e-a30e-4612-900c-c6a12cb931d7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697038, "uuid": "bc0f2773-3934-465e-8362-63b983cad700", "value": "bypass_D_1235467899786756789576890865435678.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b830644f-2892-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633737116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737116, "uuid": "97531864-a38d-4dac-a6dc-ed014a3c4f81", "comment": "Malware payload (AgentTesla)", "value": "6151363b4eb6700eb006ded80f5d5b5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737116, "uuid": "b213ea89-6c38-4782-b606-49e6425c4a69", "comment": "Malware payload (AgentTesla)", "value": "1f7262c61f588272d11a6bf35c7503c1aa46c006ae60515d56c87733ca4e0dd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737116, "uuid": "3bc4fa4d-d429-4f09-98c8-7632a5fcf483", "comment": "Malware payload (AgentTesla)", "value": "aefd776dcd0a38d22407ffef2b4726ae758214cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737116, "uuid": "5a3f7bd7-808a-469c-9bfa-bd8c731cb51f", "comment": "Malware payload (AgentTesla)", "value": "8fc99d72bb0ee99229b23adbf2ae12f3f4da67b9e8474bbe517524f1df82f351d2d0ad336e80b862fd0ddbb09e2fcb87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633737116, "uuid": "cc0776f1-0567-4e3d-ae5e-a44143d7dff4", "value": "T1FCF4C0687212B5DFC85FC431CFA91E749AA12C3E87D6431F5117318A9B3E293DE190EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633737116, "uuid": "e46b054f-2584-47a6-a35b-480443848a6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633737116, "uuid": "669445eb-15f9-4471-9f9e-e40e60e753ca", "value": "12288:4zkDbU5FpzZb8CvlyjoIbaz010v/z+m+X5/QLT6YYdQVYJUEKl75jQWmc:4zx984ZAavrlQ12VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633737116, "uuid": "b52ae64b-e544-4546-a2eb-e6ea4ba780f0", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633737116, "uuid": "b072beaa-1118-439b-ac02-5ec21e7bf586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633737116, "uuid": "3cf49206-7751-4f4d-ae3a-4f37ba82adee", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5990624f-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633706463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706463, "uuid": "b9e258b1-5404-467a-9fb2-29c924a99a46", "comment": "Malware payload (Formbook)", "value": "5cc26597e22f3f1daa2432e54f8e7733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706463, "uuid": "ae9cb96d-82bf-4757-94e1-c7a8747df4a0", "comment": "Malware payload (Formbook)", "value": "1fcc50813abb7385e0655f566a7def176171060614e8d691c1394776156f19a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706463, "uuid": "cccb083f-c6ff-4ddb-90ad-d5f56cbbbe2e", "comment": "Malware payload (Formbook)", "value": "12e0adfce5a2a3856801a62650d35af6f4e0a51a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706463, "uuid": "89159f54-f25a-48ad-8f2c-e98110206136", "comment": "Malware payload (Formbook)", "value": "69eee2e26662ef91ae6c36fbadb28e7349ae0f91af313733ff124eb49c8593ba726100ba3d0eff8f4bfbde0cc010aa8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706463, "uuid": "7c5f4d94-bd16-43a9-a88d-149a32726c92", "value": "T152454AEAA3417C7FC72205391C3B6350692AF9B4AA78728E3ADD591C5F37A0136DC247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706463, "uuid": "0f80aa4b-3011-4696-83aa-b622d7c87716", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706463, "uuid": "3d0bbbc9-f083-4a83-b499-07f1683718ce", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6tqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXA5mPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706463, "uuid": "341b3a75-51d0-4cd2-a059-5ea996bc2cdd", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706463, "uuid": "03e0d512-c6af-4f09-b94a-57f58a99aac0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706463, "uuid": "2c8fd7c9-6570-454e-b0cb-e67ebddd257f", "value": "tellimuse kinnitus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c2c9e0-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633676893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676893, "uuid": "8e571f24-d593-4a2a-8889-edb77e3a6b82", "comment": "Malware payload (Neshta)", "value": "86e0d3f2f6c8d3e8cf4da4e316f8960a", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676893, "uuid": "9209a501-e11c-415b-99ac-f01faf6444d8", "comment": "Malware payload (Neshta)", "value": "20163a5eb0b8c8bc8853d5b1a4516f12e94a14737f59e112ee51d6d6e37b9466", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676893, "uuid": "33b3a84a-bf9f-43d8-abe9-ac8d49c834b9", "comment": "Malware payload (Neshta)", "value": "ce24becfb84a908059c0403ba3ba940dda9c0db4", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676893, "uuid": "35e7370b-ba66-4c52-bc0c-995f12f2cf5d", "comment": "Malware payload (Neshta)", "value": "ac161f860ff0b7065cd45ad70eb0be793b8054a0387b7f7d65b74bf3a097f2151fa735af59c48a1c79fc643168c43b85", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676893, "uuid": "78787f5a-e8ca-4c6d-93c3-f8adf14aaf61", "value": "T12364230072292E73D58DCA3746E5D71CE227FE16DB40A50D92C53FE9617FB6804DA2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676893, "uuid": "9d310331-85ac-44ec-bf38-c1283089c888", "value": "6144:0hV84McZdPzZJFhj+zWy0Tbitz236/Us+fKOQaRx5+izoCET8mWa5uk4pc0MR:0X84lbtJFhjPyGiti33fKOJ5+cETka5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676893, "uuid": "2b6134a0-04b8-43b3-a698-37abb4141e41", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676893, "uuid": "f31337bb-3b67-4d7c-8dfc-5e3ae17d55f9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676893, "uuid": "e76bba66-eaa4-45b9-8204-3a576eea6dee", "value": "COAU7229898130.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e780dce-280b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633679064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679064, "uuid": "9304a180-77c5-4377-8e15-43dd6c14184c", "comment": "Malware payload", "value": "1f52b1901edcfff20e2fb436057a27b2", "object_relation": "md5", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679064, "uuid": "02a01881-ac0d-47d4-8720-94d73cffe764", "comment": "Malware payload", "value": "21cc9c0ae5f97b66d69f1ff99a4fed264551edfe0a5ce8d5449942bf8f0aefb2", "object_relation": "sha256", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679064, "uuid": "3d01db18-4c03-4d66-8c34-4c9b95fea0a7", "comment": "Malware payload", "value": "b5ea3a577a1b39458d8f493abdc14c406abaca96", "object_relation": "sha1", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679064, "uuid": "4b3d4a9f-abf6-4279-a4a2-57304fa8c052", "comment": "Malware payload", "value": "34890667175fea5a8e2d109adce1514382c58931863c276c1ab6e8009565c27225963aa0b10b1907346e3cd5be907052", "object_relation": "sha3-384", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679064, "uuid": "3995217d-412a-4834-90b1-2a68099ff65f", "value": "T10144E7046FF65657E6BB37BA94F446518F7DB511B56BEB0E09B010F80C63380AE683A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679064, "uuid": "bd69db18-2093-489d-b313-51cb94dc6cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679064, "uuid": "36b95a25-5eaf-4cd1-853b-f3df803ade77", "value": "3072:XRdkHgw1/CrWYgOoEh6ixzQ0bVEoq7EKNlVFs1R4B1s5PaFCEcrtKu4q1DWu5Lu6:BdkP1/YYy6ixzQ0ppq7E1iq1due", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679064, "uuid": "d4a24471-597d-46c0-ab79-5bd9eb1acf61", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679064, "uuid": "d494e260-c0e4-434d-a008-aa234edfe8e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679064, "uuid": "063a00b0-5231-4c10-bc40-de5fc81d47ec", "value": "21cc9c0ae5f97b66d69f1ff99a4fed264551edfe0a5ce8d5449942bf8f0aefb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab428068-2874-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633724209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724209, "uuid": "deeb56b0-422c-4ada-bd48-b0d06ecd8cd2", "comment": "Malware payload", "value": "0c356ef7fb30deb5dbdaf28cc3df61fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724209, "uuid": "18ae61d6-b7e1-44fb-a946-6257f64b9008", "comment": "Malware payload", "value": "22dcea7dc8afc3f7cf77555d885e606260b782de2ad4faa7797e35ed23fcc428", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724209, "uuid": "cb078734-0028-4cf1-9ef1-8e057cf9c6e5", "comment": "Malware payload", "value": "b61ad53feae466d11e79f0518dd540a63d89caf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724209, "uuid": "c2b9fc75-f28f-4249-98d1-160982e8b237", "comment": "Malware payload", "value": "9c65aefe77805bda8be457c6c3b964542d77044bd0b0df56f1a3242b9eb7944e6ac5db7b21732481ece2e43ff7fd9e07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633724209, "uuid": "66649da6-047f-4362-9067-759652042a2c", "value": "T10BE49A645AA4B3A2CA1C4FF011552AFCCA6E4D7F2A31F1CD5E89705237F7AC2B225C52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633724209, "uuid": "33b2d634-17f2-44c6-86ba-f64e4ce0ccb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633724209, "uuid": "a110d49f-3eeb-4c8c-b706-89dfde27a9c2", "value": "12288:SUlR/OBJrIVqzYqTJ1VhwCGD6iYzEEwr1E:y7mqzYqTHXwlu1EE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633724209, "uuid": "e07d8917-68f9-4772-bbda-f677aabfc976", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633724209, "uuid": "0192da77-bbfb-45bf-b435-44ce4a7e94d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633724209, "uuid": "e30d5f72-ef8c-4d63-b3c1-0f18f0b5b071", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8e400e-2862-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633716271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716271, "uuid": "3813df55-1e74-462c-9169-26247f9eceb0", "comment": "Malware payload", "value": "75316393d6bc5081bb0af37f8f1c9fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716271, "uuid": "6d49053e-5edc-490d-954d-8be99c93f0bc", "comment": "Malware payload", "value": "23f0a0759ca8a7efe037c3d9d32531425650986af2c74cb9ed0cf457254e3c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716271, "uuid": "3932c7ac-269d-41c0-86f2-908d60d02f6a", "comment": "Malware payload", "value": "50abaa994d1711c11d3e27985325835dad407b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716271, "uuid": "9934ce2f-4ca3-4a86-9ff4-32f4e89b8680", "comment": "Malware payload", "value": "3688e0a57c6ad94c73f223f79bb7f0aa4a119eeebf40be9ec4319ea5355c9897c360cae999de4ba4b113c0d1844c0f7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716271, "uuid": "2935c7e3-8370-44e7-bdd2-ae5ea92e196c", "value": "T145441212B1E1D83AC52630F059A6C6F65BEC3805116996DFC3375A335FB02E2ABB91C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716271, "uuid": "619f6e5b-8445-4fd0-aa61-2e176b2ab7f3", "value": "6144:eG8FaK2Np+v7m+wzVNaLTrs2gXyBJGihZeDegrCkKe6hx75:BUaK2NpSMNa/I2gXuQegWk0zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716271, "uuid": "66f1c49e-f0a9-40ef-b5d4-afe1c69b0c39", "value": 269068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716271, "uuid": "e4458f02-7c1f-42ec-9f4c-295c297bd8bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716271, "uuid": "b1315de8-1d8e-44b2-af3f-ea686ef9fad4", "value": "75316393d6bc5081bb0af37f8f1c9fc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b170a302-2860-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633715630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715630, "uuid": "653a0f37-9318-4402-bd51-0b350ea6ae43", "comment": "Malware payload", "value": "5081cf4876b372517dd52c5ac04b58df", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715630, "uuid": "590b2b55-598b-4d0b-8de4-4d3d3981426c", "comment": "Malware payload", "value": "252a06c8ba8af00c397a2714d7818984b1eabcec8ae9ca1df90d8389c0f5016a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715630, "uuid": "4fa08263-5f63-465e-8e8e-6f3d30d1ddbc", "comment": "Malware payload", "value": "76a0110b4a8cae19e71e72ee3d4c1c63b02a416a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715630, "uuid": "5c282f79-ea0f-4908-a30f-8023f2afe575", "comment": "Malware payload", "value": "4905a726cf7693027f1b307fe3e668c6fc6374db697cb0d7bf1a65dac7b97b45cec719a8ccd91916adc1d573add74abf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715630, "uuid": "94689f25-1464-4642-b45b-669ff25e3834", "value": "T158B57E33F6D18937D07726389C5BA7689A39BE102E38984F7BE41E4C1F3568079252DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715630, "uuid": "bce71a15-a081-43d1-82a3-dd8c7063d6c3", "value": "49152:PgzKVHH1f9gGmqQXZpQmlTPEy+e7+OYLEA:GkHVfPmVXZtL7+OYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715630, "uuid": "fd92ea72-3a89-4235-8ce8-dae2611ea492", "value": 2466304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715630, "uuid": "1a710a57-fcba-4118-8d85-053530917b39", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715630, "uuid": "dd624e87-4231-4452-a55f-840dec95398a", "value": "factura - fnbmpoxhsknjdyahbdrs.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef73035-27f8-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633670824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670824, "uuid": "060deb3f-66ea-430e-a080-4754179aafb0", "comment": "Malware payload (AsyncRAT)", "value": "8b9b369bef00b72aee460098fb4d6968", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670824, "uuid": "36d3fb4e-39aa-4a91-8903-c008b072ec2d", "comment": "Malware payload (AsyncRAT)", "value": "25483c1c5d841f11901fbb1d2da51114dc830660837cfcf94ffa0aea798c4f4b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670824, "uuid": "d482d407-2df4-48fb-8e3e-0f63a48948cb", "comment": "Malware payload (AsyncRAT)", "value": "94f12990a7ae43520cd28d41073cde3e4e89e4ee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670824, "uuid": "2c20c14e-1282-4ae1-9a98-6d24130e7ddb", "comment": "Malware payload (AsyncRAT)", "value": "83fcff3030b460957bb2b6b74c378c05562b6d68bbd212cad7e8bcffcda4db21bede34ac70910483b765a4fcb9b8bb15", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670824, "uuid": "56928c5c-e059-4319-9cb4-df2455b51c71", "value": "T193849CED726072DFC86BC4729AA82C74BB603477531B9203A12745EE9A0D99BCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670824, "uuid": "7fc9c18c-d1fe-415d-ab55-2ac9f15ea940", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670824, "uuid": "5adebe6d-a838-407f-aff2-45bb080bd639", "value": "6144:8wszrEzGO1QlOir69loEzdFujpquHppHONeSkUaGkswINSnZdVoDDLWBL6dEHN77:8wsgNQE6SoGIjLpHOgfUa1srSbVozy64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633670824, "uuid": "df1c3ef5-4c21-4bfd-a261-f26e4218f28c", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633670824, "uuid": "d6b8b22a-3643-4b84-8213-4088bb41a077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670824, "uuid": "a0e94cb3-9a52-4ce6-bc05-c5bca8594038", "value": "PI009876789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32069d4-2800-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633674401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674401, "uuid": "3c2caf0e-a4b0-4797-bbaf-124d1689f0f5", "comment": "Malware payload (Smoke Loader)", "value": "097910dc615bd581069c0ec67fa513d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674401, "uuid": "54f6c613-9a31-425b-9d6b-84d2e643d198", "comment": "Malware payload (Smoke Loader)", "value": "25b2ae77c2dc71ca729c153cce1615b77a396ff4ba598928c788eec57f1777fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674401, "uuid": "f36009b6-f7fd-4578-bb4e-1e82bc6aef76", "comment": "Malware payload (Smoke Loader)", "value": "00597735a09afbe12ad29ea00ede40733c67801c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674401, "uuid": "45628b65-b807-47f2-af67-731ef9bb7409", "comment": "Malware payload (Smoke Loader)", "value": "29bb0ea848ce8d91d3b3e0e8e62d17f8026169b8e811856756c7f7e222bd627af72d7317209c380e4cfcce111e45a461", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674401, "uuid": "8873c7a2-2733-4783-baad-e28a49277789", "value": "T175149D3036E1C072E3AF09304971C6A24A77BC615831D58F1FF196EE2F69699CAA530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674401, "uuid": "f0f13aa4-097c-4466-b30e-7a8af2db2271", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674401, "uuid": "4f003b0e-e59c-4ff8-ad62-ccfbbf13e0b3", "value": "3072:/8QYOkCol9wKhIDDVX1oWPBy4UAhZErjmZPwmlrNChgC:/8QtAwKhK1oWPf6mx56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674401, "uuid": "da01c7a8-2e96-4e5d-a25f-07485b32c7a8", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674401, "uuid": "bd06c71c-573f-4e2c-a2ad-5fdcfec5b192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674401, "uuid": "ccc3fd3d-8332-4d75-a540-bccfea586380", "value": "097910dc615bd581069c0ec67fa513d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f76e1ff-284f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633708244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708244, "uuid": "cc1c3689-17de-4d81-95d4-feb4f27b86e0", "comment": "Malware payload (RedLineStealer)", "value": "5df69875f996257406096d8d8b9fcdbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708244, "uuid": "6acf7e3e-dbc9-427f-8f30-66241465d701", "comment": "Malware payload (RedLineStealer)", "value": "260dbb4e6556f73e71926d8df1258cb902e00963a1cd199d4a00771d2058e7d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708244, "uuid": "a88b2d42-4424-4430-933c-d77d1efee356", "comment": "Malware payload (RedLineStealer)", "value": "3cbda4759dcfb63625cc67998a88dc61d43efe2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708244, "uuid": "0848a12b-31f8-4434-80c7-7c53031abd2c", "comment": "Malware payload (RedLineStealer)", "value": "7acadd2fc8321d3520230c667e866aef71910a12b71b3db3b302ae4eda30ca08fbf91d097f8a730f820ce2ad925fca40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708244, "uuid": "1d2ca3a9-ee3c-4ce4-ac27-8744db8dfd5b", "value": "T1A3E533FD19218D32EDEDF5724FC60E3ECA9160439C6F4AF4B5754090BE6AA21153AEC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708244, "uuid": "0a01ca92-2717-4680-ad6d-7cf86d759980", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708244, "uuid": "51f9479a-ba3c-45c5-8b81-1931c9e95e62", "value": "98304:DIS6rWI+6M8yPZ8ucdmFGuWQaWgaonEYBK77muLMY:J6SI+6MKmGDQaQmVK77Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633708244, "uuid": "eea85c0b-4657-4287-aa75-5e487d838f4f", "value": 3178142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633708244, "uuid": "4f0767e9-4669-4ed3-9d60-6800025f6b47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708244, "uuid": "57600738-5a9f-4217-8307-2dac0982a1e6", "value": "5df69875f996257406096d8d8b9fcdbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b71268-27ec-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633665525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665525, "uuid": "35f82cc1-7eaf-4414-badb-9a7aa64c3de2", "comment": "Malware payload (ArkeiStealer)", "value": "0db36fb815c659d43624bc706237bf1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665525, "uuid": "f17eb175-d693-405d-b192-1f9b0ede73b1", "comment": "Malware payload (ArkeiStealer)", "value": "2906d8c2aedf301e251463fb93aaafcc0dd724536c78a108c8d135c221279220", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665525, "uuid": "790014a3-ba51-4642-a82b-ed57220dce08", "comment": "Malware payload (ArkeiStealer)", "value": "fb794abf903701901236f0881f825b5a7f8f52d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665525, "uuid": "f4dd0008-7a74-48b0-8b39-ec8e5081173b", "comment": "Malware payload (ArkeiStealer)", "value": "18bc3fdaf9bbfff06c41490f05f6efa2e6e4cde04a595c62d73daa8a444e9e853524d804b5dd4b16ebaa03e927f2e9f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665525, "uuid": "6897ad60-4c6f-48fa-b15d-ce66deb893b0", "value": "T106E5382868BFD01960B3FE922EDCA4BFDA9E55D3640D74371095531B8B22B80DF8B479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665525, "uuid": "4044516d-d1aa-47fd-9b9d-17aa6088ce67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665525, "uuid": "59f8993e-ecbc-45d3-a4d5-52d471098688", "value": "24576:un+Gb5BhU1yGjHlswliv6gWMzq9zEFQk0oyBgsjRXIrlB00rgbV2eK8ruqKM9QbU:czkfXA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633665525, "uuid": "d04f73fe-1e94-48a5-812e-5814ff2c31d9", "value": 3110912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633665525, "uuid": "6fc12897-c977-404b-976b-60edf1d35f0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665525, "uuid": "d505b989-9759-4c97-8962-517cdbdf7aa0", "value": "0db36fb815c659d43624bc706237bf1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dc4cf4-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633667907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667907, "uuid": "5feb8f83-5011-4a71-9c63-5bc259c339eb", "comment": "Malware payload (AgentTesla)", "value": "e407c1fd6fa4c93ef92d0b60e8812e1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667907, "uuid": "5ec29903-66db-47f2-a8d6-0179141f4d1e", "comment": "Malware payload (AgentTesla)", "value": "2964eadcc19ac554198a302b050655235587127a2b6fd011e9704be8deec3e47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667907, "uuid": "f2fd4647-ca83-4eca-90d1-268f0d5dde8b", "comment": "Malware payload (AgentTesla)", "value": "4a690abd7a6e007bb9df0d0d3d6c361de6030b46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667907, "uuid": "480857b3-9cca-443c-912d-306f4372efa0", "comment": "Malware payload (AgentTesla)", "value": "d32052d4f7bb2a015871ff0af84ac32cb512bdad785d1d5421764475276415088ba2ca7e0c34d9ffb3df58a4e583889d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667907, "uuid": "f55eacfc-c485-4377-ba96-2c1819e1b521", "value": "T1BFE34B4137D48B21D55816B5C1F7273403F3EAC762B3E6863F8846E64E017E89E8ABC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667907, "uuid": "32db384f-d025-4140-ae89-39aeadcaae0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667907, "uuid": "7890f119-c07c-4b30-81b7-5507b1cc6222", "value": "3072:w4aaIfxGFMw4QrKh5wwnWAu8lxADIFSuPLjuS0h0CTXYmvFMQ4b1Lf2:uaIpGMw4jkAoUvL6S0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667907, "uuid": "852d9fc2-9ace-4cf6-b281-3834cae467c2", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667907, "uuid": "10320b96-a41c-40a0-b821-d9c0a7e85359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667907, "uuid": "6a7550b8-a974-4f1b-9ce7-8de6cbabf9cf", "value": "TNT Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94504193-280b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633679073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679073, "uuid": "d87f7c21-1dc1-45ad-8a84-0440f72768f5", "comment": "Malware payload", "value": "59649501055e1a6b95ac5d050b54d864", "object_relation": "md5", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679073, "uuid": "64b8ac3e-f503-4ea5-9d16-f0714cd0dd3f", "comment": "Malware payload", "value": "2a1044e9e6e87a032f80c6d9ea6ae61bbbb053c0a21b186ecb3b812b49eb03b7", "object_relation": "sha256", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679073, "uuid": "1175b9f6-b9d9-4117-95ab-42fe659367bd", "comment": "Malware payload", "value": "e0689982c9182f1c2be0e015b3c0f6e0fc6008f8", "object_relation": "sha1", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679073, "uuid": "2e681901-db73-4df3-8914-223176f7fe6f", "comment": "Malware payload", "value": "da3c923c59536f607d8100e4e50f7a841c6cf23386d87331e267ff804a2466ad4538fd927c0f10ccd4815be81e53f311", "object_relation": "sha3-384", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679073, "uuid": "ad0edbc4-8ac3-4068-9ff4-4a12fec63334", "value": "T19F65338CAE49CCABCF8512763C4621675A70EB5208418C81FCB92FE5CF4F75C6EB6189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679073, "uuid": "ed133c7f-e32b-4f28-b82a-0d148c62b3f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679073, "uuid": "39973daa-562f-4e52-aa0a-a6f9a3932296", "value": "24576:l+t0D9jaWAsmt2AbKd051/x6Osdu21Xq04SoQ6h/Aijym1LvbuhZUTdQ:+0gWAsmwAbKy1/YTdu21Xq0nJo/3Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679073, "uuid": "d7593bf9-55fd-4c29-ae21-7f846b76badc", "value": 1491968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679073, "uuid": "bb2f3a98-6458-42ec-8a8b-115288bd3255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679073, "uuid": "d21f166c-c770-46e9-9ede-66003ad31b09", "value": "2a1044e9e6e87a032f80c6d9ea6ae61bbbb053c0a21b186ecb3b812b49eb03b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24aee9d6-27e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1633662995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662995, "uuid": "344a5b10-69a7-48b6-9050-7514615d0e1b", "comment": "Malware payload (Pony)", "value": "3087b67577a90aa611436c94ed23ae5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662995, "uuid": "f6fb936b-d481-4921-93d1-fb0d8c589963", "comment": "Malware payload (Pony)", "value": "2cec15c8fef9435abd5c332486d8ad7083eeb9eb84de9077b5bf6bb42458dba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662995, "uuid": "473d273c-68b8-4837-aebf-2a16da208034", "comment": "Malware payload (Pony)", "value": "6a84f2dd65787b2f9041421357c9939c63dd796d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662995, "uuid": "cae2ba6c-bc0a-4506-baa1-b56295049f1d", "comment": "Malware payload (Pony)", "value": "25b30c6afdbd22367d54981e8abb866af4c6f1aecdd0a97474ac51b8218beda5b83a239948692e506bb9812b606f07e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662995, "uuid": "48f49faf-7e51-46bf-8e3c-060caebae7f6", "value": "T1D7E3DF43FE6DEA87E4118932ACE2C2FA0213BD71EC645F1B75D4A35E6C75B426E80391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662995, "uuid": "f3e40d7d-6656-45c2-a383-6a4b9d9cae6b", "value": "864db8a731b1823c994bef60988e95f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662995, "uuid": "f39fc4fe-0075-41d6-be8a-99fb400b36a1", "value": "3072:IzTpvZP5c5VcVkyIqSq3FZ/CPvBUk+2icuOHBSKwVLkIPbxWu:IzTpTcfktVZ/eBJFhuIoKWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633662995, "uuid": "dd380186-f5a0-4dc9-bab5-ec8e2a1bc211", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633662995, "uuid": "28f29c4f-56b7-4c67-94a2-c9be63e73b68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662995, "uuid": "f7578657-d5b4-45e1-8556-0c75b777c1b8", "value": "2CEC15C8FEF9435ABD5C332486D8AD7083EEB9EB84DE9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d624e9e-282c-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633693262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693262, "uuid": "14c53ef6-578a-478a-aa11-bee0a1b19bef", "comment": "Malware payload (Loki)", "value": "d116068cae9880d5bea1f0d1b9746ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693262, "uuid": "ee0fc681-6e81-4ba1-a71b-a77683e89455", "comment": "Malware payload (Loki)", "value": "2d18c761330855213e4b74a7bbce1409b8fd95aa704a15534fc96df4a0745dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693262, "uuid": "6a376426-7042-41d6-bdbd-2789747121b6", "comment": "Malware payload (Loki)", "value": "425a1b465cd93f0f4efb402e053e798cefb34a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693262, "uuid": "5f3526f7-e3c4-4e43-8066-4bd405e54a80", "comment": "Malware payload (Loki)", "value": "81973cc57f566355af1e6c7e6891661150ee63681aa25cbb3e0cd27e8c147169e2065d289bfe1d45865247797ee88d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693262, "uuid": "97b4c914-d9fb-46af-9ade-c1a80b5ef5fb", "value": "T147A4E1E0C2392AA3E70C4A34A45835B95B5A5C93DF27CC0BA5CBB81905FBE61D3137D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693262, "uuid": "254c288d-ea1b-407d-91c4-c69b1d985478", "value": "829c9249891dd079159eb8dd120109b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693262, "uuid": "2ccc3558-e5dc-4253-b886-cc5f7a98db4a", "value": "3072:8f2pVYe4hW+nr08qfshK7OfDXqoxmtAfe0Pd4UPBNZAWmwO+Azyg74WMZuvA9uPi:ehbXnIS4UPBNZALhkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693262, "uuid": "3843b89b-27a2-46a6-97d5-5c3bbab002dd", "value": 484568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693262, "uuid": "63435647-5c2e-4573-88d2-e736c13972b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693262, "uuid": "7b5cdf6e-1ea4-42f0-a8e7-13249173da1d", "value": "2D18C761330855213E4B74A7BBCE1409B8FD95AA704A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573cb787-27ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1633652772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633652772, "uuid": "9baf0a37-5754-410c-bc3e-ec35d3b4b66a", "comment": "Malware payload (Gh0stRAT)", "value": "c61470df88115bd1c14540652f48ef49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633652772, "uuid": "cbf93eb2-731a-4f0c-a0cb-cf64887f17fc", "comment": "Malware payload (Gh0stRAT)", "value": "2d29648e8ef3eb8e7dcb9632359d315ecabee7c32a0c3f3f622b124fd7c07da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633652772, "uuid": "5c8b65c8-37f0-45d5-8e55-57daedc3730b", "comment": "Malware payload (Gh0stRAT)", "value": "d3d39e2ff6b8f9d8d04d72385b48fc1cc3429407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633652772, "uuid": "6d9b79cd-ea53-4e48-b27e-91bca787df69", "comment": "Malware payload (Gh0stRAT)", "value": "5a15c7b564a5075fab17e46942ffaa4b45f2574c50e4ca39dbfb6670a1e5a0cecacd06a3dc5d1b99e5bf9042836bb919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633652772, "uuid": "d091091e-2908-43f8-9c95-f89cffc36144", "value": "T16D74E019EE42C01BE4D482F5C2D2CBD89A7CAE73274530DFE7E4A49613581DA79318AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633652772, "uuid": "7ff6ff5b-20df-4940-846d-b1efc62d86d9", "value": "a0158c18d7c57554131cbbf4101b1cab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633652772, "uuid": "3830d7a8-148b-49ce-b9f8-b72e66fca2e7", "value": "6144:ihru3c9FNN8tyEW96wgvRHCzOYtqlGyzcsX3KA0LQIQRj:wruM9FNatyb3gNCpOdn/uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633652772, "uuid": "abec1c03-c11e-4a22-827b-921372e19ff4", "value": 364651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633652772, "uuid": "abd1e25a-18c6-46ec-ac87-2978b81a6204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633652772, "uuid": "bd708cf0-2918-4c39-bfd6-021465155d0b", "value": "2D29648E8EF3EB8E7DCB9632359D315ECABEE7C32A0C3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a25c13d-2833-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633696022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696022, "uuid": "4760a540-8270-4db7-b0f2-6329ec15602f", "comment": "Malware payload (Formbook)", "value": "d276c5c44df83a6a0332f07521091e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696022, "uuid": "98598ba0-b506-4593-a986-8e853c020558", "comment": "Malware payload (Formbook)", "value": "2d29cdb14c2e054ee53f935fc31dcbb91e0b1a2b9fcd355b0a130c325954ac94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696022, "uuid": "5f6e5e3c-be65-4e1d-bc56-a25b7614ce2e", "comment": "Malware payload (Formbook)", "value": "f8d6fa4b4a9d7893a8025cdf90d79d4773031e07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696022, "uuid": "7a2c9108-c6b2-40b2-9431-16dabe17145c", "comment": "Malware payload (Formbook)", "value": "057f4933234bd621cbec96f887107a0dfc5210c7e71fabf417e84f3511a1567a6d3899c0638e8099ee35264ec0cc66c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696022, "uuid": "9733b7d0-a199-4800-afe4-d6ada5020209", "value": "T1DF441221F1C1C9B3F6EB82314AB3E776F57541091161AB8367B90E7A6EB3E06DE09344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696022, "uuid": "099765a3-e607-4bf8-8cc6-8ae453eaf2e3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696022, "uuid": "2830095c-cd34-44a0-805a-b656a678e1cb", "value": "6144:F8LxBshyM+CXtZZANSRv9e5zpy9tXkJMAym8EvGeKvAaPJ2/yBI0:/4qXpApDukKm9vGeKvAaUyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633696022, "uuid": "cd28eb8d-2b2b-4d79-bba1-b4657029aa2c", "value": 261517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633696022, "uuid": "71a9fa0c-f1e0-4f8b-b751-3223df6be3be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696022, "uuid": "dc166a95-2173-409f-a528-08f96b46afbb", "value": "new order 0891.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc945671-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633677047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677047, "uuid": "ade3de53-1fd4-48a6-9834-4c2bfe40d6e1", "comment": "Malware payload (Loki)", "value": "e36495a8a2614365af92d90fe3a679c0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677047, "uuid": "9a316c6d-dbc3-42ae-9018-030319dd6b6a", "comment": "Malware payload (Loki)", "value": "2d79967a595bd083ea6868ee0a500d9dbaaa3339811bf851978137a8fa15ba54", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677047, "uuid": "15f36b19-d5d5-45d0-be65-dd840e03bb7a", "comment": "Malware payload (Loki)", "value": "843618f366dc7122623ff89300ad87709e0f874f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677047, "uuid": "da4f5a56-2b8a-4899-93ba-45120d8e43c5", "comment": "Malware payload (Loki)", "value": "d042c622c7743ccf09762dc21445e5ada96c59f4a416b0558d8180c45b8cb4c7e5effeb1a8f88fcdb79050d92b71abcf", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677047, "uuid": "fa6007b2-5cfb-4ec5-81dd-17ae980aa4c9", "value": "T1A6D45B88F54035EDCC1AD7319A75CC3496227CBEA63A511E24DF3D6B7BBF69389100A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677047, "uuid": "b4ee8d68-f510-4bc4-a7c9-8122a60677a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677047, "uuid": "d1d6780c-8420-4512-8bd0-d03ec52bcb4c", "value": "12288:cBc5IPshuzggPnc5bdAwtZ9ZqDXuVEuJXmVBTWqQSYoP5Y0PP7r9r/+ppppppppV:oskUccAwtFUXu21q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677047, "uuid": "8c420fae-4347-4c74-bdb6-4d78014b8721", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677047, "uuid": "b6734742-fcdf-49cb-8bb9-bd1669626fac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677047, "uuid": "d9f488c7-ddb7-4c74-998c-eb46fe17985a", "value": "DHL s\u0105skait\u0105-fakt\u016br\u0105.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e909d81-2808-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633677775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677775, "uuid": "697fcdc0-5d6c-4f0e-9d6b-75f4d684bfdd", "comment": "Malware payload (AsyncRAT)", "value": "1a5224cc3ca9a34e6d04f0c12bd5eaa8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677775, "uuid": "a27d7711-9a2e-4db0-96b4-fc86af635b27", "comment": "Malware payload (AsyncRAT)", "value": "2e75196a6836b1fa3145e7d92f61c4ae246097c7c1b006316ec9236d5a820251", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677775, "uuid": "0e4d44c2-2476-4de0-8a8c-ecf7095fb5bc", "comment": "Malware payload (AsyncRAT)", "value": "50032af324492fa6b542d41fd83ee3e1f77db4f0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677775, "uuid": "ef2bac1b-6d59-43a0-99df-4a3702c3ef2a", "comment": "Malware payload (AsyncRAT)", "value": "7540de24987c937e5817d6c9e0b3dee7d7a18c038ae7942f6cd91ddf230384a63886733ceb39b7ab6dbdedfdd8a9fe9f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677775, "uuid": "a0f21422-9ff4-4e7d-8dee-f43cadcc1112", "value": "T1B5642209368299FBC66452F15BFFE3B6E83783041292051B9B548F3EBA345BB44151EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677775, "uuid": "cd190e0c-347b-422c-a1d9-4f2784378cc2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677775, "uuid": "9ccd318e-6266-48b9-b658-c29f4de45a41", "value": "6144:F8LxBsxx6UOzWYz8EIeoWLiJkmlHUR4Or/qnfUXkc/LOzWVciPJIpk:/xx6UOzXz8ET+Jk8aq9kqzKBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677775, "uuid": "db14d45b-754f-4973-b0f5-2ff77b55a7bd", "value": 332632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677775, "uuid": "cd6041f3-2c31-4646-854a-f8728e5e8be4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677775, "uuid": "542dfb9b-a34d-405b-a8aa-b95536d8de2b", "value": "1a5224cc3ca9a34e6d04f0c12bd5eaa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b23b3c3-27ea-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1633664831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664831, "uuid": "b57a002c-e569-4453-9130-221e3481660e", "comment": "Malware payload (DCRat)", "value": "44d35ffd7d1fe06fa3d74da8346fd4b6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664831, "uuid": "2cadd37b-6140-4b5c-b9bc-57c274781cc8", "comment": "Malware payload (DCRat)", "value": "2e7c0e72ebe65df6ed44631550c14d1dfce5c0a540ed450df984802890b25c53", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664831, "uuid": "e9d3f373-976a-4bad-bc48-ee9ab4825495", "comment": "Malware payload (DCRat)", "value": "56f08108437c3ef2a10865c7fe3b23c279c8f225", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664831, "uuid": "0b9091b8-9146-4776-9d72-1ad5ef0533ff", "comment": "Malware payload (DCRat)", "value": "c042020af965f5368ccce39333b1c27f817a84e5b939b32877cc6a15198f7a78f271228e336b09e9a48892265cdea184", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664831, "uuid": "6037007b-d922-4c7a-8171-f268f30e11cf", "value": "T140755B227E46DD13C0291637E9EF942407E8FD183B66DB9B7A9B335D64113A30D2D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664831, "uuid": "6f066552-61e0-45ef-96bd-8c9bdeba0c7f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664831, "uuid": "384bbd4d-29ba-43af-813d-cdb1bec344c9", "value": "24576:U2G/nvxW3Ww0tqc0DpU6uqIHQuzottRJ6zx/A+4G:UbA30MUAeQuoG/jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633664831, "uuid": "f97c6e49-300d-43f8-aa94-145a71fac68e", "value": 1558177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633664831, "uuid": "9f3caeda-2a8d-461b-b86d-b056081747db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664831, "uuid": "845abe4c-bcaa-4472-b53b-0bfd3daa3333", "value": "2E7C0E72EBE65DF6ED44631550C14D1DFCE5C0A540ED4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdc2d7a-2813-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633682395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682395, "uuid": "d485e00e-07b8-48b1-9e66-fba84bf77898", "comment": "Malware payload (Formbook)", "value": "b4a46fe4d41e00e081990f4ae7474566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682395, "uuid": "7102a808-d3dd-4137-a377-11fd7b2abaa9", "comment": "Malware payload (Formbook)", "value": "31126bb88883cdb4de8893da0c275cb8e1bc3889258cc7710617b5c65cd6f476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682395, "uuid": "1e118449-e146-455d-841e-c2bd14a2f83c", "comment": "Malware payload (Formbook)", "value": "556c025e5a7a7b37fa015cb3c7c7a66e1f38d0d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682395, "uuid": "30245475-0f4d-4f8f-a45c-5681b3ca44c6", "comment": "Malware payload (Formbook)", "value": "b969c89c0489fb211e6182e49f09495c3d3d77b2fba2be4cc54d657951558ffc8e2d0ab67000ce5bd2cd0f58432c7df5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682395, "uuid": "199e3be8-0fa9-49eb-a817-acdf1dc7202c", "value": "T16594F1527240C4E7E5B846718CABC5B162B1AE6DDAD2C30F33D27B6FA5F2353051B289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682395, "uuid": "0d5d7968-0b41-465f-8e30-060dfc6b3a36", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682395, "uuid": "c466d4ac-874a-4087-b29a-a6286cb24d0b", "value": "6144:68LxBad4RZMLZoDhThz3gFxwM6q8nUGtsiJUfGdfIOXv70RgtAMapMX0fXPQY:eyhTM6r5fffzXv70RgrX0foY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633682395, "uuid": "c1e71a13-b002-46a2-9e56-a2b5bdb46551", "value": 422598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633682395, "uuid": "7e44ca51-a6d7-43f4-941e-b8f88e0fa54b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682395, "uuid": "9a973a2b-be6d-424b-a375-5825983b243f", "value": "8205108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4408b9b2-2830-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633694830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694830, "uuid": "0e3e37bf-879e-4136-acac-bae421dcc494", "comment": "Malware payload (GuLoader)", "value": "c3c654a9bf2ed5c0975d6673760176b0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694830, "uuid": "cc37abe5-3228-426f-907d-6dca5e14dfed", "comment": "Malware payload (GuLoader)", "value": "32624d996fcbcc8e2a62e4b9eb1f395d9e506df213438894550c703905b714f8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694830, "uuid": "0c214eb3-ae41-407f-9f69-984ef1741b7e", "comment": "Malware payload (GuLoader)", "value": "e382a74b64b0ce65f452ac69b6c820bac79fde34", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694830, "uuid": "d99aaf9f-13b8-49bc-8356-1c6877329982", "comment": "Malware payload (GuLoader)", "value": "69bf31b24e6e8d10f69d8aaf36d7823fc62f1d25ce519072a1da674aafdb95c392a669a4cb59b7042e342b77cf82135b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694830, "uuid": "e183c8a3-505d-421d-9774-784bc1ef5d29", "value": "T19E430265E2E222A92B0CF87BCFBD7655DF23804D2A27746C107879B31C05E60F57964B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694830, "uuid": "691cd5b8-efc3-418e-b231-65f0a6d07d3c", "value": "1536:NpkmAXMbKeKL7kvufbGskxG68tKRrzhGT1:NpAXl7WLsk0/gST1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694830, "uuid": "ccb68632-5cb6-43d9-89c1-8d4bdc81fbd4", "value": 55175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694830, "uuid": "f282996f-b49e-4322-a921-3433ff4d7ba6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694830, "uuid": "db234641-44fd-4ed3-b5e9-76bf582d7d5b", "value": "FACTURA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04c6320-27fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633673188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673188, "uuid": "8e29d751-ea22-45c6-b66c-c6ff0ef48836", "comment": "Malware payload (Mirai)", "value": "9f135171e35db6d6340c9424e8e31328", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673188, "uuid": "a69e41d6-6909-425e-bca3-8ad344d7f4a7", "comment": "Malware payload (Mirai)", "value": "33021497d0081f5154d86ee9df775c89afff50b933328caf40f494fedc67b570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673188, "uuid": "e8491ae9-a0bf-4baf-a638-9b05d26efcc9", "comment": "Malware payload (Mirai)", "value": "18e331a031f350a8bfeb1f4f0f18734be2e03e86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673188, "uuid": "6f3bfe57-29ce-40ab-9da9-92a41e394c6b", "comment": "Malware payload (Mirai)", "value": "2f3e6a632432ffb8f6c9bbf12b211e0c85037c50002dd58099e9c77b80c649e6644fcc91118ea36f0d922d8c20b297f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673188, "uuid": "4944a122-3fa3-4cc4-9720-4b89bd1f1922", "value": "T11A6371197F650FF7ECAFDD374AE9174620CC641A21A87B397A34D818B20B64B05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673188, "uuid": "79fcf4d6-a724-4016-a45a-492047894759", "value": "1536:EJ7dZCypJ9KoNPROWJpLSeAwdsWWj4MLZLd6s:4ZZCypJ9BROsc4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673188, "uuid": "ef3754a4-128c-40c9-bcb5-e810059beea5", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673188, "uuid": "53a398bd-25ad-4093-b6ce-7d41ff6ff4a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673188, "uuid": "05fbe755-ba98-44d5-b64d-d30bc03e67b2", "value": "9f135171e35db6d6340c9424e8e31328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5b299e-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633692588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692588, "uuid": "01c1bdb3-be31-419e-92ec-287828d07c37", "comment": "Malware payload (AsyncRAT)", "value": "314cd7b612a00fe11e5cdf24e78cf70c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692588, "uuid": "2296a4db-1288-4167-a0a7-bbb2e31cb18a", "comment": "Malware payload (AsyncRAT)", "value": "340b29d12df56541ea4ebbeff770c9eccdd8647baa5c5c04e7908afd892883fa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692588, "uuid": "04c277e0-d7dc-4a82-b329-00c8b9929e77", "comment": "Malware payload (AsyncRAT)", "value": "d0a38a0ac7eef36a5370f5e22a4754f63a2b9854", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692588, "uuid": "88f4a0d4-4331-4f0b-8dd2-d00bdd763b03", "comment": "Malware payload (AsyncRAT)", "value": "d4be2c8064dbf42eb683f7248e2f8fe6c8a17e27dcaea58d98a1ae420abf95a7d52764b416d641f368dab8a6c3659905", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692588, "uuid": "9365e8d6-a349-41ee-8464-e7a1766a5b99", "value": "T10281D764E8391E93FF5A6212D27DFA5600E6BA8E03DB46F9740CB9C307B57216B31460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692588, "uuid": "65c5bb82-1f25-48c4-bfe3-a22076404e78", "value": "96:X3fj0jbaiADqZoXr7BudVHGE0aI9yPRIVRF9Eavbrh3G:X3f/Dz7BuXmE0aIYyx9Eavbro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692588, "uuid": "38df1081-73dc-4a0e-a799-23179f8cda51", "value": 4084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692588, "uuid": "e82f42bc-c534-4ae8-a8bb-86dee70f00a5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692588, "uuid": "14f0ebb9-235f-473f-9d68-7561bbbe3a00", "value": "Inquiry 001382021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038da105-2800-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633674106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674106, "uuid": "2396e14f-e197-4f19-8842-152a6ded6678", "comment": "Malware payload (Mirai)", "value": "38699b8d2d426074f104d6d5b5665552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674106, "uuid": "e6e0fbda-9096-4878-b19c-dffd23eaf8e9", "comment": "Malware payload (Mirai)", "value": "3499d9ab68405841994ee15f2e1c55a2e49b6da8fbfe83892ce590afd3e4f3b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674106, "uuid": "15127cf3-f1c0-4f37-ac20-bccdc2943819", "comment": "Malware payload (Mirai)", "value": "2d8ed2f29a39d1766df55a94b347a012eb79de52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674106, "uuid": "e664f2fd-3ec0-4c19-b410-0ecad985d66e", "comment": "Malware payload (Mirai)", "value": "15ee5abbd6f76f038afc643de41d85da01029b172299bb98d96bed2767edd69824fbb8f20ca60d97213a8eec19b66d21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674106, "uuid": "8ebf1d61-b790-4be5-a899-85f843b72b0a", "value": "T10DB39DDBF74B5651C86187F00BCB4BED3E2323119F6788E7AD0E2A3959791CE490A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674106, "uuid": "5898076d-e401-4a41-aa40-e52345db0317", "value": "1536:t1naGG0U5ACqYrdwpXyP/Dce48a9BGiacgB/LW+:tFaGG0NCluJyPA58a9BGiacgBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674106, "uuid": "f8cbd88e-9833-4ff1-9744-9a7e724be872", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674106, "uuid": "4a1734e3-845c-4f05-9713-271633207f00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674106, "uuid": "684c95bd-a042-4c37-a9cf-bfc3279f44c9", "value": "38699b8d2d426074f104d6d5b5665552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3023bf65-27e4-11ec-843c-42010a9c0014", "comment": "Malware payload (DBatLoader)", "timestamp": 1633662155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662155, "uuid": "e6ffc253-2d64-46ed-b63f-e2ec9b21f507", "comment": "Malware payload (DBatLoader)", "value": "9b2881f035d44765d0d5e27c542a1c62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662155, "uuid": "fb825396-7ecb-4198-a151-0f95cf8caba2", "comment": "Malware payload (DBatLoader)", "value": "352a416f0f48684c2694968f3752d11a98ba54b7e7739d2f91d1b49782954b07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662155, "uuid": "216e8aae-2dae-46dd-a766-fd05f300e5ba", "comment": "Malware payload (DBatLoader)", "value": "27c567657f1e41fe9e3d8d46bc6ae5243fa3d0bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633662155, "uuid": "40964b9e-7294-452a-a0e9-798faab418ac", "comment": "Malware payload (DBatLoader)", "value": "4b54d768b6f1c75447dc0d3a9f8b5f7148306be619a4ff06939af7cd091edf513222e47a94d9119069c8da37b7dbdf7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662155, "uuid": "42d0c4e6-ac44-4949-a38f-1a9fda50d2e2", "value": "T1D6056D7596F589B6C69326F1AC2F96980712FD40382446CB74ECF65C39327E53B3A08B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662155, "uuid": "f1dabbfb-57ac-443b-a61d-5b0ca440d583", "value": "384487a869f88e6d61619b7a3f81e432", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662155, "uuid": "ba4c362d-2f54-49b0-bfda-24f0bdb26418", "value": "12288:LJNzf5G/0os4Hn6hgF8VCJ3fj9F4in4uq8Sk:vhfos4Hn8dVU3fxF4in4t8Sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633662155, "uuid": "5961381c-90a9-4af8-88d2-3ac78d82c0cb", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633662155, "uuid": "61f00384-6733-4d44-9b7d-a0c96cf4dcf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633662155, "uuid": "190eca2e-e77a-4387-a0d4-cbe07334bb77", "value": "9b2881f035d44765d0d5e27c542a1c62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d868cd55-27f9-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633671457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671457, "uuid": "7c871429-365e-4eab-b2ab-32b5547036d8", "comment": "Malware payload (AsyncRAT)", "value": "093def59f4375153898cfe0448428d8b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671457, "uuid": "b04dfd10-3609-48b2-b23d-22a8a7cee77c", "comment": "Malware payload (AsyncRAT)", "value": "36116c1b30feddd5a1a22e7b9f9c751f1f7486532fa7f52933923c255dcc8c44", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671457, "uuid": "dfe0250b-b766-4eed-ab7c-341ce51dbf54", "comment": "Malware payload (AsyncRAT)", "value": "918257db693eaf725f44b7c14ffd0bf7157874fa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671457, "uuid": "85f5ce7d-5207-4c48-b0f6-010944b2947c", "comment": "Malware payload (AsyncRAT)", "value": "7056456add139b3fe94fd04f9dd6d2a9f15d638ceab7b4f4c959a197e29d675cb7237ac5a0fa796ccf9c78630a22cc1b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671457, "uuid": "24a5993c-c403-4be1-ae18-04031f3e57ed", "value": "T1D0849DAC726472EFC85BC476DA982C78EB60647B471FA203942795D99E0D98BCF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671457, "uuid": "ab649175-9cee-4cf1-8ac7-cb76784523a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671457, "uuid": "490e9fc1-9b7a-41e9-8173-148d92700d95", "value": "6144:EDZhVtJizWXjaKNJUszsaeNoGwHFBB9juBIx+zQIS0W2/XVISNv:EZkKNJU8spNhEnvBAQIS0V/XVISNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633671457, "uuid": "af0ef23b-1d0e-4b52-80a4-023037ee3619", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633671457, "uuid": "bf35c3a1-e97c-4c4f-8c0a-525014cc8551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671457, "uuid": "5ae3bf69-7ba1-4878-9c92-97fca83c66cc", "value": "PaymentAdvice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcff8a4-280d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633679945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679945, "uuid": "04db7c22-5b53-4a05-bd94-f834e843f156", "comment": "Malware payload (AgentTesla)", "value": "2c57bd29891a8f1d62d3f8b4d0de1d0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679945, "uuid": "68f6607c-7546-4d9f-8041-8270e0fc6e4e", "comment": "Malware payload (AgentTesla)", "value": "3856dcf8e7f4098a54379da0b07bac3bc497a5e7c14914f880f241dd6ee65464", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679945, "uuid": "d68ac97a-f784-40e7-8784-b24db4b4e74b", "comment": "Malware payload (AgentTesla)", "value": "fa1e7059e5c4a04865fe0933257c3f7745f6eda9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679945, "uuid": "d751f1fb-0165-40c2-b45a-cabe0d87698f", "comment": "Malware payload (AgentTesla)", "value": "a6b8c2d3711e1d2daf8270602ea71d6b4997166b7fb22c4104dbe3d535e2ed5b68fcfc892950d9aea5637862bc07bb46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679945, "uuid": "91364ae0-6311-43f1-8b9d-26b8b2d6a618", "value": "T1AEB4BEAC312075EEC85BC476CAA91CA4EBA0347B871F9217901765EDEA1E997CF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679945, "uuid": "aa8a4871-5c4c-406d-b254-2d3f1dee0731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679945, "uuid": "81bb206e-d723-462b-82c6-e28c43d3ee4c", "value": "12288:rFubgvj1jv5AvDdmoWDjCJ6d2+HtxVTM1+Xz08N:pubgvjyh2joa2+Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679945, "uuid": "5cd34ea2-336f-49a8-b25d-8a1ddc64a917", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679945, "uuid": "ba163791-494e-4087-a725-6fdbdeff120d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679945, "uuid": "b2004d13-845a-4136-9238-91c708524cce", "value": "Zipcodes_OPA_ODA-2020.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb905fb-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633706634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706634, "uuid": "b40c55d9-1ca6-4a62-ac88-60f0c63e31d5", "comment": "Malware payload (Metamorfo)", "value": "ce5db09da4d21dca0de481213fe6c0e3", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706634, "uuid": "4bc927ba-f1c2-4ea6-a3d9-750400313b73", "comment": "Malware payload (Metamorfo)", "value": "39c9aa7404600ecf0fabb4f1bb00dd5d093af9e0188dc9c65786d0fdb8437572", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706634, "uuid": "641bb120-2c42-4011-a2e7-e46443a16d81", "comment": "Malware payload (Metamorfo)", "value": "0ffbd10053ed38f4002398680814eab5969f3c5b", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706634, "uuid": "8618f773-8e9c-4c19-8f7e-0a4f375fc21e", "comment": "Malware payload (Metamorfo)", "value": "ce9dd009a0311a57c95796bf0775069240d6fc4bc3d9d532ad44dea1f85a6e7324fc646c54a2134010f654e80d0b66e4", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706634, "uuid": "d891b025-5231-475a-bf2e-f21f221f25d1", "value": "T14C31EB051EEA0329C3B38F7A0077A2074A36FC52AE934F9D808487DA28A1050EC35E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706634, "uuid": "a64a739b-3b84-44ef-865f-22ab740489a4", "value": "24:8+JUHRlVo5kcbA+PKjf+/P+jFz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+CjA8u1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706634, "uuid": "4b9ae4d1-330a-4038-b1d5-d4a43b94b119", "value": 1552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706634, "uuid": "2064b56f-9bf9-4936-8cd4-230adedbe67d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706634, "uuid": "90f41f96-0709-4927-8b37-30274c75ffe4", "value": "curriculum.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7576fbae-2885-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633731420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633731420, "uuid": "ead033e8-65d0-460c-bd9c-94bcba4deff4", "comment": "Malware payload", "value": "169f80655af13634bb1040ddddbb922a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633731420, "uuid": "2eba3848-c017-4614-a559-8c8077025da2", "comment": "Malware payload", "value": "3c299b147655000b066676d4e3957f5583819bdda36c7d7710151932a337d2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633731420, "uuid": "74fd20ca-6504-4a65-a3c1-0a98c1c805b5", "comment": "Malware payload", "value": "dbe1dd683aef95dc19f646cb1ba4b3e4c9c81bf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633731420, "uuid": "c260c9da-0fd0-45ed-95d7-aaf5abf23b0a", "comment": "Malware payload", "value": "997d9ef80e664569e2d84fde7d90919c4030ca208e35845f53ffdfc57eaf5f0aefaaed2ae8b9c137c0df8c940382f6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633731420, "uuid": "3948a8ce-6f59-499b-b21b-947400ebb9df", "value": "T1D2D49BA45565B3A2DA5C0FF050562AFDCA6D5D7FAA31F2CEAC49702123F36C2B131D82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633731420, "uuid": "b04c6c72-4fd5-4f85-8adc-16bd50dda7c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633731420, "uuid": "2ef0285a-700a-440b-9eb8-4d3cf7477cbc", "value": "12288:zMYv6GXWQU77ZLqAlz4Fo4KIsn1zEEwrmHUX:MdN57p4Fi75EE4mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633731420, "uuid": "38e65754-c7ed-49c7-8c13-3871c943b137", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633731420, "uuid": "fa9bd877-9b91-4af2-9bd0-39ec55ecc2f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633731420, "uuid": "6376d4d8-f8b4-4344-b3b9-5da14afee6a3", "value": "82051082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265bed9c-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633659991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659991, "uuid": "b6c57e13-4bb1-4b2b-974d-8d94c702ed90", "comment": "Malware payload (Mirai)", "value": "2d74e246ea04bbf2e706ac885708397b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659991, "uuid": "7a8e8473-d871-4c2a-bc79-5b5a17576fc8", "comment": "Malware payload (Mirai)", "value": "3d714116c12d0c4c4b516ada1a5c89af0fd802d889cf9c3e59ef8c8660263e1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659991, "uuid": "2b156622-9f27-4379-a6dd-e5b31455a6e4", "comment": "Malware payload (Mirai)", "value": "45a9a12be5e4d0bae07475449719bb257cfe0aa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659991, "uuid": "dec8cd4e-120b-4a97-82ea-423903616591", "comment": "Malware payload (Mirai)", "value": "55211e30b67050a2c8caf157f698349f875843bfaac19442f0155f4903a47291c1029a714a7c7f3e9cae0f67257446e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659991, "uuid": "00c22d4f-fd01-4366-8705-2b66daf7fd4b", "value": "T125F2B315BF614FBBDCAFDD734AA8174134CD640B21A53B3A7A34D518B24B20F59E38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659991, "uuid": "af31ae80-e6e5-46c6-8da1-15989cc5ac03", "value": "768:ud3sehWRGlzleKdeXeKeeRXApXiv45yw:ud3sCFCreUQ+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659991, "uuid": "a04240a7-3c87-4690-9dd0-13858f4e27d4", "value": 34708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659991, "uuid": "31dd6bd9-b0cb-4d15-b73b-ea3e5f702caa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659991, "uuid": "f0801503-09c7-4ea1-b5ea-d4212f8a4a5d", "value": "2d74e246ea04bbf2e706ac885708397b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d8a749-2865-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633717731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717731, "uuid": "9617ed22-530b-4ed4-9135-72f5d2995d99", "comment": "Malware payload", "value": "f51be6224cb9c4066d79a453a6616c88", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717731, "uuid": "5beb11ff-c004-4fe6-a6a8-0cbf73d718e1", "comment": "Malware payload", "value": "3eac942f7a3c37df00c1638e979ae3127efb84fa74e40c2cbc6f0ca97db49362", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717731, "uuid": "7c3ff787-1305-41f5-8baa-d63848611191", "comment": "Malware payload", "value": "cb3939fcddd436a8dd35b83ad2faeccb822d6e41", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717731, "uuid": "40b36d5f-68c3-49e4-b5f1-fb8dcad0c15b", "comment": "Malware payload", "value": "9067c3455c0d4148477d5b6ce959dca5ffb0d3533facdb81d757db66004809c0dea475f1a353cd3dbb56d8ee24b24dca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717731, "uuid": "e075067c-d725-4a2e-a39b-d9a74534f184", "value": "T112E533D59274E9BBC2D75830628340E2EF34060EE1C68267321F41E5DF6EC552BABDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717731, "uuid": "df8f1c5d-1a73-4e75-8022-2cc989aac62e", "value": "49152:zfJq5LifMOifHpzkqwJAUG+XRqQIgGx6LiyR2xRCQX0thBw3fQH4enZy8:106MffuqNR+47gGxbbxZEtHh3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633717731, "uuid": "4aeeaf0d-a497-4da6-ab17-cb0937f7c42a", "value": 3057920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633717731, "uuid": "0c62951c-2fa2-4b0a-a65d-ec33d964fc89", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717731, "uuid": "9c959404-25b9-442b-873a-c841784cedb3", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660585ef-281c-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633686297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686297, "uuid": "559a931e-3191-461c-b986-93b43c5376bf", "comment": "Malware payload (AveMariaRAT)", "value": "c1413ae6ae7b1a685e55ecc607b0563e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686297, "uuid": "12e5ce5e-696b-40fe-8324-8cb08962ad47", "comment": "Malware payload (AveMariaRAT)", "value": "4003aba6461fce00a63ba6b1aeb641e212b9762ff97142bde50595877d803351", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686297, "uuid": "df380ded-56dd-4567-a927-4c8ea31e86d1", "comment": "Malware payload (AveMariaRAT)", "value": "04582ce4a33b9ce48179d075d5dbcae30068c797", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686297, "uuid": "01463623-cf1e-471a-b0f6-2af2ba31bd1a", "comment": "Malware payload (AveMariaRAT)", "value": "08fb406151905b96b4b0d45ed86f623e65547ba8ed44a175085bf9e2419f46884d47b3525de98e3299c65b8b5584e041", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686297, "uuid": "2c425a74-dd59-44aa-8954-9927cb5153e0", "value": "T1A1D18E4D371D396F3A5AA66E2251CA5E24C39FCD66C01E0570DADF620EF6DB2C092781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686297, "uuid": "a38f738b-02e7-44fe-bafd-89936972d067", "value": "192:lhyZkaFicYnV8p6Qrhw6jGm3Erf5h/d0CTnymI+6woar:tatmV8p6gljGm3Of5h/eWnymITwoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633686297, "uuid": "d911f68e-533f-4c49-b769-de80cc84dc2d", "value": 6426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633686297, "uuid": "57638679-1130-456f-ba6d-6f6929268a6a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686297, "uuid": "e75902ba-375f-4443-9688-0d35986087d9", "value": "Shipment Document BL,INV and Packing list.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d97f663-280d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633679760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679760, "uuid": "c1ad832b-26b6-4ad1-9b3b-7213e61ff262", "comment": "Malware payload (AgentTesla)", "value": "42a8be6badc833094caab59a43eddbb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679760, "uuid": "83a9b8bf-29c1-4ad2-9027-e934c446661b", "comment": "Malware payload (AgentTesla)", "value": "408d5d3c525c41ae2b20e13cf51c64e1d99193b7d88005235c5e9199b4b78ee2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679760, "uuid": "51c2dedc-0af6-4318-9856-5206a56f1ecc", "comment": "Malware payload (AgentTesla)", "value": "6b34b2b542380475a2131c230de3620d215930cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679760, "uuid": "9e5f1084-d78e-4550-abb3-b197636a2e0c", "comment": "Malware payload (AgentTesla)", "value": "1f4784d270a32041a03d68e0b0974167107f329a4931db430a422cf11b6a390c2a448f33abb85a12302c3cf9d64e9569", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679760, "uuid": "4008e2b7-a0bf-4d60-bace-0c75e42a725d", "value": "T1BA8422AE18DDC1D8B365BF3FC43507C24C1D9EE40FD8A43D1E598626AA22B985382F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679760, "uuid": "3b767c66-972c-435b-90ff-7a580d45dd0e", "value": "6144:hJIUlpj1PMF+gqwVfv/OGMh5iQTuc6RWnBL2Ao5sAgmdAwnhKYNASiSlhrF6cgRz:hiopjxMRJOj5iQTuzgs/5XghwhKYq0hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679760, "uuid": "449fa7de-e336-44de-8883-ce095c7a9275", "value": 391529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679760, "uuid": "5ed6a89e-d853-4030-98d1-5d8f8261a61c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679760, "uuid": "0fb7aa12-a9f1-4580-b6da-47764bec05d3", "value": "SOA.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102e8947-2846-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1633704192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704192, "uuid": "4fe215b5-0d5c-4986-9f92-9423e75d5d3b", "comment": "Malware payload (SilentBuilder)", "value": "dd8c72acf6a10c82f693d43db75adf0a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704192, "uuid": "6dae07af-f0cc-4de4-aa47-7218f57865e7", "comment": "Malware payload (SilentBuilder)", "value": "40d0fe47b57dd880d1faf82185a720ed79855988ca0efe29ee99be53221dd9cb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704192, "uuid": "1e2e7e2c-0b49-4955-90b9-f7e671349e84", "comment": "Malware payload (SilentBuilder)", "value": "cbdbcf8b507968773635dac518cdc18ac19215e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704192, "uuid": "6d5d5a52-1343-4d11-bd38-3f04017dee83", "comment": "Malware payload (SilentBuilder)", "value": "726f897e68768e1662dd7a30846fcab0b22d6e10951a2f7bae27896c13b7545d63d3cb9f0e692dd62de81462023f23c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704192, "uuid": "94a676e6-7876-446c-b963-43d59cb6ce7d", "value": "T13B34E14AF575C84DFE4AC73A4CCB0B9B5376DC228BAF0646B285B5516EF0DBC290214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704192, "uuid": "a88d3cc2-fefb-45a7-a192-d2adb1a4c3d9", "value": "6144:iKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgl9HW3cZZRprq15Obr4vO8PDklovS3WHA7l:B9HVTrmkbr4vLDa3/Lvf/1euv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633704192, "uuid": "b66c05fc-ceb7-42fa-9680-26a044f73b13", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633704192, "uuid": "7694f0f6-bd8c-456a-aad8-7aef4c1bdd8e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704192, "uuid": "8aef3502-8c0b-49c0-a785-dab79164f9b3", "value": "doc-1403936672.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db25faa-2841-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633702202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702202, "uuid": "e7a11bcd-a7b5-4d27-9239-0852015b7b8c", "comment": "Malware payload (Quakbot)", "value": "b6df54aa777e37c53e23875afcf9df6f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702202, "uuid": "d751989a-53ce-4019-8579-ce5f6ab42564", "comment": "Malware payload (Quakbot)", "value": "425f6c7d6dea44ba6a838e69af3b375b8fb428c4f2c8fcce61d42f5c9d2cff29", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702202, "uuid": "9dd603f9-b8ee-4ff0-be3a-2c5365945eaf", "comment": "Malware payload (Quakbot)", "value": "6088b463e11992f6ea7b76c368bef21723842368", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702202, "uuid": "7eadc3d3-b9ac-48da-b501-2a9b47ae4fb1", "comment": "Malware payload (Quakbot)", "value": "dfa42f5870cc69f102adeeecaac2f21d68d4382a2e05e800f9a5d3553dadf9fca82ac7373a908092ef2f2bc3408e83c5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702202, "uuid": "6862af01-044f-4d18-af9d-f1dc03100aad", "value": "T1C9D38C467797C99BE58903398EE3D69B3B72FC20DE32430332457B0E5E7A6A18C16752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702202, "uuid": "35db03e6-60c7-480f-9dc0-d29d969a143e", "value": "3072:/k3hOdsylKlgxopeiBNhZFGzE+cL2kdAmc6YehWfGvtUHKGDbpmsiimati+RLHc:/k3hOdsylKlgxopeiBNhZF+E+W2kdAmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633702202, "uuid": "9fc701d0-e1d4-4187-bf60-bef591bb149b", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633702202, "uuid": "d65122f2-eaaf-45ed-95c7-94788771117f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702202, "uuid": "716e3ae6-d2f5-475d-b449-01f018ecdab4", "value": "CMPLN_1335990824.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491b47d4-2811-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633681524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633681524, "uuid": "403c8b5e-60ac-46df-b044-32eeec9373c8", "comment": "Malware payload (Neshta)", "value": "13a1c548abf86e0c908fdeca6fb315fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633681524, "uuid": "0f8234fd-c92f-4d59-b6b1-4f4d07c661c1", "comment": "Malware payload (Neshta)", "value": "42b3efec41088a0afd2cc17e038169dd572baa116aa734a427012d39917f4107", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633681524, "uuid": "8da71daf-1981-4891-93db-e0c7a5afad60", "comment": "Malware payload (Neshta)", "value": "c2988a93906cffd63704990194eb9b3ba556a209", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633681524, "uuid": "e82546c0-6e32-485b-94da-c71cb8f73c33", "comment": "Malware payload (Neshta)", "value": "1d3f0e85c1115ee42026d9c81dca6b09a25628989a4e616381891c217dc7c9f99c500ff1569871c09559618c60eb69e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633681524, "uuid": "7048735f-995a-40fb-9778-669122628cbb", "value": "T1D825E4103565CA57C56A31F0C911CAF097A0AC49EA69C2C72DF2BEEB79B5B43CE0149F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633681524, "uuid": "2cfeb2fb-6114-4c7e-81bf-bc77cca464f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633681524, "uuid": "01ef9810-cdfc-4767-8b15-6bae85251065", "value": "12288:Sj+EyyHi+EchqKT/VfEFI2Y7HuRAeTCJbUEiOsrxDyL9pD3P:O+1ai+6KT/FE22YSGwililrx+L7Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633681524, "uuid": "c714337d-8fe2-4daf-a533-775e8630c6db", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633681524, "uuid": "f0b3c57b-f4e3-45aa-ab41-f0dbcfda6a08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633681524, "uuid": "6fc897f3-dcef-4ba8-b9b1-11e3f099a7f1", "value": "13a1c548abf86e0c908fdeca6fb315fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa5ebb2-27f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633671058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671058, "uuid": "9a8eb133-57d3-473a-a9ab-9601f72b6fef", "comment": "Malware payload (Mirai)", "value": "8dd064de37795ce747a7fd3c507952ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671058, "uuid": "6984f03b-fe92-4810-abeb-e4a6df8a948c", "comment": "Malware payload (Mirai)", "value": "43b5f8867c81c06b40101bc07d8aab886563fda86abc06a02ef7d0dc8df0e5fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671058, "uuid": "0500bf6e-c10b-45ab-90b3-38c7dbbc6ade", "comment": "Malware payload (Mirai)", "value": "bc50e2d9cb4d7e08f14cda3feb35879baff76187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671058, "uuid": "4a10ca0c-bf7e-4961-88b5-d83a4d04cddc", "comment": "Malware payload (Mirai)", "value": "ea44b63363d18fb3f7481528953d2c4c3b2e84e974ff2e3dc50214fdf2282e2722314a73488888f85c5efc25ad116989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671058, "uuid": "858be5ff-4e8c-456f-9a44-38935ef09112", "value": "T12933280BA58181FCC599C17443FBB53AC876787E0639B1DA7BC8FF176D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671058, "uuid": "41f06708-c974-4385-af24-12f0b8760708", "value": "768:Dbs093tGOHn2PAe6nCAQTGWexrecbwBg4ubt7dwE1rjWb571H7qungg:M0937QAe6CAQiWexKg1xV1rs71H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633671058, "uuid": "27e4efb0-9edd-4978-94cb-6cb7f62b1361", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633671058, "uuid": "58b031cb-667d-46df-ac81-341c02a3b6e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671058, "uuid": "8e953adc-97d2-407b-a7c5-3f80bbc5490d", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc318fb-2860-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633715358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715358, "uuid": "ae90412c-26c7-41ff-80f5-9a61e11d87ba", "comment": "Malware payload (RaccoonStealer)", "value": "93bad5e8babae0cd735bed2522c531aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715358, "uuid": "19521e06-c81e-4cc8-843a-25f6f91e9feb", "comment": "Malware payload (RaccoonStealer)", "value": "43d1e6e1b9e106f6b06af78762f4c8de58b89ff64934769906230023dba3f1da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715358, "uuid": "e517d18d-62a4-4581-b2c6-703dd5762bf2", "comment": "Malware payload (RaccoonStealer)", "value": "d6fa52a94672e855526673e6b67a282f9245a37d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715358, "uuid": "55be8d87-b1cf-4a05-bf2c-41f65742c50f", "comment": "Malware payload (RaccoonStealer)", "value": "bf608b993a40f48fdbe65d7b6666a68e72329a771dec28116cc3e2fb9c11e34cb67675799e880f6ccc9fd1864bc53641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715358, "uuid": "4d837158-a63b-469a-8e50-05f1c57bd686", "value": "T17CA40110F3E1D071C2AE09304DE1DAB185BEB4A29579918B27B85BFB1E603D06B3974F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715358, "uuid": "3442434c-6fb3-40ad-a411-bf84c8dd09a4", "value": "4f9c7d0d3671483fa7b1247d926d59c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715358, "uuid": "07ab7a29-8b5b-4518-bb7f-e9dabbb2cc27", "value": "6144:oVoPtGPOPr4lkRLhTZfsahfDZEgIWIERRO1hWVAPajLTH0Vt87tC+YTaiIy:O+tGur1NZfsa9+1WIER+eA8LIVYokjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715358, "uuid": "a5d04844-017f-49e7-bc5b-8e83ecba4eba", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715358, "uuid": "14b832bf-93dc-4e2f-b482-f330b6fc3b4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715358, "uuid": "ec3f279e-0d58-4b73-8998-0354e3d803b1", "value": "SecuriteInfo.com.W32.AIDetect.malware2.24935.14015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c722d77-27e3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633661827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633661827, "uuid": "6f099ac4-76f3-407c-a50b-ebeea4d46053", "comment": "Malware payload (RedLineStealer)", "value": "13125b46122981864bd9f93b018ff04a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633661827, "uuid": "9cf00abe-caec-4268-afee-54812c7d3ec0", "comment": "Malware payload (RedLineStealer)", "value": "468dfca11764f8455465bd5bacbc136edf3ad29d89552f97784435271c97eea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633661827, "uuid": "d2753dac-f3a8-4846-a9a2-0ddf07718854", "comment": "Malware payload (RedLineStealer)", "value": "f969a87b7781573d99aecaf4c08e9238903d6e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633661827, "uuid": "2bea8e9e-8a4e-4a11-9645-ff8d6379bcf1", "comment": "Malware payload (RedLineStealer)", "value": "669a5b7ad3875ce942066a4dceb1ca9cd62abe8405d13cb1f3cf37dbb5e855ab276da678940f838e9d2d207f196c0f52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633661827, "uuid": "08590566-2403-458b-a649-7a8284167c60", "value": "T1ABD402116E97C037E13FE4784A718651CF737C625931948E2BB5A3BA1E252A0DF2E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633661827, "uuid": "7262e06e-5e8f-42dc-a6d1-e1ecf6e468a6", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633661827, "uuid": "d1f6f5e4-056e-4f27-a389-cf89efc8330a", "value": "12288:l2tOJdUPKwdstT0HS3IjD+aEyWBGdHtttRquChVW:l2tOrwdp+FyMotRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633661827, "uuid": "b965dbb4-9fa7-4a5c-b25c-386cf6d69925", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633661827, "uuid": "55976b09-0e99-4573-a2f5-cdf9bd767007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633661827, "uuid": "b044ba78-cf61-4c84-a51c-63d5e04d1d89", "value": "SecuriteInfo.com.W32.AIDetect.malware2.24481.26327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b177f0-2890-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633736167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736167, "uuid": "bc527e6e-2286-4f26-9ee9-79f82107bda1", "comment": "Malware payload", "value": "943629165fc1727b96154675f335d2d5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736167, "uuid": "4b2d9954-d953-4f17-b051-e64e91f5c78a", "comment": "Malware payload", "value": "480bd38c6284c8919dfd90e90dadf1280b5d9f057afe3985211d5e2d9d43b705", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736167, "uuid": "7326bdbc-7eb5-4ec8-8358-28c1058cd2b8", "comment": "Malware payload", "value": "7798d9f4059ea0b8713c69eded734895884783da", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736167, "uuid": "3cd27742-65e3-400c-a861-9e3dc91affbf", "comment": "Malware payload", "value": "b2cb585288de4228948fe0cbcc7bf93def0db6a86e0c3112118a8bfbb4423bb568f8078ffbdedb2807c3c928224fefdf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633736167, "uuid": "f61fce98-fea8-421f-998f-cba3aafc087e", "value": "T11D542312D9DD25D505791AFFC9A2214603887F36424DC3BBAC2B18E36DBE8B1D6D8CB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633736167, "uuid": "0dffd221-6f1f-49ae-88ac-d4662c97cd91", "value": "6144:O1JbnAi0UCkUt7BHA6DTI8KDI3pLzN9Dae1WCg1Fric42:O1JJ0UCk6ZD2GZnJ1NaoZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633736167, "uuid": "9d2faaca-011b-4d34-a725-fd49165436cd", "value": 294088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633736167, "uuid": "e50477fd-1471-4f1a-b215-41763188b034", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633736167, "uuid": "306099ab-30d9-4a6d-8dff-98c1613294e9", "value": "R409876543456789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9373af95-280b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633679072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679072, "uuid": "f18534a0-6e2b-45bc-98cc-8d098b215de5", "comment": "Malware payload", "value": "f6ce0d336eee1969de143373c2b71f29", "object_relation": "md5", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679072, "uuid": "ddc72aad-7df8-44f8-9351-e4ab928beb93", "comment": "Malware payload", "value": "49c41771e8e348b30de43d1112221c71a6497794b541fead7f3b2eab706afba3", "object_relation": "sha256", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679072, "uuid": "a6d6f151-200d-4d27-a4ec-91dfc65f1718", "comment": "Malware payload", "value": "6ce5aab58901c641fc7e8a2bec6dc3308459b820", "object_relation": "sha1", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679072, "uuid": "ae504c06-7624-4be7-bfa8-64755d1f1fff", "comment": "Malware payload", "value": "a43832e9bf1db28b5b23b944551e93ec09119f363e79c1e9f74c0e197b67921f5b7d1b63e63dc405f7b933ad33cb79b9", "object_relation": "sha3-384", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679072, "uuid": "918c2f02-6620-45e6-963d-4b8db9d7a7d3", "value": "T16D65338CAE44CDBBCF9112763C8635765AB4D75508409981FCB53F94CF8EB1C6BB608A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679072, "uuid": "9b254ac1-ae1b-46fc-a1ae-219b27208479", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679072, "uuid": "01cde67b-8457-460b-be01-2475abcd5f83", "value": "24576:Ji+D9jaWAsmt2AbKd051/x6Osdu21Xq04SoQ6h/Aijym1XLvbuhZUTdg:JpgWAsmwAbKy1/YTdu21Xq0nJo/39Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679072, "uuid": "92af625e-ab0d-45ac-a834-0f573ba6b478", "value": 1496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679072, "uuid": "106d6c85-7f97-473e-b05d-351e22c54e36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679072, "uuid": "7e7a6b78-4d0d-4a74-86b9-cb9f3bb52ff2", "value": "49c41771e8e348b30de43d1112221c71a6497794b541fead7f3b2eab706afba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb55fef-27fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633673533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673533, "uuid": "4235988e-6674-4d38-b59d-413481e1f329", "comment": "Malware payload (Formbook)", "value": "21d3a09d6c4451c6e326a5361ecb290f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673533, "uuid": "25d19948-6fe7-46db-8b41-5ea948bcbd4b", "comment": "Malware payload (Formbook)", "value": "4b8143fc8d8d9ffc0efdc2eaf1e66a15c3ff56cd7e53429083f5fb908f5b9c67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673533, "uuid": "889542ec-4ee7-419b-8215-13e6058fdfb2", "comment": "Malware payload (Formbook)", "value": "f3b89cde1e7d9ca3a1090f6f4bbdb1b50c44e144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673533, "uuid": "f8702263-e413-4e2c-a5d5-33fc72b8c153", "comment": "Malware payload (Formbook)", "value": "c49827b3a048991a60e4fad5749454084182796fd826dc22e48d6b5ad1bcb435ca99593c174b48b325cc7580adcecbb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673533, "uuid": "141c7343-7ff3-4d40-ace1-f03803152564", "value": "T1E235F5002695CB01D1B637F4D864CAF097656C55DA29C28B2DF1BEEB79B1B03CE01A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673533, "uuid": "c66ff7e5-9e89-455e-877b-ad9f2a083b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673533, "uuid": "82ec0e11-f4b2-421d-8186-a0de968f078d", "value": "12288:0a+04DyL9pD3n+0Sape4q4xAceA8svAuzlh5AKutVZPl:3c+L7D3+1+dqIAtJDuxXAptVJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673533, "uuid": "2ee0508e-2fda-4b13-b867-074b58ec170a", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673533, "uuid": "bfdabf8f-8856-4a68-a0ac-e9ee3a260843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673533, "uuid": "4b852172-98c8-4a94-9db7-1d39444ef36e", "value": "21d3a09d6c4451c6e326a5361ecb290f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9464fd4c-2802-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633675208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675208, "uuid": "e3f7f13e-b21d-4121-98a1-c899efa95100", "comment": "Malware payload (AgentTesla)", "value": "6d959cd2a4838735cd5487cb9fa39e19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675208, "uuid": "8acce19e-4a77-4bc2-bc63-e799cec7e5f6", "comment": "Malware payload (AgentTesla)", "value": "4c1a6a14ee8633cd3040e7faa98d48631edde10f6d6e0db5d1d11594922506ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675208, "uuid": "09affec8-ffd1-463b-8d99-31a0fc0dfcc5", "comment": "Malware payload (AgentTesla)", "value": "0cbd9796c8a550cb970f5e5baa440a786f8d7edd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675208, "uuid": "c4724f12-42fe-438d-8982-860a53c65e9e", "comment": "Malware payload (AgentTesla)", "value": "a43a3d46fef3e5515b4de5176c347512be5e1ad9b6aca455b182ad53024c7bc9d017b67c40609b3d91100c28f887b5a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675208, "uuid": "d70c760f-88e8-4bf2-98a4-d13880fc68db", "value": "T1E58423C44C191A8F6661D0CFA53065AD6C894F1B0FB69C63A8E7F2B2518271CF2B4DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675208, "uuid": "d2fe9827-9c23-4c4b-a20d-25d3440461d9", "value": "6144:70sMehSqtz7p0hVXdUsR3sCFlyGXrAkL2Gw2FTrHqZKtOjODLZWWbvMuSxNH4Kp6:NMeTcXis3s/GXz2GnrHdOqD9HUrpJWPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633675208, "uuid": "6fd51f1f-b0a2-47ae-946a-95ca2cd7fa6e", "value": 381166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633675208, "uuid": "b314d719-716c-41ed-9c65-53d403068b90", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675208, "uuid": "5978522f-f5c4-4fb9-904b-af456ca4616d", "value": "Invoice-BELIMPEX-210705 (49.611MT Core Board).BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1af67db-281b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633685968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685968, "uuid": "7ca58f92-79be-4850-a7e7-9521f34d6298", "comment": "Malware payload (RemcosRAT)", "value": "be0def7d91c8f70c433e5b0a9ad3b64e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685968, "uuid": "471da97d-0809-4442-a219-adc51dee8ecf", "comment": "Malware payload (RemcosRAT)", "value": "4c60bb36a8789392f4d2c953f08dac0a0056e0c493a0584481ed3fd4a946cad7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685968, "uuid": "d4d96197-5ff8-404d-a842-2626f84ae636", "comment": "Malware payload (RemcosRAT)", "value": "11e3d697fd25f1c2fc1d35aaf3af70e23dbf9e3c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685968, "uuid": "8122ef2f-879d-475c-9e46-f55713f1afc6", "comment": "Malware payload (RemcosRAT)", "value": "c6eeda1b9f52d5fa83d630b6311caf5c1745c42558be1043aec63846cd69682ac40955c587f164f3ebbafaa2c01b7f89", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685968, "uuid": "0d948764-9b50-4687-8e39-90d7b2d0f9b9", "value": "T116738CA6F6C1DC06CEA9037A49F782D66626FC551F53938F3248F75E4F70AC0892261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685968, "uuid": "cf608713-2395-47d8-8f9a-ef2fabef8873", "value": "1536:wk3hOdsylKlgxopeiBNhZFGzE+cL2kdA3tzI0ScDNzmVQyrnHRBoESK4nceC7r9S:wk3hOdsylKlgxopeiBNhZFGzE+cL2kda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633685968, "uuid": "dc408f39-24f3-4c18-a3c2-0a59e6eee155", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633685968, "uuid": "d360dd4b-9b33-4213-9f67-801d712cb347", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685968, "uuid": "c39f2530-02a8-4d3a-882d-1039b0831244", "value": "remittance advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72014f1c-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633676868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676868, "uuid": "798e9e43-2eee-4231-8ec8-c80fa0191cad", "comment": "Malware payload (SnakeKeylogger)", "value": "321adc92534ea63aae9faec6b43364ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676868, "uuid": "7a788970-c228-46a1-910c-7c8d0316b47d", "comment": "Malware payload (SnakeKeylogger)", "value": "4cdf1288e386e25b7c1fbac105c20d8d9490a4adb85d68b647f8aa744b6c24df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676868, "uuid": "5dbc27bb-863f-481c-898f-e9d77257a60e", "comment": "Malware payload (SnakeKeylogger)", "value": "3afbfbc4e63fdec4d8abc6b039624b00f35ede68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676868, "uuid": "4a171991-d679-461d-bf31-87b00142c3f7", "comment": "Malware payload (SnakeKeylogger)", "value": "9bc6d2272872681c3f67d07945f650c07abc76717dc72bf397629331b0e2ae296119025f4baa7656c0e8c4e5bc158291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676868, "uuid": "62beb70f-fff1-411a-9955-a7bfbb540bcc", "value": "T1F6C42361FBA19CF3F49D1531D8353839A3AB430492A58257C7B46EB829237C72D1BD8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676868, "uuid": "e298c9a0-dad3-4491-9c73-1ede14b5794d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676868, "uuid": "a69c01d3-8b33-422a-8f2c-31ee8fbae797", "value": "12288:nU4f7kn1QoiQY6/9NffDxGbpcYHjGlfgkiS+CCwT:nngnyoiJm91fDMbpcNlfgkcwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676868, "uuid": "4d3166df-e006-413b-89d9-2eeec33a83a7", "value": 586308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676868, "uuid": "e157d5d5-6aca-4975-84bf-2469255917c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676868, "uuid": "cb80ccf4-d1d7-4d1b-b79d-fb58fad583f6", "value": "25678023400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92b41ac-280e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633680504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680504, "uuid": "14d82c83-7989-4ae4-9952-3dc753b06ebd", "comment": "Malware payload (Formbook)", "value": "9d95cf845f980370aec4ab7a815f1803", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680504, "uuid": "ee87b70f-9547-4082-b910-03f5642ceedc", "comment": "Malware payload (Formbook)", "value": "4dc95a3bcf000bee17c567dcb6047c2e523641ad704f6e677421e817440c51f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680504, "uuid": "82794c34-fa52-4c79-954a-8a1139e53569", "comment": "Malware payload (Formbook)", "value": "a21b5d35b87a3ca35dbf313689d720c07903c9e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680504, "uuid": "392a4777-fe33-42bb-922f-e97047a769d5", "comment": "Malware payload (Formbook)", "value": "411cec79fe041fec79f6e1c9bc459f6992e32a266e9ef7169999409ff4ab70e552f704e8216aad8e493f46ca246478fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680504, "uuid": "b248accc-5e1b-40a8-a8a8-b65a3a6b253d", "value": "T1A8336B5267D45377E77E677618B180100BF3E716AA17EA2F7E8C509E0B43B41C3A2BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680504, "uuid": "fadc9de6-c530-4eb3-a304-c656eabca16a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680504, "uuid": "bfc9d330-951a-4fdd-be8d-3196f6356eb9", "value": "768:n4IHjYMT1/5wTm0TtQU7E2Cy5A+SJYqCmDITjJ0LYs1/r1hIkuUyFfAc5tuQsxYY:np1AjQVkjmUTjJ011hZuUyFfaQsxmof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680504, "uuid": "c5e5f37b-cc30-4691-8d36-b1e0c0fa5e32", "value": 51640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680504, "uuid": "dde3944c-a429-479b-8f9d-6d6cd86fc5c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680504, "uuid": "23a8030d-2904-4919-961d-46ef3e82a775", "value": "9d95cf845f980370aec4ab7a815f1803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05fe41f-280e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633680463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680463, "uuid": "e3c1cc22-bc45-4167-ba9f-ff18df07feb2", "comment": "Malware payload (AgentTesla)", "value": "82bcd625eee035a1fa8ef33c3fcca2be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680463, "uuid": "f94807dd-bd7e-4420-934c-e70d15e608c9", "comment": "Malware payload (AgentTesla)", "value": "4e7451de9580ec0fb96acccc20fbfcc867e96250dc7acfce5032417d8f3b1b82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680463, "uuid": "92ab9e81-61ab-43f0-b310-bec3ff997de8", "comment": "Malware payload (AgentTesla)", "value": "99d5c8c2ab4285dd5c5fffd627a3c547948ee8b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680463, "uuid": "a8c282c6-f6de-40f9-ba24-36137c930dfb", "comment": "Malware payload (AgentTesla)", "value": "12a899f43cf4b125b817da045142f13ea0186ac9c478e8ef6ea540ab31ffa5537592ff50b6fbc73ae41e4025c5f79b79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680463, "uuid": "f8d14ff4-2aea-4dbd-863f-4b2c2b5921fa", "value": "T1A03506002695C701D1B637F5D860CAF093656C55EA29C28B2DF1BEDB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680463, "uuid": "db8ea68a-056b-4290-8b0d-59b29432bbe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680463, "uuid": "afbe8ca3-c403-4add-a001-85a7ca090cd3", "value": "12288:0zwA0fDyL9pD3n+0SN8AXL0zVmc9zvF2A8k+RL4:5x+L7D3+1N8wL0R1ldX8k88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680463, "uuid": "0fc0acae-6ae9-49d9-a8ce-d144bf50b025", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680463, "uuid": "c90ada5e-732c-42a4-950e-149979326396", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680463, "uuid": "0f629318-8c78-439f-91d2-12aba3f7a89e", "value": "CONFIRM_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efd4bd5-27e1-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633660811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660811, "uuid": "4b970f59-45f2-44ce-85d5-578a6e30e9fd", "comment": "Malware payload (OskiStealer)", "value": "f68ff9908921c8063858020d8c4f5f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660811, "uuid": "5b097b2b-347b-45e8-ad5b-1e7654a0132a", "comment": "Malware payload (OskiStealer)", "value": "4fdd785a78c5dfcecf40931ff10d7d1a9dfe36a0dc85e13e72ab0ef75230ee52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660811, "uuid": "d4aa53db-a65c-4b11-b7c8-b9af504e1efd", "comment": "Malware payload (OskiStealer)", "value": "5056a2ff7bad3ff23b6fa027202a833a83278c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660811, "uuid": "80d5295e-e250-4acd-b20d-609a337a7bd9", "comment": "Malware payload (OskiStealer)", "value": "3c027ecd1ea4bd7f1e10b5d02b6b3de599123a7b854606c96843b7c86270a22bfca5d6d822f82bc798bf771a484cc5c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660811, "uuid": "2983aabf-71cf-4f65-92ad-79a6e7ed240d", "value": "T17D64E1A2F2C09CEEE57006715879EE7026ABBE4D8078640E919DB63D17731D710ABD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660811, "uuid": "eea34545-f0ea-44dd-8af0-50ab8e673b82", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660811, "uuid": "2ef7c090-0e55-4b4c-9ccc-2dbbe0cd86a3", "value": "6144:n8LxBoEGD0GAM6IyvseLMEL0IQmEOTn9rugXfx6iU8pUchcPh:5hzCseAE0yugvxnU8uJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633660811, "uuid": "fb229b1a-5bb6-4f74-994e-640e7d24c9b0", "value": 323725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633660811, "uuid": "9b1c6a65-cccb-4032-a82e-477fc05f5eb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660811, "uuid": "6e58f3e8-12c6-4038-bbc8-bd942638a7b8", "value": "Trf 862930873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69757b7b-27d1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633654091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654091, "uuid": "2ac08212-7e2b-4b58-ae48-17b4d3af7d63", "comment": "Malware payload (RedLineStealer)", "value": "ac15a469e23ea7318db185a369386cd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654091, "uuid": "0349727c-d174-4cd3-9492-49eee95e73d8", "comment": "Malware payload (RedLineStealer)", "value": "508b437b04c95d5249d9497dd2219c47cd9db9b11be6ccc2ec73749fc9620850", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654091, "uuid": "3be6dcdb-04b4-4a34-9479-feff329327ac", "comment": "Malware payload (RedLineStealer)", "value": "418703b772bdb4577ba4a642afe7aa319c8066fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633654091, "uuid": "ccd3cf18-b2b2-4e4a-b353-6faeb5f78b5e", "comment": "Malware payload (RedLineStealer)", "value": "aa4d8b4d14b2ac6da323eb32aa6c4b81ebda6d28fa8a9b124d59d7a0467380e4e59ed31ecd178aec8c498683c5bb3b33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654091, "uuid": "804c133f-a22b-49bb-9618-39a4fe91b050", "value": "T1BFD59D052AEE8711FDFB1F78A97685A507673C80AC3CE16F6165325E0A30F43DAB1726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654091, "uuid": "4462741d-61c5-4f2e-bcb9-77207e13a869", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654091, "uuid": "51f1995e-6880-4ddd-b01f-c551bcecd688", "value": "24576:b/CcmiBw9HSCKtyFMvnascY9nYH0TjrDBTVLh5PzqJR+wI7ZmocCc7Kjk:GkBw9c/vascY9ng0THDBJL/1z297Kjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633654091, "uuid": "13c141bc-3e1f-42a9-a153-5d5edb30a500", "value": 2948608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633654091, "uuid": "5a9255a0-dfcd-415b-85f3-315042f6bd69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633654091, "uuid": "ccd15740-5681-43d7-a728-d6892e4ca4f3", "value": "ac15a469e23ea7318db185a369386cd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c62dec7-2836-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633697502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697502, "uuid": "6404de3a-c930-423d-a0eb-8c9ecf2a25d1", "comment": "Malware payload", "value": "9dc523e14863a8c0d0f6b00d7a90085e", "object_relation": "md5", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697502, "uuid": "b21565b1-0e80-4cf1-bc19-62844f1be4e5", "comment": "Malware payload", "value": "50b0a3a83707a39f0402c115a0c2a92233d10405b1977ebea899f0b038ac85e7", "object_relation": "sha256", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697502, "uuid": "2eb14881-4b2b-42a2-9f75-c3c342eecdac", "comment": "Malware payload", "value": "7997389f496342680ef58ab011cd357f4c1b67e3", "object_relation": "sha1", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697502, "uuid": "d89e00ae-de71-4eae-83b6-43171168a29a", "comment": "Malware payload", "value": "ff3983b121b70b9ed990a88d32f8111f872c736aed28d499e08670da21fc8f7ae238508398efb9895d83096a0e838182", "object_relation": "sha3-384", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697502, "uuid": "54e11ee4-b82f-4681-bbe9-40ec115b221b", "value": "T16DE2C7437662E952D7A8D7528F987E649A7E34C992332D4CD0B42AC02C70FC3A68537F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697502, "uuid": "9c17a880-55d4-432f-ad56-269775a6fb5a", "value": "48:oWHTDo8fE5ws1slU9WP4NpQfMpsTs9OuPA5CVqiX:oSTDo8fE5wKOU9WP4N6Mp4+OuPAYVqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697502, "uuid": "4715880d-b482-446e-a2bb-62a986bfccee", "value": 32269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697502, "uuid": "e6e321ee-10a1-4d36-9dce-ac536bf72f5d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697502, "uuid": "95f5c389-cb93-4c7f-914d-7a15ce85a4d7", "value": "50b0a3a83707a39f0402c115a0c2a92233d10405b1977ebea899f0b038ac85e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1145d4-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633673828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673828, "uuid": "2fac5bc1-6583-47aa-bada-df43083107ca", "comment": "Malware payload (Gafgyt)", "value": "a46f5ba91d39cb3654974cc4b3ee139d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673828, "uuid": "f0ca8ff0-2fe7-4b97-a6f8-7730856dd1b6", "comment": "Malware payload (Gafgyt)", "value": "50bc02393dd725972f897b5b44985699eccc440147c2df98e10e0a1555e82456", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673828, "uuid": "3e4c47ff-ff89-4ea2-9d64-15e93b732ebc", "comment": "Malware payload (Gafgyt)", "value": "40950d920c079db2c294d2eab970745f03348d92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673828, "uuid": "491106bb-56cf-4ec5-bb42-8186d8bad35c", "comment": "Malware payload (Gafgyt)", "value": "53bf9d61bf1008947e853d49a83d6ccf4bd0c4c4a2b01ebd8c415e882977ea3bea87dfc1bac241857c8ba6ac2aa6616d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673828, "uuid": "47b155b6-826f-4667-a51d-91214e717495", "value": "T170934B06FC455713C1C327B6F7CF43493A3667B55BEB330266346EB02BC67992A26A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673828, "uuid": "80f1d0d1-7bbd-4201-bddf-b9a8ce17c384", "value": "1536:qwLtgzHyDf+QUWmUpliql6OIQ5hcpX3hdhkmzjvVqQEyi/lJsKPe:OHcmhqz5hcpX3hbjvVqQEyi9JsKPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673828, "uuid": "7adda8f3-f497-413e-880f-fad2e823c050", "value": 96233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673828, "uuid": "00555d22-a0a8-4b7d-a12a-f6630f7ae0d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673828, "uuid": "587aa59a-7a96-431e-98af-8d0ed90560ae", "value": "a46f5ba91d39cb3654974cc4b3ee139d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ed2880-2814-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633682913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682913, "uuid": "46ccb41d-5182-4d5e-bcba-c4ee9e6d1ee5", "comment": "Malware payload", "value": "4e7e9c41d4211d7181c725aef7833119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682913, "uuid": "61e58aa8-2c98-4a7f-aeb0-6d72096bf7e0", "comment": "Malware payload", "value": "50d451160beef08b9e7ec0acdaba5dd3cadf405469a8a67ab5070c848efe65f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682913, "uuid": "7575d072-2fca-4c76-b1dd-b4f18012d967", "comment": "Malware payload", "value": "c1ffa37d0cddc899ebb432e8beba588be064d21d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682913, "uuid": "a5f17324-03d8-4e47-875d-e43882ab087b", "comment": "Malware payload", "value": "7007245fd5151d70c3c4f478e4c4a28136ecdd6137ce507538d7f81e1bade5861935dd6ed61cd1646171c302b40a9502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682913, "uuid": "9a0b87b2-f5dc-43b9-a19e-e9ba1317c956", "value": "T1BE25D1927B5B8A71E68A25351EBAD3A49573FC280F0341C7326037AD1D35ED2AE3531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682913, "uuid": "70cd6c66-66c3-47fe-90d3-51ab66c84d4f", "value": "96ca6acf62b8206bb09d9637ae09f215", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682913, "uuid": "6342de99-ec9b-4af9-b4a5-4a7db75b4e36", "value": "24576:jzMTUiaVv4xyJjzCH0vKRTk6HuXmrmQpoU5QdgI:cNaVv44JBvKRTLwm7oUSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633682913, "uuid": "c9321b10-f5c4-4c52-b9e8-53fdf083261d", "value": 995705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633682913, "uuid": "12a06bfa-0a74-4b5d-a969-339d318748a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682913, "uuid": "ba1f5a37-f1a8-49db-b5bb-f4ecff1d5270", "value": "Inquiry lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c32dbe-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633692602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692602, "uuid": "70289cb5-276b-4480-8a45-d9b75c35d81c", "comment": "Malware payload (AgentTesla)", "value": "9e0d1e60cac258b2b76f154915f01023", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692602, "uuid": "5109c1e6-393b-4e28-a0ef-68b9bacd8790", "comment": "Malware payload (AgentTesla)", "value": "5364080f7fe6c21ac0ff2a59b848baa187b2c9946c853db4417f431e4d8f05dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692602, "uuid": "53208314-3a0b-4e88-8a3e-77561722ef3a", "comment": "Malware payload (AgentTesla)", "value": "276ea730d2a21a1fa18f4107e76afd602f838a1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692602, "uuid": "03d4721b-b88c-4bd6-b797-8ea0a4d3a05d", "comment": "Malware payload (AgentTesla)", "value": "3056a340e845996581ac0799c6af42bd24f4c2628d446d2141e24c819ef831ab25d449da16da918ed345f496b84bc830", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692602, "uuid": "ce5bf49c-1e6e-47c1-86f9-fd1c2b285523", "value": "T145E4DF318804B92FCEEF0F8771152FD37C79223BDE545119B08F1AB96A68238597AF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692602, "uuid": "87b327dc-a5d8-4350-8088-73c893972f74", "value": "12288:uwKL2BZAW7ksXQPyTceLwbdftOOysTAJylw9E1XTUFsjwocNT/k2WG1CIYPaAV:xKL2zRQoc8YVkOyssJyy0QFsjPYzWzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692602, "uuid": "07b6d61f-27d4-4ce1-a834-f346382cfd47", "value": 704371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692602, "uuid": "6ffa91d5-d4ec-4b61-929d-25054fbc4277", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692602, "uuid": "50315ebe-4245-40cb-ac58-8824f35ace62", "value": "OUR ORDER USD34.9089.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02dddcd-2819-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633685160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685160, "uuid": "ae76942a-dd2f-4124-89f5-e67833e9c72a", "comment": "Malware payload (AgentTesla)", "value": "4294207de61a99bc0f2225c4d65603cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685160, "uuid": "a3965be0-990d-4cb2-bd77-77c05d61c2f2", "comment": "Malware payload (AgentTesla)", "value": "540eb66424507abf90623424938e3e8bf6d0674084c0a023949c72c31fafdab6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685160, "uuid": "5907cd9d-5133-48ff-b26f-1450b64efd69", "comment": "Malware payload (AgentTesla)", "value": "6456c1009561d85bf61d1ef5a928d26126a8323d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685160, "uuid": "3dde69b5-c70c-4f5d-bdda-1b2961666620", "comment": "Malware payload (AgentTesla)", "value": "c553339af7c8b5fab836df4f1b0732bf31b986324cb5c7d9a2ce9db20c533146fe0339792461408bc2be52d994a20b92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685160, "uuid": "f836bffa-31dc-4056-bb4e-0e7f4468b512", "value": "T156B4F1242FE89325F5F64F7429B006A09BBE781D8D3FD31D5E8418EA2EA37159310B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685160, "uuid": "7aeb694e-08da-4dc0-a346-a4d1bc8d71e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685160, "uuid": "5c8016f7-7f0d-4f05-a212-8a53682d76f2", "value": "12288:W/DyL9pD3m65O6Xk3O+Wut5+IKTivh7jJmHS8+YO:I+L7DWMjFO5+BTyBmHS5YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633685160, "uuid": "f30b78ad-05c1-47b6-b0ca-c09f09c93275", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633685160, "uuid": "be6e7364-d50a-4443-8bef-e3a72f83f04c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685160, "uuid": "f9e505ed-3e0d-470e-8e97-98ffd5e11164", "value": "INV PL M20211007437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f869a7c2-2854-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633710595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710595, "uuid": "37463f05-7b70-4349-94a3-bb5eb79e4cd0", "comment": "Malware payload (AgentTesla)", "value": "4a7d0a3d39178511844b811d1f181eae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710595, "uuid": "7a4c273d-85b6-4d95-98a1-60df0c5331d7", "comment": "Malware payload (AgentTesla)", "value": "5518f7bfdc3e37c30964a7ff15b31879768bdfda368560a5402b60a85b740801", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710595, "uuid": "a36c11ba-0206-4a75-9b45-d2d3a03ce3f2", "comment": "Malware payload (AgentTesla)", "value": "825da90692f68a6f31052b29ba3e50593c66547e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710595, "uuid": "e540646e-6705-4a3c-85b1-3cbd29a92c91", "comment": "Malware payload (AgentTesla)", "value": "4a872d30d1022db1a46f43e16eb54e59049786fe6ab067ca4e759cb312679e2e87ca1340fd7dcfc92a788c53fc637b21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710595, "uuid": "4bad551f-3167-4242-9769-bc06b94ee462", "value": "T1EBA4F03D36A7C900EE7547B6ECDD905007BCE852306ACB3A6A8D612D68227F94DD46CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710595, "uuid": "9fa7382b-5adc-4beb-b41a-507fe888ff99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710595, "uuid": "0243f893-12fc-4e3b-8534-a34e46c050b7", "value": "12288:K2kVo5qoyghT4NASMCaHg7uUh5KIDrOdgaHNNbmZ:K2kV+Ugt4uZEnh5KIDrKgatN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633710595, "uuid": "e9b0d9fc-eebd-4e85-9c02-dd20d168f015", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633710595, "uuid": "baeaac32-65e1-48ba-b41e-72e0fa7cca84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710595, "uuid": "91a30330-d8bf-4c1d-a6d5-6830f720989b", "value": "UIEWD03242532223245.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1489c6-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633676810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676810, "uuid": "2dabd9af-e41e-41ff-8fbe-225193030b8e", "comment": "Malware payload (AveMariaRAT)", "value": "bd1b61722ae264d4f00a0fb412d12bc0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676810, "uuid": "a29ca127-975a-4a36-b681-f3191cd5e7ab", "comment": "Malware payload (AveMariaRAT)", "value": "58a5be83221386f1bae87b2a785b08c758591bcbc235b21132240feece1972bc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676810, "uuid": "81713f06-3f2d-4d44-94f6-cb1d7c25c663", "comment": "Malware payload (AveMariaRAT)", "value": "4188fa6acae6960268d2bc0512aea9dc08ba7486", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676810, "uuid": "59652e9e-274c-4f94-ab05-3bc23725e023", "comment": "Malware payload (AveMariaRAT)", "value": "19595519f53d28b02778fd77233ce33ace005e8b2b1241a89ee25907e7f088ca2b0531cb37ac538628e11c7a0c42aecf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676810, "uuid": "599373e1-29ab-4792-b518-008f67ab8e93", "value": "T168C2DAF22798C2EDCC6502725CBEDDF201B95D2C5EE5880AA6DD394BE57334A20DD90A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676810, "uuid": "8073c824-286e-41cf-a59b-59ce989c6966", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676810, "uuid": "27d07b1a-4fcb-4377-b1da-092320411c00", "value": "384:V02/7Wo+fbX0JNUAZFhtI+9cuu/dVg1rz6c:VjebkfZ/y+9cgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676810, "uuid": "2e3b1ab4-7096-430a-81fa-0ebf6ab1ca13", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676810, "uuid": "6ce337be-f8fa-42b2-846d-7c8854621dad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676810, "uuid": "74aa3c75-df88-46f4-9122-cfbf5a3829c0", "value": "SecuriteInfo.com.PWS-FCZZBD1B61722AE2.15652.15596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5bac0d-281b-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633686016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686016, "uuid": "fb2a5b7b-28b8-4f87-af7d-14be96c8f127", "comment": "Malware payload (NetWire)", "value": "6a4e8dbad4bd58452d15a706ff60bea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686016, "uuid": "18679241-5a87-4814-8c6a-35e463754a71", "comment": "Malware payload (NetWire)", "value": "58afc43111bd508783f2010caef50731ac54f6e7841cc6715ac4b83a8ab5715f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686016, "uuid": "43f5ae11-0fc5-48cf-b8fc-d8c21b0eaffb", "comment": "Malware payload (NetWire)", "value": "1d4ac836ecb7df7fac04e77562b5b9d4b30df697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686016, "uuid": "0149dda2-e640-45ba-9dd8-778e302c631b", "comment": "Malware payload (NetWire)", "value": "4afce96c517d4a489c689b310aae0716c5a664755f67debafc27b74bd964d34e0b901d998b0d3ca596f9229c7f98fd03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686016, "uuid": "460c5c92-192a-4eab-8f2f-27263c27d9ce", "value": "T1E2342948F68771FEED4B8831959AFE2F5B607812C236CF03DE170989DE1EC568E146A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686016, "uuid": "e8a77dfd-1ded-4bd1-b81e-00d0fb943466", "value": "6144:QVOTcK+NrRioGHlz8rz0i/MhzQqqDvFfLc9tPEt2lyOYVuBx:0K+Nr8MrYi/MDqRTcvst2lyOYVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633686016, "uuid": "356f44a5-28f6-41fd-bcb9-d9408b5f641e", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633686016, "uuid": "d28bbfd7-5027-47c5-907c-e84aa83b03c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686016, "uuid": "9897cf68-0702-4718-a2a5-f39a42663c99", "value": "SMS LOGS.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870e892a-2841-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633702244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702244, "uuid": "ca6c95de-aedf-4f92-a82d-fbbb96619834", "comment": "Malware payload (NanoCore)", "value": "c87a4d4a3d7055d3fb628e9f5034200a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702244, "uuid": "45353deb-926f-4b3b-a127-cf1744815190", "comment": "Malware payload (NanoCore)", "value": "5925ea17cc4efd2b4f52887a3d669aa83c52e3aa14df43c7f275d2d9d33ad5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702244, "uuid": "d916dc3a-6412-44fc-8ea7-98a6e6baf7a1", "comment": "Malware payload (NanoCore)", "value": "fcaea92aebebd7ed940e1fab475a99d4bb08c45b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702244, "uuid": "64c5c157-c105-46ea-91f3-4020dcc9f2ec", "comment": "Malware payload (NanoCore)", "value": "231c1c4d0c02e4b337c03dde8dfe9f808f6d2843754f31b28c206ac737eafd0280b1b062191322e3577e01bf3da976c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702244, "uuid": "f325391f-afcc-43f0-9691-84522b892ac2", "value": "T1F56412D277D444EBE2931B318DB1F7D8B6B78305052AD50307712FB22A70D9EA629593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702244, "uuid": "d00eb368-c227-41a6-be79-397df47c8924", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702244, "uuid": "d5ce230a-3e8f-4031-9784-bedca9e6c7ec", "value": "6144:F8LxBsS5zy6UrHrQP6HLqirYp601fyKmbiRbk/tba7HoMmtPr1lKHpI5ebz:/ScvrcCHCp1KKmORbcZfrzKHrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633702244, "uuid": "fe941e35-8b9d-4a5f-8b3d-e81ffb8d2ccd", "value": 315909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633702244, "uuid": "1bf4f035-3b68-47f1-9b54-5706cfbf19d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702244, "uuid": "03aac116-eb44-4abf-bcbb-b37d19777eb4", "value": "Eral_order_8499248_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3ed487-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633667917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667917, "uuid": "d101e1e5-eaa4-4806-bf7a-84bd963ed593", "comment": "Malware payload", "value": "96e74ac8392e3a599cb3643849d309e7", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667917, "uuid": "0dc1148a-cf23-4f6c-b32a-af9ee4bbe70c", "comment": "Malware payload", "value": "5a0a5d5dba05830ff1f30cecd4420ec2c2a71bc2e7b5a20becd9a783670557d6", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667917, "uuid": "466e4253-d579-4734-91ae-63d2b7c06e6e", "comment": "Malware payload", "value": "8cb1e89f58cc5a9d9ea25fc7e34724ecc76452cd", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667917, "uuid": "cbbcd540-9c1c-400f-b112-1fff4b991f16", "comment": "Malware payload", "value": "8c826a64b60ada9e4dcc24f09bb89c29eeeaf1b7cdcad7d8959a94f881ef26fbf4b52c483fabd18bb42d09d0ea37473b", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667917, "uuid": "16334e70-7468-4819-87b0-991e59e21cb7", "value": "T1DB84126DCF8EC05BC38B67365289B992898660C39049EF772E68578C5582CC053AFDDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667917, "uuid": "b4a8bea9-3e36-46f3-b89d-5999e394ae2c", "value": "12288:T9c7CjkNNTPQ7Ass6HANW5w9V8QDa2nB2XZKW3:Ai4FPQ7Vs6gNW68QDa2ncZKW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667917, "uuid": "ce90bd63-2ffe-4427-90b8-b14f5deb8fd5", "value": 401335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667917, "uuid": "ee617d64-1147-45f4-ae14-e6c5df6f765f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667917, "uuid": "443e9e1f-2630-4ad1-9a75-6f1a7ec2eaf2", "value": "HSBC payment Advise.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4759f983-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633667777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667777, "uuid": "35eac121-7923-4eb4-a14d-54068888ca4a", "comment": "Malware payload (SnakeKeylogger)", "value": "7a9b009197639c07d754905388500d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667777, "uuid": "89014342-1be6-413f-bdd0-c71292f04be9", "comment": "Malware payload (SnakeKeylogger)", "value": "5a7069de34bc25503f1697122ece6e7c4ed8126f91bf54e14ff71376238e111e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667777, "uuid": "986ac497-756e-4a17-aad2-98a0b6c4a59b", "comment": "Malware payload (SnakeKeylogger)", "value": "12593ea2cdc0d7780829f02ee6084aade9c2fc1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667777, "uuid": "b025908b-43be-472a-9fc0-8e6d61fbc2cb", "comment": "Malware payload (SnakeKeylogger)", "value": "6ed2b59f8cc5483a5d30fcb7b373b28964848274b7f49d79575fe954a9c235130199260bbf2221f12a4214c9fb10908e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667777, "uuid": "4a19f754-d2dc-4ec2-affc-eb1d0ee07efc", "value": "T1E9C3181C3BF88804E6FE8A7316B1A121C7B6F8520966CE1D57D1F51A2A7CB408D16FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667777, "uuid": "f89a83b8-59aa-47f7-8b8f-2bcf38b9a119", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667777, "uuid": "95c7655d-d788-4c54-8d38-de810152ee7b", "value": "1536:fdUEf1RoaJFmZJCUUtBZ1uY6r8b/6g24+KpiOWBgAn0Kcl:fdUEXzJAZJFUtBHuY6r8bC18wBgAnbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667777, "uuid": "daba43d7-8673-447b-8161-bec2f734b35d", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667777, "uuid": "5cdd2f36-a0fe-4726-9743-a57a8f45e60a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667777, "uuid": "7d5aacba-48e2-4e0c-9e72-1dec75cb1a19", "value": "7a9b009197639c07d754905388500d28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee8679e-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633667790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667790, "uuid": "c81f902f-a2b3-4d9e-8a51-5fb8576bdc4e", "comment": "Malware payload (Metamorfo)", "value": "a33eac573d7e3e71a2b6729769bd117f", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667790, "uuid": "710859f5-16c6-4c50-9b96-79549133905f", "comment": "Malware payload (Metamorfo)", "value": "5ae1647516e23de4444c2bc2b04e1357f02c572421ecfefc82f3c2222c3ee5b4", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667790, "uuid": "7ff06dc6-542d-4a93-bbf4-0e1fc02185e1", "comment": "Malware payload (Metamorfo)", "value": "24a6a3dde4541f00cddd5e08cd9c0f7859ffadab", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667790, "uuid": "bd27b526-a236-4787-9e90-2e6904a3cd18", "comment": "Malware payload (Metamorfo)", "value": "7c291e091511822479cd348fa7d65f1e4cb1d7b4a7ea6ad8d49d01973906ef16b7cae28ae47ddc61168a3d99bc3b7afd", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667790, "uuid": "fa8a19cc-b6b2-41d9-a1b0-0feb0fcccf6d", "value": "T142447D06B3D5437AE4DB07321B8B93628A72EC788673412B1249790E3EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667790, "uuid": "d0b5fa6b-6645-4248-acf1-23b23c3a8945", "value": "3072:GmB4Ay903DaYGAywgz88ereWn/7w05g0+McB3RUN46ILJ9+ZB5yOanW5:GmF3DaYGAf8er1nzTjrh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667790, "uuid": "e6661730-2854-464f-9bed-e8a939bbfeb4", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667790, "uuid": "2b75360d-ef10-4d81-b1a0-5061d0e40405", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667790, "uuid": "fe749b77-b687-481e-8454-435d036c3c75", "value": "a33eac573d7e3e71a2b6729769bd117f.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c628850-286e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633721607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633721607, "uuid": "afd7f046-d9a9-4117-9eae-e549fab102a4", "comment": "Malware payload", "value": "4327ed1671deb9f1b0169cf10680840a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633721607, "uuid": "1c2eee69-cc12-4ef7-8351-a9d22b32bbce", "comment": "Malware payload", "value": "5b0ef982ada2cab733e409b050c472ea4c8eb3c6950633828c1570747e81ead8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633721607, "uuid": "2b0a5290-1488-4d2e-91ad-57aa2a51509d", "comment": "Malware payload", "value": "b4015aa7d5579097378d0477903511397b04f007", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633721607, "uuid": "9a46999c-cf63-41f3-a595-717433f604e6", "comment": "Malware payload", "value": "5e66559788ab421ab2cd2fa07408225da577f563a21cbbcd468177feb0b02d457daed0cc2bb3230c6e13bd5ebb1b5412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633721607, "uuid": "018339c4-3c66-4389-9bf9-a761fd226de5", "value": "T143249D10B6C1C9F2D76545335CE2C6A4D52DBC6CEF206AF73B849AEE9E3D2D29512302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633721607, "uuid": "e9a6d450-ee3f-4378-955d-679ec09101ff", "value": "ca5041463b2dd933d009ca1aebe1423c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633721607, "uuid": "341fe59a-0fdd-447e-9967-79a4a4c70d66", "value": "3072:G0utmxeDwGvoJ5gVrcPI1Ze83rRe5RHZFS4sz:G0EmxeD5JcPI1tRe5R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633721607, "uuid": "bdfc68c2-fc28-455c-b9ba-b2b139eda56c", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633721607, "uuid": "074dbcb5-0c5d-4b9d-a81c-eda1573aa9b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633721607, "uuid": "cfba88d2-7c6c-471e-8ea5-429c4af869e9", "value": "4327ed1671deb9f1b0169cf10680840a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cf9abb-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (ModiLoader)", "timestamp": 1633707042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707042, "uuid": "e7b9f5c0-e11c-483e-9591-94f098753b3a", "comment": "Malware payload (ModiLoader)", "value": "a003b564bd23880f99a29006e780a89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707042, "uuid": "ccbfab82-e581-4739-b44e-936aa4ce7769", "comment": "Malware payload (ModiLoader)", "value": "5bc09c3c2a751169a32cf97a62765f127bce2d0eadce3481a6a831b6fdcc044e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707042, "uuid": "d7587338-f2a7-4e9d-b1c2-7b0b4332ce11", "comment": "Malware payload (ModiLoader)", "value": "8465374554a0c6c02f7914c1278afd79e96ed8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707042, "uuid": "63082ee5-e5f4-44ec-9dad-8b8fabc60e0f", "comment": "Malware payload (ModiLoader)", "value": "99a5b8e5d5b1bd57bec74fec078c9e527ae018d6d9340c7038ca8d5a853261241fae14372f322924ed6a8d4435d28335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707042, "uuid": "ed1b155c-6365-48a7-b9d4-f5fd534913fe", "value": "T127456CE962527DBEC3234A380D3F66143D2AE978267460953BDD0C5C6F3675236EC28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707042, "uuid": "1b0523a3-311f-4b52-a7d9-8f15712d6f4a", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707042, "uuid": "103af451-53ce-475d-90e2-c6adcb5924b4", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6hqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXAJmPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633707042, "uuid": "740ef715-4855-416e-aa2d-c0d25d0004bf", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633707042, "uuid": "53d87109-f1da-4cc4-8cd2-dca668450d68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707042, "uuid": "27b01dad-26f7-4170-af50-81ab6a4f3c38", "value": "a003b564bd23880f99a29006e780a89b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4eb52c-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633692586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692586, "uuid": "c4433240-66e0-44f5-a51b-dd638f225c21", "comment": "Malware payload (RemcosRAT)", "value": "c93ab7ccc7dc32040285727f6a9dccaf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692586, "uuid": "b6127ec3-552f-4984-9d84-9b7e341a7002", "comment": "Malware payload (RemcosRAT)", "value": "5bc91213119f28b798b9a6ebc11d35100b46f5cd572627927c723e5c554fffaf", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692586, "uuid": "5fc8ceb4-5d57-4f3e-8599-331c073e7507", "comment": "Malware payload (RemcosRAT)", "value": "538e92569202a21f9dbf612798aa8925b8d30e83", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692586, "uuid": "ad9095ab-4e13-4003-a41b-cc50265b84c1", "comment": "Malware payload (RemcosRAT)", "value": "f2d7e09765624d4eddfdf17bb8379bf09deef5a5cc4935e8a5eac025bc6fba6b826a0c987142db769052610b19d13188", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692586, "uuid": "bf44a476-fbd7-4068-9961-90ae82da84df", "value": "T167456CD672923C7FC32305781D775A68B92ABD30743D6999779D09098F3AE1033ED28A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692586, "uuid": "bfd58bcb-2cf4-4bee-bb75-f6c3cf5cc218", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692586, "uuid": "343cf14b-27cd-4dc7-8861-ba3a638e0fca", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6Iqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXAkmPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692586, "uuid": "cd98790a-b720-46c6-8dd9-9ee177667270", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692586, "uuid": "a2d8d424-fd08-4682-b427-b70d8cc192aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692586, "uuid": "77b2b472-16c7-4a36-8adb-4529d087f724", "value": "DHL_1012617429350,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222a363c-2813-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633682318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682318, "uuid": "b85eda0a-f5aa-4eba-95cb-2776aeb97a51", "comment": "Malware payload (GuLoader)", "value": "cbde303e8189a2af9b25158dc9474375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682318, "uuid": "54811bea-b486-4c12-8e97-385167e50ed2", "comment": "Malware payload (GuLoader)", "value": "5beaf925ba1c27967e8d8235e53c98cf22a8ad6749cb42e7e7e2222f9e9e40d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682318, "uuid": "6b1a6603-6d28-47b4-b250-a5343dc5a581", "comment": "Malware payload (GuLoader)", "value": "4fdf112f93937a2f9bde60b13faccf5e4e688f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682318, "uuid": "d5bda92e-1a47-4e94-ac8f-eec5310da3a9", "comment": "Malware payload (GuLoader)", "value": "2a2c806dc2e949b470e4996e3218ab0045024f044bfeb5931eb607fd8076aa3b66d81b883d70d95a932eb06c41b37527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682318, "uuid": "2bff3a38-639c-4d90-ba17-76ecb6c718c7", "value": "T11FE3F5D2B6CD8936D402E17F6F3F9867AB1C7C3305412983728E2789D7712EA69B5306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682318, "uuid": "cca00fb0-d7d5-40ea-a489-0b0882188b47", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682318, "uuid": "d6757e55-205a-4f93-ae9f-5f62904296fb", "value": "3072:t1QyCoQO14Yc2xmBuuZ1ISrdTfWzh/jrVB:t1Qm4Yc2soLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633682318, "uuid": "0c567e2f-aec8-4e84-8cf8-2770d7fd3aad", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633682318, "uuid": "6098102d-9601-48db-95cf-cfebcde602cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682318, "uuid": "087a192b-f460-491c-9b4d-9c8591d0e921", "value": "PO7000019004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcbbf02-280b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633679066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679066, "uuid": "2569484b-d368-4858-953a-20fa5deb25d0", "comment": "Malware payload", "value": "7cba41b2cab8e8a263167dacc5dc96eb", "object_relation": "md5", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679066, "uuid": "82d75a24-7e82-4f8b-ba86-bff4f2be0895", "comment": "Malware payload", "value": "5d5ff74906d2666be0fbfe420c5d225684aa1cb516fffc32cfeee9e788e4b6e4", "object_relation": "sha256", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679066, "uuid": "6631b89d-366c-48f7-993a-6895bdbc60cd", "comment": "Malware payload", "value": "4f0ffee3bed7a6dd31f1d1dd17f73045b6b4fdec", "object_relation": "sha1", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679066, "uuid": "7349552f-9f2d-4d9c-9710-054d368aa69c", "comment": "Malware payload", "value": "3377af02889f497c32665d06f0085424f3ae1fa610d045bb34167cd70c16d0f710301b7b3ab4f41e2582f559ba55d67f", "object_relation": "sha3-384", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679066, "uuid": "78ebbb7f-0f4f-454a-a1d3-17b7161cdb6e", "value": "T17DB2D80137EA8335F2BD1B755CB602100A71B9829C33DB5D1ED1209E5EB3F549A21BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679066, "uuid": "81dd8ca5-4939-4e24-ab57-79a96f927ee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679066, "uuid": "de9aa0a0-3dc4-4c8a-afb5-2c6f3aaefd55", "value": "384:6bUCmruNKNkpKEBLNii0ryoa1oLbgz/VI7L+XovOe8RWRvthSYDI5yfSPWjPbW:6PMNkBBLN10S1MbgjCzvOe8Rw1hw5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679066, "uuid": "4b58cc2d-ee03-4058-98ad-4f207081f976", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679066, "uuid": "5edd8e75-f257-4af6-9512-bb65919a47f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679066, "uuid": "9dfb1a83-7aae-4164-b3d9-184198638a27", "value": "5d5ff74906d2666be0fbfe420c5d225684aa1cb516fffc32cfeee9e788e4b6e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a350d50d-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633667932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667932, "uuid": "cbfd60cb-56a0-407e-9320-fb9ce1f694b9", "comment": "Malware payload (Formbook)", "value": "4a951f6b124474b354ad38403074d5bd", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667932, "uuid": "7a7c8de2-ef71-4933-84de-7d74e47f1714", "comment": "Malware payload (Formbook)", "value": "5d94a08cddf84ab11cc26e7e8531a04bab46f9ddf44c1ccd7e38a269ffdfaad0", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667932, "uuid": "03e96797-26c0-489b-83d7-151813ed200e", "comment": "Malware payload (Formbook)", "value": "b633ade3ba620fcc4ae0a96adc0e30c502cf3017", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667932, "uuid": "d6d384a4-903c-4857-81dd-6348428f6909", "comment": "Malware payload (Formbook)", "value": "d2ae4b134922f94bdcc181ba9da9461b7487dd10304edacbb90f98b295ae0fc48f59f9034ccf3352c753008f7f825ac8", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667932, "uuid": "a376f7df-a596-40d3-b4f2-d8dbb8650431", "value": "T10EF45B52F691CC7AC0372A7C8C0792B49E2D3E219D98554F65F4FAADEB38643242709F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667932, "uuid": "01874da0-6018-4bb3-ab3f-286f85ca4158", "value": "a85da29f7c79b749e46738d8b965ea53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667932, "uuid": "3b457f78-5f18-4a71-9f4e-89b4e37eef98", "value": "12288:5siTtPf0MEakNE3XqKkjY2Nn4kY7CE5L0S4rrMGdMpGyS:KaF0MEakNMrkE2+kY7CE5L0S4PMGdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667932, "uuid": "a5bb092e-6afb-4373-8f7e-bc41bdd10cfe", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667932, "uuid": "4b1c6e43-d11c-425b-a3fa-3fc24ab2e293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667932, "uuid": "fb804025-5678-43d7-b118-e5603386612d", "value": "Se adjunta estado de cuenta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec0115f-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633668703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668703, "uuid": "2fc82c14-ed86-49c0-8042-3151a3bc355c", "comment": "Malware payload (RaccoonStealer)", "value": "044d551343e337fb182558fcf53c40d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668703, "uuid": "10d88cdd-3d2d-4171-9260-17ac92db7b8d", "comment": "Malware payload (RaccoonStealer)", "value": "5dbdce6b20dd0ca2e4d6e328980e222dcebe1ad73f7e5e9c0d8360f06148550e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668703, "uuid": "28fec66e-ae6e-492a-8ea9-0492c966219c", "comment": "Malware payload (RaccoonStealer)", "value": "600852092e19b1dc06409c1e91e28475eacbc290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668703, "uuid": "93a595c0-da3c-49bb-8977-d87e1cbaed45", "comment": "Malware payload (RaccoonStealer)", "value": "3120b7ee465f908a151c69c11a5b066a3485aaf7a07872fa1ecb1867910156f92a796b76bb33b7facde2b3084b84feb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668703, "uuid": "c80ce42b-ba89-4156-ad61-45b32862866f", "value": "T1AEC4E000BBA0C035F5B256F44A76D378A83E3EB16B3594CF22D526EA16746E5ED30327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668703, "uuid": "c0d6c9e2-fe8a-4d26-8279-23888855a67a", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668703, "uuid": "cef22552-d50f-46e5-a4af-c8d2b34595c5", "value": "12288:Y6eYeweNA8SKhPwMrWr+BjXxJnhGATa8geU9YJrB:YcgSKCA8+JhGf90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668703, "uuid": "b4f33363-57a8-4720-ac63-823c74c2b637", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668703, "uuid": "c7b9c0aa-bad2-4fd4-b5ad-7b0419bcf9c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668703, "uuid": "2ee035cf-5794-440c-96b1-6d39baf9f75d", "value": "044d551343e337fb182558fcf53c40d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ad694f-2845-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633704153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704153, "uuid": "fb3663eb-3c90-499e-a879-8b1ba5a85ee2", "comment": "Malware payload (RemcosRAT)", "value": "e34948f046ddd465d7c954beae8fb1e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704153, "uuid": "449f38ea-13bb-4856-b47e-1ed59468dfb6", "comment": "Malware payload (RemcosRAT)", "value": "5e1473cb44990bf7a1d8da8ad410642430bc6c5663859bc4e4c738e22b3cc71e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704153, "uuid": "bce910a9-59b1-4803-8ee0-07ebac51a569", "comment": "Malware payload (RemcosRAT)", "value": "7fc47a7b3c2b5eefcfdc04ada42d06cb4fa64e12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704153, "uuid": "88559f41-4430-4763-9b4a-eda5a095d9e6", "comment": "Malware payload (RemcosRAT)", "value": "a62f113bf01803438c042d17f894e3aa0f35d9c4b27a7891859f27638a0841bd48e43fc2c51cffc96e414525008cc8cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704153, "uuid": "3543b04d-f909-471b-b01a-cdceb1ba588b", "value": "T167455AD2A7513C3EC36A17389D37B7542D5AFAB0A434F5867BDD59088F36A0036EC24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704153, "uuid": "a3192f28-f0e5-4963-a8e9-c90d85384f7a", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704153, "uuid": "f693cc8d-b431-424f-9031-e69c115acd07", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6tqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXAxmPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633704153, "uuid": "581cf0b5-1e42-49f6-962e-611d990f3191", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633704153, "uuid": "022a176e-4f27-42fd-be00-77898c86f1b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704153, "uuid": "5bdce987-e4b7-47ea-93ce-ca8db867d918", "value": "e34948f046ddd465d7c954beae8fb1e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c577946-2824-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633689610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689610, "uuid": "193ea6f8-c8b7-474f-a9bc-02611ed90de1", "comment": "Malware payload", "value": "7d859a22f38f0bcd55a46bc8b67c40df", "object_relation": "md5", "Tag": [ { "name": "Custom sshd", "colour": "#6EA55D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689610, "uuid": "d68b84de-53ff-4b58-b27a-37b967d2a909", "comment": "Malware payload", "value": "5e9d356cdfc85a66f8fbab29bf43e95f19489c66d2a970e33d031f267298b482", "object_relation": "sha256", "Tag": [ { "name": "Custom sshd", "colour": "#6EA55D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689610, "uuid": "82df92ff-5db5-4ca4-82a2-13f10dc0dc4d", "comment": "Malware payload", "value": "1829b0e34807765f2b254ea5514d7bb587aeca3f", "object_relation": "sha1", "Tag": [ { "name": "Custom sshd", "colour": "#6EA55D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689610, "uuid": "02b56ea1-052f-44b1-8f42-4bcfa8e08312", "comment": "Malware payload", "value": "74bf4274aa136cab5ce25a5f868a84f4628f3fd636e7735adec0fda742a7c77eb1ea457d0db0749aed871f46dab3d095", "object_relation": "sha3-384", "Tag": [ { "name": "Custom sshd", "colour": "#6EA55D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689610, "uuid": "a690749d-de97-40b1-b236-4552796c0879", "value": "T1CAB58C4FEF998C6FC969463149BB43342B39F1981702EB2F2468A5343D877685F86E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689610, "uuid": "c1848b95-6389-48df-bf2d-f6994111c6a3", "value": "49152:krFNVxxhCqXwYX1LBpn/eSM7HqRI6XJkwJyTXu7G5rEgeT4xUDbS78ZP4MLV:k5NVxxhCqXwYX1LBpn/eSM7HqRIAyTX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633689610, "uuid": "aa41c927-d804-41bd-b2ac-3767e1ecc12a", "value": 2481380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633689610, "uuid": "84abc108-8f8f-47ec-8250-0af2426d5ffd", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689610, "uuid": "fdce366a-c362-487f-a7d4-37d43c11c8cd", "value": "5e9d356cdfc85a66f8fbab29bf43e95f19489c66d2a970e33d031f267298b482.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33b737d-27f2-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633668442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668442, "uuid": "db49c1aa-d934-44a5-b9de-ce6493d16d76", "comment": "Malware payload (Metamorfo)", "value": "6a7cdab361b872c51259ebe2a907a758", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668442, "uuid": "7646f2ff-750c-4192-8592-4d13eba815fa", "comment": "Malware payload (Metamorfo)", "value": "5ec7248ad671135f1269228d0852d95da19271ea6a6e945ac44fdd8842922577", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668442, "uuid": "2a9a2cce-23a6-4d9e-9dbb-149216516312", "comment": "Malware payload (Metamorfo)", "value": "6dc40b9b5b9127437a0ecc788b61714554693bc0", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668442, "uuid": "79815c89-b3ff-48f3-abf7-25e329bbdce9", "comment": "Malware payload (Metamorfo)", "value": "fe077a7087e3013ea9f08326d7264f603bbed96b6a626f082e4a94008d0ed0458a5161279825ee1f9f482940161e7f81", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668442, "uuid": "996ca8de-7e92-4b5f-8b6b-b8c02ae66f09", "value": "T1AC319C051AD61329C3B7CF7A1077A2464A76FC52AE934F9D80C497DA2891150EC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668442, "uuid": "4cde62d0-4c11-4ad2-a67a-305d21f55a1a", "value": "24:8+JUHRlVo5kcbA+PKjf+/P+Plwz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+CjAqb1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668442, "uuid": "79ec76c5-8a89-4dbb-85a8-e841d4a0b411", "value": 1554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668442, "uuid": "d40f161b-33bf-4b2c-9883-7ce30b5d6bfe", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668442, "uuid": "a9a61da1-831d-4119-9b09-946341075f56", "value": "curriculum.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d808b9c9-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633706675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706675, "uuid": "78ef8737-ea95-404d-a502-8da2130e3e1b", "comment": "Malware payload (AsyncRAT)", "value": "49fec718fd33d7193849eb33cf3ba9e9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706675, "uuid": "60435a45-c099-4767-b22f-4b74fd609686", "comment": "Malware payload (AsyncRAT)", "value": "5f19b4d0dda51a43fcf5f7d7f45378a65ef5c0545e668092d4cfb5a6dbc93105", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706675, "uuid": "770be738-d918-4f60-bfc6-72f052b1dadb", "comment": "Malware payload (AsyncRAT)", "value": "8950ba7d16018dc89c6dcd1bc7676db7ff0885b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706675, "uuid": "c2f92972-3ccb-48db-8b64-b1bf712fe2f9", "comment": "Malware payload (AsyncRAT)", "value": "7cf8718955684e6283bc15e22a24a883b8e99ad16f53b289ad2be9a9fb76b0ef0834380c7068b3d271bc02b36adad492", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706675, "uuid": "ad1e3fd5-c256-4849-adcc-e7052b057d6e", "value": "T11601F109E4BDBAF38646B6B766FA9040B475038613A4594A2022A166D07E5B8C598D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706675, "uuid": "a9a86aff-c366-4ead-a3b6-5db98c711c74", "value": "24:qobbV9H62EUMg28vOoHpMVcYkpZRCMXUALFpZJjSoeMgA73:9N9HPEUMuOcDjmgTrbeMZ73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706675, "uuid": "c53c75b6-6bca-478f-96c8-eb16809224c3", "value": 785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706675, "uuid": "4a0c4d7c-3548-4d21-ae73-d705d1e2105b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706675, "uuid": "902eff7f-abe5-4779-a5be-e445bdfd4c95", "value": "BSORMZTYNHIMN.xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fe1528-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633692599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692599, "uuid": "f7ce0c35-042d-4d9f-912d-8343880d094d", "comment": "Malware payload (Formbook)", "value": "33ba18af523e6abde86bdd1adf3bf452", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692599, "uuid": "3976c890-446b-409f-88bc-35570aa7615e", "comment": "Malware payload (Formbook)", "value": "5f4b71e4968e877ecb5b41ce6f780b915cb2666cafc6e5c61434e8cb07600136", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692599, "uuid": "e0144082-8bcb-4a79-9652-42e356adb127", "comment": "Malware payload (Formbook)", "value": "a191108684d44472e1a059d3c9ae34913559874e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692599, "uuid": "5ec7bd1e-e8a7-4a0d-8a00-8cce46872086", "comment": "Malware payload (Formbook)", "value": "94d54dcb6030384a82b074b54f2a03ef26052bfb84c05fbae23f3fbc4bebd08beee6317ea2120c3c2b45a38f02817812", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692599, "uuid": "c5f18851-ef8a-4b98-8086-8e8df30aafef", "value": "T15215BFF875047DE6666F576BDA96ACDD03B627238ACBA4CD80A4B7C30563335FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692599, "uuid": "cf24b5b4-1789-4609-91d3-07480e4b1ed2", "value": "24576:dACuzBiPco0mB9VG0aI7OKPnG1I2VRJq/B2I:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692599, "uuid": "19eb17ff-f559-45c2-b318-72db14a7b7b2", "value": 898322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692599, "uuid": "f084f084-3ebe-422e-8834-eba4e0d00578", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692599, "uuid": "f11f54bc-b533-4084-8c97-0eeac353c0dc", "value": "115-209.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab86d7c-27dd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633659327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659327, "uuid": "35fbb4bf-c975-41ad-95a0-091b944285ba", "comment": "Malware payload", "value": "7af5101f293481a72e18d505558bf0fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659327, "uuid": "84f5f5cb-884f-44cd-95c4-7309a8de99a5", "comment": "Malware payload", "value": "5ff120719284d49968b0c1e9ddafe5b8df385e32ec8d2b02c8cfc2ea08016f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659327, "uuid": "20f7c55a-a241-44b1-b700-12b2ff8aa634", "comment": "Malware payload", "value": "2200e414ff324824d407daf4253fff835337862f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659327, "uuid": "3c520f6a-dc33-4f44-9a92-6c3d73434d2d", "comment": "Malware payload", "value": "eb7955c46485fb322d97864c3bf155d770d72fb287753074be02f7a2f4126e0e0e482588278ba28c63599578344c725f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659327, "uuid": "c6fd17ff-9e81-45c9-be21-52b83551abfe", "value": "T14EE6E82A625065C4D05B82B8D7D68BA2D270BC38273737DF23D277222E75DD1AA7E143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659327, "uuid": "5be2c88a-c8d9-495c-b395-8ed812813c20", "value": "791ad4970db53926aba1c5d959290508", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659327, "uuid": "1074cfa2-a2d7-4f77-99e2-9c3e4c4dc2bf", "value": "98304:SSTBAq0TdeEK9l3UumYUARqQgQNt+WY8lJlo5zuvgTGbjHgNMrqnXuJQdM:rTBAmSufXRxp3QMlMegTyH8MrqnXuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659327, "uuid": "0c9aef53-279d-4a34-a301-141a7b006aa8", "value": 14410832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659327, "uuid": "d49fd288-b339-470f-8f9e-6709bf79a931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659327, "uuid": "9c6e995f-3b24-4203-b432-aa07190fdd96", "value": "gramblr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba95d2f-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633667946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667946, "uuid": "d54db509-3b0d-4769-9a26-80975668eeb3", "comment": "Malware payload (AgentTesla)", "value": "ec42903bc571eaee153243e574bb8988", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667946, "uuid": "ebd8c01e-5f3f-44d0-ae0e-51214f2b2fbe", "comment": "Malware payload (AgentTesla)", "value": "600c11d4d3fce5f15cea757259458aaa47e3ac4e9b709669e9f159b6aa42cf61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667946, "uuid": "17d4ce72-2c3a-4ea2-b83c-8d1d174bbc06", "comment": "Malware payload (AgentTesla)", "value": "2d9decc8dc9ccba9dea4aba7db92f1e0d6092b87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667946, "uuid": "ec68b0d3-28e1-486e-883f-da40f0b024e1", "comment": "Malware payload (AgentTesla)", "value": "c818937aa9ba036e34e3a5c8b47e22a2b8b3d5b3d048a6c26b64ef081c9f91b7fcb0a3557b61fb8af543ce3e7beb606d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667946, "uuid": "0331199b-52af-4b20-b40b-43c38128fa97", "value": "T101F20E7DF1970A988F8693B8171B6F81158CF54DF3D884B636B8DB3866C4D7A821293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667946, "uuid": "e0684e3a-5553-45e2-9802-5fffb2dca936", "value": "768:HTH5WtnezeJwHXybGyykWNNv4G0dNs6OYgTycU7e9n0bzrPlfpXozC:TsnfJwHXybGyykWNNv4G0dNs6OYgTycE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667946, "uuid": "8faf3fb4-9d1e-40bd-9053-477859c1000e", "value": 35012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667946, "uuid": "13fe2960-12b7-442f-91e1-9f19bd33625b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667946, "uuid": "88388561-0c15-423d-8dfb-6f8ab06a65b5", "value": "Remittance Payment Voucher HDFC_EFT_300921_9562.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f042f4-2823-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633689518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689518, "uuid": "daa4ac33-8471-42f0-8789-680512fb1d27", "comment": "Malware payload", "value": "e683405e15ffa517e4759d8907d94295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized kill", "colour": "#38517E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689518, "uuid": "669364a5-a9a8-45f7-a81d-dfeb5c3cf900", "comment": "Malware payload", "value": "602c435834d796943b1e547316c18a9a64c68f032985e7a5a763339d82598915", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized kill", "colour": "#38517E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689518, "uuid": "82d3741b-06ce-442b-bf09-3ac21b610474", "comment": "Malware payload", "value": "771340752985dd8e84cf3843c9843ef7a76a39e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized kill", "colour": "#38517E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689518, "uuid": "c6483024-714b-451b-bb4c-03b7abd9605b", "comment": "Malware payload", "value": "8ef17505413d612671c5c4ebe3c214f2c28c0106dada60f885c873e01d6944cfc1d5bb9ac31eef9bf9eec177bd7614f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized kill", "colour": "#38517E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689518, "uuid": "638fb904-4f0a-4b0b-b7d9-b8d0328627c0", "value": "T1E91523069E1B4CEFCD5943B8B7869608463AF8689BD22BA1234D7C3B1D72FC01F1695D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689518, "uuid": "217855fa-faea-4a8e-8375-a540b05502f4", "value": "12288:7PU8P1/gRgpaLv0QOQS4u6os/PZ/PnLJ4jJe6Yq9ZcoHrZTXhIBNK9KqasF:5FHQZisJ/PLJ4jKacoHrNyBNJqau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633689518, "uuid": "f885b754-e71f-4280-a58c-805bd3f16c05", "value": 887992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633689518, "uuid": "699aaa8d-1e12-47e7-abb4-172b087557f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689518, "uuid": "49baa48b-f693-4a16-8a47-f64059473aba", "value": "602c435834d796943b1e547316c18a9a64c68f032985e7a5a763339d82598915.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b23970-27ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633666332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666332, "uuid": "d785db5c-9cd9-46f2-abcd-096496a757f8", "comment": "Malware payload (Mirai)", "value": "a8dd72a51c5871fc160a039e8b84e125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666332, "uuid": "d44d3fed-6666-4d8e-9d48-54c8cee74aef", "comment": "Malware payload (Mirai)", "value": "60bebeb392bc1ee39a33f9be900e2dc47f9b9d1697674da6fb294b57875dd474", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666332, "uuid": "fc680a69-cd1c-4e98-8373-f5158fc866a5", "comment": "Malware payload (Mirai)", "value": "997c56f0a9a482b632c53b229346536414cd696c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666332, "uuid": "03056697-85fc-48b8-bb61-d200f108c341", "comment": "Malware payload (Mirai)", "value": "1c40f32ddb8d5559a29fc675e5122fe868c37e94153aa29e5310c5e41fe3a85e32495e8fe69ace71cc1cd7a2ccc0e0f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633666332, "uuid": "b7ccd8be-ce16-4ca5-9955-52fc17966409", "value": "T1DDD34B1BB491C8F6C44285B126DB72509913FEBB0AA63147B3947C647F398CA1E7AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633666332, "uuid": "47e85b15-b365-4c19-9f68-7aa0d4b5cc1a", "value": "3072:m1gnIqW9Vf6CuV1D7eTtBC0lSutJ8a+PQ4KQOjsvkBBBBBBBBBBBBBBBB2SeGrm6:u/fpi7IiPutJ8a+PQ46IWeGrmcEO3Sgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633666332, "uuid": "38c6e64d-6a78-4278-a467-f745f6202b6b", "value": 137557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633666332, "uuid": "cb403d5d-bb62-4a15-b687-ed61bf686f04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633666332, "uuid": "622cb964-5ecf-481c-8826-90e04b2ee033", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de90066-2862-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633716268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716268, "uuid": "bf80a628-c37d-4b83-b45d-18fa530047ff", "comment": "Malware payload", "value": "09daa9d0c2e3bb67a8082c99ec9a3f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716268, "uuid": "e465f3be-9477-40cb-b868-2cef5887e073", "comment": "Malware payload", "value": "60f4f215c1db6a740df556f170c6ce56a2d575909dfc62f46bfb1ba42a3fdf82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716268, "uuid": "2848a883-7cf8-4e54-970c-0effcbd5a918", "comment": "Malware payload", "value": "ec33b71e9cd01323e85e9b05b4c2b540270b1f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716268, "uuid": "d5ab4cc8-54b3-48af-80c4-6506fa99fb2c", "comment": "Malware payload", "value": "09b4ae2de980645e2023008a3f634a346b499998c4e8f64a11f0b778c845dfabd35c9e26fcfb503bae34f7b09168a800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716268, "uuid": "179d560d-300b-423d-8d92-3e4b2e6f6360", "value": "T1852523A22E81482BF6E41AB00E776D161567BD259DB1C21F5290FCCFB634211CA29F7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716268, "uuid": "ab35db06-f751-43b1-a6a5-f5628d29b4ec", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716268, "uuid": "38e8b9cd-2839-4a68-8b83-9a2cac17d5ef", "value": "24576:Hif1ZWvnxRgAZWf14dDqKZ18aTgAs4rAh5Ce1eRWst80s:Cf1ZWvnzv64d1TTPAhXstps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716268, "uuid": "dda9966b-abc2-4f88-821c-8cbdf284762b", "value": 1025108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716268, "uuid": "cb9f092f-d004-484c-b173-ef22e5e5bd73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716268, "uuid": "a5af9267-0c85-44b8-8b64-dc3889483cbe", "value": "09daa9d0c2e3bb67a8082c99ec9a3f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6ffad2-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1633692349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692349, "uuid": "8e096d1a-6fa4-491c-add1-af7fd09b0b7f", "comment": "Malware payload (AZORult)", "value": "b6841e1bdebcb206e38123af2ba3254c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692349, "uuid": "261a26ac-37f2-43b5-8fec-92a42d9d0ac1", "comment": "Malware payload (AZORult)", "value": "618c78fbf67d014137470a93c49571272e7777ce49ab31ccbf47ec11739ef822", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692349, "uuid": "532ec5f2-a165-4012-bdb3-265b2a7b761d", "comment": "Malware payload (AZORult)", "value": "0e3928f6de38d4b2d0badb245d1516721712b330", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692349, "uuid": "e41077a7-6e5f-4924-a659-6271b7c48af2", "comment": "Malware payload (AZORult)", "value": "d2d9d785f08f0e3bb0f0ebd5b8da00f2f3f7ab99ab69fc9d87f6cfb42329779738d6d837b58a086c002cff20ee748834", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692349, "uuid": "9b374d66-c919-42fb-9308-409e33457123", "value": "T1A0E533B02A8ACCE4E679D07AD531D57507E11C099C4BDEF5CAD0B86A443A3ABCB78173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692349, "uuid": "315ec38a-7794-4e65-8540-2742fa3147e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692349, "uuid": "4ff0ab88-392d-4d29-8d0d-cdb4a9ed220d", "value": "49152:gMZ5UDugtnTvPGUGz364fbSsH795n+UANwbIw5AcGDcGxoG5lVecve8v1t0o3V09:9Q4bf+Q7fswdGDcoBh3vbP0o3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692349, "uuid": "b8dc5ed4-bb46-45c7-89b9-4f544b2e4289", "value": 3046912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692349, "uuid": "22722d32-c542-4eeb-9858-feb71fac9163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692349, "uuid": "a7c1173b-ec8b-4f9b-94ca-b56c27b705d1", "value": "b6841e1bdebcb206e38123af2ba3254c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748e9e6e-2836-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633697489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697489, "uuid": "4f4065b7-382a-4fd1-9384-0a0f3a5c10d7", "comment": "Malware payload (RemcosRAT)", "value": "962ac172fbb7edd2110cd1cfa61b782b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697489, "uuid": "e259d74e-1ef5-4951-a40a-4374ade5b15d", "comment": "Malware payload (RemcosRAT)", "value": "623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697489, "uuid": "4868e53b-e28f-4724-81c3-fbfa06063dc8", "comment": "Malware payload (RemcosRAT)", "value": "9244b408286c5e0cc4d5d10f5b0f6718756a66fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697489, "uuid": "f62f790d-9353-479e-81b3-4c3bc1c4e658", "comment": "Malware payload (RemcosRAT)", "value": "a4a5b4353cf2d8a45657eb1906e18a9a96de1a7be0588901b9ad802f003a824c8a0d1e5e854d07ccbafa9f6a344b722d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697489, "uuid": "71b4e128-20ea-4bf4-8346-c734a466518d", "value": "T12FA49D12B891C032C17212700D69FB759ABCBD202D3549BB73E96D5BFE710D1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697489, "uuid": "64653571-0010-4010-9a32-8770aa5e92e8", "value": "ec8ea73e2aa6f868311acc5b792bc222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697489, "uuid": "7c40a551-8d75-4efa-8135-cc3d58995968", "value": "12288:4f+Ud9dFEvMNIWXLg4SPw5+rTmu/ZIzOEb:hUdyvMNDU25+r6YZve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697489, "uuid": "4ae66268-c622-4619-9ba7-264a1145d195", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697489, "uuid": "3a7b1718-e432-49c7-b9c7-5b7d9d8bec71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697489, "uuid": "7fd2a28c-0519-4fe8-82e6-402e39a877d2", "value": "623bf7759de8303bc15901ee832dccb2febb294b84d3c5304022fb7be0b9c1f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ec5944-27f2-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633668345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668345, "uuid": "8be217dd-5614-4be2-88fd-98cdf7cbf49e", "comment": "Malware payload (Metamorfo)", "value": "db3b2ebbd911641fe592e5446dc44652", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668345, "uuid": "61d0a115-da98-4397-8098-fecf31748f60", "comment": "Malware payload (Metamorfo)", "value": "6298e28fe2cf868969b52cda49e12623cc57357289b6871d3bd0ef2c5ac72007", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668345, "uuid": "229852e9-6d81-4f11-ba77-651bbe996510", "comment": "Malware payload (Metamorfo)", "value": "a55a4fad72e759a60a25b841571832bce0ccbdfa", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668345, "uuid": "1ae22b71-840a-400a-ada3-2803bc0b601d", "comment": "Malware payload (Metamorfo)", "value": "c11be30b4fd30c7ff6e0fccf244419bc0957c30e11b0dde388f1b9e602b52874275070abdd0e3991fa3cb862f66c4466", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668345, "uuid": "149fe432-0c94-488d-9d1e-6f33ea87d10c", "value": "T13E319C051ADA1329C3B7CF7A1077A2464A76BD51AE934F9D808497DA28A1150EC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668345, "uuid": "da8cbf9a-9d88-4f4f-a9aa-c6e58109d3ba", "value": "24:8+JUHRlVo5kcbA+P/+/P+Plwz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+oqb1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668345, "uuid": "1c7ab1f0-92b8-42d9-b1e9-e7ee69f002b4", "value": 1550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668345, "uuid": "5cfd62e5-d1c2-444a-b45f-a867690c7c6b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668345, "uuid": "d8c7abb4-f78a-41fe-959e-edf477a58b76", "value": "Anexo - 045071021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7baacf82-2806-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633676885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676885, "uuid": "6929dde2-79fe-4e2c-ba64-6a2400cd4f71", "comment": "Malware payload", "value": "ffd19e1f641eabb75fbb435ce64f2e02", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676885, "uuid": "b3513d12-253e-4544-bc16-ef24f9c058f7", "comment": "Malware payload", "value": "62c152caa333d0f9cb91ca06b7305ec3568b0a0751ff6f60f65eb1fb97dc2568", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676885, "uuid": "c057c22f-336e-401f-afaf-45eace0f0a73", "comment": "Malware payload", "value": "45f52468e5ec0a83c6649da7dd213c57fc4a4120", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676885, "uuid": "c81490d1-02aa-4e9c-b7df-c5fcf3a86d36", "comment": "Malware payload", "value": "2e9f8a1deb8548293ec32a7124f1066cf365d642de6571d6f34d7a863eb7c1c8c78da3ca950b8259ed22ef7b7dbb7cce", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676885, "uuid": "186df1fe-dfc9-48f2-b2cf-ebc931edc919", "value": "T17294D19B76CD0DE1D3DF4A765844E4B787F0EE24EFBAD142B260398EB0F635A0646184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676885, "uuid": "45699597-0389-4b72-9783-17984b7a1c54", "value": "12288:W14h+OAm6CFDshGK2JcMIrTY1lrEgcRs9aYeDIu:WlOkBhGtJlqc1FErs9kDIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676885, "uuid": "77209324-2b62-45dd-a4c5-0ec5f2b41052", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676885, "uuid": "8d3b1d8c-0f70-4ea9-8ed8-7e34628b47bb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676885, "uuid": "a468896b-4216-47ce-b2c6-dbacd95ffff5", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5059d90d-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633668652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668652, "uuid": "4192c493-4a36-4785-b8a1-06dd204240c2", "comment": "Malware payload (RedLineStealer)", "value": "07c656644707998a6672e1cc7b3a9ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668652, "uuid": "564440d1-41de-4053-a558-25b95a4904ed", "comment": "Malware payload (RedLineStealer)", "value": "62d2c5b180e6523289d12df913648a1872c6feff6b4f45bb64705bbe9492b4da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668652, "uuid": "4e92bbb3-71ff-49c9-986b-bae8925b3a22", "comment": "Malware payload (RedLineStealer)", "value": "3a3fadec1e199c33d6d5688e153868be9eedb329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668652, "uuid": "40388e9b-5b4d-4422-8b46-aa04c4680ac9", "comment": "Malware payload (RedLineStealer)", "value": "a5ecff1b22bdbb71653b068138b8d3da8706e77aba8f35416dea9fd90ccd0fe70c45b73ea87ec9cdba43865ddc1f765e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668652, "uuid": "bb13c6c7-f6cd-4559-9903-ceb472b56c96", "value": "T1BC84CF10B7A0C035F2B756F44A7A93B9A83E7DA1673594CF12D566EA4B34AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668652, "uuid": "c242f882-ad6a-4485-a53d-44d9e1216924", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668652, "uuid": "305c8272-8d89-4df4-9253-419b67ce39a2", "value": "6144:VyEaiOY9xKx+bF3stvwxprRvmO23LsAFg25kqDPdJGtrUoCCvWulDKUtW1kMdZCF:AENVxKw2vwP2oKk2VJGtrUUvWWKUtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668652, "uuid": "68bd0430-1842-482b-ad5c-289d4fd50c30", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668652, "uuid": "578967c3-cb49-4b9c-8148-b1331f308378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668652, "uuid": "bb76a6a5-fce1-47fa-b22b-7985a43557e0", "value": "07c656644707998a6672e1cc7b3a9ac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ec30f5-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633693864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693864, "uuid": "a7e923cd-a3e0-4eb0-b42e-fa0de81ab612", "comment": "Malware payload (RaccoonStealer)", "value": "72ec822792e913d602bf3b3d6ad3c68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693864, "uuid": "8397f28d-8f66-45d5-9a47-63383cd2d08f", "comment": "Malware payload (RaccoonStealer)", "value": "63f6a92084e81e72720f6160287e6766e2214f489d11142a9668925c6c4616f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693864, "uuid": "3cf6a56a-0219-483c-93fc-fb13ce9f0afd", "comment": "Malware payload (RaccoonStealer)", "value": "f87844987a3690336ec089d44ca7a9f51c18f33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693864, "uuid": "ce614e17-c167-41ca-a8db-9cf19ef49cb1", "comment": "Malware payload (RaccoonStealer)", "value": "c3da9b9af76ad0e22474fa79e3a00efc9139aa5c1f34d8eb94d0fc9f611438bd829eef75fde0c9a610565269b0eccfcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693864, "uuid": "32cb94e6-276b-41cc-874b-3f97723996ed", "value": "T17B14AE9076E58076F2AE15304A699BE08737FC62E931D98B1FB156FE1F792D18A21303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693864, "uuid": "38250abb-863f-4a51-aff0-ad5d055c2ac7", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693864, "uuid": "bad29c1c-2646-4447-a5ee-9ede023c858f", "value": "3072:6pmtya3uZMpxy8iwJDXKv5shnjRsmW8H5LxcqPrbtZPwOfP3ARsH+kKfhgC:6pmxukxySXKvYlsSSytXjH+kKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693864, "uuid": "a3cc0624-0574-42b5-85e9-94ba0d3d392c", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693864, "uuid": "2b76bb7f-76c5-4c8a-abc6-10388ea5e374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693864, "uuid": "003c3436-0fa2-4da1-9f73-e88b83559f3d", "value": "72ec822792e913d602bf3b3d6ad3c68a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed0405a-282c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633693399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693399, "uuid": "5ca6b8b9-82ad-4dd2-a328-2f0302dac694", "comment": "Malware payload (RedLineStealer)", "value": "807faa5152c7d455da1a15f20a30d3c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693399, "uuid": "e05ea295-66f8-4b18-887b-e2aebb923573", "comment": "Malware payload (RedLineStealer)", "value": "64aeba861b5cafc4f04035fe488ac651300b3d2e9602906bb9b6f0812bfda195", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693399, "uuid": "1879ad06-4a32-475c-a926-0acff626ec56", "comment": "Malware payload (RedLineStealer)", "value": "b93593f56641529e6d89c3be048b4267bf4fae1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693399, "uuid": "e2549866-c5e3-4e27-8e30-395f01a9c349", "comment": "Malware payload (RedLineStealer)", "value": "131b5f64fff677524a8ed1115fe94131cafa0aca48f3ec7d4cf4a9df16d019e32081872863bdfffd7e26b30b0a941b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693399, "uuid": "9186e5f9-4039-4cb1-a890-24e606b05e2c", "value": "T13054DF11B6F59432E27F5A344DB187A44F3BBC619D31958B1BB0A6FE8F35292CA21307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693399, "uuid": "d950a3fe-2424-44fd-ac0d-e294bc114ae0", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693399, "uuid": "6a023e06-4b93-4153-ab51-c557caee9174", "value": "6144:rSesNWtetphAK6Z5VHsT3i11ZPZ0gHinlLFrjYkxY609:hdtMp+55JsT6d7s5FP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693399, "uuid": "20875417-21ba-493d-814b-813219fd6840", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693399, "uuid": "52cf8c96-475a-462e-a261-a70bc7890cc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693399, "uuid": "1e1f2278-c725-48a9-98be-192973ca516e", "value": "807faa5152c7d455da1a15f20a30d3c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c688b5f-2862-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633716373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716373, "uuid": "8fcb63bd-8219-4533-b77f-faaed4415106", "comment": "Malware payload (ArkeiStealer)", "value": "d68bdaade9fe0341cfa3d77586075bd7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716373, "uuid": "c743f80f-7d88-4ef9-ace3-757a4031ff21", "comment": "Malware payload (ArkeiStealer)", "value": "655fe710c79b1aa6eae28aa55812ffb87b4d1e6620a6ebe145fa70ab78f2afb1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716373, "uuid": "f2961cb4-66fb-4b9a-a81a-9aa394106360", "comment": "Malware payload (ArkeiStealer)", "value": "b6d3f147105e2a0d1e304f2a2fda3c4f6ca15100", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716373, "uuid": "c949b90a-ef89-4cc7-a8bf-39d93e447ae6", "comment": "Malware payload (ArkeiStealer)", "value": "affe6bf1a73cd3b9b5b14d1546d47a8b19896e2c977fec681a5522088e07a541e3f93c1de07c6a319d1e6331817bd7ca", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716373, "uuid": "aed06ee7-05b4-4a15-8522-13d36598b918", "value": "T13BD4120167F28032E3BF4574587583A02AF77C556AB5918F7B782BEE0F212E0AE64753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716373, "uuid": "ae00568d-5bd8-4946-89ec-c6d2185fd9d8", "value": "b81208afe657df957690a75b8ae29877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716373, "uuid": "075ede07-25fa-4265-814c-67e956a28ec3", "value": "12288:NNrHEogh9IUfTc+SfyKeemu2QwM5rM05lOjF:NKo6NYXftPrX/GZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716373, "uuid": "b18a4c91-6dcc-477b-8f8b-df80f14a88ec", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716373, "uuid": "bf96aadd-9c64-4a93-8e22-9371ebc60b5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716373, "uuid": "648b5c61-9ae4-497d-b98c-eceea0356e7e", "value": "d68bdaade9fe0341cfa3d77586075bd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763fa57b-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633668715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668715, "uuid": "3c59ac9e-2bfd-4de3-b50c-a7ae6a041e46", "comment": "Malware payload (RedLineStealer)", "value": "4cadcae373b8049b2ba3f072caa0ecdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668715, "uuid": "10512b49-9f4c-43c7-8c5f-55e851b33486", "comment": "Malware payload (RedLineStealer)", "value": "658d828f56fcfaa0984e56ca3a350a35049a762c454c68e869bb150748c24cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668715, "uuid": "feb17c5c-4121-4963-81bd-73ea865a1a99", "comment": "Malware payload (RedLineStealer)", "value": "eabf426b122730fda8011fc84070fcc67c549868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668715, "uuid": "901af55c-bfbc-423a-a4b2-a935f60b7ad2", "comment": "Malware payload (RedLineStealer)", "value": "853b7d1a05ef520faa19cec8abf2d49af8a6648a93ec464c8a1f447846f88236d019e7e2cf096b946281abe7b97ca019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668715, "uuid": "02450dbf-6f77-4019-b264-8da5c4f7afe5", "value": "T1E984BE10A7A0C035F1B312F4497A93A8B93F7EA17B2894CF62D526EA57746E1EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668715, "uuid": "ec6828fa-0f40-4848-8715-0e1de49e3c44", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668715, "uuid": "9717e05c-1e5e-4428-9958-bc621d008f61", "value": "6144:JEcB02fHjd7a/2PewXcGWSBKVSKH+UibQnxWc:q52fHB2SewMGWS0YKHSbQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668715, "uuid": "4bcb869d-88e5-4f7a-9767-577616b48c68", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668715, "uuid": "ca7aac2c-bf26-4334-8f5b-31730883b15e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668715, "uuid": "9be4d4f5-9124-49a1-a93c-5eac391b1b76", "value": "4cadcae373b8049b2ba3f072caa0ecdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c9e7c9-282d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633693654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693654, "uuid": "cda9cb35-9ea8-4231-a3f2-b8e25f0998de", "comment": "Malware payload (RemcosRAT)", "value": "ceb178a1032f5d768e321db28db24d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693654, "uuid": "e4fded6e-3a83-49bc-934c-308693fad149", "comment": "Malware payload (RemcosRAT)", "value": "6653d6fb54f51870c3c9bc33e04ffe4a855c1886f3b2f328c2ca7ba5e1f088cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693654, "uuid": "b983da21-8a58-4faf-8706-46d19241c287", "comment": "Malware payload (RemcosRAT)", "value": "eaba42910a33de266a6347ca7ad4573912145b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693654, "uuid": "c9829e9c-f763-4e70-b90f-e2903fc62f1d", "comment": "Malware payload (RemcosRAT)", "value": "4b63b904eccbf4c1c479696561e3452525c377eb4882c18956fe6e0afa9e4ac7e79a2574ed15b7f69cad715ffe4757d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693654, "uuid": "757878a7-dbe8-4e62-9a13-ea8a84758f86", "value": "T175A42312D1C528CAF64E85B4163F36DC727FA8094323540F93E14FA66DBA6670E3629B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693654, "uuid": "2b7641db-94a6-4f44-aaf9-34fee37cf7f3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693654, "uuid": "73de91b0-173c-481a-a15f-c151943e689c", "value": "6144:F8LxBsp/L9OZEkauXnKd4523PghbshJuzFF9/m0Yb6P915E3cTd7n0BWCZm+B8CL:/pj+9auXn3so9m0YmP7tdr0zZzvWXOi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693654, "uuid": "fab7dfae-26cf-4a2a-bf50-f14d65e2f399", "value": 484782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693654, "uuid": "067a20e2-593d-45f6-9400-31d5643e9790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693654, "uuid": "48551091-377a-45a3-8f39-e2c5205d1a86", "value": "ceb178a1032f5d768e321db28db24d88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02dfcf3-2822-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633689025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689025, "uuid": "50c62922-9f14-4426-ad7b-e0498063ea41", "comment": "Malware payload (AveMariaRAT)", "value": "aad054f64bb6ac94238bc073603ed2a5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689025, "uuid": "0f6c3af1-704e-4c8f-9345-6d3fadf4374c", "comment": "Malware payload (AveMariaRAT)", "value": "68211e55839cdee3f9da3d67af65541f1a21f07dc1ae503a5ebbcd5451b9df6f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689025, "uuid": "69d6016f-6482-4328-a967-6db13936eeb7", "comment": "Malware payload (AveMariaRAT)", "value": "d41fb5f76ec3b99316892438529409abd7bbf687", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689025, "uuid": "3c5269e6-415b-415c-ace4-392eb50aefd9", "comment": "Malware payload (AveMariaRAT)", "value": "edcb34a7ea32b5013219de5085000e42daf01dea69a84d41d7ebccad099bb31179f7aff30b679b7dc2c28a39d3dc1804", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689025, "uuid": "34b0bbb8-8fad-47d8-9c9c-c2f97b9eac69", "value": "T1A5455AD7E5507E7EC32325791C3B9BA42918FD34B938A58637ED4E184B22A413AEC353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689025, "uuid": "a391d024-1347-4059-8bff-54801f6cec70", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689025, "uuid": "bb1cb1fd-ca4f-40e2-a9c9-f0b45969f144", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6cqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXAomPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633689025, "uuid": "a7c68ca7-b55f-4692-9592-00003572e068", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633689025, "uuid": "952bb29d-1031-4673-8038-03abe38a22b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689025, "uuid": "6f7e8429-8d18-45b8-a0ea-af9bcdfda648", "value": "Enquiry- 0076HGF21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d74bbba-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633694041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694041, "uuid": "12ffbf8d-366b-40ea-82c4-e465ccd07e8f", "comment": "Malware payload (NanoCore)", "value": "dd663bb6a23cd47928fcd9e34ddb98e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694041, "uuid": "9c471ef6-d02a-48c5-9c04-56c2ddcda891", "comment": "Malware payload (NanoCore)", "value": "697258273c1137710cb5c611d88138699fb86208492129d02a6ef8bb6a37df69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694041, "uuid": "7c1f6f75-d936-488f-b6c8-1e61a49714ef", "comment": "Malware payload (NanoCore)", "value": "5b24583b44e954cd8696acc4c491221b246d820c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694041, "uuid": "15df2a30-8a4b-4af0-9a80-5d591157faf7", "comment": "Malware payload (NanoCore)", "value": "c2490476b712c3dd3b9580698438f0ddf831a5d163263044010ae0df21b5043227504e720aad2c33c091cf468044d517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694041, "uuid": "a4723df4-447f-48a0-9e4c-5d5e3889f343", "value": "T1CF351202B7C28472D6731D316E3D67256E7D7C202E349B6EB3E4896DDB35580A224BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694041, "uuid": "c71f8eda-9c07-47ba-badc-080f5624d6b8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694041, "uuid": "a5dab1af-f492-4c6b-b89e-ca69ffad1195", "value": "24576:rAOcZEhsIxVnpx3xvv98rxXGpZWTq6ai0bagi7vzJ9:t+ApxhH98rhuETq6d4a5vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694041, "uuid": "fa054d01-9fef-4709-9fbf-059dbfc38a78", "value": 1060509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694041, "uuid": "2f7541cd-cca8-4a64-8ceb-cb69a1fff6ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694041, "uuid": "4cd640f6-26b7-4d9f-a382-a3a9db559a1e", "value": "dd663bb6a23cd47928fcd9e34ddb98e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46af8f4f-2837-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633697841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697841, "uuid": "a1a58f36-514b-4a15-8927-18d450d3622c", "comment": "Malware payload (GuLoader)", "value": "5788cb5c4d6c5104921502abb26111ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697841, "uuid": "63951b6c-693d-4276-a32f-fa21df7be889", "comment": "Malware payload (GuLoader)", "value": "6aa72c90b21234c317db9252005e32ec57d4f8b943f99e0cc9b7a3b049745ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697841, "uuid": "92baaed2-9fc6-46ba-b47d-4a277fe40365", "comment": "Malware payload (GuLoader)", "value": "10aa79817213bbff0572998b75b037694e488e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697841, "uuid": "0c17442a-35ea-4195-8869-9afdc2da842c", "comment": "Malware payload (GuLoader)", "value": "7a5f7e134ea5e70e75a38d1deb0ad9be27b5a25d1377c96a3e5e159c8135dbb15c625eb5fcde75f93ecf98b09845bc18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697841, "uuid": "62e8575d-8e0c-43ac-b945-a825a02f03ed", "value": "T16EE3F6D1B68E9535C402E07E2F7F94676B1D3C3305413A87B24E2B89D7B22EA28F5356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697841, "uuid": "c86c4dfb-065d-441a-8344-2274e0aa82ed", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697841, "uuid": "140986b4-5660-4987-9b00-ab9e19dff5e1", "value": "3072:tq0SZHspqBHD2F71SV2OGuRlsSUgQsKjG9T39zh/jrVB:tqjLVDG71SAPuRh7LrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697841, "uuid": "15eebc7a-52f4-4a45-a101-11e0030c846c", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697841, "uuid": "514587eb-7f90-4c56-a348-300e50c497c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697841, "uuid": "abdc62c7-50cc-4ed9-b834-de4af7d2ce4d", "value": "184285013-044310-sanlccjavap0003-7069_pdf (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b639d2c-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633660026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660026, "uuid": "3a478668-0990-4d70-bf85-6e2b0775ab6c", "comment": "Malware payload (Mirai)", "value": "8d8beb7af0457cf34be2340dbdc6f2b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660026, "uuid": "2d7bbe55-5d2e-4f13-9e60-70ec2764a820", "comment": "Malware payload (Mirai)", "value": "6c585acd7e38e3dcc354dedb710c7533b24930aeb87582b778cd12ec373b0dd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660026, "uuid": "ea58cdec-4b96-41ba-a265-383d7c2d0774", "comment": "Malware payload (Mirai)", "value": "edd768816e92f882537ce580221d2368e40227d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660026, "uuid": "299fba76-6ce4-4596-9f67-f1be4ca3818b", "comment": "Malware payload (Mirai)", "value": "35802b239c8198130c7239f86991ed11f49b8a82bffa023984e239c17806279f73f3d10fcf6de7d161cfd154b34810a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660026, "uuid": "28272569-94c0-4a0f-ab9d-619df00ca393", "value": "T1E7D23A31BA761D17C0D4A8B962F74B69B2F5064F65E8CB1F3D230E9AFF10944A5032B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660026, "uuid": "639a10b8-0022-4186-92fe-4b79824da901", "value": "384:Yzo4SryOYTKN3YgRVJDoG8+lrBUmTkd/gSQnWtT5KL6qdyRdn4BFU+pfmL/w:Yzo1okVRzovBd/9QnWtTIoWO+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633660026, "uuid": "907aacec-e500-4eb3-9c16-cad58c03392a", "value": 31004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633660026, "uuid": "160f560e-ea85-4088-a97c-83471d91f3f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660026, "uuid": "04659527-de4e-43c5-bc25-f9c2faabc6a6", "value": "8d8beb7af0457cf34be2340dbdc6f2b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1c9b9c-2862-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633716267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716267, "uuid": "ad9f56f4-449f-4805-ae43-735679cf7a6c", "comment": "Malware payload", "value": "8296bc5164d69575e78a8d858297b6f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716267, "uuid": "1f3cf13f-f932-4347-a11c-68f09cb5a249", "comment": "Malware payload", "value": "6c67f4940622e0556a4c63a7ae217af25ccad540bf1a4607cf68e708a6bcff8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716267, "uuid": "a37d795b-8ff1-4636-91c2-c99a3b3f9aac", "comment": "Malware payload", "value": "7108e5b3acffd4db5dcb73c219d51fc60bf39937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716267, "uuid": "c3dae73e-d493-405b-8ca2-71e04364e7ea", "comment": "Malware payload", "value": "801cddd1006eef3e54cf44cd3602d376dd5034db3c9e6c6c1108928e0730775e54a9b0ea6535720966617926a57fbf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716267, "uuid": "8f5d4776-0f1e-4c3a-8f9e-9cb2766ac300", "value": "T11F2523103E81C4B3E9E69E70DE76561298B7FE221D24C62E2340B69F3873D41D826F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716267, "uuid": "77ebe189-9e53-4685-a335-fe048fbb8f48", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716267, "uuid": "4f1c5faf-58f4-45c4-aa5b-6f5c4f4b25aa", "value": "24576:HizM1ZtNZNFk66A13kOl7LLj1g6Dt8yXPYcHje:CY1Z7F35fLjHDezcHje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716267, "uuid": "a43ecfff-198e-4e25-81c7-1284676a2495", "value": 1009995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716267, "uuid": "8efc0879-73c2-4b7d-927d-dcea91c450b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716267, "uuid": "da8bb3c1-55b7-452d-9e7e-304bf945d422", "value": "8296bc5164d69575e78a8d858297b6f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f853073-27f6-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633669912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669912, "uuid": "146a1068-c881-4423-962b-7ae52623a3d1", "comment": "Malware payload (njrat)", "value": "a23360923a178f5fa03aa6bc07af76ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669912, "uuid": "7d3f9ec1-8770-413c-a9a1-7ab47a5aa12e", "comment": "Malware payload (njrat)", "value": "6daefc6f282bc92111eca7dd24c20c236b209bd1d14d6290ac543c707d60df32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669912, "uuid": "01ea5489-a79d-438c-aaae-a158ce4bd8db", "comment": "Malware payload (njrat)", "value": "55627fa47a75643c3072389be3dadf4b3346284d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669912, "uuid": "a4f21e05-3f2d-4a17-9c56-150967027d17", "comment": "Malware payload (njrat)", "value": "ed74d26568c8ad63ac5888e2920bf8f8a6d049f4dd40f6cbb74fdb34ad87150cf3fc9b39597184bfbd6a5b4da81f7329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669912, "uuid": "a34da239-1ab7-4049-9d5f-a69bbab12d22", "value": "T146032A4D7FE181A8C5FD157B06B2D41207BAE04F6E23D90E8EE564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669912, "uuid": "56611887-d933-44eb-8018-af6a281495b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669912, "uuid": "50422c33-372b-40b2-b6ee-da7d27165e42", "value": "384:/IhqBkiyrnDNGRn5IyUv6IzfDhW/6wFbbrAF+rMRTyN/0L+EcoinblneHQM3epzM:wf5M5jUvPzQCw1rM+rMRa8NuDyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633669912, "uuid": "907049fa-b885-4b68-89b0-d03619b8366f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633669912, "uuid": "31e25223-25ce-4ca6-bc01-3d3e5c099f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669912, "uuid": "a734eb1c-f2f5-4e3d-bb8f-5b2e75fb62b3", "value": "a23360923a178f5fa03aa6bc07af76ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6903a98-27dd-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1633659374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659374, "uuid": "840a121b-368a-4309-b9d2-83ca438e2e9d", "comment": "Malware payload (CryptBot)", "value": "724e8026fcd687cbd7808408ffbdd3ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659374, "uuid": "9cd153f2-7fec-4b9d-89f7-caed42a90026", "comment": "Malware payload (CryptBot)", "value": "6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659374, "uuid": "e148e3e3-3ee2-4d7b-83d4-f97c1d45d2a3", "comment": "Malware payload (CryptBot)", "value": "d9243d3b0aa7a8d6b58b7f6f7065c9e55d4fcb34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659374, "uuid": "91e4fd63-a661-43bd-a39d-9017295036f5", "comment": "Malware payload (CryptBot)", "value": "c5776e5dcd951725201d3737dd35054b97a120e7998e2ee6eb45479d6b2c5ecd6611e4e7a959f1db9be209d61e6acad4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659374, "uuid": "6c199b6e-2845-4cff-a6d4-45e6150ca4b9", "value": "T1E374AE00A7B0C035F5F612F4197593B8A93F7AE16B7494CF62D526EAAA34AD4EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659374, "uuid": "49416d74-c832-4bf7-ad08-e0eabe2896ec", "value": "0d61443d5aeb8f94dcb0465acbd1f25d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659374, "uuid": "dda323b4-881e-4a18-a21a-e15cbcb035da", "value": "6144:haYcHyGtkpjwwj9azy/DcWWrktaxJwPR3:gTHXt279+y/DcWWrFxJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659374, "uuid": "9589fef8-7e9a-46cb-a56a-1d53643697b6", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659374, "uuid": "3b1533ef-052d-4c54-a807-a90f9899be87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659374, "uuid": "76098ffc-c56b-4d22-b1a8-ab79f3926c28", "value": "724e8026fcd687cbd7808408ffbdd3ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025bc6ca-283a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633699015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699015, "uuid": "efebe6b0-75e9-46a2-9f29-73fe45333dff", "comment": "Malware payload (AgentTesla)", "value": "67c0d730b5bca610d544bb5f92d46fdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699015, "uuid": "ee0ee733-575e-4d49-89fc-77478dad2980", "comment": "Malware payload (AgentTesla)", "value": "717d6f1816f57eebf48095b595cf5c513fa04ef050308049c56cf2383f7d097c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699015, "uuid": "5a8509fc-ebe6-4bda-a684-c4c3e34e9531", "comment": "Malware payload (AgentTesla)", "value": "a15df45149e7e08289d98ef0fc40dd3dc396f50b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699015, "uuid": "c5dbf314-d45b-4f10-8179-a6f26ef417ad", "comment": "Malware payload (AgentTesla)", "value": "3db62a2fc175bf9bc0d5ca91cb16c95d24a9a3383cb828b7af58568942b5c5fd99c326dea9169792dc9bf4b42dd68cd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699015, "uuid": "2e4762ef-2966-41ad-a63b-b6a2becc1e07", "value": "T141B4CFAC366075DEC85BC476CEA92C68EB6034BB431F52079063A1EE9A0D987CF155F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699015, "uuid": "61b1c6ea-bdd8-4293-9832-117e02d54a46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699015, "uuid": "cb02e1c7-31eb-46ef-86d5-841be0b1f08b", "value": "12288:AcglpMTmcaFgwnenjIlw7DN1vG3E6L02miYQ4z6:q8TmcaFgpjYUO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633699015, "uuid": "476c6800-66d9-48aa-83a8-83d06f113c51", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633699015, "uuid": "cff30977-3c01-4658-b040-6430a35c2c4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699015, "uuid": "4ce2bdd1-485b-410a-9500-32216a64edf0", "value": "REQUEST FOR QUOTATION FOR URGENT RESPONSE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3db873-2862-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633716374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716374, "uuid": "b88b3134-43db-4b24-b7b2-57de8d2ec8a0", "comment": "Malware payload (TrickBot)", "value": "864e1e300e32b0d2e40f145186719f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716374, "uuid": "4a327870-431d-4a63-888e-ff57ef9e997a", "comment": "Malware payload (TrickBot)", "value": "7329669d8afc510a838f43ca91821e5b01c157fb397f1f347490b4e028bbf6eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716374, "uuid": "33428d6d-8800-4fc9-8bb5-d3c5a6ada946", "comment": "Malware payload (TrickBot)", "value": "b78e1c74f4017166c5b673952e254600dae2f6d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716374, "uuid": "007a1f70-d917-417f-b386-5aba5f245f66", "comment": "Malware payload (TrickBot)", "value": "0c69fbc95f717ff52290cb045a5385c8a59b4f1c3b12bdd41a6278198832a1064d5dc1565f0ffaddb89ccb66a94b894b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716374, "uuid": "5d0112bd-cbb1-4c03-a0fe-e6c07e12bb06", "value": "T10BA4D033F1E4C8F6D1F712700EA65BA9B63AFC10CBB0EA5753805A5D1C76A858923367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716374, "uuid": "b490ea28-f15e-4c2d-9bb9-12f1d6499d15", "value": "f8cb6cf7a746c79f8c917be532cea46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716374, "uuid": "21794f70-67db-404b-ad63-be9dc1d61b94", "value": "6144:X9cZrtODhev9zIVchYkh2Kb//xHEZ0rmMTG9VVwF85HA5ke1W1DJSqFD:tmIDh1kB/xkOF0LNA5W1D5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716374, "uuid": "c0443348-074e-4bed-ade2-06443aba0efe", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716374, "uuid": "9f968253-e3a0-438c-bc50-16954fc897a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716374, "uuid": "bb46d54a-f0e3-4b3c-b6d9-80cc403bc04b", "value": "864e1e300e32b0d2e40f145186719f36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da37e40b-2844-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633703672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703672, "uuid": "e7d50cad-7c31-4eaf-aee3-962bb2cf84c1", "comment": "Malware payload (Quakbot)", "value": "c46458d7d92acdf0e69bb7b907c3e9fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703672, "uuid": "ad1cef17-8a65-4996-8df6-5bdef705f920", "comment": "Malware payload (Quakbot)", "value": "734f618a5d1cdf0cec77efe7aa492b49484a7e0853362c68577cea6d4e90fbbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703672, "uuid": "8396d582-f707-44f6-a26f-b266caf68d86", "comment": "Malware payload (Quakbot)", "value": "671f5fe47eabbf2d05cb7930b0a2d6c0c3c18a2d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703672, "uuid": "1ee8557d-34f1-47d1-9da1-d7e79549e568", "comment": "Malware payload (Quakbot)", "value": "84242cd7e317486c3a68e0b13af5183530d9ee95ed38c1edd41e0b8340df586bf6694a0978e94a34d84b42d70026fe30", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703672, "uuid": "1e3b1b79-636c-4ee1-9235-8f7b17893126", "value": "T167056B013A84D431E7EA55709E39C6E90A5C7D15DFB0A5CBBAD07F2F2AB94F39225302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703672, "uuid": "265990f1-193a-4199-bdba-8a9d46e87fd1", "value": "8c0d0671247235019d5724ca3b739bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703672, "uuid": "69c12dcc-7412-4f53-87d3-995a4e88cc7b", "value": "24576:Zz/lh7rH/i9rz+hwKzyUj/JGzwMgtx1EWsrbw4iaZ4gRrbY:Zz9h7e9rz+t/JGz5g3uWsrbw4iaqgRrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633703672, "uuid": "c64f93f7-ed74-4364-b7c9-c49a0c21c5e4", "value": 850464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633703672, "uuid": "05d5cf31-aaa3-491a-8947-f8f9f299f668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703672, "uuid": "9ae45170-d72f-4bbf-93e8-976257803ff3", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6961d8c-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633706619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706619, "uuid": "5e3a3ef2-6d57-47a0-a58f-732667c324d7", "comment": "Malware payload (Metamorfo)", "value": "91ff365117cf2bd8edd3983225b3eeac", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706619, "uuid": "bce21663-34b6-4e35-af24-f8ce034e230a", "comment": "Malware payload (Metamorfo)", "value": "73b767cf7dbba776e370a19b791e69508193ebf457f25438018f691441ab1913", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706619, "uuid": "f2ab020e-7d01-4413-a568-5b06c364d3a5", "comment": "Malware payload (Metamorfo)", "value": "a43f38fd27369e1eb65f2bc21df5f2b5bf8ca329", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706619, "uuid": "4f03dc35-4d30-45f5-9b95-a30a07f6b225", "comment": "Malware payload (Metamorfo)", "value": "86c6b2645d1b0e2a751f250bf6b6ac8b0675bf12c41bc69c542a09bc9d83285d2ca702aba5fdef964b852c0973609602", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706619, "uuid": "b8169a8b-8449-49a4-a363-a28d04e04d4e", "value": "T1E231D0051EDA0729C3B38F7A1077A2464A77FC51EE934F9D808497DE28A1050EC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706619, "uuid": "5809a781-7c99-48b2-8024-c62e5a00a40c", "value": "24:8+JUHRlVo5kcbA+P/+/P+jFz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+o8u1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706619, "uuid": "b81da980-f970-4d99-908a-f82141d0b9b0", "value": 1548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706619, "uuid": "2334e7e6-e57e-4782-abb9-a6cfcec3a8ac", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706619, "uuid": "756bae72-27e5-49d0-87c0-0b7755c5d8b4", "value": "Anexo - 045071021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdc5ace-2830-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633694769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694769, "uuid": "5f40e48f-dbe6-4c40-a9dd-6eacb1188c3f", "comment": "Malware payload (NanoCore)", "value": "c2cb6764c4ae28c29fdd1831798908c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694769, "uuid": "f8c1797d-9ee4-4765-b57e-edd733f47e0c", "comment": "Malware payload (NanoCore)", "value": "73e7073640cd97e98bf9e0b3047e43dbc856df1d7183c384db5f3e10427ad873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694769, "uuid": "25ccf1bb-c6f0-43e1-9aa5-6efdeb2cd304", "comment": "Malware payload (NanoCore)", "value": "2b58e90bf806f995086d1eed82af82fcd14bbb61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694769, "uuid": "54c1d46c-170e-4c5e-b3b3-cb99da404384", "comment": "Malware payload (NanoCore)", "value": "18bf6ec151ae74067c71de88cc607acf8257d788e2017a60b9be5181291c9c3f72044f209ed781940c99b020fd80e624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694769, "uuid": "6fa256ab-3870-4db5-b271-ebe4c62db14c", "value": "T1D73502527685C5B1D5622931D934E6FA2E387C20DE20952F73E43E6FB7351D0222AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694769, "uuid": "34946e84-e740-4ff3-8d2b-e87562871889", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694769, "uuid": "8a5ec927-17c6-4a91-933c-04554775c843", "value": "24576:bAOcZXGN8TpRIHAmUF1erVyC/wTq6ai0bagi7b6dmT:9STCkTq6d4a5xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694769, "uuid": "bbd565a3-b37f-46d2-98c9-7520d810546d", "value": 1158415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694769, "uuid": "b1de4986-82e6-4f23-bf6f-65a7c52c3730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694769, "uuid": "d6e48b8b-ffb0-4df3-a165-d70323a34840", "value": "c2cb6764c4ae28c29fdd1831798908c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09dc37e-2865-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633717856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717856, "uuid": "f28a6e04-a6fd-4705-b117-42ea7bb5c27d", "comment": "Malware payload (RedLineStealer)", "value": "abd1179ae904e45cd8262a79acabb15d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717856, "uuid": "06a51b41-3d3f-4c5c-9992-e3dc1cec01ac", "comment": "Malware payload (RedLineStealer)", "value": "76493231b5079b130b51b23a669c910a137a0e67fbabf59782de23dcf93a0d28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717856, "uuid": "265e74aa-b70f-4950-83c1-982bd7828613", "comment": "Malware payload (RedLineStealer)", "value": "d80d2fa7b23396574738b35f94a2184bb98307a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717856, "uuid": "072ed41d-47ff-49b5-baf2-ce63ccde1496", "comment": "Malware payload (RedLineStealer)", "value": "1e89092593dea30a66691ec20c81f61f69f6746729babf779bb21556986682f54d2d6c911dd982a44e8f8aaf1803582f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717856, "uuid": "48cbf082-1b45-42ae-8aad-1fdb3d9af519", "value": "T17863B67B017550A6C1882730F8A50F4B7ABCD6351980B698B08FF2EADC1D69D9EF43B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717856, "uuid": "0bbd1ff2-6f11-473e-8bc5-3e2ac088735c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717856, "uuid": "a215343a-c6ab-4067-82f3-faef5b395436", "value": "768:LJqWEyTs41Y9MKcPrMZ1IjsIG4sMVi7X25Ux0nEU/4Ty0x+WgWe7ryDARaj4mhyb:LJQNjTHIjsIGCiz2v/8HaykP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633717856, "uuid": "194bbb57-b0b9-48ec-acc9-58a698927252", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633717856, "uuid": "92013942-a7bd-452a-b8d2-18015bc059d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717856, "uuid": "7cb9f918-fb74-4f5a-95e2-a279e7b4fd33", "value": "abd1179ae904e45cd8262a79acabb15d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa917f36-282d-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633693848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693848, "uuid": "d4835f1f-b8bb-4587-b4d1-d37a8b3fa29a", "comment": "Malware payload (OskiStealer)", "value": "f93fe182b5ec5a3a1e343110b1ca22a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693848, "uuid": "78351aa5-1c9f-4edc-a758-a59915a05a5e", "comment": "Malware payload (OskiStealer)", "value": "76891a7bc50be94f6c5ad4e10cbb3a6eb515d452e5bcf80efbde25d8b61d8607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693848, "uuid": "a402e839-5e45-4bf7-93a3-1b8a1c0631a9", "comment": "Malware payload (OskiStealer)", "value": "0e0071d31a81435b3f3af726a6ecb69e75fe4d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693848, "uuid": "d26d5f4b-7b7a-4645-9cb2-87e26f4ee321", "comment": "Malware payload (OskiStealer)", "value": "d615b25837341fefac93f8c04656c6548d0eb8d7d8a02ba4dd9219c341720ec278f346c3d83048c495ac080a21fd89d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693848, "uuid": "afa3e3dc-df05-419a-9bae-691ea274af41", "value": "T193341247F2C189FFD3672E321C33FFB5F3BA4605146298978FA50E6936148A1770A985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693848, "uuid": "abbcdc6c-7d6d-478b-9672-a5ed2a927cc1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693848, "uuid": "e235e66a-e802-4be3-b332-566864478a89", "value": "6144:F8LxBsSVduKhsAc54L+s4CYPFZlLi/+YH/vm:/GduK+IjEVLi//vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693848, "uuid": "5ada3bc4-e7d8-47da-97aa-06a54c748de1", "value": 249811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693848, "uuid": "091174dd-fd79-4881-804d-3701d6e205df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693848, "uuid": "9230886f-7424-44de-862a-1f906ec8d326", "value": "f93fe182b5ec5a3a1e343110b1ca22a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898b307c-283c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633700101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700101, "uuid": "cf1d7bbe-3d1c-4019-9a95-f5ffc9bf0cad", "comment": "Malware payload", "value": "1072f91ff5a5d2a7fbdcd270b6180bfc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700101, "uuid": "eebe57d6-afb9-4b3b-9994-ca0dcdbd4534", "comment": "Malware payload", "value": "768e7ab1140d858bcf40e62a0a59e23dcd85831c67a0924ea8b82de0992b9b47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700101, "uuid": "ee2e2fda-4d19-4879-845c-ae8bbe2fa647", "comment": "Malware payload", "value": "f7c8181f0f7773c177eac1c63c53d3ec9321c010", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700101, "uuid": "a3333d3e-83d7-4948-ab77-883e24200215", "comment": "Malware payload", "value": "2650fb5b27d3c6b609e39af4a58c0a4ed44d290c55f53681d4f2596ad98266c3a811f675f7a97350a4752fc22b0d1272", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700101, "uuid": "769f67c0-dabb-4a1c-bb54-70b060552a9a", "value": "T1CCA5F74057A009B0DA3663B03BA1B710DBBD789DEDD9B1ACFD0FA13B4B2056B8765706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700101, "uuid": "08af9488-d17f-4b82-9763-d6ac126bee39", "value": "24576:Uo2f2vwkNNhPSs9El1AJlDYI5c7mvbu5hBebD1u8gKcZPL8:r2OvX9aobJu2cZPL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700101, "uuid": "4b35f767-4205-4389-95ee-141b752b05fa", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700101, "uuid": "b09a16f4-8a4a-46ed-803b-fdaf17d261b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700101, "uuid": "3cc28f22-550a-4d1a-8ccb-c888ea3aaea1", "value": "768e7ab1140d858bcf40e62a0a59e23dcd85831c67a0924ea8b82de0992b9b47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a263f966-27fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633673514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673514, "uuid": "8ad2dc65-4ca1-4625-b31d-6a99f8d6cae4", "comment": "Malware payload (Loki)", "value": "6c723afaf7020dcf54106f7c0b2beab8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673514, "uuid": "963da835-8eb2-4824-8cb8-5b5d1118641c", "comment": "Malware payload (Loki)", "value": "78a0715871efd92e83a6538bd479ae4ad347107e6adfb20cf655e61181585d96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673514, "uuid": "e3de5e7a-8d18-4ffb-950d-8d5697f019df", "comment": "Malware payload (Loki)", "value": "e489718e42f7925cddb2a8720769495bf82f72f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673514, "uuid": "13969d4d-e86b-426e-b3c2-f2e46e08e63b", "comment": "Malware payload (Loki)", "value": "70b313d3fcb39cb870c18a315f79f0e4693abfd90adeae06567cfe4b36ef4196cdeed852e1edb668475880d45690b333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673514, "uuid": "6506fb83-26f3-453b-84ec-a09079cb0e15", "value": "T10615D4002295C711D1B637F4D860CAF097656C55EA29C28B2DF1BEEB79B1B03CE11A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673514, "uuid": "9266719d-5469-4440-9361-0c2152d5eab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673514, "uuid": "32471da8-dc1f-42b2-8227-64e58a28931d", "value": "12288:38b0KuDyL9pD3n+0SL9Kl6kjQwAb/EHJV:Mru+L7D3+1CnGbEHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673514, "uuid": "f5b97526-3a94-4dcd-b022-553792d5bf5b", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673514, "uuid": "b0c9c308-b902-4e67-82e5-48a0ccc5de4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673514, "uuid": "35e65ce4-f5d8-4fc0-8855-1d0c123025b1", "value": "6c723afaf7020dcf54106f7c0b2beab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1cb9f5-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633659971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659971, "uuid": "73c402df-a097-4731-bc22-6687cb59e577", "comment": "Malware payload (Mirai)", "value": "c862043ba756114fd531ffe96273e24f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659971, "uuid": "fb001222-24dc-4846-a989-34bf58a5f5ad", "comment": "Malware payload (Mirai)", "value": "7a6f859060dcd92de679cd1922fbf727e639cd816e20807fc34474b114ffceaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659971, "uuid": "bf8a1335-c566-41e6-9735-8e0b6ad079f3", "comment": "Malware payload (Mirai)", "value": "1c1b3e418b973692536e6884fa84fe879abbe770", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659971, "uuid": "0cdb005c-1a48-4de0-8edd-1df013c5d706", "comment": "Malware payload (Mirai)", "value": "794ae7aa982366d5a2ef54c73c8d973602cbfdacf679539b573e8aecdb9a77df8e0322432494d74c63ccfb724b5bd98a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659971, "uuid": "ba288b22-53e0-444a-ae4a-94b6a663af4a", "value": "T13DC20892B9919A17CAD45377FA5E418D3B352398E1DF33039E122F407A8692F0DAB642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659971, "uuid": "bd933041-5b5e-45b6-ba28-6f7aae30da0e", "value": "768:Cl/S0320DJ+i8hnqpS+XhNKhIDmx85lZ:2S0pP8hnkhNRDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659971, "uuid": "dcd82e9f-3fdd-4306-8c1f-5316cd897460", "value": 26436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659971, "uuid": "f1b7ea02-279e-4bfa-92c1-089acff35f90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659971, "uuid": "f7aa615f-f1fc-4fc0-a142-d8ca3405ef63", "value": "c862043ba756114fd531ffe96273e24f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca5fc0f-2809-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633678363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678363, "uuid": "f44c133a-ea44-4c39-b0e7-709f2c9d70fd", "comment": "Malware payload (DanaBot)", "value": "1c38c0b56969a81e7adf89eac12e0d0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678363, "uuid": "43ca27e7-1550-4d71-8468-451323df3132", "comment": "Malware payload (DanaBot)", "value": "7bf358e7bffe42b707987d1e14465a5fd91fb4468b8bb5cc2bda2fd95ef801d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678363, "uuid": "d8af74ac-7caa-4dbd-b37f-c42c0e369496", "comment": "Malware payload (DanaBot)", "value": "cd0aed133aa9ac7f9ce555b4edbf5e8e68d9ce98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678363, "uuid": "f81e4bfd-1d8a-4677-a6f2-8ad6ad3428c4", "comment": "Malware payload (DanaBot)", "value": "d9941b2caae48e267596e007677c9821665357c89f0744a3685ad936f3946ed8a59c34a2f6c201ec5753cd5f68ee080d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678363, "uuid": "9a55c559-24e5-46ae-9c64-cf75bddcaeab", "value": "T1D435231036DAC033E66F26700A64CAA54B3FBE656772924F6BF211FD5E65382D62C307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678363, "uuid": "8c72b7a0-9946-4175-980b-3d533b1a083a", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678363, "uuid": "e058f898-c1b2-461d-98f0-481d68953a46", "value": "24576:jiwbzIFNHEG4k69HYz9Dft4yiRLSOJPUTYfeJuvpWDME7Ks:jiwbUBF1sRJJMTzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633678363, "uuid": "527ee64c-8bb7-4684-b9d5-d5e27ceaf2b3", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633678363, "uuid": "3fbb72b1-2a57-4d44-8129-a23f4200f588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678363, "uuid": "bcf98249-4050-4122-a2a3-1f4cadcbb36e", "value": "1c38c0b56969a81e7adf89eac12e0d0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0f6ac9-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633706950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706950, "uuid": "d21d6aa3-f527-46e1-b9c9-3309fe5b5cee", "comment": "Malware payload (Formbook)", "value": "baf212e9711b33e14adcaef461189e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706950, "uuid": "1a4bc00d-b4bc-43e7-bd99-51f748239621", "comment": "Malware payload (Formbook)", "value": "7c0ab1d837684e8d37e75578f4821e25d7729cb9d3739f397cabbb9c95f2ddae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706950, "uuid": "357eccd8-7119-4763-b84d-2e6f7fe992ed", "comment": "Malware payload (Formbook)", "value": "9239c7cd7e3a95c0c365aade6f541dcad52bd22c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706950, "uuid": "c2efed03-d12d-484f-8fb4-e085d4773958", "comment": "Malware payload (Formbook)", "value": "9e44dd2fb7903184c4ea680d0cabaf0653908a540e934c3bc8338e06a205c065de7de07af8ae9f0b0eca126a5f28bc0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706950, "uuid": "aa114040-1846-4aec-973d-918c6040f1ae", "value": "T1DC441257A1C18CB7F9624AF466B2F73AF77547410F21750303A49E3A78A0B87269D38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706950, "uuid": "9d2c79e1-6efe-49f3-8021-6b6253a8ace2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706950, "uuid": "b04369bd-1c7c-4ea3-baa2-ca9cabe02cb6", "value": "6144:F8LxBsYraWyTroLJvxcB2MjzGbK86mNeYjrEi1OjePBT:/NWGsLJiIOi768eY31OGBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706950, "uuid": "59f57e36-c05d-4101-9232-d563d681836a", "value": 261070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706950, "uuid": "00a3057a-b62e-4662-9371-1c76249a0811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706950, "uuid": "20c2466d-db57-43c5-aa0c-bcb58d39de0a", "value": "baf212e9711b33e14adcaef461189e40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ac4233-280e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633680448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680448, "uuid": "c5640809-7a5a-4e08-800c-34dd5d5e7515", "comment": "Malware payload (AgentTesla)", "value": "f7b2af2fdae8835266c03596a00e32f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680448, "uuid": "aa3d6591-c4c6-402b-8d86-7730bda5ae9d", "comment": "Malware payload (AgentTesla)", "value": "7c9d8eb662c655cd9dfc30fcb10e086386193d61f7306fd75637d8eeb8badd45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680448, "uuid": "ddf3711e-8722-4b0b-a1f8-843c271b4e3b", "comment": "Malware payload (AgentTesla)", "value": "53f5714e41c3d61677d07cc9d138df20913546be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680448, "uuid": "74795788-9464-4236-b7e8-3d98244eb645", "comment": "Malware payload (AgentTesla)", "value": "9e9dac719bb964ec6bea596acebb60db14011409a1ea77adc5b6dff5b878024b389efd201e257c8117088c436ab88103", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680448, "uuid": "c1eb6605-c5bb-4a79-8680-ae22322a1c39", "value": "T13C7506002695C701D1B637F5D860CAF093656C55EA29C28B2DF1BEDB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680448, "uuid": "b954af10-1d6a-47c2-81f9-47d542796762", "value": "12288:zzwA0fDyL9pD3n+0SN8AXL0zVmc9zvF2A8k+RL4:4x+L7D3+1N8wL0R1ldX8k88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680448, "uuid": "1ca6d650-148c-4318-8b96-69a83bc94037", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680448, "uuid": "01955277-fb73-4c44-9709-af0f934c4c0b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680448, "uuid": "ee15e8aa-a591-4079-9930-5a75365a3e6c", "value": "confirm PI#10020210546.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c2a6d9-2845-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633704146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704146, "uuid": "0eb44432-f523-4447-a497-4cb37417a3a7", "comment": "Malware payload (Quakbot)", "value": "0165319f5497be926734db4dea80c9ff", "object_relation": "md5", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704146, "uuid": "e4806e54-3614-4799-9cf3-bb8989d7f4b6", "comment": "Malware payload (Quakbot)", "value": "7d0c933be0e1c72e8de89fc3812e06732ada6a90d988d8bea548cb47c34be8c6", "object_relation": "sha256", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704146, "uuid": "56ed16f9-b4ce-4c64-8bdd-036a0008f0b0", "comment": "Malware payload (Quakbot)", "value": "e9edf9cb05909ed69c665fc5af7184f4331ba305", "object_relation": "sha1", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704146, "uuid": "bdc0a1be-98f8-4984-a81a-5d2e599713f8", "comment": "Malware payload (Quakbot)", "value": "0d080872aee837182afb5dd062b9bb398a5f3a6615c167866fe41b6cd5173787b073da368b32f51f8f1e08fff44c4320", "object_relation": "sha3-384", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama112", "colour": "#3E5C49", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704146, "uuid": "8332d9f0-f8ea-4960-85a4-c61cae22371d", "value": "T122D38C467797C99BE58903398EE3D69B3B72FC20DE32430332457B0E5E7A6A18C16752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704146, "uuid": "ea76c7c8-321b-4bfe-8912-5ed8a523b078", "value": "3072:/k3hOdsylKlgxopeiBNhZFGzE+cL2kdAmc6YehWfGvtUHKGDbpmsiimati+RLHc:/k3hOdsylKlgxopeiBNhZF+E+W2kdAmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633704146, "uuid": "2fe95ddd-22f2-4b83-90d6-208ab2892a51", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633704146, "uuid": "1ac19611-57b8-4aac-9525-dd9f187dad5a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704146, "uuid": "c4b61a78-7f47-45c9-a66a-175250d4cd39", "value": "CMPLN_1956676014.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d274ff6b-27ef-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633667152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667152, "uuid": "cb2b52f4-6420-4078-ad84-c3a7f424d90b", "comment": "Malware payload (RedLineStealer)", "value": "e19effaa677cb5e593eb379348d6a5f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667152, "uuid": "50da9a56-7007-41ce-a2c5-f4a90e581e8f", "comment": "Malware payload (RedLineStealer)", "value": "7d353bce5ec37a378a5800c6a8bad2203d80664ed304e2728010bb69f6fef950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667152, "uuid": "1f04b1dc-af80-4667-899f-36f4b3443b95", "comment": "Malware payload (RedLineStealer)", "value": "f0a13943c488352d3ff22389340d9e7125770339", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667152, "uuid": "62b3e5fd-3b8d-473d-a31f-9665ce5abbe0", "comment": "Malware payload (RedLineStealer)", "value": "6467577474d37f9e37bb7a48b9eaea752840366259eabd412500f29a6dce5657519b3f586f3dda994e8c5dbcd97bbd19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667152, "uuid": "c7ec4b7d-14cf-48a6-8841-0df636585781", "value": "T1A054E01076F2C435E2AF66384E71C7664A3BBC626D70508F1BF216EE4F322D1DA66316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667152, "uuid": "a77602d5-4aec-42b9-9394-d5dff3d83c75", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667152, "uuid": "47a37d43-1e98-4a21-b9ad-b37d94fda2cb", "value": "6144:6xPGFwrkxNBT43TiVeKTxG9RIr0ewCWobvreYDL:Sow0NBT4DisV9RcNZjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667152, "uuid": "76768735-ade3-409f-b3bd-793efc66e48f", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667152, "uuid": "5f04dbb5-e0b3-4cb0-83a4-05e330f79837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667152, "uuid": "8ec62a45-6e7f-45d9-99fb-8420763fa40b", "value": "e19effaa677cb5e593eb379348d6a5f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74157dcf-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633694052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694052, "uuid": "82ddd755-17df-47df-927d-e703d3856eb2", "comment": "Malware payload (NanoCore)", "value": "d8abec927aa5885f549ad9c5d83e09c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694052, "uuid": "cb28fbd4-af15-49e3-ab91-04d74d7f6b08", "comment": "Malware payload (NanoCore)", "value": "7df9406d1bbbebd2b00ab81be8182fa8b0185665af4ac6cbad0a8e6ffac0104a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694052, "uuid": "b5406618-d0a0-484e-8912-f02227f60a47", "comment": "Malware payload (NanoCore)", "value": "5c99b88e7d1e11461e789dfdd3a6302176355b5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694052, "uuid": "a6ed3e03-766b-4bca-88fb-09aeaa52f8d2", "comment": "Malware payload (NanoCore)", "value": "11fce90a08601c42436950e4cfa26c76f1dc010879321bbccaf90d0ad625ecbe6b5bb01a6aeefd25b0f56cf64557d6a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694052, "uuid": "97c56684-8293-4a3e-9c92-519daf8ec1d3", "value": "T1A9351212B6968472D2731E329A396750ADBC7C201E348B6FA7D4097DDB355C0A268FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694052, "uuid": "71334aa0-6a90-4aa0-a6eb-59797c05d22e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694052, "uuid": "42f41654-16ed-46e6-9d5c-215bd78c07a2", "value": "24576:rAOcZEh3G2mfLih+sliQIaB7UBgTWTq6ai0bagi7vzJIJ:t50fLi3izaBXiTq6d4a5vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694052, "uuid": "d0756399-dcfa-45a8-a674-67161efd14a1", "value": 1107611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694052, "uuid": "20f0a21d-f3ff-4def-b42b-622f63b6af17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694052, "uuid": "2249426b-d13a-46d5-85dd-b3e82130e8cb", "value": "d8abec927aa5885f549ad9c5d83e09c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d9856a-2802-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633675217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675217, "uuid": "899dfd5e-4aa0-44e7-b1cd-641adf31edd8", "comment": "Malware payload (AgentTesla)", "value": "13227221b1219457ae0dd44747253fa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675217, "uuid": "c6f6d5dd-f0fd-4a32-8b9e-db09e4c5e1f2", "comment": "Malware payload (AgentTesla)", "value": "7e327f717e68756a9a9c66d11777b442dfda467537ddb7e426a4ff606fd72151", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675217, "uuid": "0e1ce0a1-2159-4509-a797-75da23908c09", "comment": "Malware payload (AgentTesla)", "value": "9b6a5e9e362bbb7012b750e54cc62611380ca8df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675217, "uuid": "4114c46d-78f9-4afe-b1ee-c0def7d56eeb", "comment": "Malware payload (AgentTesla)", "value": "cd416999f88163b35d2c6c34f24c46235d220b9499481881e858a55870915c7bf0e93ebe2cf7341fe28fd21c5b443acf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675217, "uuid": "b604d291-c5bd-461b-a500-0ee27498f8ce", "value": "T12094F19422778641CC7C83F9291977606335D016626EE3780EA8F0FC7FA7BB54AE0697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675217, "uuid": "59596f70-cdf0-40aa-b247-ca8bb594f304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675217, "uuid": "af29d929-df28-4b44-ab44-da1f9069bdf7", "value": "12288:CkoHBvseqx1G4sbNIY1rpeOXRF/padwG/Jk6xJ:Ck6GTsbNz5jpaHxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633675217, "uuid": "0116c757-bfd8-4632-b1f0-f3d0e2877fec", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633675217, "uuid": "7b18e815-321c-4004-ae92-9ad6c9237ca4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675217, "uuid": "523b97aa-5cf8-4ec9-b896-33f0eb8a074a", "value": "Invoice-BELIMPEX-210705 (49.611MT Core Board).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc938de-2861-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633716164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716164, "uuid": "466d8fc3-e520-44d1-868f-ec330a069f47", "comment": "Malware payload (RaccoonStealer)", "value": "72e10883565c5a00df98e14a2771e7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716164, "uuid": "07469d8b-3492-41d0-80f1-f98f858627d6", "comment": "Malware payload (RaccoonStealer)", "value": "7e6f0c6c747f8c0e6d34b57115061e99b14f004dcd568001bc4923ddd4c4a273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716164, "uuid": "9f1354e5-568a-48c1-87ab-f4b04548b9a9", "comment": "Malware payload (RaccoonStealer)", "value": "55b5a66f9811e90184ca981c95d2a28c444ede1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716164, "uuid": "33789c82-1e03-4fc2-a96f-c9ef797bc297", "comment": "Malware payload (RaccoonStealer)", "value": "ae3f935518ae192f4a7e90960d925f5b8b74cc6daee8eb8fe3d3221d26088417fe7c9fb5293c86de890dab7a935d06c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716164, "uuid": "08b3cda5-39b8-45cf-860f-1c3bd2f156ee", "value": "T136941210B682D873C4DE16714852E7B742BB286625B1A08BBFF86FFD5FA13D01A35346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716164, "uuid": "6da347e8-c4ea-4c06-a4b8-72e9d3ded987", "value": "b81208afe657df957690a75b8ae29877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716164, "uuid": "4e575920-a0d2-4eaf-8cd8-49d75997052c", "value": "6144:rBfLsiXsG+JF0h0NLnBgqQEYNUTogSaPmGv/8r3+jVIhvGRhPeXpyDTceO:Vzsig76BOYC8g7v/k3+jgoh2XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716164, "uuid": "cc412486-e505-4c63-a5bb-aefeade1f956", "value": 448566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716164, "uuid": "17ee2a56-a91d-4f36-a613-e4b593bc5721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716164, "uuid": "494ab183-2c89-4c2e-982c-da31ea19c415", "value": "72e10883565c5a00df98e14a2771e7d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abace83-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633659998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659998, "uuid": "e53c40d8-18d8-4d00-92b3-7b2405c7d2dc", "comment": "Malware payload (Mirai)", "value": "a6d420044fde82b6170c7c063de8063a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659998, "uuid": "117e228f-bfb6-4abb-9d9a-d9bea36ad7c8", "comment": "Malware payload (Mirai)", "value": "7e988a5faf234d66712f5319a7d13f76c0b375a178945db7d4949fe109b6df16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659998, "uuid": "41857e47-3ce5-42e3-8a7b-b3c5c2eec662", "comment": "Malware payload (Mirai)", "value": "b5f4ccf62665c916125f16c0898c54544cd74d40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659998, "uuid": "e11ecbad-41f9-4d04-869d-9acd3180bd3e", "comment": "Malware payload (Mirai)", "value": "783f99fcd3f43f936554349bdc6e9d942667cea0be44a3e028927d5f6e97aff33bbba3eaaf49950060351e6a0f80f48a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659998, "uuid": "60b51e26-ae94-4fdf-85e8-97aa1465b037", "value": "T144B22AC6A883D5FDE82156B660B7EB339776F42A7408DD47D368D5B36C825009E0728F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659998, "uuid": "341b824b-c0b7-4bb6-87bd-c88c87bf1eeb", "value": "384:fnyB7bc0ebo5hwEBA7E/zmDsQm0fyLLDaKNHvSKC17bqE9jPMqdTjNHkkkZ:w0Sm7E/SgOfyWSqKClPMeTjNEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659998, "uuid": "3b19d9e5-186e-4530-b5a3-63c8f01468b6", "value": 25176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659998, "uuid": "e5fd82ea-687e-4371-9cfa-929c97cc9556", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659998, "uuid": "cab59ff3-0ece-4ba7-993e-8b528f10dfe0", "value": "a6d420044fde82b6170c7c063de8063a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a7515b-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633668605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668605, "uuid": "dacea6cc-f389-4b10-baf5-1187b7b1f1be", "comment": "Malware payload (RedLineStealer)", "value": "7dcadb62989654b48b14fad128a42da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668605, "uuid": "a73dcd46-e6ed-473c-8184-f6c47f8b6548", "comment": "Malware payload (RedLineStealer)", "value": "7eef9ccab581ff9fd105d641c38dd0a835cf1b2a6e9cf47b91d17e3c2ca358ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668605, "uuid": "9b9f563d-ee56-4680-b7d7-daa39736cb75", "comment": "Malware payload (RedLineStealer)", "value": "5bb25a50fc6df8d96474c0080595e223f9050415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668605, "uuid": "9f2fe02c-57e3-410f-8d7d-0da2b3e8a736", "comment": "Malware payload (RedLineStealer)", "value": "f3bece1967282be719c5921410db049f91a019bd1621b79d9614844c5afa34b308434633642854929e30396a67bd4b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668605, "uuid": "64cecd34-9b90-495c-a268-4b275cfe5d71", "value": "T1DAD402102691C03EE27F65754E708A508B7BBC239970A48B26F617BA4F657A1CF26337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668605, "uuid": "03f0a982-f5a0-4d33-b400-58495c51e632", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668605, "uuid": "9bb57dcd-1a37-4f5e-bd30-306a12ed9aee", "value": "12288:6Rt7J/E0POdH8GVSk+EgenNhzEFMjuyHC+2b1oiZFr:6RtRPOlL4qJbEF6c+QqCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668605, "uuid": "b9fb1a39-6639-4052-a3e6-d527ad6ea252", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668605, "uuid": "aa4084a0-484b-49d8-8ca2-f30a306a0f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668605, "uuid": "d8e7d78c-8029-4711-b848-49a25384951d", "value": "7dcadb62989654b48b14fad128a42da9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1291a43-27ec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633665834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665834, "uuid": "062ce9af-c022-45b3-a249-b27d5acfddf5", "comment": "Malware payload (AgentTesla)", "value": "ba92a6eeebb4eba7c4f39135d51f10b6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665834, "uuid": "52838786-257b-4564-84de-c5756dc001e0", "comment": "Malware payload (AgentTesla)", "value": "7f39705ac3006c28346790ea38c684a973e4fe3534ceca73932e910a05dbe315", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665834, "uuid": "875137fa-04a5-4560-a54f-815ce4f53138", "comment": "Malware payload (AgentTesla)", "value": "e1cb5cedea34e542b57faf27aa9f8fce2352d227", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665834, "uuid": "f44850fd-080e-4d90-9b05-f4cc8c479f92", "comment": "Malware payload (AgentTesla)", "value": "35c816de70bf69e0b0f60d24d6243e48480b824cc7cf755c36aedef2a1869cba02a695d7603fa65ce1ac761bc3a19e6e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665834, "uuid": "556e504d-86ba-49f0-98db-893a06f2aa5f", "value": "T1E394236BF0A4D5DEEC52A3217DB4F75A01082D5A4EF4293D3390417E1FB2A6EB816C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665834, "uuid": "be4a0979-5b0b-4934-8edd-7c9d9d397af6", "value": "6144:sX3oPMZ1M/wmzhnE/iJOGNn+A2tc/6g2yR2kj5Z0sGCFlmAtjiyvc2Pa2+3h:sHoEETJCg2yR265ZSCHmA3c2C2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633665834, "uuid": "b2846169-5bbd-44b0-9019-e56ad8335523", "value": 412188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633665834, "uuid": "436f0cc4-8cfb-4f2b-9e74-203bc4b9dcd3", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665834, "uuid": "e6b2fa8f-a8c3-4672-bc46-57023e8148e3", "value": "nuovo_Ordine-pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7905a0-2868-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633718789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633718789, "uuid": "04971882-d110-4b25-a7c6-635386d3004b", "comment": "Malware payload", "value": "85bb826bec2ceb216bac61ef4d6eba9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633718789, "uuid": "50b99cce-e82d-4131-8659-394f50ce11d9", "comment": "Malware payload", "value": "8044cb87ea2f5796fde3829f8f45f1540a2c1c425e5adc03d028ce3f737940cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633718789, "uuid": "6fd13556-6e73-422e-8e6c-19a8cf6be301", "comment": "Malware payload", "value": "10425b5ca8d775b744dd82a53b6f321c9e5dfd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633718789, "uuid": "1c634638-65b6-4621-afde-4a604c026a5f", "comment": "Malware payload", "value": "4b3915b64849274710a28a98a3915300cbe9ccbc0d8c2aa5f5fdababf4b0c2f81bb827f5e2d7d74733580d9d87fb9af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633718789, "uuid": "9005d4e1-7792-4876-8575-12254d414f8a", "value": "T11F947D59FBA408B5E066D1388D378545E772BC8A0B70DBDF2364525E1F33BE0993AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633718789, "uuid": "22ad19c1-8060-40df-b878-b7c22d770ac6", "value": "bb371708c55cf92a872421fa64c41b03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633718789, "uuid": "41b9dba1-cb2a-4630-857d-85fbf3d44ddd", "value": "6144:3AcJbfEZxGUr2mVy56i8+3lJ69L7cRRaAC9BJcoh/LiXq0Fe17qkIV:XJbfEZchmA56i8+7O7SC9coFMq0S7qk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633718789, "uuid": "8866a859-2069-445b-ba6a-1a417c4774e0", "value": 428041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633718789, "uuid": "0e81a180-baf4-4abe-8c4e-dd1a7bf5312a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633718789, "uuid": "be07806e-7ab4-48ea-a0cf-9d9f37b18811", "value": "10425b5ca8d775b744dd82a53b6f321c9e5dfd2e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324ae7e6-27d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633657005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633657005, "uuid": "e1912d30-fd06-4c83-b6c2-a0925279fb09", "comment": "Malware payload (Loki)", "value": "6a2b5b8f86f5be8ea02dc895d37cd205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633657005, "uuid": "b0229a90-cded-4aae-85fe-bfa94f28d648", "comment": "Malware payload (Loki)", "value": "815ffebdbbd8196de95355b067f49b562237b0818c5bdce80b1e4248f1b493d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633657005, "uuid": "1d4095cb-6842-4e0d-a86f-4963eb6025c0", "comment": "Malware payload (Loki)", "value": "d18896a1ce2ed7dda377c9e7ea0ef72933b6fdb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633657005, "uuid": "fe64babb-8794-4930-8f5f-a31f2ad0fc06", "comment": "Malware payload (Loki)", "value": "b0d3114b8ef14acfe21e989e0329682aa2d3ab6a0eba749d0dc707413f1fef783cd3ae649d71b4678a95329b93199559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633657005, "uuid": "844a73f7-61c8-4f4b-b90b-c252fbeffb56", "value": "T166E4C46C3B454A72ED1D8AB14B29DE08FB672F83624C7D92F3AB25CA871F1571C44CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633657005, "uuid": "48163d13-f18e-4ab6-9644-5ebe5d229597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633657005, "uuid": "dac10503-a239-4f8e-90d9-09e7dc8271da", "value": "12288:yTJCZXIzeeUdZzLyMGKRVWdAnwuBd3X3uIIIkIxV0DT:yXJ+FLFGKRVWdAnwuBd3X3B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633657005, "uuid": "c589173c-52e0-4534-a007-2b1e4490d802", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633657005, "uuid": "7dcbfc69-454a-4828-8091-a87c3cdd9911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633657005, "uuid": "1d1c5845-54c0-4abf-a2cd-104719786113", "value": "IMG2503169654100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffefb2ad-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633674100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674100, "uuid": "eec186f8-45eb-4cc6-bc94-c2a14a95c33f", "comment": "Malware payload (Gafgyt)", "value": "639ce556adbbab2cb7a1bd3ec851d64f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674100, "uuid": "b14899de-2fbc-4d03-b9d3-72f9063727c7", "comment": "Malware payload (Gafgyt)", "value": "81784ef5160d97d0b77fb0a9f9c6fa12c14d6f582301a72b0a6815a1344caeec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674100, "uuid": "bed8e2ec-ce57-400f-b3de-2a683a2b995c", "comment": "Malware payload (Gafgyt)", "value": "e48d13de25c4a7f372cae3f9db68ed1ea274ae32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674100, "uuid": "56351474-5488-4bfc-8b37-5e85bb443e56", "comment": "Malware payload (Gafgyt)", "value": "1ad33fb18a0c7d44b4b71fe1f7f0f3f1cc6aaf47714cbb5e249b74340dff529bfe2e4b0d2ded969c027832b6d559bd77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674100, "uuid": "b474793c-fda4-4b13-9998-0562ef88495a", "value": "T12FE33B09F6408B53C0D32775B6CF524537239BA5A3DB33069928AFF43FC27AA4E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674100, "uuid": "7e6fa428-ed3b-45f8-994a-800182195a3f", "value": "3072:yRAdZbsaNMlNHJPvF7y5OA5hwfvT6/IM/9RPO4m5wTy+/Quyn:yRMtsaNMlxJdy5z5hwfv2gM/9Y4m5wT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674100, "uuid": "9a3a4ca7-8961-421a-bac2-6408185fbe83", "value": 156069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674100, "uuid": "f1d53ab2-6eb1-4157-884b-ff5dbbb759ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674100, "uuid": "0d4f634a-4711-46de-a1cb-2a8eaca08bd2", "value": "639ce556adbbab2cb7a1bd3ec851d64f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd2b494-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633673825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673825, "uuid": "2700d9ff-efca-4cd2-bec8-827d4ec6df2b", "comment": "Malware payload (Mirai)", "value": "396af8e9db1841c30292d0e2d9d93deb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673825, "uuid": "ddeb3a8b-8b3f-41d7-a390-6460b51d70bf", "comment": "Malware payload (Mirai)", "value": "8281e2c64f144d99687fa3f31ffd74cddf051a315c568deb4929e02248300327", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673825, "uuid": "989d1d6c-a185-4200-bf37-36b7a36a5da9", "comment": "Malware payload (Mirai)", "value": "c1adc605d43c9405aaeba0dde5f45de2d12811d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673825, "uuid": "e7f1489a-97bd-4c3d-a08b-439c354e7ec3", "comment": "Malware payload (Mirai)", "value": "96fb976d56b172398d036100b9081385b22dfa8dfea6f02716287986b2fec79bc4788c17b1e8e77b1a9eb3f9effaece1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673825, "uuid": "458a87e6-0e53-4d87-99d3-dfd61ec15477", "value": "T107332981BC919A12C9C423B7FA2E01CD372563A9E2DF7207DE216F1177CA82F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673825, "uuid": "6c33feeb-74dc-4e25-b92d-81379c7d231b", "value": "768:aw8hF5yjQQsLC3TfWvHbXFspnpeyrNSwrfqUoOPbmBNOS9iVjySfR2Mj:GhF5yjQ7LC3TWvHbXCGYSkfqp91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673825, "uuid": "d0e621b6-894e-45fb-b9b3-5b1f902eac2e", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673825, "uuid": "2e2e2402-f3cc-408b-a9b8-36fb5a9d8ec7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673825, "uuid": "72fd31c1-b499-4148-a0d9-86f5043e8b21", "value": "396af8e9db1841c30292d0e2d9d93deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0929476-27fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633673537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673537, "uuid": "e9adf9df-0fdc-4af6-8a3b-dba9714a4504", "comment": "Malware payload (Mirai)", "value": "032cb23ae5c16fb2fb013f5638964463", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673537, "uuid": "04727ea7-5802-4fef-b856-27bded2e3e58", "comment": "Malware payload (Mirai)", "value": "829fd3a3edc5779e3f59d709c34f8b2f01afa882160e0e5b077420766f105798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673537, "uuid": "01098a74-db9f-4a11-a3f3-ecb15d384d04", "comment": "Malware payload (Mirai)", "value": "d75f8c9e21ef925a395fa2c08fcf2bed899882ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673537, "uuid": "3ce933fe-32b8-4109-8344-ec10688a0470", "comment": "Malware payload (Mirai)", "value": "ab393d023beb38b5216d8478f2969edcd0925f482ff99077cdc7e49e6ce6a946f2947d036c1b060dac8c0ab9c559b812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673537, "uuid": "f28219ff-017f-4415-bc16-beddcc84e4b8", "value": "T110235BC5A587D9F8FC160A342172EF326B76F93F1018EE87C7959933D942702E10A5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673537, "uuid": "1c8626d5-7893-4f18-8189-e91431d3b38d", "value": "768:53sPWVrWy7PBIedilokjFMdMh80otXznlxKUu141AaIK5pYim61ls:/D9I8ilokjFMdMu0inLKH14SDKLrm63s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673537, "uuid": "9005022a-e9d0-48ae-a8e6-4ac09d787da6", "value": 47024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673537, "uuid": "3000d3a4-84d6-431e-8476-2f1a77d99259", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673537, "uuid": "a419242b-7782-4c5a-ac5d-ad2ef92e1931", "value": "032cb23ae5c16fb2fb013f5638964463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cc748d-280e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633680398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680398, "uuid": "e91cb3dc-c123-4f7b-80ed-b765bc7a5db0", "comment": "Malware payload (AgentTesla)", "value": "d4703f7967a5725a9e40b9daa22fac18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680398, "uuid": "466972a3-aa12-4c72-947d-310331547aa7", "comment": "Malware payload (AgentTesla)", "value": "83027ee13e9ffed64aef90253d5f03d786b9d941444237e5310edb7161b628d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680398, "uuid": "2b7e8d57-2370-4ea7-9202-093cfb3333e6", "comment": "Malware payload (AgentTesla)", "value": "80aa4e0b0a515619551897330e5e0e32ae7dece7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680398, "uuid": "3eaf0089-1ff6-4734-ba7e-240aa714d97b", "comment": "Malware payload (AgentTesla)", "value": "c1220d1dda27fe663a641f9e126c134c566563f19eb4b0b658ac6f1c77a2390d92a1153080f40424fb6aeef8cd46c6c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680398, "uuid": "64e9911c-9328-4c72-945b-dfe82efc2e20", "value": "T11A25F6002695C701D1B637F4D861CAF093656C55DA29C28B2DF1BEEB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680398, "uuid": "2a6f329e-c6e0-48e8-9bab-d73975057d92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680398, "uuid": "0b900cd1-4161-4996-872c-0d7d710ab737", "value": "12288:sXU05DyL9pD3n+0SFcFx2o1C+BAFN6T0T778KQahp0TtMR:Kr+L7D3+1FmxEhT6TI78KBhp0T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680398, "uuid": "bdcf0e58-a966-4f95-bf76-e0bf65a15b56", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680398, "uuid": "55d09b94-949f-490d-84d9-e8d53552bf27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680398, "uuid": "5c7c2380-5ffe-4aa2-9d77-c5f6829d685b", "value": "SH_062847193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973c419a-2893-11ec-843c-42010a9c0014", "comment": "Malware payload (QNodeService)", "timestamp": 1633737490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737490, "uuid": "4755b101-c6d9-4fa5-87c3-615820e12159", "comment": "Malware payload (QNodeService)", "value": "1e402e51c81595338f70c559d60310ba", "object_relation": "md5", "Tag": [ { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737490, "uuid": "98aba512-bfe5-4c3b-aa78-5c1bdad6676d", "comment": "Malware payload (QNodeService)", "value": "8365c8f584aaa90207ac42f3ddee63a3935e4e1229d6cf6dfca6ee40fec12f17", "object_relation": "sha256", "Tag": [ { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737490, "uuid": "5147d3b3-adc1-4b8f-b23b-5940aafff94c", "comment": "Malware payload (QNodeService)", "value": "5058a8c1e890bb98f3add6b0b0b898befdebb4b2", "object_relation": "sha1", "Tag": [ { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633737490, "uuid": "6dbb3497-d0fa-406d-8f4d-52f0c9c9c231", "comment": "Malware payload (QNodeService)", "value": "e197cbe1645909191d8a2e8e77fe07980d38bdb15e90a116ab9dfc716a1ca153451aa4cb826556b1c6f6896470f3799f", "object_relation": "sha3-384", "Tag": [ { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633737490, "uuid": "6d1ff11b-293c-4fba-bf25-aecc71a623b6", "value": "T12BB423E47B1E754DE716727F3396D9CA53A5A46AC3603C4AA226D30EE04247843FB633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633737490, "uuid": "a5af3004-9d53-4ed0-91ed-cd1433272b41", "value": "12288:vgWIW/2uH86KFYitOrexs4YuAaQ4hTY5yx:vgHTQ1KDtOrz4hTYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633737490, "uuid": "7cf299b0-f1de-4674-bf06-994e515cb6d2", "value": 496554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633737490, "uuid": "69ae6629-8087-4223-8188-17edc1d33c1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633737490, "uuid": "7d9d0dd6-1300-4631-90a2-3c5cfe175218", "value": "IMG-08102021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98748304-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633706998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706998, "uuid": "79e83e35-5140-4116-ac63-6dd149011166", "comment": "Malware payload (DanaBot)", "value": "cdbf24d1750c61ebacf6f73b4a598881", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706998, "uuid": "2934929a-fb02-4f22-9d6b-13df4556a5e7", "comment": "Malware payload (DanaBot)", "value": "84152e97051619068fcd8e0e59428e636fa1c69a3266a1fadbf6e69d919dbd8c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706998, "uuid": "03a3f966-11f2-4949-b1a8-7a332a871ae9", "comment": "Malware payload (DanaBot)", "value": "e978e44f48dda4823642e1985f955598e44c2c79", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706998, "uuid": "c30e8614-9c13-4cdd-bef6-3626b499f55f", "comment": "Malware payload (DanaBot)", "value": "f305040f4e716a89ec73314348e5eee53bd53744faad9e6170bd51eed8d2ff5f8fb3f0494420d6270fdf7f3fdbd1c2c3", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706998, "uuid": "e8b75ebe-d028-476a-a8ca-cd87966bee48", "value": "T1AA35223477E5D036F2AF25708E2187460A3A3C52A631759A7FB265F89E341A1CB3D30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706998, "uuid": "1785fca9-b1af-4b5d-aa03-ac50e9d64551", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706998, "uuid": "2bf30cfe-aa04-4115-b22e-6208e23b6fdc", "value": "24576:U1xrzXzf5EmBUudUWMK8xl5c4nVERdvNafl6jKNf0fwtt1:U1xrrzhlDd6K8VcRNi6+PtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706998, "uuid": "ea183fa1-d2f0-4ba8-a449-6f83af1f08e9", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706998, "uuid": "c9a31bec-ffe8-42a4-a717-b4737c0b4185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706998, "uuid": "111cc993-1a4d-42d4-9b00-9710302598c8", "value": "cdbf24d1750c61ebacf6f73b4a598881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dd0d2a-27fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633673526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673526, "uuid": "efcf5f43-3048-47b8-bb34-062fb85984b7", "comment": "Malware payload (Mirai)", "value": "535fc31a08c6dade1911676731a96852", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673526, "uuid": "01de5491-4d42-428a-91d0-7f0b4937c9ac", "comment": "Malware payload (Mirai)", "value": "8472c823477150a1b1287cca7a7a9cadbe05dd134619a11d324329b5e63022cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673526, "uuid": "37d08a0b-29df-407b-ae66-9fe1808adbaf", "comment": "Malware payload (Mirai)", "value": "c57e28408d3e53535a7cbdd5b4b93d72efd4cbf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673526, "uuid": "cccfa7ee-0259-43dd-8c99-0e263740f14c", "comment": "Malware payload (Mirai)", "value": "a6df6c1edfe8b19b33d8c7e7159a5725ed478daebe941728792188aad90b0c95e9ff5b0f22ce210e5a4056dddd433557", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673526, "uuid": "2abf938b-37fa-4983-a164-495d0d111879", "value": "T1C03308C4FA8B89F5D90749304067F13FCF31D5B941B1C6ADEF9A9F35CA67542A20228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673526, "uuid": "d67aa70f-ab29-4da7-8bfb-3ab257ebafc8", "value": "1536:nfyMY0q0Yv5qP69Dj0MGNLijIFtbL7YkOE1tP:fyMY6Yv5qP6BoNLiWtbfYBE15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673526, "uuid": "f3c4e9a8-50cc-41e3-9970-8b8793d58b23", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673526, "uuid": "75229a7c-0808-45b0-a1a2-c2bef3d04269", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673526, "uuid": "dde6d41e-19d0-41b0-b2b4-f3b86f607bad", "value": "535fc31a08c6dade1911676731a96852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a737c266-2865-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633717760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717760, "uuid": "11a95a5d-130d-4b42-ab8b-c8ca341c87d6", "comment": "Malware payload", "value": "a83c5b4682feadccb8d0d5388d94b985", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717760, "uuid": "59142cf0-9570-428b-8df1-adb99655e276", "comment": "Malware payload", "value": "84806a1a1a3a6674f1aeb940aeeef2d7e22a60a99ae03d06107a8564f45d2f98", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717760, "uuid": "ba55a589-1295-4cd3-aa1f-4f3381b2947e", "comment": "Malware payload", "value": "a972889889b7457770f5a1b203c49b436362ba7c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717760, "uuid": "b0a0d410-5ff4-4b8d-8276-901c9c7b1cf9", "comment": "Malware payload", "value": "3ab2a2e53b3782a32d41d23354d76236011b05e6c63d9f2be85337686e1182b5f54fd364064ebd9ba25701f608f04155", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717760, "uuid": "518e7b07-76de-4c1a-89cc-8be03449389f", "value": "T173E533A64FA4D4FCD80B593099AB84E2B63F0312DB97C2A73D0F455B9B56C24131B8F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717760, "uuid": "07ce19fa-5bf0-4d71-832d-5768f0c6a8e7", "value": "49152:FceptoszdzlnMHXqyX/KiO1q2TwDzLOzVwXw/z0gEpVOrELRRxIWhgR12xn:GiBzfnqXq29OZMbMVwXw/zLPrEzxI7yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633717760, "uuid": "e25bf5a4-b7bc-4066-a1b4-ebf514dfcaaf", "value": 3032209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633717760, "uuid": "c8d354a5-7e4a-4eb3-9911-98238d966b0d", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717760, "uuid": "1c7b4fae-bc0e-4e98-bf60-83c2d07f5382", "value": "Porno_Izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d23061-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633668738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668738, "uuid": "c9213a9d-72c7-482f-a03e-7b453e605f00", "comment": "Malware payload (Formbook)", "value": "6c63918b39ec12855131ee16f7806daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668738, "uuid": "31f6e41b-db92-4473-8c33-807921f3d7ba", "comment": "Malware payload (Formbook)", "value": "862d9ecd31b3ad9fbdaf4f5c25e2bf5e4abbbb0a922e097a0c0dd69c8acb6ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668738, "uuid": "7c1bdd62-a94c-43ec-afcd-f62d52f28538", "comment": "Malware payload (Formbook)", "value": "6737b504e82d14a4bba4891f7e01da49c63161df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668738, "uuid": "4fb4f54a-739c-422f-8adc-1caba89d97f4", "comment": "Malware payload (Formbook)", "value": "d404395b2d587fa65e9eb30aa13299fd7c3803dc6568df55b171a0ff0cfcb995dbd3fa44b91629446ab2d5d057cac9e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668738, "uuid": "a2a652dc-3585-4220-857d-8c265f2cf87a", "value": "T1F825E6002695C701D1B637F4D864CAF097656C15DA29C28B2DF1BEEB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668738, "uuid": "d617ad04-8183-4562-af2a-24a00a2d5a78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668738, "uuid": "68df2965-48ce-4171-a97c-64560bd21a9d", "value": "12288:bLE0lDyL9pD3n+0SslGqk6iAPOXJRyD9wVovYRF+UEPKc:Xf+L7D3+1q0yD9DgRYUEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668738, "uuid": "bf41e607-9a8e-4304-8d2c-78488ef8da06", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668738, "uuid": "dfb738d7-258e-4f23-a1d7-2ba725b4ca5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668738, "uuid": "db84dca8-4f1b-4c36-ac88-1030f8cf0073", "value": "6c63918b39ec12855131ee16f7806daa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8cae62-280d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633679891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679891, "uuid": "edf840c7-8aac-4a26-99e1-197992731580", "comment": "Malware payload (Formbook)", "value": "754d58f597c5947d64269ad73f3e38fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679891, "uuid": "280cf18e-e98b-4ac5-bc63-dfd027f3e104", "comment": "Malware payload (Formbook)", "value": "86aab91018b32a9ee913459090b66fe44f00e625f05560483547ad39d542a61b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679891, "uuid": "c913375e-693e-4116-b36b-06ca196fed12", "comment": "Malware payload (Formbook)", "value": "abd09f3ed17e77b7dff4a57e465d8d79af7ab9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679891, "uuid": "c67a1945-db7e-46eb-8616-b6f7b2c1ef24", "comment": "Malware payload (Formbook)", "value": "d5d90411873e28006cd26278680ac11320e9d8bf65f33f69c2cc1e0f9cd5958e6f6e63a1853162f1db52457a1318ca19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679891, "uuid": "138a90a1-4e3d-4197-a213-a82c6179a4fb", "value": "T13B44120369F39AFBD19362B81273E77FEFF654695322068313805F721C511AB9E096B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679891, "uuid": "b3d0c201-d845-4d39-b2e0-e37c78cfd607", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679891, "uuid": "1d2989ac-3880-4ad7-b6bb-09a6c72b4e56", "value": "6144:F8LxBsoiasdxJ2BaggnRNlMman37oLSJDy5i5ZJFSwb:/1JUaggRNloBJD5Z7Swb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679891, "uuid": "37395b5f-3766-468f-844a-f17fc1eb8708", "value": 257790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679891, "uuid": "d3e38494-9ac8-41a8-a157-c2bb0a99a6e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679891, "uuid": "eb3ee722-ba78-4a6b-811e-dab8aeb3c119", "value": "MV ROCKET_PDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70435a49-283d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633700488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700488, "uuid": "7576ed1e-f0c2-45b9-ba07-07082ed15ac8", "comment": "Malware payload (SnakeKeylogger)", "value": "98147ae0775ad4e705d83aa363c3f813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700488, "uuid": "9121a745-eca8-4b58-a55a-4d328624c660", "comment": "Malware payload (SnakeKeylogger)", "value": "86c09af046beb3862b4f46e7ddaa73216878ea47f6dd937143bb937ef3745baf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700488, "uuid": "e6b21f50-e9b6-4b2f-bfaa-e11f8a99b436", "comment": "Malware payload (SnakeKeylogger)", "value": "931ce4f9edae9b062d56f32461475a62d2e6fb6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700488, "uuid": "05994050-64dc-45c9-b3a2-b0ed8c1a7cf1", "comment": "Malware payload (SnakeKeylogger)", "value": "0fff7f2bb308623bd186bb1faa1f4550ab107bf9d0fc1797b3f420576485a1d528d815c79e7b4805fceb082ecacc12ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700488, "uuid": "d9240cce-2971-4d83-b1b9-42067f5409f9", "value": "T166D48CB522F7814AFCE6C1F1DC44EB7362ED6C6DEC94C295E8A67065E273EE4168400B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700488, "uuid": "67236f16-1988-4cd8-b1a9-5dd2e191f1db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700488, "uuid": "0d78a2ba-959b-401b-8f74-85563510a0e5", "value": "6144:AKPysXKrO+XOp6RvYgpKnIrODvzJuwoX4ajAHqEFB0Zb0it3je4Q+3HwOpftZU2M:jarOuZrKvIw6VjAHqEq33Copf3UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700488, "uuid": "c1930c11-ee57-4d55-9dd9-d1afb6086a5a", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700488, "uuid": "d3250233-828b-4d52-a121-07c4b66b54e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700488, "uuid": "f85bff5e-b683-4fb1-b1b3-7e26dab365dc", "value": "Wire Transfer Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582522e3-27f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633669094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669094, "uuid": "9cf2369f-6a50-47f9-ac60-fe35c31b0cbb", "comment": "Malware payload (AgentTesla)", "value": "47d7067e29230ccbd54ed1c28d3a3e29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669094, "uuid": "fb22c588-7022-4a7d-814f-e5678397d279", "comment": "Malware payload (AgentTesla)", "value": "870a3493d4ee25d6e27a4feb3775987e5fee26ccabb5e6a2efa4d6219d3a7f0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669094, "uuid": "b190df5e-8436-4a44-a93b-c2805dbab4d9", "comment": "Malware payload (AgentTesla)", "value": "e3460008b22410f6769399d48d5a9a59cf2f55ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669094, "uuid": "8323d94f-a8f4-424c-8a7b-42b8cbac198d", "comment": "Malware payload (AgentTesla)", "value": "99aff3f82ce0c68ed9019b4a5bd965e5f0b24e63273d0b1bbf9efddba010cf7e67e81e3a9d65512af6da3a8c70da14a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669094, "uuid": "938b394d-64ad-4e9a-a918-510d0f4fb8ce", "value": "T1D8B401382FE88B51E2F24F306DB507A0977E741D8D3FD71D0A8464A67EA2B45C610BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669094, "uuid": "60f3a2fa-d3a6-4adf-b8d3-229a99658165", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669094, "uuid": "8412e98e-f6a8-4f74-a5ac-cbd73733587f", "value": "12288:yeDyL9pD3XrTp+meaF1WLbAp6759cr3T:9+L7DnXeqibApj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633669094, "uuid": "08337f30-1b5e-49cb-87f7-9859cfd25e2a", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633669094, "uuid": "fbb9342e-4563-4387-9e57-52326135213c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669094, "uuid": "bb942d83-980a-4923-ab80-bb95d52de177", "value": "SecuriteInfo.com.MachineLearning.Anomalous.97.22331.2679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eec1e80-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1633676863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676863, "uuid": "08120dfb-9d6c-42ff-bc00-6aec9c8ad41f", "comment": "Malware payload (Hydra)", "value": "eb23552291fd4e500782677836a0fef8", "object_relation": "md5", "Tag": [ { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676863, "uuid": "6d9b6199-0430-4099-b3fe-49938e088110", "comment": "Malware payload (Hydra)", "value": "8729cde8ad57b1764b18b2e3d62ff8d9c1b38b651f1e7328fd65b839d4f48a72", "object_relation": "sha256", "Tag": [ { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676863, "uuid": "7de36fb1-dd72-45c1-97e8-903947ac66c8", "comment": "Malware payload (Hydra)", "value": "ccdd2908ed405afca7f6c80352d3b12d6dfc5d73", "object_relation": "sha1", "Tag": [ { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676863, "uuid": "c4e8236f-2691-4bff-963e-74451e110d50", "comment": "Malware payload (Hydra)", "value": "58f87cf4bdb478fcb39ca0e8e8155f0ced1c4a048bc7fe0ab9e8b245157a4a6bd3bef178afb9948dd7035aadef9c959d", "object_relation": "sha3-384", "Tag": [ { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676863, "uuid": "615ca9bb-e0d2-4a17-a805-5c31ee36f5b4", "value": "T14B9633C5B2C44051EA268E7A95D6594C7220072A3983D13E86881F70D972FDBEFDB93F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676863, "uuid": "0de9216e-1dd5-4110-9674-764fe3853d41", "value": "196608:/8/k+f7qeSxmTWyNMWUDWx0RiQdyjynFAL9pMaFpZSb:/4JQxmTW2MWgWabyj40pMaFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676863, "uuid": "b6681ef6-36c9-41e7-8352-a84b9f3fc448", "value": 9002043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676863, "uuid": "b171aeaa-9e9c-4ab8-93b7-2b0e7a23409a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676863, "uuid": "d5700725-e21a-441c-bb6e-79a2b4c23eec", "value": "download1.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c3294d-2805-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633676366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676366, "uuid": "4b1c38ec-98fb-4310-b481-836fc6b1611c", "comment": "Malware payload (AgentTesla)", "value": "a41cb78c9e8447c5aeee34bfddc2f70b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676366, "uuid": "9f3b8492-a54f-48f8-aabc-9148593cd327", "comment": "Malware payload (AgentTesla)", "value": "87ff2a6c7e35ec62d468b6220b346c0b52dd0095b682dcd112c8c6ac88058e52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676366, "uuid": "c5fa0e40-9700-4ea2-9905-034f2b38aad3", "comment": "Malware payload (AgentTesla)", "value": "2229b40cc243e7de036a976855ac15372e36793f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676366, "uuid": "a07e5ccf-7fc1-47be-baf5-1e9cfb0fb2fc", "comment": "Malware payload (AgentTesla)", "value": "20ae914a00f016890e7154b258f11bececf2fd4624a07a5e9b38f1b59364852d524e81dd141755d929e886ddaef0a8b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676366, "uuid": "6d9a1e7d-6386-4efe-865f-28d502c43459", "value": "T1E675F6002695C611D1B637F4D861CAF093656D45DA29C28B2DF1BEEF79B1B03CE01AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676366, "uuid": "d027e41c-459c-434b-9a30-9da7eb36483f", "value": "12288:O4v0dyBDyL9pD3n+0SpeiCIy7+OojbwwtbBzDoxp:PoyB+L7D3+1pefhi5XwwIxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676366, "uuid": "9692f9e1-0acb-4145-9132-4af4d8cc674d", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676366, "uuid": "ee4e2b1b-bd04-493a-8e5c-79a758a02541", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676366, "uuid": "6ba6e8a5-2139-41fd-bdcc-f727a8e88782", "value": "HIPV0259 1X40HQ.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757c3c64-2847-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633704792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704792, "uuid": "88e72046-69b6-4d9b-9656-71fc01e0328c", "comment": "Malware payload (GuLoader)", "value": "8e3344ef4fc72ac88f166738713ae68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704792, "uuid": "15ef250d-b8e5-43a1-80aa-d54fb8636209", "comment": "Malware payload (GuLoader)", "value": "8824bcf3cfb5197e0597892402ab4de22c31a8f22a2bca19a3e70aaab747ab25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704792, "uuid": "57809e5e-419e-4af6-8088-8f590f43b58e", "comment": "Malware payload (GuLoader)", "value": "fcaf3ddd8521c72ed0d0ce8da762f1816d70c422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704792, "uuid": "6322eab4-4892-4a12-bfc8-3c472244c477", "comment": "Malware payload (GuLoader)", "value": "b7ac84a03e85b53d54b296b1fed2637dff80e7f5162951bf4cb0cb31d8f5830000fec9edf5678cd92adfb0fe6cd5a1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704792, "uuid": "bb95894a-0f2e-427d-9794-ed339a8431db", "value": "T190E305D2B59D8532C402E07F2B3F84A7BB2D3C3305412A87724D2B8ADB711EA69F5752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704792, "uuid": "4867d3e2-a7dd-438f-9fa8-d624f11058ab", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704792, "uuid": "d8c9b322-d4b3-492b-ac93-da4c66c9cef0", "value": "3072:t7OK4rY7jY/TTtYSVu5SqthYuHlTT4zh/jrVB:tv4rY70/dYSYqLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633704792, "uuid": "1f43e8b7-9b5b-4017-8e9e-4be0d2edb374", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633704792, "uuid": "7b356286-6a38-46bc-8a0e-f2908d08e0e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704792, "uuid": "e22baf74-8d69-41da-b6c6-f45fb1a6b012", "value": "update 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab9e514-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633694090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694090, "uuid": "b0ebf049-7a3a-4112-b301-d0564e5acaee", "comment": "Malware payload (Formbook)", "value": "14e9d4a3c47e34400ea28ca5fb719f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694090, "uuid": "956dbf8f-6daf-476d-99bd-1f6350e52612", "comment": "Malware payload (Formbook)", "value": "88a493516a6037955cefbfa462f2db1272f621053e3f08dd18f5a0882904a6b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694090, "uuid": "1a283242-cf73-4697-9fe3-6ffbad3ed777", "comment": "Malware payload (Formbook)", "value": "c0bdc4c58377560cc24aebf3e9c3f8b7127cde61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694090, "uuid": "bcc99879-3620-4fc9-b5f0-adbef136bda1", "comment": "Malware payload (Formbook)", "value": "7049c24ed6e7965408db97dc0ab2c053a28823b767e7bfe385d210a5280d47c18760a47109d99e5684d983cce0193d84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694090, "uuid": "ab3a55c9-e99b-4602-b054-c1183422dc1c", "value": "T157A4F1346FE49756F9F14FB029B012A05B3E780D9E3BE20D4AC459EA7ED3B558210B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694090, "uuid": "bb559432-ea64-4431-8634-38e518f54ebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694090, "uuid": "b3303665-f1f3-4dfa-85bd-91223c6de03a", "value": "6144:MFODMLhiTaF9dCJL9mERt9RGTtKttotRtYDETAH65JWbtw01GiM3dOt0gqFQZQQ7:MVDyL9pD365JCtpYhagEsC/6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694090, "uuid": "a7a7d361-bb9b-4bef-b7e5-b3dcd4013230", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694090, "uuid": "749516fb-b621-49f0-ad88-97c3b70a220a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694090, "uuid": "c38fd08f-83a1-42be-9957-14ae01176af6", "value": "14e9d4a3c47e34400ea28ca5fb719f44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54130181-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633668658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668658, "uuid": "7fadcbd3-b3b6-445d-95f7-88a4a0ea43f2", "comment": "Malware payload (DanaBot)", "value": "3834e42821256917ff876c71169ebab0", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668658, "uuid": "0dc1c5fa-9db7-4059-bb60-b5d4a32b14a1", "comment": "Malware payload (DanaBot)", "value": "897a894564a26c39e18d2e23369815d5b088f218ce0be2516cda74a6d13c87f7", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668658, "uuid": "1d4ee9fe-3640-47d5-b25a-53a7dfa16595", "comment": "Malware payload (DanaBot)", "value": "6466a6bd10b724cb385535eef5f74fe77563f1e3", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668658, "uuid": "85046a64-9547-4eaf-af90-d0705561d14e", "comment": "Malware payload (DanaBot)", "value": "4d1566f53169d119508317ec24a177efa25e06ec15df5bd3612eae7d0ec50053d9d06a51aca8f5cf9137f45cb8eb9cf0", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668658, "uuid": "0a3a7831-1721-4822-8039-b1dc42901049", "value": "T1CE451210E7A0C034F4B752F4567AA7BDA92E39E0972884CF62D41AEA8775BD0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668658, "uuid": "fff8dd7e-79ed-4a2d-83d8-78fbba53355b", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668658, "uuid": "3e08a894-34b3-45de-9917-ca99860c3376", "value": "24576:LM+nbnG9sJmkNLQeulS00YHgLi1WxLuVuzUmjf4L2qat2a40MGye:L7TGK02SlmK+LuQIa4LCt2ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668658, "uuid": "17bf1740-4735-4271-9c74-abb00d508dcf", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668658, "uuid": "889a5664-7487-4753-b366-bb1b9404d565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668658, "uuid": "2ce82fad-683e-4c46-8e27-bd473439e480", "value": "3834e42821256917ff876c71169ebab0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3a7d75-2816-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633683917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683917, "uuid": "2dc3d31f-ee4c-4ce0-bbbf-67ab1fb378cc", "comment": "Malware payload (RedLineStealer)", "value": "d0d132f9124eca02d8c87f018079d56e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683917, "uuid": "9fc3a9aa-9150-4b61-9fa6-95946c09802f", "comment": "Malware payload (RedLineStealer)", "value": "8a1c6ffaf3b297bcab6948f268af2560dd9e292a4ef5b037774f4d7ce94cf156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683917, "uuid": "375ba62a-f1f8-431f-ab63-7c9b55c4ad55", "comment": "Malware payload (RedLineStealer)", "value": "9fa52626bab5f322a4b2833415649df053020a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683917, "uuid": "a3fba448-6023-4e06-ba93-3a1c1368900c", "comment": "Malware payload (RedLineStealer)", "value": "803b7699a0c9233b72d2055749fdae591253fc6164c1aa04ef02d8160dc323e268ec5b4e8be46571b89571123726a67f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683917, "uuid": "4b67f9d1-4f52-42d4-9788-4c4eea31ce84", "value": "T15854DF0075F5C436E2AF5A344DB1CB654B7BBC229831908F1BF06AEE9F252C2DB65706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683917, "uuid": "90d0376e-b403-41a7-99d4-c42e266e7e85", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683917, "uuid": "1764a628-1b33-4f5f-8540-63eccca56c20", "value": "6144:RHMM7wrknN0zQQgOu0VoPC8QOGoVHbW+6kaVr3Y8HVA:yYwWN0zQN2V03JGy36dVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633683917, "uuid": "eedc0b7b-f954-4048-a0eb-2b36b0822b08", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633683917, "uuid": "6d207229-cecf-4fc0-ac42-65abbc8f0559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683917, "uuid": "701f741d-eb06-40ce-8cd7-739481b087c4", "value": "SecuriteInfo.com.W32.AIDetect.malware1.25767.14824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dae436b-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633668674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668674, "uuid": "29be74dc-0a18-4ee8-8682-716ea0329af0", "comment": "Malware payload (ArkeiStealer)", "value": "eb9cf2fe7201ccdc36b41ccf83fb1a44", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668674, "uuid": "cba53b84-5c8c-44e4-9211-8c9a8c05af54", "comment": "Malware payload (ArkeiStealer)", "value": "8a4213b5d7d5521f1c2d94db5474d565908dc907473ccfb600aab5c6db83316e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668674, "uuid": "722f8ef7-86b6-4156-9c26-bb2edef06542", "comment": "Malware payload (ArkeiStealer)", "value": "d93137c9c98cb272a93dc93457b6e4a3921b57cf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668674, "uuid": "98726041-c322-46eb-aba3-9a4bf440749f", "comment": "Malware payload (ArkeiStealer)", "value": "79b2abe41db3c4414a399e880628555047e7a494ba84cd4988b22db60367db358f41eb6c9a86e0a8c012954d97f394fc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668674, "uuid": "e6c25dbe-fc31-49be-a57e-61ae52f576c4", "value": "T12FF40200BBE0C039F0B662F849798369B93E7AA2A77494CF12D516FA5A357D1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668674, "uuid": "ce8a1fb0-68a8-41df-ac16-4204451212f7", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668674, "uuid": "1e2e71ef-35e2-456b-bafd-3e8efb752e2b", "value": "12288:vZK6LY47YboTXWE83eXql2xmKCZoEgDMu0rr9GXiSPO+JVPj:vICY47YboTmEDLxjtEgDMu0FGRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668674, "uuid": "7f86da22-fab5-4f1b-b816-b375e1e89f8a", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668674, "uuid": "5ab2e51d-37ab-463d-8f8c-b1c86438a90b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668674, "uuid": "ca0817bf-dbe5-4aa4-acf4-a22109a25d65", "value": "eb9cf2fe7201ccdc36b41ccf83fb1a44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8c78c3-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633676809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676809, "uuid": "1abce5ee-a959-4fcf-8b48-f2346f1dfb08", "comment": "Malware payload (AsyncRAT)", "value": "875907098d94ec01c9d5adc5bff9938e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676809, "uuid": "119ba2d5-a8d7-475f-a148-af71866354c3", "comment": "Malware payload (AsyncRAT)", "value": "8aee2728f357f201e5a756943d431be6e59a789ae76cf75e59a39db62f851130", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676809, "uuid": "1e511d13-0f9b-4fda-b777-e26bff15f2a3", "comment": "Malware payload (AsyncRAT)", "value": "eb2dbf47fa8f400c79f3d2a6383c3be19a876c41", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676809, "uuid": "e35ce053-b9da-442f-bbbc-9d060ababb58", "comment": "Malware payload (AsyncRAT)", "value": "1d5c5985cbe120fea192afed9529a6eb5c506f01f920de1d302cb918cd2975483321576e20312bd8f9aa8a50ebd3c828", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676809, "uuid": "8b1d2afd-7196-448b-aa78-fdcc1d3c24f8", "value": "T120748CAC726076EFC85BD476DA982C74EA60347B931B9213942355EEDE0D987CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676809, "uuid": "aa6657ac-b74b-4fce-89c1-c954924bc6f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676809, "uuid": "5c71469d-a1b1-4f83-9a4e-8e518859982f", "value": "6144:prBQZ6wpDHaDbMbx6nP2X388Q3v0QxD51RIkcLgSFoTUxeETBtDDFNZtsju:pFQZ6snpXM8Qf0QxLOBrFSKeET3DDFNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676809, "uuid": "356dbe3b-4426-4b82-921b-6b15a0cf1f79", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676809, "uuid": "84ffb223-8549-44b9-b900-da8ddcfd65eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676809, "uuid": "5ac322e0-0c60-479e-bc85-e908e08f063a", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.20322.19712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c367e4-27eb-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1633665491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665491, "uuid": "96bd4d82-d74c-407b-afe2-70ec2fad3943", "comment": "Malware payload (Hancitor)", "value": "6f2f9df7a84a72ccd6003a0ec20f8cc4", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665491, "uuid": "f715d8b1-b64f-4fe0-9102-312c735b1f26", "comment": "Malware payload (Hancitor)", "value": "8b0b33091469c17d7750b198941bc184ec40c8e3cb470b5733f43e96a17113f7", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665491, "uuid": "568ed9a8-15c7-4822-b6bb-76e4bcf738a2", "comment": "Malware payload (Hancitor)", "value": "28182365778ec737e6d0d4008ada318621db41e8", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665491, "uuid": "eea684dd-d5c4-4878-9e12-d36a51cd62a7", "comment": "Malware payload (Hancitor)", "value": "b4b23d73b67ada401d0b4cafefe26e9fd60c83d95adb502752181fae0ec179342b11f3f7ac34847b34c773e094d20465", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665491, "uuid": "9429a8c5-b45f-40ae-b275-c6d788d051d4", "value": "T13E052240F9C0E553D947057D18BBDAD81A3AFC25CE98CE8B7204770E6C35AB486C2BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665491, "uuid": "0baf0f25-9f10-48ea-aefa-47bfc4178d9d", "value": "12288:uB+jxjYxBs/RPYdf2aCQeg1Mfpfm6ukJmnvoPZqXStgi2Tw:uSjeG/usvQFMfQmJmvsZ/Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633665491, "uuid": "39926732-f820-4411-be53-90d2a61abcdf", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633665491, "uuid": "41681783-545b-48c5-a640-fcc43cbadd7b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665491, "uuid": "b4a73e36-af7f-4938-b3ed-aa3b9d1c55ae", "value": "1007_0080561858.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d233f749-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633660279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660279, "uuid": "2351aabd-b6bd-4460-8a71-2907de9d75e1", "comment": "Malware payload (njrat)", "value": "72a2512b36128f94127a7206df3a5032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660279, "uuid": "9203c86a-6ebc-4673-a6ac-f4b2ceb62ee5", "comment": "Malware payload (njrat)", "value": "8b54ac281ea90d359b212b1ce7ffd0b4ac5cab9ee2f93bd9ca393b992556e80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660279, "uuid": "dbfa50f7-4785-404c-a78b-2946a8a04779", "comment": "Malware payload (njrat)", "value": "6a3873d420dad9f5f20ce7f8493efc3c2cfe5a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660279, "uuid": "e9326f60-efc4-4013-acf9-ff8fbe4307ad", "comment": "Malware payload (njrat)", "value": "5f2accc6644dc71d01cd585b0f1231da35e70a6b41879e261b748b8f6578121b96c54c65d6831c999fc99bfbecade9d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660279, "uuid": "1c3628b6-65b3-4575-a106-b285288baf71", "value": "T10384CF01FAC145B2D6720D321969AB21697C7D201F288EEBB3DC6A5DDB701C0EB35B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660279, "uuid": "2f637e91-6797-41c5-a73d-765844fbb392", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660279, "uuid": "f3ce74ce-b2ff-43f1-b84e-1ad89d2ed1c5", "value": "12288:+RZ+IoG/n9IQxW3OBsze2X+t4RbeZcdm6LAo:I2G/nvxW3Wh0teZcdm4Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633660279, "uuid": "575dccba-7aed-4560-b1b7-46d394275b54", "value": 405086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633660279, "uuid": "02f0738a-902c-4cad-8db9-e0b88bbc96a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660279, "uuid": "5a7cf0fd-d5ef-458d-b105-a6a57bbaefbb", "value": "8B54AC281EA90D359B212B1CE7FFD0B4AC5CAB9EE2F93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc6dc11-2861-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633716160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716160, "uuid": "16dc4627-ebc6-473d-86df-2390dc563a99", "comment": "Malware payload (Smoke Loader)", "value": "3d1e2ef175fcb07d039f702890c6d25c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716160, "uuid": "9b289061-0bdf-4c16-b05a-9bf62b38ba6b", "comment": "Malware payload (Smoke Loader)", "value": "8b59d8f1ea4fb412eb2064b4243c6f2dcc4efd26b78e3eae92c9daf6f6a70b7b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716160, "uuid": "dd4ac6a3-9048-462e-93a5-6c6475975c29", "comment": "Malware payload (Smoke Loader)", "value": "e6f90a294184278ba6d23487527b3f5fc822b164", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716160, "uuid": "31b78136-a359-4621-908c-48e1859c91bc", "comment": "Malware payload (Smoke Loader)", "value": "a7dfe9617c9acb88620bd777f388beded5e78bc650a62114a9fd71f1e7c1de52b4cd6ea90b23143fbb5ac402e9e6b687", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716160, "uuid": "bb5e9a39-9ff3-4b9f-a022-4f3e57690c0a", "value": "T188F39D2072E1C472E7AF15305878CBA05A7BF8721979828F67B45BFE5EB12B04A35353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716160, "uuid": "8073eb81-2d3f-4e3d-ad61-ff7ca5f6066b", "value": "4f9c7d0d3671483fa7b1247d926d59c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716160, "uuid": "3a6643ea-8e63-4ef0-9495-d28558e34d86", "value": "3072:CiC5ndCecxLXiH06KAPQv0t/6+ZPwpX2++hgC:CzndCnxOAD8C+ER2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716160, "uuid": "2d75be3a-66b4-40f4-8afc-83e7968a6384", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716160, "uuid": "f95e0f18-3153-497b-9d86-736bc7e35a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716160, "uuid": "613c4305-ea8f-4050-8f10-eccc9248f035", "value": "3d1e2ef175fcb07d039f702890c6d25c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967380ca-2849-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633705706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705706, "uuid": "dae1a2ce-b697-41f1-9658-9ff824b505c1", "comment": "Malware payload (Quakbot)", "value": "626915692334418868f9dfcfb5f10dc9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705706, "uuid": "5c24fc53-953f-4d31-85f9-6aedc36dd46e", "comment": "Malware payload (Quakbot)", "value": "8b8d5d1a753e341a130e1f5f62c122b0b51356c8d341eb8c94b8bb712f8396bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705706, "uuid": "f5200472-c4ad-4954-a023-95f48528a20c", "comment": "Malware payload (Quakbot)", "value": "6924fa150dd7ab2b62902c1c72290fcddc3a1080", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705706, "uuid": "934d1a97-ff08-484d-a0f2-ecd0358129e5", "comment": "Malware payload (Quakbot)", "value": "ebd6e757b3b40d2a79f2c62439c204c3fa92ef5f1df09a85b2c387e9292aa0ab908327e5191c6c35ed1af4b5e113e4ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633705706, "uuid": "7bd16bf7-732e-434b-a8a7-3d9b069ad63e", "value": "T116056B013A44D432D7EA25749E2AD6E50A5C7D15DFB0A4CBBAD07F2F2AB94F39235302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633705706, "uuid": "d7134eee-16a6-4c61-8f6a-8ec3745934ee", "value": "4b0ed3c133761d444e64cac0bf8be97b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633705706, "uuid": "82996d0a-60c2-47b5-8921-0147acc290c3", "value": "24576:MO6c3oCrVA7bEK7mJaW2eX8TvE81gIzsk6EzCUfk7au:SuVeEK7mmeX8TBgIzsk6hUf4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633705706, "uuid": "b6414c70-971a-4676-b36a-b5274d517215", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633705706, "uuid": "a2aab9f0-0a68-41ea-bfca-6d9c5e517ae0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633705706, "uuid": "1409b190-a200-4de1-b194-22854cb22fa9", "value": "44476.7248479167.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bc2f81-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633673836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673836, "uuid": "dd707302-a796-419b-af32-178e77acea4f", "comment": "Malware payload (Mirai)", "value": "c5860ba52d8f9c7eea35d39a6f846a25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673836, "uuid": "6745715b-e834-42bb-946c-815c6a8d7cf8", "comment": "Malware payload (Mirai)", "value": "8c0416e7eeef275c8fdd3a8d3116946de5bf4dc963ca36fbe5de0e6179caf557", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673836, "uuid": "d76fa427-eecb-4c61-a2eb-e81b4a71ff30", "comment": "Malware payload (Mirai)", "value": "4457ec19c21144088f78afb48dc2b63e8c5978e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673836, "uuid": "54671035-4b16-4372-964d-4b3784812a94", "comment": "Malware payload (Mirai)", "value": "55fad639f79c8a57595e51ddecf959702d6ffa7d7f8c4a6c86babb946a1f091f56197d0051a71249d8e551ecf073cc91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673836, "uuid": "d1440c80-dc1d-46e2-b505-a4bce852b85f", "value": "T13A239DF3C42DEDD8C54902797A284D3D5723E50086271EFB5E9A86A59007EECF60A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673836, "uuid": "40fe2bf3-51e0-4930-989c-0ba114125f84", "value": "768:Ma1/hnrsPxgOH59EEvc9NhG/BJLtsqFaBNjq/CboO+O4ICnN:Ma1/tsFZ/c9NhA4vOzOgICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673836, "uuid": "080463ca-b203-4dbf-b40f-fbf8e67ae3d9", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673836, "uuid": "55dc98ed-5e45-4497-b7a4-ea4955c0106e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673836, "uuid": "a268db1c-57f6-4f2a-9fe7-b54ae8789191", "value": "c5860ba52d8f9c7eea35d39a6f846a25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0d7407-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633667837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667837, "uuid": "193933b3-409d-4b0c-acc1-780810467513", "comment": "Malware payload (AsyncRAT)", "value": "b69806723ad47bcad84d9469fb31671e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667837, "uuid": "c40714a6-6de2-4ab0-b515-19f6c721e6c5", "comment": "Malware payload (AsyncRAT)", "value": "8c94991d49ddd484162c687d6fbcfb0b0be0597631c4a685460de88fb5f652a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667837, "uuid": "def1d7c0-e5e2-45ea-8805-0f9d83096307", "comment": "Malware payload (AsyncRAT)", "value": "a39e8d2c30d16b2f553f0bd8d2f08efcf65948ba", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667837, "uuid": "264afcc8-7908-400c-a6f2-bba21bc6ed04", "comment": "Malware payload (AsyncRAT)", "value": "eae92b8b8bec3abcaf825f3a13040f187412cd1e1447c98a02122b78d2dba8b422ce1d2abac7671259f8177fe9398b84", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667837, "uuid": "64704005-cec1-412c-a9c8-0f308cf32fbd", "value": "T122A3F00B1F38D8A2D4E84EF77D9F3823B5BA1F587CAD1037D484F85529B254E0442AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667837, "uuid": "9d4f2c01-21c0-4fe6-8b9c-5a9066625644", "value": "1536:g3OIiyWI12hZvAqT6isFeZXxxLKJy2aySP/p/MCwOw1WiuFGB6P0C+ZY:wP12zvnCeRx2aPh/mONFGM8nZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667837, "uuid": "db1fdb3a-ab2f-4e66-b9a6-13129bb29886", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667837, "uuid": "06576576-4a74-4bc7-b11e-9ba8e0d2da99", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667837, "uuid": "810b8b22-08d5-463a-a82d-86346e771cf2", "value": "Removal of the suspension.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6860328a-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633667833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667833, "uuid": "465ef427-789b-4042-86d4-8f0f9cd6b12f", "comment": "Malware payload (Loki)", "value": "fc261799724525d666d765bf427e3652", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667833, "uuid": "d27c1490-a888-4ae5-8008-02f463d930af", "comment": "Malware payload (Loki)", "value": "8cd5296dffad7375d1bf2d94962f2e0c559dc66235cac231dd5bedded17a71c3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667833, "uuid": "6dd1d82a-63e6-4229-9d84-597db12a3500", "comment": "Malware payload (Loki)", "value": "73aa7e36f7f7163991cf906c9dca46ec6e853773", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667833, "uuid": "e3503059-cbf4-4b69-9606-f0323ebe3520", "comment": "Malware payload (Loki)", "value": "230528379386641d5dcc64d8b92d844ccf6059e66172b9669d3eee3e01654af9512c04dc1c423b86ae9e48e456c4c0c6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667833, "uuid": "da434089-cb14-4410-880f-a8fabbed0636", "value": "T10984221B3AE2E39BD777263FCF2800259DA55C114ABE70D173187A1E9579FA488E8063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667833, "uuid": "d726ae57-aa25-4773-a018-ba39e26a4462", "value": "6144:c4lXpvG6IUV0SfRhLWZTzC0cLhT4aa8Yedx/pf7Sna91oZYhxXuI0S5rR46sWF+n:jzaUV0SfRFEiThvhRx/pca9mYhxeTS5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667833, "uuid": "2a643b70-bd29-4e42-8c21-6cb58d4b2b1e", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667833, "uuid": "f0f052f1-2086-45ca-91d7-b29bf7a9b10d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667833, "uuid": "88af2f99-5339-4fc9-a25a-96d01607f3ec", "value": "REMITTANCE ADVICE REF0000360261.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3b1ffd-2829-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633692057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692057, "uuid": "929c49de-e3a9-4144-adee-a8c0f1670036", "comment": "Malware payload (njrat)", "value": "c8b74e3eb7f08d7f22a5979b6035db99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692057, "uuid": "eb4a24f4-1d44-48cb-bbb8-1ef841f6edaf", "comment": "Malware payload (njrat)", "value": "8d09712c6f3ed0173113b57d0835b1b7d32f2ee008143a6bdec9390aee412c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692057, "uuid": "60ffaac1-3203-48cf-aa2e-24be014a9ad4", "comment": "Malware payload (njrat)", "value": "9a240b60ed6fa9593b3581a98a97d73e9bcf313d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692057, "uuid": "521404f9-381d-4481-ae51-53454a11969b", "comment": "Malware payload (njrat)", "value": "b214fa7a4118bafe10dca7f8104f3fb9d41c86f3adfbf90972531a6df2b5fbc160d9024c9e273f7ae4ca18d90dde1c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692057, "uuid": "b6433d22-83a0-4390-8402-869a09072244", "value": "T1DB373329B0CA0BB1E9335973ECE5935629ACF4346C709F8FA3F819486DF0481E56479B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692057, "uuid": "7ea9e657-e53d-4560-adab-bde837173ea1", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692057, "uuid": "54297814-2f1a-43c0-b72d-43ff2bc0461a", "value": "393216:p243AtJQaRzFW591DHLjnnABq4GEwfKH+G4RZ57l5PYdE1Ly1r++aJYGRQbAHPxK:Pbg05913jnABDpaKeGWhrwILy9++amGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692057, "uuid": "27bf1714-c8c3-4775-b9bd-d076b5892f25", "value": 23171111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692057, "uuid": "c063cdcd-12d1-40c8-b6cf-8763412eaa21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692057, "uuid": "60988d79-00c5-41cc-bea3-977e7697920b", "value": "8D09712C6F3ED0173113B57D0835B1B7D32F2EE008143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ef5ef1-27fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633673431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673431, "uuid": "76f970ba-d432-46fc-9774-50f3633c1c74", "comment": "Malware payload (Formbook)", "value": "75d1affc8c3a971ba2cf24924349b5f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673431, "uuid": "c35ed5d7-9fd2-4d92-88cc-0b0b0a4d7779", "comment": "Malware payload (Formbook)", "value": "8e07ed824686ab14225bec681819b2844d512eb9d78b7884f30a79adef5bab43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673431, "uuid": "2c86eb14-fd67-49e1-8086-0d73c6fe75b4", "comment": "Malware payload (Formbook)", "value": "8a8ba271c5f969060764110b130149675d88f512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673431, "uuid": "e3fa4a71-8381-4f9f-9385-707694aa075a", "comment": "Malware payload (Formbook)", "value": "ae565bb4ed7e226bd598c25c3f2e68da97123926a8420500273c7cd42d79b7dfa1b2f66b3c4f9de6446c3b39121b592f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673431, "uuid": "8e5aa073-f997-4e5b-86d6-c4f856afbdda", "value": "T15EB4F2202BE1AB25E5FA4F33BDF502A0667D6D0D9E3AD31D0AD035EE39B27594110B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673431, "uuid": "3768df5b-d104-4fe7-b798-2fc2de1840d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673431, "uuid": "524a5c3e-308b-400e-913f-b93ddee5e9b3", "value": "12288:2EpIG0TV7yoLC88N7zy7ybB1eCkWA0GqruDyL9pD3:J0Dj8Nvy7ybBIIAdqru+L7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673431, "uuid": "fdafc13f-4b11-43f4-b290-96aa3f47efa2", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673431, "uuid": "3d678d79-a5f3-49e2-bcfc-a9c3764b38e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673431, "uuid": "fdb26b80-ceb5-49e0-91f2-7f2bc110d4a0", "value": "SecuriteInfo.com.Trojan.Mardom.MN.15.2808.18342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4add1751-2861-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633715887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715887, "uuid": "03148707-3b35-47c4-b9d6-a17eb6db9251", "comment": "Malware payload (Vjw0rm)", "value": "02974070f253c8d32b65c129c8adab76", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715887, "uuid": "bc2ad084-2a20-48a6-b569-252874a203be", "comment": "Malware payload (Vjw0rm)", "value": "8f9fd1a639033e1f4c01cbbbdb0c421bcb1bb255959054702feb8a041cb47557", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715887, "uuid": "c31cb353-a45e-4723-80a8-b200df19dc6f", "comment": "Malware payload (Vjw0rm)", "value": "c62bb59bbd0cfd519f1511cb64a897ba48b9789d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715887, "uuid": "2fccf149-ef86-4a14-87e1-a71ec7429713", "comment": "Malware payload (Vjw0rm)", "value": "84c7868b2b3608b577829b32eb9dfba9832154a935ae6ccb3c136209dfe1a4ba707b38508dc8ae6819672e92ea3fe18f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715887, "uuid": "037a9be1-7616-4f98-a2b5-a2a8cfb37883", "value": "T11F8381459E401C4BB9B4D693009D0428DD15A6F4CF6E686AD1C1C9FC3EEF24BA78FEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715887, "uuid": "07fcd3f8-5b17-4633-bdcb-892477e9cdca", "value": "384:96/Hai4Vw4DrBwpJWfjpwO7yr5JfAf2fGfgffqfdkkzP1fACL4WKw0wf:9dAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715887, "uuid": "510eac97-8780-4c60-9217-a0725c390ebc", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715887, "uuid": "5d960c01-ad1f-44f3-9737-2ef41fc86124", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715887, "uuid": "80511dee-238b-45fe-9332-87df1e81e5da", "value": "S8AB2M27X5C.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85c4349-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633692475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692475, "uuid": "1f6ca00f-c1ca-463c-9462-3c039ccebd78", "comment": "Malware payload (Formbook)", "value": "686ca4f92b03e695e03d8d56ac9d01a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692475, "uuid": "2ca50105-10a6-47a4-b59a-2eecdca45276", "comment": "Malware payload (Formbook)", "value": "8fb0895d475560584335f48db057beb1840bbf685f180f46c53eb8aa8d8ec676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692475, "uuid": "0b12c098-0bdd-4b75-b37a-326731e10dea", "comment": "Malware payload (Formbook)", "value": "8bfc238b86d267f7eafd5613d7cda9c00765fcbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692475, "uuid": "1a94889c-f98d-4f2b-8f9a-a55a6a922002", "comment": "Malware payload (Formbook)", "value": "9e4b2201d5edc6441852ac9eb2168eea39cdadf37a2a93de20639c6124aa463bed81666f862f00cecea2fc6622468ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692475, "uuid": "88fec997-9171-41e1-8905-9f9f1ae33232", "value": "T1B405AF15C0E78037D2265A793C0F177D3867AA829BA479163EF81E5CDF75282F60738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692475, "uuid": "f48f616f-1383-469b-be5f-06a065884b27", "value": "63d793c7bfed8139488cc1a5c45be64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692475, "uuid": "eff7de80-0da7-4069-9254-08ab71e76e80", "value": "24576:lawOWWJ7S8YsU8kY7CE5L0S4PMGdMWEjI:llcJ1nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692475, "uuid": "151aa9e3-83d4-4550-868c-ab4b6a21707d", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692475, "uuid": "4f575f6b-a6ae-42e0-83f6-e6f50880094b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692475, "uuid": "b4f9fd7e-7f97-4c2d-bb91-d0d53bbe8d19", "value": "PO_9084873737.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecea35a-2860-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633715625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715625, "uuid": "853a3d5d-ceb5-405a-b8dc-668eef268d67", "comment": "Malware payload (SnakeKeylogger)", "value": "e7a495b7eb22d030a673fa6266c267f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715625, "uuid": "29b0a6d7-7b36-4f20-af49-9fa46baaad55", "comment": "Malware payload (SnakeKeylogger)", "value": "8fe862342aff138507975b0be1e7811ab31aa64a5ca63710add093080ed7d4eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715625, "uuid": "cc415556-f307-4400-9a5f-00d89149ccc2", "comment": "Malware payload (SnakeKeylogger)", "value": "dd95c74e975b9a23656b148f7fb7b7948c31a265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715625, "uuid": "144f56f6-0fe9-467e-a750-caf39879dd8f", "comment": "Malware payload (SnakeKeylogger)", "value": "7712fa373b7a0359989212bf9c16dedb1665f94c30dac5ec64227054df8eedc30a0b5affd6a69f62d39aad1356a4924e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715625, "uuid": "3f8269a0-bf55-46cc-a9d2-55f356f1bb0f", "value": "T172C1C711A3E88727E0B347385EF347017774EE166E63CB4DA9E0422EAD27B048953BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715625, "uuid": "a531b55e-255c-4d26-9643-81fe9cbea117", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715625, "uuid": "0d17ae8a-a503-4c3c-a286-9dbf61249e6a", "value": "96:WdM+wQ+gNn7FaxcCWnNhbhdlioEAsdkrzNt:un7AUnNh1nMet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715625, "uuid": "f0de5627-cc1e-4a5f-ac30-42c3145d61a0", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715625, "uuid": "2ea8c923-248c-4efc-9839-db8eb8daac4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715625, "uuid": "ddfbae42-8ea5-4d20-9fe8-b7fa476e6d06", "value": "e7a495b7eb22d030a673fa6266c267f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fe42bc-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633707054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707054, "uuid": "c8d8b6fe-ebc5-4fcf-b834-dfc608261a3f", "comment": "Malware payload (RedLineStealer)", "value": "6c87df463c7e57eca5835bfc882bb318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707054, "uuid": "5528ba5d-2d4b-43c7-b9d0-b8b36815f32c", "comment": "Malware payload (RedLineStealer)", "value": "902919bbb5fcfe040dfa4504239b4638bc78e1fa5e296de5fe92d0b578902355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707054, "uuid": "f9d1fabc-e80c-49c4-a7fc-2089f6fd4133", "comment": "Malware payload (RedLineStealer)", "value": "7b1c62241e15839c125ec4328673d00c5285b8ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707054, "uuid": "deba65e7-5bdb-443b-8d94-21b7334f3a5d", "comment": "Malware payload (RedLineStealer)", "value": "60ffd90c902662724af88eac440359a5f8e1e222771c58bd03bc197851fec393061ca694eb110389a40bdfc49e705c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707054, "uuid": "18b22e5a-b30a-4b11-9c4e-586fe7b81537", "value": "T18854CF1036F1C436F6AF46354D76C7A55A3BBC625C31A44F2BB126ED9F222D29B1A303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707054, "uuid": "e603515f-51d3-46ee-a5f0-90998632cea2", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707054, "uuid": "fecd0ca0-b461-4ca1-8795-ec18ea09c29e", "value": "6144:YBOkyFx4/vRpN6XpmcxMYfsphTqLq4kTWxipwvbcb:j5xov0nxRfsPuLq4kaxipoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633707054, "uuid": "7204752b-0fc6-4f7d-9712-56b66142110b", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633707054, "uuid": "086cc3f1-33fc-4294-9a76-dac2ebad1d5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707054, "uuid": "f98f8a6b-f1e4-4e63-a8ce-ae4ec363e8bd", "value": "6c87df463c7e57eca5835bfc882bb318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34917f6-2878-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633725914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725914, "uuid": "8fc552b2-867d-4ae7-a6ee-2f70dfcf1a61", "comment": "Malware payload (Mirai)", "value": "e9d527479ae91b38d3c22838af262d7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725914, "uuid": "8315d607-8703-4b3b-bf82-98c82648ef41", "comment": "Malware payload (Mirai)", "value": "9045648ccb0e005668d7f5f5fa7db7c2ea40e12aee10c0a8cfd187ec33f83c8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725914, "uuid": "cd09c01a-a6a5-4fda-bc72-2b3f863e50eb", "comment": "Malware payload (Mirai)", "value": "cf54fdb11107f169cd2cf72f321367b754c6f379", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725914, "uuid": "bb05f81f-d5ed-4715-96fd-f789a69ab3ee", "comment": "Malware payload (Mirai)", "value": "1af3bb550590421a111efcd371a31bdcfa1c109744db2fc0b77cf74601b0396022f5d913fccfce1b76700900d35fe038", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633725914, "uuid": "4bf3bc59-55fd-4d15-a285-e65b34e0440f", "value": "T1F1739E76C43E69D4C5980638A5E94D380B23F5098663AEF69DC38791500FEBCF90A7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633725914, "uuid": "f88eae0d-e7d1-4966-9a7b-ddb1b96861f5", "value": "1536:R/ZRPzAardsPd2YNh7qAFGN6GkNBOhQY6CFrd42+iaV3O:RRtU4yPdPUNYBOhQY6Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633725914, "uuid": "54321263-872c-4ef0-ab30-3170c017d97b", "value": 76716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633725914, "uuid": "9dd87204-75a5-4eb0-aa72-64cd2a829f72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633725914, "uuid": "721585e1-b5b1-410a-a6c0-f04ee6cdbc35", "value": "e9d527479ae91b38d3c22838af262d7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ac0a97-27fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633673519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673519, "uuid": "98a3ce6f-d49d-40e4-98f5-f0deb7d11437", "comment": "Malware payload (Gafgyt)", "value": "b1ef4f4f0c637426a58a6a175ca69c70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673519, "uuid": "5da12ec7-3d2c-4506-aa7d-066ca452601e", "comment": "Malware payload (Gafgyt)", "value": "910263647fa089ea67ed2e1c051b64f2a9d0e685d4c57d6fe564ccffc25c4d0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673519, "uuid": "8026cb92-da86-4564-9705-03b30b620054", "comment": "Malware payload (Gafgyt)", "value": "0c28a6e7cec18fbaf1b0e0834431fa4530de8112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673519, "uuid": "f202f1f5-5971-4fea-9e24-a2a32957e9ab", "comment": "Malware payload (Gafgyt)", "value": "13a0a9e2017519c6ab8fc7b6fb0ae94f7b3ee49ca7ab82ad2053f9ec34f587722e78c5eb6d3832c2372d18870424d113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673519, "uuid": "2512ab3b-1296-432f-b6f7-0c62e917d89b", "value": "T1A8934A07B71D0F43C1DB59F029BB27F18769BAE212A36181A91BAEC05B336792413FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673519, "uuid": "db54daca-6f20-44db-8b46-988061f8f0a7", "value": "1536:73jA9p5uzDMkbQoLMw9ZEm9xkaIiyys8oi8455hxaepOFO6V6yOjjoEyee:7zmpeDMkbQw93zIiyCPZ5hxDOFO6V6yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673519, "uuid": "7a208e6c-451c-49ba-8949-42b8b3740c25", "value": 90409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673519, "uuid": "8194b07d-7386-4cf1-a477-a1f39a1ac40e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673519, "uuid": "9a29ba48-df90-4c25-8614-454363f1baed", "value": "b1ef4f4f0c637426a58a6a175ca69c70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abee6d04-2831-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633695434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695434, "uuid": "1ec3a200-063f-43a8-9c31-7e00b5712369", "comment": "Malware payload (Formbook)", "value": "9b8f97905f8e282e8636bf229cc051fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695434, "uuid": "ab1f3ef0-49a9-4b28-8f92-0856c5a05603", "comment": "Malware payload (Formbook)", "value": "917a73c89d57171f6b172a278fd49adce967f2496bb0263c17bd99a657f27ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695434, "uuid": "924c6027-dfaf-4aba-8206-2247c9e0c6ce", "comment": "Malware payload (Formbook)", "value": "5ebf5c9470f76fabdc654c412c91217769fd7af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695434, "uuid": "366a5dc9-694e-4cc1-a3a9-f4c72dbb518a", "comment": "Malware payload (Formbook)", "value": "095e226bbf2f0b0f95e53825a905f593c1d3673b2a70102cadd1d2237e3774449d035b0e8be1984dd8f16e4791826c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695434, "uuid": "50e5c075-4718-4e88-9aa3-be2bea3542b6", "value": "T11344120599D3D4B7EE825E70843F9A9FB3FF923C09205A0783654FB37DA5A89C611262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695434, "uuid": "9086fb50-63b0-490e-83fb-15b7a177a460", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695434, "uuid": "f44eb67d-ea8a-4239-a38f-4228b2bb899d", "value": "6144:F8LxBsy697ZKqVsbymIjJU/llUlil+Vzk2wHd/p:/TtxmbPCJvliEzS/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633695434, "uuid": "8a4ef69a-e8e1-459f-9b7c-f6ba12350561", "value": 264368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633695434, "uuid": "0d5243c1-4fea-4f96-bd5d-ecbe0a2e75bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695434, "uuid": "9aa0df23-d1d3-4c6e-b2c9-e95696a79f7b", "value": "dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20851f98-27eb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633665135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665135, "uuid": "cf29c871-e97f-469a-936e-43de1ab4a52e", "comment": "Malware payload (AgentTesla)", "value": "0fa6b1c3a32f042d892346137f5e8337", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665135, "uuid": "5cb0f7ac-085c-4414-88a3-10399bac7f42", "comment": "Malware payload (AgentTesla)", "value": "917ca56e4fe3399ca8c9c7652ff60e1bf02b308820ec4ba8ce33f1157488b9b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665135, "uuid": "a370f5db-1ec1-4512-89b7-236ade23e106", "comment": "Malware payload (AgentTesla)", "value": "39795a346252393f4ee73658002e04d3a6a2388d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665135, "uuid": "9e3ceddc-1f14-4b0c-9d22-20cabafb9ae5", "comment": "Malware payload (AgentTesla)", "value": "33560e412625c7fe33cfe4e66fd0224f0d12c06e071e4969761ff50fdc8d9ce69622c41520809f35ff84c5964f65f1ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665135, "uuid": "17a5484d-0119-49e3-b975-dec97d81f471", "value": "T1F935401363AC8ED4C06692B4DFC1C5B96C19DDEE411A53B4AB02BB24B76FD031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665135, "uuid": "dc8daf73-6bef-4566-9024-cd8838eb8680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665135, "uuid": "81209894-6a80-4bd6-b1ea-cf7fc79ead18", "value": "12288:zNUQ0Jf1eZVkJ77DIcbqbD3FLM2WdQVYJUEKl75jQWmc:xUQmk417D8D1LO2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633665135, "uuid": "e376e5d9-e7a9-4b58-b6c5-b986ded9414e", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633665135, "uuid": "cb696be7-03b6-45f9-a514-09629cbef5c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665135, "uuid": "7f637d85-395a-4038-9d38-04b279631435", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3ad08c-27eb-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1633665507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665507, "uuid": "e23209a5-4bca-41a7-b8aa-3f4c0c012cb5", "comment": "Malware payload (Hancitor)", "value": "d2d1e003e62a09aeb1dfd04a4e012d40", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665507, "uuid": "c3cbb890-2dcf-4cf4-8084-79e1a0d688fc", "comment": "Malware payload (Hancitor)", "value": "9262b8794f8edf0a347dccde6e70cacf32e2e2c65ed48483c0076222f03e81bb", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665507, "uuid": "a7a9f25c-400f-4f9e-b85f-36b3890bd730", "comment": "Malware payload (Hancitor)", "value": "884fd03be850256deab3b128c626869871dfdaa8", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633665507, "uuid": "eed5bace-6eb0-4172-8479-c8b71a6985da", "comment": "Malware payload (Hancitor)", "value": "9acfa058383b2eef99ec0a6fd1b70cdae3eac66306613ecc3d4d224d95bfe77d4df52fd4e4b9d3883e551e7d2de4ccc7", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665507, "uuid": "7eb960b4-5c17-4d32-a1a9-f42cd5f9d8cc", "value": "T1A1052240F9C0E653D947057D18BBEAD81A3AFD25CE98CE8B7204770E6C35AB486C2BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665507, "uuid": "3f0c413a-d843-4227-a3eb-0ef07174831e", "value": "12288:xB+jxjYxBs/RPYdf2aCQeg1Mfpfm6ukJm7voPZqXStgi2Tt:xSjeG/usvQFMfQmJmjsZ/Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633665507, "uuid": "9704e9c0-356f-4e91-a4af-941974a4a523", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633665507, "uuid": "98246449-5ef9-4afe-abcb-341ccdd02baf", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633665507, "uuid": "615fda56-4b38-461d-91cd-13574180c87b", "value": "1007_0205114656.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582e88ff-2836-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633697441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697441, "uuid": "63d0b86a-d1a1-4cd3-873b-398d4e19c980", "comment": "Malware payload (RemcosRAT)", "value": "a4b6aa7e8db16399c1474ab74b9b2cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697441, "uuid": "ef4a3ee0-1a30-412c-a49b-4297ea7f8b13", "comment": "Malware payload (RemcosRAT)", "value": "937dc71eb5479dbd15e1cdbf249dd94ff9f0576cf051c15e54b570531fb854c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697441, "uuid": "93ecd7d7-bb09-46b6-9ea2-5665a4cb29fb", "comment": "Malware payload (RemcosRAT)", "value": "3d8da9d4a7f54aeee9b17e771391efe66d61389b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697441, "uuid": "15a14773-20ed-4b77-8a82-4e47af75a00e", "comment": "Malware payload (RemcosRAT)", "value": "1832aeceeeb0d5227610000ee75c142fea21d6649e87c5fac5307d9681d5f7b47386f5c43f79f06d6dd8af832ea09224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697441, "uuid": "0aa48489-e62f-4a06-a440-d9317f49af6d", "value": "T167D47C4BDBD0617FE232A57C8C23BED854663E211C0988FA7BE80D448F7626135A67D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697441, "uuid": "2e0d4d7d-2e71-4e2c-8509-4d7b7d4a5e9a", "value": "b22795c7c5933bf88ce6268fbff58dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697441, "uuid": "65fbfc40-d450-4ee6-891b-a2e135f0e1c4", "value": "12288:ddKKG7bKBAsmMmkTPO+oxbeinq25zff/m/nPsilqj5:dLyshiWyxEgzff/6nJm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697441, "uuid": "c1ea5179-9f93-48e6-a88e-399908003bb3", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697441, "uuid": "1fead9ad-8573-4af8-be30-f5e99f2def81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697441, "uuid": "f6b7450a-a31a-4dca-9855-abc36be32790", "value": "937dc71eb5479dbd15e1cdbf249dd94ff9f0576cf051c15e54b570531fb854c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52470663-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633692277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692277, "uuid": "734f36af-8e96-4a99-93c7-5bb5040ea959", "comment": "Malware payload (RedLineStealer)", "value": "b9fb6705711c86e428fa197af54fbd05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692277, "uuid": "1e97d0e5-70b1-4a71-852e-37a3982da315", "comment": "Malware payload (RedLineStealer)", "value": "937f408309d50f0418a6d888b9d1656f429c75a35c47d856144c2b3c29eadaef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692277, "uuid": "34a85fd4-71d4-4637-b7ad-a95b210d0732", "comment": "Malware payload (RedLineStealer)", "value": "2efb3a006f3e94ea57e7e2f831cd71d1b464c779", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692277, "uuid": "9e55d4d5-8491-45a9-bdd5-e047abc35785", "comment": "Malware payload (RedLineStealer)", "value": "91b8df1806dbc48ada88c9c34307abfa9c90d470b0cb5999d3bb5fd44d5d72d0222642298920f2c4af491953ca90e125", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692277, "uuid": "d9bc301a-d866-47a1-a694-e29d28ce1d42", "value": "T17D64C01176B0C432E7B35A714B6287E54B7FBCB25D7041CF2BA125AEDF716E08A25306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692277, "uuid": "1ccb228e-4018-4e44-8e9e-f3ceefb0b25a", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692277, "uuid": "4a349d46-d5ef-4278-9af7-242d5e7647e9", "value": "6144:0hhwc0J8wWVZN9RYpeMvOQx+z7yZnhWCDNhSXD:6z0J8wWVeecOQUnyDpDNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692277, "uuid": "201cd176-e8f5-4507-8558-f3a8d3ded46b", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692277, "uuid": "50c7e67f-5c8d-45b5-aec2-5622d8dcf4af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692277, "uuid": "d75b5331-f10e-496b-b41b-9b72bb6500b1", "value": "b9fb6705711c86e428fa197af54fbd05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ae8678-27fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633673202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673202, "uuid": "03fb90a5-7ff3-43c0-926e-fc84a4536766", "comment": "Malware payload (Gafgyt)", "value": "62d32e09a68666751b38206d39b1168b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673202, "uuid": "54307fe7-192d-47c4-b94c-8b437dbd4036", "comment": "Malware payload (Gafgyt)", "value": "93b0a613201e3df5a0ecdb9ceea3d7e479f1c65085a08787f6bae9f34f3d266d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673202, "uuid": "aec46d20-f87d-4814-b3d8-160044e8295d", "comment": "Malware payload (Gafgyt)", "value": "1b652ce1210e7fb5ec331ad7d5d0e6ae08ceb7d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673202, "uuid": "a9e2b089-1d86-4a1e-9e32-75e73927f02e", "comment": "Malware payload (Gafgyt)", "value": "b1beaa0aee6a9e84fd1b8877423d30f4021d467e7f370f93970fba8a5b6c2e02b520f01d299f8a50670778013578d11f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673202, "uuid": "0d178bff-4e12-4c36-8ed5-bbc45dfbd8d0", "value": "T1B2B3C92A7921AFFFD06983310BF79F30879522D626915386F25CE7185E7128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673202, "uuid": "8f0a01c6-dc6b-4ce6-b19a-96a6de078915", "value": "3072:q5r1q/pgaC15hX8Y1SYKdPwjF9uhs2lAe:0wxu15hXLfKdPwjF9uhs2lAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673202, "uuid": "f17806b2-20a5-4a4b-810b-a0d32ed0ddfd", "value": 116020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673202, "uuid": "28ab8b7e-ffbc-45b2-af99-8edc487134fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673202, "uuid": "47d3e2be-e290-4190-89e4-7bd802571e60", "value": "62d32e09a68666751b38206d39b1168b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ac0b02-2802-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633674962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674962, "uuid": "5ff9cb0c-5e57-4527-a2fd-91ff8a8c87c4", "comment": "Malware payload (Smoke Loader)", "value": "1d07d0bfe5e30aa3011b9e684f8065a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674962, "uuid": "597cca5e-c0d6-45a2-8c6f-64c41af66426", "comment": "Malware payload (Smoke Loader)", "value": "93fa6ef35219a3eb1a2eeb1fd63a81be79c68130435e07131e610d2e7509e077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674962, "uuid": "fdc31537-0f09-44f1-af53-5634f99d02e2", "comment": "Malware payload (Smoke Loader)", "value": "cbeb926052f8ceea8f902fca514958418b7704cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674962, "uuid": "11d08346-2825-4b30-b69f-53bb3c7c1076", "comment": "Malware payload (Smoke Loader)", "value": "9a534d87d45f43bdecea6ee662a437de7a7da94dc12f6fcbfad4b95c8efa313209f60c349d17caaaa3629eda01cffd75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674962, "uuid": "89a0e8ee-e04a-4273-a001-e6733e06db60", "value": "T1EE149D1036E3C4B5EF6E19344DA0CBA14B3BBC625931958F2FB156FE4E782D08A25787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674962, "uuid": "0dd5e659-aef8-493a-914b-a3681e7bf7bb", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674962, "uuid": "8d96d622-16c3-4a55-97b6-c6c31d049930", "value": "3072:kAUcOECFVtwNBnj0H1JZ1Khqye3rrH+ZPwN3hp6bTVhgC:kAUBhwNBi1RGqym+Ep6bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674962, "uuid": "b421fdd6-7538-43aa-b546-658a9c96a838", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674962, "uuid": "39e66a06-89e9-46a5-867d-f1183df9b707", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674962, "uuid": "f297d241-0d6c-4fbe-ae6e-06c054794b29", "value": "1d07d0bfe5e30aa3011b9e684f8065a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608725f4-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633706904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706904, "uuid": "59a5c8a7-d74d-474f-bf44-cf1e772fc5e9", "comment": "Malware payload (Smoke Loader)", "value": "1d4ed257c2f26fa7d5ccb7ff9dfeae53", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706904, "uuid": "c5e04fe2-6852-458c-a938-b92038e1a378", "comment": "Malware payload (Smoke Loader)", "value": "9535b07e3af3a051c0de3169f11aed4e5f7dd52d651e739f16db250bc631def5", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706904, "uuid": "3049a859-935e-490c-9dd5-7711916a6558", "comment": "Malware payload (Smoke Loader)", "value": "ae434c271eb3cf905e450bd45a0bdc249140a4f2", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706904, "uuid": "ce9fef87-5211-4c4c-a260-49dbcef62b84", "comment": "Malware payload (Smoke Loader)", "value": "ccec0dafe5b35dd592db6dcf0670f9ff8edbc86293ebf1a10ad581821226f67fc1a95d083e23775a3914f89809de9f09", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706904, "uuid": "94cc6e20-f4ef-454f-94b3-94ada23c1c5b", "value": "T135F39D1036F1C476E1AF15308979CBA11FBBB822797481BF27B816FE9E712809A75317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706904, "uuid": "b74ef97c-b5fa-455a-8ced-e33f9921b59b", "value": "4f9c7d0d3671483fa7b1247d926d59c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706904, "uuid": "c64d97c8-a5c1-4329-9bbd-3206c6ad7c54", "value": "3072:ZJC5ndCecx/m0wdChAKd9zABi+ZPw1gFeEjjhgC:ZEndCnx/m0wotzj+1eEjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706904, "uuid": "162c3407-6243-42cb-8d75-79948d1aa6be", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706904, "uuid": "cb492962-4ccd-4df6-a61b-186a1d5abc5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706904, "uuid": "f6020b25-da2c-4803-82a3-a37c126235df", "value": "1d4ed257c2f26fa7d5ccb7ff9dfeae53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c04712b-2808-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633677771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677771, "uuid": "7bb3cab5-fcb5-4390-999c-8b2874a4b779", "comment": "Malware payload (ArkeiStealer)", "value": "c636e3e392b35202abeba44e28358fe3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677771, "uuid": "9ff5fcef-5657-491c-878d-77df4d28099f", "comment": "Malware payload (ArkeiStealer)", "value": "963c707c60281e427250fe4dca8347ed4fb7a30567090d34de5621b73bda64c0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677771, "uuid": "1cec012f-cb20-4d42-98c1-90597e85b6de", "comment": "Malware payload (ArkeiStealer)", "value": "8f57f9f0c7200f7a3f4f601c3e1b143b7072d71d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677771, "uuid": "d5135335-bf83-4a45-8af7-84d9c1b175ea", "comment": "Malware payload (ArkeiStealer)", "value": "1d52043c21cde3a80b5fc7e99ce4bab98429552083b04935ccd0605d2c97105efe96ed17a9a2ff001212e81452e3de17", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677771, "uuid": "8dec7ce8-650d-45c0-95dc-870dbf7f2cb5", "value": "T135F40120A3E0C035F6B756F459B6D2A8A52E7E71673994CF23D62AEE06355E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677771, "uuid": "366855aa-8be1-43b8-8c09-03a2087d7108", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677771, "uuid": "94154729-e1f8-46a8-9528-15c19e3e27a4", "value": "12288:PJlzM1sgT148utKpSq0KJjVNI/eK5XoxWEs1SPdehtkDcL5TWGbjco/wRjEfzzqz:P3zMbx48uCv5r87xoxJs1SFe/kDuSGq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677771, "uuid": "d7d27a49-95fe-4095-bc46-75b3733d5918", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677771, "uuid": "cf68895c-bf58-4d08-b22c-93ac663fa888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677771, "uuid": "5f94f163-0ca1-42d2-829b-4ad35042811f", "value": "c636e3e392b35202abeba44e28358fe3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d39e417-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633693879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693879, "uuid": "d398e08f-a305-4781-93f1-69a6e41f4145", "comment": "Malware payload (Formbook)", "value": "b8af003d11b6ffd7a6dddd4fcf35bf3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693879, "uuid": "e0d79e6a-476e-462b-9589-353fa76a12d1", "comment": "Malware payload (Formbook)", "value": "96a54086e0d1667ed27dacd61ce88129d2ae1236718babe4ee5b3054385cc215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693879, "uuid": "7c2c4069-2597-46d7-88c3-4b995aff13bf", "comment": "Malware payload (Formbook)", "value": "792b723347fdfc886d1d8a365d1031bb83de451a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693879, "uuid": "1ad73c60-01df-4361-af00-2134deb3a307", "comment": "Malware payload (Formbook)", "value": "15724ea3f6672f07ca8ba7d59b240a5fb6d674936c8e50ffa1f8cbfcf211c8abbc4fed21c24058dc0a3172e9eb66c508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693879, "uuid": "22eca5e7-18e3-407a-bd10-c309681b7aa4", "value": "T1FA456BCAE992BC7ED3721A382C376354AE2AB93069B855D677EC0C584F3170136ED247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693879, "uuid": "71fa3b20-0a4d-487c-8669-c505cf67bf0f", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693879, "uuid": "000140ab-648e-44a8-8304-c1aba0589d74", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6Hqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXA/mPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693879, "uuid": "f5c9fc20-bccd-4643-b970-fc018b4f7d03", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693879, "uuid": "89aab775-2f19-4ac9-8596-f9d999f558ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693879, "uuid": "ccd9d7aa-5f05-4abd-b244-85dca0e47a52", "value": "b8af003d11b6ffd7a6dddd4fcf35bf3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39606bd-27f8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633670939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670939, "uuid": "96ee6e6a-83a9-4b33-b949-58012698ed47", "comment": "Malware payload (AgentTesla)", "value": "0fbcd1703a4980176958a0949a3dc60a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670939, "uuid": "9f345a00-d980-4d09-b876-c4ef050be9c2", "comment": "Malware payload (AgentTesla)", "value": "97e72fa55e850976b11fd89b2df89a0987c2b45d2da4b3f8295028b42f24540c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670939, "uuid": "cda08f2d-9e30-43e4-a186-0e8b186b9fa3", "comment": "Malware payload (AgentTesla)", "value": "4ad47e283937197f3469ebb702ee950c5625cdc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670939, "uuid": "94c5b92d-c834-49fb-a013-28cac48f0c93", "comment": "Malware payload (AgentTesla)", "value": "c8bdd1b885fc4f7135ea7a69131cd82d226d5e49e65b06f7afd73b7d0db5a354b5ad9220d27fa0130405fa13323c00a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670939, "uuid": "14b620af-4504-454b-8b09-cd1d5384939c", "value": "T131F46DCFA13057CDC98AC9B284AD1C17FF1C1D36928769AB2E573BF7485E44B8B0A095", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670939, "uuid": "99bc93a7-30e3-484c-8fdb-25452daf5971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670939, "uuid": "db8217bf-ec27-428a-844e-bd10130fd77d", "value": "12288:rZbywPYQrW5mpVJon9iTb66WpWgLVi3CZ/Cw9raBgIwq6sNNCyScWI+gkeiFbl:r1ynQrUmBmcb/mI34aArrjq6sN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633670939, "uuid": "c2ac3eea-d981-44dd-b9a5-4fcb6989daf8", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633670939, "uuid": "0156bf9a-906f-4c81-8a2e-7fa59ba8b31e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670939, "uuid": "99e739bc-1309-429f-871b-1eeb5128756f", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66407850-2876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633724952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724952, "uuid": "5ba7c1ef-3790-4412-9c74-808cffcbdb9f", "comment": "Malware payload", "value": "1dc3a1c0972a9e32d88e85d1cf8f2c65", "object_relation": "md5", "Tag": [ { "name": ".xls", "colour": "#BFCD3D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724952, "uuid": "0b4e908d-9d01-4593-b0cd-b78b7f494627", "comment": "Malware payload", "value": "9828f899790d150360e0a3f78f3eb3b758417644bc16896aeb411e2af9e8ea4b", "object_relation": "sha256", "Tag": [ { "name": ".xls", "colour": "#BFCD3D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724952, "uuid": "b2ccf9d0-22da-4491-b944-e3dae0931d0d", "comment": "Malware payload", "value": "808311a07522956f55bf842749083e199b0f04c6", "object_relation": "sha1", "Tag": [ { "name": ".xls", "colour": "#BFCD3D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633724952, "uuid": "7a2279aa-d8e3-43fc-881b-14e7d9ad8d9c", "comment": "Malware payload", "value": "66966051f2423f6278c44b6ae6d953d7c551c3066b268452f56cbee5489f72c9bc428ecdb1f121d020b1cba4d1e90192", "object_relation": "sha3-384", "Tag": [ { "name": ".xls", "colour": "#BFCD3D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633724952, "uuid": "0a9e7cca-632d-4409-a52d-5b4b12a48734", "value": "T10BD3AD467797C94BE54903398EE3879B3B72FC21DE72470332467B0E4E796A18C16A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633724952, "uuid": "1cbc0394-a0e4-4282-b48d-cac946d31ea0", "value": "3072:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfGdtUHKGDbpmsii/+u6ssC06+:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633724952, "uuid": "70541d25-03c5-48bd-821a-c77357b890cf", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633724952, "uuid": "d410ac85-8368-4cb2-a3e7-c2502c0236db", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633724952, "uuid": "c8288450-4c28-4ae0-81f0-13027a0ec97b", "value": "1701667874-10042021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26940283-27f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633669870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669870, "uuid": "4bf349ab-982b-4880-b59f-41d304e1819b", "comment": "Malware payload (Loki)", "value": "50a9f1a6aa4774729d0e961fdecebb39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669870, "uuid": "4e67f417-c981-45c5-aa13-ad360b8336c4", "comment": "Malware payload (Loki)", "value": "991641570ecc27df7502366358d2f4a57abce6d882ac23e73a228d8f50904aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669870, "uuid": "4c0a0913-0aa5-4907-ba81-c776a6e80983", "comment": "Malware payload (Loki)", "value": "5ff121b306c87fcfcdc645d66fd79bd5f59e65e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633669870, "uuid": "28e60dfb-c570-45ce-8712-478997bae99a", "comment": "Malware payload (Loki)", "value": "0dc0809621a0b91b34f8ad9abbd6656d3209a4a8a92f9d03cfa71c9cca74ffdb4e9ab20eca4c80c5a5ff51044d2c05ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669870, "uuid": "88937a12-f5c0-4342-9b7b-16fa8323cb08", "value": "T16784F1346FE48756E5F24FB029B402A05B7E780D8E3EE71D1A8114E63AA3F56C710B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669870, "uuid": "1685bc2f-675b-4219-a4e4-99cf56ac29a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669870, "uuid": "85038813-3ad4-4140-bd6f-c15dae7f9f46", "value": "6144:RQBmHRmfhiTaF9dCJL9mERt9RGTtKttotRtYDETAHvganZq8KIDXwx4CqdVqo8fT:RQbDyL9pD3oaZqcDgWCqrfXP1jd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633669870, "uuid": "7bbe378f-20db-48f3-a18e-4fd4e8b274ea", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633669870, "uuid": "a6c359d4-59d2-4760-9eae-13ae04ca868d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633669870, "uuid": "b4e3f927-42ac-494c-bb4a-f12e80b5ed8d", "value": "PO 211008-01A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c507124-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633668752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668752, "uuid": "af41018c-40ed-4019-8a5c-350aad67bbba", "comment": "Malware payload (RaccoonStealer)", "value": "65aceed190dbeecae0cf2791ecca6099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668752, "uuid": "cc2e5e05-54e1-4f48-9d1f-abbfdce53a8a", "comment": "Malware payload (RaccoonStealer)", "value": "9b8bafc0d1f12757220e764f6b5a4da42c3f8bfb4fd7c89e10246fda157a7c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668752, "uuid": "8bf7f031-d039-4692-8147-9b4f1321c294", "comment": "Malware payload (RaccoonStealer)", "value": "bca3a12188561ae991b203f3d92ea60d1e3e2b57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668752, "uuid": "5b305817-2b7f-4cf0-a2ad-1297762bd111", "comment": "Malware payload (RaccoonStealer)", "value": "f5792c9ff59962f7de5937b4912284dfbaf9f310e72b949e104d397c194d3f735019d80715111f20f3a3210ef6fe21c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668752, "uuid": "801d3f94-2941-4509-bc49-6c9770ad2d71", "value": "T1C2C4E100A7A1C035F1B797F90A768368A93E7AA1A73894CF52D517FB1A346E1ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668752, "uuid": "17f0c546-ee6b-460d-b970-a74031de2118", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668752, "uuid": "112a87ac-430f-4723-a480-1147c9ad4541", "value": "12288:2ljppc2k5VQi8zdBShk83yc9w/VWuCG3x3mgBU1F9tJO:Ajp7kAVzda1d9wVTCG61T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668752, "uuid": "7f0b1366-484a-4060-b424-8bc317a21808", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668752, "uuid": "b553ecb6-1849-4c86-9412-81fd228d60e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668752, "uuid": "9486a5b4-ee3d-4a24-9231-488a023fc6f1", "value": "65aceed190dbeecae0cf2791ecca6099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8b3794-2831-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633695163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695163, "uuid": "1fd422e8-3563-490e-8028-e886881ed44f", "comment": "Malware payload (RaccoonStealer)", "value": "498da76c0b716a75e72b1cd604a1a719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695163, "uuid": "eeb10002-acc3-4327-bee1-7d0ff6dbb1a7", "comment": "Malware payload (RaccoonStealer)", "value": "9bec2f9c52d746d49dffd22fc0cf217c87970b85d7fb4e19e908edc0eb48c16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695163, "uuid": "87d0678d-06b7-462c-8f20-3a2f323270e6", "comment": "Malware payload (RaccoonStealer)", "value": "14317e9110870d39da6864302fb56e4f073499b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695163, "uuid": "c1c16da1-b3e3-4975-882f-7fee75fbcfc0", "comment": "Malware payload (RaccoonStealer)", "value": "e1f81016c2a7c5633be3412a09f1a3b07d4ee4312aee8f1b87cc95404f714da2307c843d2ac10a35f2ec4186d3be91f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695163, "uuid": "ade82a95-3c7e-4058-bb81-6e68ffed3004", "value": "T16514ADA036E5C072F36F59306DB19BA14B3BBC225931858F5FB156BE1E7A2D08B25313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695163, "uuid": "fdf42802-b65d-4334-8208-dc9a9a7b60bb", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695163, "uuid": "5e346890-fb65-4640-8cbe-8f2f996ad35a", "value": "3072:mK7Kya3u8MpxyBiwJDX5L4MDO7YhljlqUwP67vy6QrCTZPwaFWnKA2wlSohhgC:mK7su5xyPXpx1hBsUwC7tTXcBl7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633695163, "uuid": "c48beba7-3b0f-475a-9ba8-d21567bdd3e6", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633695163, "uuid": "c75a03fc-6a0c-4d56-a6c0-a22db7945b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695163, "uuid": "43008897-e60d-4a68-976e-7cf41d6e4537", "value": "SecuriteInfo.com.W32.AIDetect.malware2.21009.30791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3893d1c1-281d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633686651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686651, "uuid": "9b358b9c-c76e-448b-b505-26b7c85d38f0", "comment": "Malware payload", "value": "654903e125032211433eed5ae14a22c5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686651, "uuid": "28bb2e81-6b5e-4e58-b318-72d4eed19fb2", "comment": "Malware payload", "value": "9c26e86dedb051713e61c3f2ee85fb529d6789ec324abb4402c9c828bb533f6b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686651, "uuid": "93fc487c-a9a3-4cf4-8bc1-0c2071a55cdb", "comment": "Malware payload", "value": "77978999bcefbc6e429ef961c2eb452a854d7d2c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686651, "uuid": "1e24a1e0-d6fe-4618-9ad7-1c29405f3efd", "comment": "Malware payload", "value": "ff863a2cde7cd739bc15e4e63bcc8c166b0a23e0639558e281193fcbee2037afaaed1e5c530fc8e9e9ed5433ad4e073a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686651, "uuid": "49cc0a57-ccab-4ad1-a716-60b2ba56e84d", "value": "T11B02D974CC2CAE91455CBA847B25BD8014E9392B4E7CA1FCFEA20440B655E4EFF33866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686651, "uuid": "af16b02c-f6ce-444a-8e8f-c4b00486db6e", "value": "96:bMvUg5T6T/vXhDGR8jyhwjNhXU6NymJnUge5e8Kme//RS0Hfoze3WW/Aur5eH/s/:bMvUg5qvXhjyhwhy6LJjA98FXhdi0aB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633686651, "uuid": "7d7148ee-e2c4-4b60-b760-ac2685b102b0", "value": 8844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633686651, "uuid": "d7c88a31-f019-4d31-ae77-e39f9662a7e3", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686651, "uuid": "ad2fc66a-3739-481d-b713-053db2647b7a", "value": "Launcher.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed146ab-2841-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633702338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702338, "uuid": "38644d0b-8d0b-44ac-ba8a-393ce80069c4", "comment": "Malware payload (AgentTesla)", "value": "54951f1b7cb5e0ed887a85ef16f6a2c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702338, "uuid": "9cb9fdab-41cc-409a-b37f-d8f34b367a39", "comment": "Malware payload (AgentTesla)", "value": "9c511d7b01c5dc1246a34afd65bf1869301525330dce135c6415d55d89ce248e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702338, "uuid": "8fd0b8cb-2943-476f-99ea-2b9bf5a4688e", "comment": "Malware payload (AgentTesla)", "value": "509c9894a661cf640f46c1804beb2e62ca2dad70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702338, "uuid": "2dc6bc0b-88aa-4523-8d42-8777ee72c0d2", "comment": "Malware payload (AgentTesla)", "value": "7f08f108d55548aaf8c0fc473c15459631d4446fe989aba1eaee48efa54d9f58ddaea35e16052fdb20ad4c8a9f70bb08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702338, "uuid": "a173d658-aee8-4fbf-b7b0-4ece72ad75ff", "value": "T12DB401346FE48712E6F64F706DB402A05B7EA91D8D3BD30D0E8445EA6DA3B1AC711B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702338, "uuid": "c2530160-2776-4376-a543-02f87e29add5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702338, "uuid": "1b937765-270d-4499-8f7e-3553a8767234", "value": "12288:9MDyL9pD3vtAOcF6whiQS+HZLJ+sj+Ll:K+L7DFLy6wh7HZVa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633702338, "uuid": "4cd78848-b579-4cf7-a842-5ade04e43391", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633702338, "uuid": "90e1c39c-60dc-499a-b7e4-e62afaf0c092", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702338, "uuid": "76597518-df28-47fe-a619-d0ce9c52b2df", "value": "RFQ NO. SAM-AM912042_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800aafff-282d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633693642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693642, "uuid": "64cf94a1-b925-4a3b-adbe-90b4dd17b229", "comment": "Malware payload (RedLineStealer)", "value": "d30d5cced28d8fe7748175f578aa7e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693642, "uuid": "6f3a6bb0-2637-460f-ba71-66becf43c275", "comment": "Malware payload (RedLineStealer)", "value": "9d26f65d8d3e42e7acf5b5ca89147d66512b0119537fa94b3a44549ab44c3614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693642, "uuid": "896bc417-586f-4c4b-8854-8ad7a771d579", "comment": "Malware payload (RedLineStealer)", "value": "b23e25cd6401c036f2b4de52a50fcbf1a96168a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693642, "uuid": "4fd46ad8-57ed-4233-87db-c19316f4e9e6", "comment": "Malware payload (RedLineStealer)", "value": "ed44015cb8d2cdec4ee86c66048082d3faa6b71b3ffb16941cf600564e2eeb8c0d5d385d1950277778391c54d97fba96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693642, "uuid": "8f441147-9f3f-4fad-bb83-4602484e9b90", "value": "T18064DF1076F5C432E66F1A348D71C7628A3B78656D32898F2FF456BDAE312C1CB21326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693642, "uuid": "2e2c7750-fd9e-4265-acda-e39cdd25668f", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693642, "uuid": "9fb66d6a-a335-42d8-8f56-9d3b3cbbc8a4", "value": "6144:1Bmvv2LxMdbAlpTQo2IZsp9sLAhiiAiZg6W:e0xqbAvQo7K9sKNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693642, "uuid": "72298cd1-bc1c-44a5-92e9-d57bf2d9fa53", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693642, "uuid": "af29d338-7b25-4f04-a067-e8359515f4cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693642, "uuid": "793f00aa-b853-4d46-b4c2-5079f25ee815", "value": "d30d5cced28d8fe7748175f578aa7e05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cd6ac7-27fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633673545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673545, "uuid": "7b129000-ca2a-4c51-8539-57c4daee6e99", "comment": "Malware payload (Gafgyt)", "value": "39cac3ad141978d8a6a9d16f7c38a532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673545, "uuid": "0b62242a-d1b9-4893-bdbb-e26d416789d6", "comment": "Malware payload (Gafgyt)", "value": "9d9ee9f7954105ec80510fd266b1af7fa007e8e73e5a6a6df62682a852a2ee57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673545, "uuid": "e5a0c1e2-a49c-414d-a139-1dcc801928af", "comment": "Malware payload (Gafgyt)", "value": "91f131ef115e9a1ab14694b73dddb654f6778ed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673545, "uuid": "f95679c3-2e3f-48a9-82f3-cc22f7f60ab4", "comment": "Malware payload (Gafgyt)", "value": "72c32e1aa967c16fc0360be7e65aafa5ba12e279f1650ecde65f7c180a5087280a686e1d8a955fa8d8c1c6b0f5dd1d1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673545, "uuid": "a3b903ca-0db5-4974-a88e-a61eb1a243db", "value": "T1CCA32A05F9018767C2C32776F78F47493B3666B557DB33026A347EB02BC27991A3AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673545, "uuid": "74ff6561-3b77-4983-845f-31b952e557e0", "value": "3072:dpju/sAm/hD5h51xX8ZHMj0+rQ0wim4sQTe:Tut4hD5hjxXdj0+rQ0wim4sQTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673545, "uuid": "4b03d38d-9beb-4586-964f-d8e8fd1ef7bf", "value": 103635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673545, "uuid": "d2bd936d-71ce-4282-848f-ee5b3d089fc6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673545, "uuid": "db2245f6-7719-431b-83f5-9e7a45b0e579", "value": "39cac3ad141978d8a6a9d16f7c38a532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655f8bb8-283e-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633700899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700899, "uuid": "530194f4-ecdd-4a59-8f00-f456f0be509f", "comment": "Malware payload (GuLoader)", "value": "b2f0cbd01eb244dc1cb5448cb4cca362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700899, "uuid": "540107dd-4f5c-4518-82d2-1009a5b8417a", "comment": "Malware payload (GuLoader)", "value": "9ef2c4b3a377515c3f4cff8d2bb0dc9f86360b836d2fc215c1b7a41c3f0ee52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700899, "uuid": "8ac5f5ae-53c2-43d2-9bae-246f56f24f04", "comment": "Malware payload (GuLoader)", "value": "aa50307949d12b6bb2f5077083e85f661a8eac6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700899, "uuid": "2838b95f-b214-41b6-92ca-215699c8c51f", "comment": "Malware payload (GuLoader)", "value": "6ad336e2eebfb1a5e96c07d08ff0a124c86ad38635db99ab6072d352333bdf450c65bd5e3c6554adef864b35565bdbb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700899, "uuid": "ebf99a50-bf1d-4fa3-8bb5-b4e8317723b9", "value": "T15FE306D5768E8836D402E17E1B3FC457AB1D3C3309813A93B28D7B8AD3712EA25B5356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700899, "uuid": "89627c4f-3d12-41a7-9538-695bfe90ffe2", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700899, "uuid": "2e85550c-920a-4500-9a9e-9ad33a99cc73", "value": "3072:tM/vpL+mcGO/dDFbqzyVgFg3b8xJqUZJTXdzh/jrVB:tAJcGO/dDFbVgRnLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700899, "uuid": "980686a6-4899-4e5a-89dd-70d1e1242500", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700899, "uuid": "78e0495d-2247-4aaa-bf33-00c3e77befa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700899, "uuid": "14606272-1ff4-442a-8918-3459f31af076", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a07d25-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633667796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667796, "uuid": "01567fc8-a16f-43f4-a069-b8e79358638a", "comment": "Malware payload", "value": "5ede14585e55b6b67660efb6237e2e85", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667796, "uuid": "7836dfb2-c127-4024-9760-0e09c459b9d0", "comment": "Malware payload", "value": "9fd784ffe3affccb06b50be9d5f41802adea4215810d88422e941af581bc602a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667796, "uuid": "5ae9e891-eefc-4ed8-b409-10479c1edadf", "comment": "Malware payload", "value": "d3ff6c89920dbcb3a858fbf897ea2d6d56fdd9dc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667796, "uuid": "4b686c6c-d39d-4c76-8c0c-11cd54677dac", "comment": "Malware payload", "value": "1bceb3f40294f2d515fa3396b87952d8e6f0c4c200e4111b78752db50e4bb4738b36b3df44c9a212d76e669cf51a2919", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667796, "uuid": "53ee38b2-189c-41b1-851e-6ba906a1a9c1", "value": "T140B58E22B2C18437C0772A3C9C5BA7ADA9397E112D38994B3FE41D4C5F396817E292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667796, "uuid": "0eb96e6e-87f1-4c59-908c-698377d50d9b", "value": "49152:aO2Id8SNudebzRKmlBtaGnxATPmvLYLEA:SIdNIdeM6wwxSmvLYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667796, "uuid": "dfb0ff52-368e-4cec-92af-144c1a2a4fdf", "value": 2461184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667796, "uuid": "d28114b0-686e-4462-b3be-638d32494654", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667796, "uuid": "0c23c009-be4d-4a41-95f6-227ec0c12c60", "value": "factura - icghwxwznkrbdcbuvsxe.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e829b3e-2890-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633736106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736106, "uuid": "9c17e269-ef34-499e-90e0-64b4f91689fe", "comment": "Malware payload", "value": "e80230955cc16706e2a07615a1f3a68e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736106, "uuid": "4a71e2f3-c148-42a3-9af1-82909102dea0", "comment": "Malware payload", "value": "9fd9a7f1fcd183cb0ae2219de02104e103fd135d25b0ed1b7283ecd3f99f856d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736106, "uuid": "9690589c-3aad-4808-9141-f8c137828a02", "comment": "Malware payload", "value": "a37935dafc7b2a14e9e5ea060429bb40d2bbf967", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633736106, "uuid": "59f4b60a-5068-451e-b111-ca49e4d9c440", "comment": "Malware payload", "value": "9cce5b97b126038da716879df52ac1eb58d79f805b0cfb7de8fe8a6e0cbfce081cb83cf3a4e932f6b301c73a37323524", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633736106, "uuid": "f28c2ffb-dced-4dfa-92a4-11aeab799694", "value": "T197949D10A6A0C035F5F352F44DFA9278A52F7AE16B2460CF52D52AEE97346E1EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633736106, "uuid": "3ef6e6e9-88ca-4bdf-befc-4d430e763903", "value": "2a29283552656e7323601d9f44dc0a25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633736106, "uuid": "79912842-f0b0-480d-8f0f-69853caaf7bc", "value": "12288:kwFH8YFUkYRNRBht6u3o26rcS/HDGBeh:ktfRrBhR3o26lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633736106, "uuid": "89ca5d1b-227d-4ecb-aeae-d70de269bd53", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633736106, "uuid": "b0ed41d3-6836-4167-9619-b6c21a45f446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633736106, "uuid": "8c776127-9b95-46d1-b7f3-02832f741bb4", "value": "e80230955cc16706e2a07615a1f3a68e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ee0ba5-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633692570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692570, "uuid": "23cd3a1f-b2f0-47f1-ab39-76716d92f732", "comment": "Malware payload (SnakeKeylogger)", "value": "3012e52028d1cd5e04db79750533a064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692570, "uuid": "a666f284-40dd-4064-816d-43e287c1a55b", "comment": "Malware payload (SnakeKeylogger)", "value": "a10549ff7694ca1fc6390a7178a4b920f518fb852cfc4298ccbde265fb5a73ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692570, "uuid": "e2e12f7b-6824-45f1-94a4-b6a52259600b", "comment": "Malware payload (SnakeKeylogger)", "value": "b3f855c167742a9ff803daf31c3fab2f04e024a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692570, "uuid": "c4294bfe-5236-4958-bc54-932c482f104f", "comment": "Malware payload (SnakeKeylogger)", "value": "52a6fae09002e939a8eb9614a47504a3ffbc5f78b88511c94a71e8cbe392b232e1e4fc9d2afa29cca1b80857f09cbf02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692570, "uuid": "0ecfb017-8b35-46c4-a3f9-830216eb8c42", "value": "T108F424201242C469F6C172F3412756FABBBE3C033D85D89E22A87927552D6D3AF0B79D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692570, "uuid": "10130d9b-8ea3-4943-a0a9-bd2c2c29eb92", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692570, "uuid": "02a239ca-6607-4fe6-be71-e9fd8b568c07", "value": "12288:WAABDH4yqVO1HaSrkOdz5/f3KD5356OR6ur/HkCCC/BGNdvWY2q0kNg:W3BDYyq8pYU5fE53kO6UEwGDvWY2qT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692570, "uuid": "990ce677-fa19-4328-8394-659381ba127e", "value": 754813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692570, "uuid": "d3538579-fdef-4a57-9679-27d1d56242fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692570, "uuid": "d09de33b-fa3d-44f4-8638-7bf2628644b2", "value": "34567892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da68f799-27ef-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633667165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667165, "uuid": "dae81b8b-ec07-4c81-add6-f95e78bcdf66", "comment": "Malware payload (RedLineStealer)", "value": "4cf3bc57a39bd9ef992c98fe35c09117", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667165, "uuid": "1aa9b46b-034c-44cd-9841-cccbb8504a9d", "comment": "Malware payload (RedLineStealer)", "value": "a1325e79e1ac9114bdd898cbf9bd735d1ecf9475d72aca44b5a52d7b99952640", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667165, "uuid": "27671d2e-35ec-4ae5-9a80-6204fa223292", "comment": "Malware payload (RedLineStealer)", "value": "cc2cbd33d82784e95c0146c0f51c64aefca16792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667165, "uuid": "1d5b4bed-fcab-4509-9337-f0965cd48bd0", "comment": "Malware payload (RedLineStealer)", "value": "7d5d2d31611de2b20b22f25c9890e973b28033f3fb55d94c40650e6bcc633d2002fdde7f305546ae4a37f3f01f54c2de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667165, "uuid": "dee3d174-3306-4c19-95d0-d5fbb53e1f8c", "value": "T1CFF5AD052BEE8710FDFB1F78A97A85A507777C40AC38E16F61A5325E0A30F42E971726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667165, "uuid": "96558e33-4830-4134-97ac-0b350275f97d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667165, "uuid": "947ecfbb-fc9f-4bf3-993c-c1f5a81b3baa", "value": "49152:xVYykuDytD0PZV9FuSvZWiOygR4qNR8n55nSQ:AR7IH9FYUqN25xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667165, "uuid": "8f00c5ac-0f86-4ee8-8475-27cda90dcbbe", "value": 3604480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667165, "uuid": "a62b6d92-2c1d-44b3-a2ba-f6d114476e7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667165, "uuid": "da10dd9f-d85c-4d4c-8cff-8bf1c0e3f408", "value": "4cf3bc57a39bd9ef992c98fe35c09117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f207a96a-2820-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633688250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633688250, "uuid": "5c866b12-44af-49f7-a291-b599cce98971", "comment": "Malware payload (AgentTesla)", "value": "2a0404415d060d229fbc37bd7bf74df2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633688250, "uuid": "37e93931-818a-4d1e-b190-ec855504260e", "comment": "Malware payload (AgentTesla)", "value": "a13968af110efa8190f958a856a0fe41b9c0f98463119e833453e092be3866ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633688250, "uuid": "5fd1f354-bf30-4b39-9964-d7eb95039f1c", "comment": "Malware payload (AgentTesla)", "value": "9a0f8ed5b05af157f91fb73cc58f93340cdb535a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633688250, "uuid": "339985a7-d43b-4c4d-939b-e0edf9f17edb", "comment": "Malware payload (AgentTesla)", "value": "f8219d747d22cc532a6f1a532e2c2d04ab6ea271685e2fa841bb03534040a97c27b799e42dfb2ed9cfeabbaba2c7a229", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633688250, "uuid": "e2e17aa5-ee04-4ec6-9222-8b1e6ea84647", "value": "T11BC4C0AC7B50B69FC817CE768A641DB4EA64646F470BD303905316ADAA4DB9BCF001F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633688250, "uuid": "2524e14c-2910-4e0f-9fc9-0b04d8c179cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633688250, "uuid": "2abdab9e-12f2-4d07-8de7-fecc3e8193b8", "value": "12288:jokn53L+/R4P2X264SjnKqiVsEmStsREuYO3uVmAyOX9+DDyL9pD3:j3JLqR4ajKqSsJStEvYw+L7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633688250, "uuid": "c9236682-7a61-4f98-9ec5-9b130eb79ccc", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633688250, "uuid": "667805b7-e2f6-4393-8a9b-d5fa2cf8c92f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633688250, "uuid": "3d9098e0-08f1-429a-ba9d-583d6be18810", "value": "SHIPPING ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437dab73-2861-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633715875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715875, "uuid": "6dcfa38a-cfe2-420f-bdae-248af8ac2571", "comment": "Malware payload (Vjw0rm)", "value": "e600ddc9272ed25bbf4291460be628d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715875, "uuid": "0e9cb936-bbea-47ec-999d-a99fd231765e", "comment": "Malware payload (Vjw0rm)", "value": "a2cbfdcfc29291460269481e1fbb5084ac7d96bd51e8c8e2d1973d6a17faf9e1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715875, "uuid": "30dcd3e5-27f8-4a30-b73c-992d314421d0", "comment": "Malware payload (Vjw0rm)", "value": "e85a57ab41b248887d8dd55bb41c41b12a9da15c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715875, "uuid": "8411b79d-a9c2-4489-be9c-e14a68cb6511", "comment": "Malware payload (Vjw0rm)", "value": "3966c07dac70fb0309b931c68c62453f0b515e69b59d2eb4c31da3c30c9b7177f6b089784f9f236fa907ba9edabecbaa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715875, "uuid": "fd953682-5e0d-40bc-8736-9224a34ea878", "value": "T1B2838E459E413C46B5B4F692109F0024CE16E6F4CF2AA45BE08979CD0EEF2176B9FF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715875, "uuid": "def2ea80-db1b-4b85-93be-07777c7b9435", "value": "384:wfHP4VQ4jLhQpJWfDJQubSIsnfAf2fGfgffqf9X5fgCL4WqwUQP:P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715875, "uuid": "cc494521-fe7b-441f-9f20-8ce21116f117", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715875, "uuid": "48bb3c96-ac88-47bb-b92e-1c360a701723", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715875, "uuid": "66b78826-335a-41dc-8ce0-e559c390dabc", "value": "F51N3M18A6S.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab1c61a-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633706706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706706, "uuid": "b1b7d7fc-2c79-40b7-b1c8-f3400ec57583", "comment": "Malware payload (Metamorfo)", "value": "2a7e8a4187fa048a7bac8c1f1b5e266d", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706706, "uuid": "c2732040-45f0-479c-9df8-eab65ecac6f9", "comment": "Malware payload (Metamorfo)", "value": "a310a9ddd758cc9867324c58dc2d530e4913bde049315c2f28b18dac4e3cbb62", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706706, "uuid": "f245c578-8793-4bdb-b0a4-2d920f9bb70c", "comment": "Malware payload (Metamorfo)", "value": "f4918f87ab298bd42dc2a5e69869cd32b7f81ee9", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706706, "uuid": "8a5dbf04-ff11-484f-ac86-bf7f20524993", "comment": "Malware payload (Metamorfo)", "value": "955b459a4652bb0585374ceccd75b9157c66a56d22a88caef525cbb48dadcc8ea9a03634a46dca25faec0bdda4163a12", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706706, "uuid": "910308a4-2bdd-420a-b0b9-e7c27921f2f7", "value": "T1AD31D0051EDA0729C3B38F7A1077A2464A76FC51EE934F9D808497DA28A1154EC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706706, "uuid": "e82d3118-34e8-4532-be0f-53d6f009fc4a", "value": "24:8+JUHRlVo5kcbA+PLDjr+/P+jFz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+Pj08u1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706706, "uuid": "0f0c49d3-c73c-4f22-aac1-c4cf82129e48", "value": 1550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706706, "uuid": "6aadc4a1-d959-49e3-b72d-8240f9d5df76", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706706, "uuid": "bc5086e2-89dc-4554-a6ce-4dee6f81fddc", "value": "foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4686dec2-2819-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633684956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633684956, "uuid": "3516f1fc-b0d1-43b9-8b69-4d125d3e2a6d", "comment": "Malware payload (Neshta)", "value": "7d22685ef9d80598a24d2f096e527da9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633684956, "uuid": "b8f0b1bd-50bc-4408-854a-86cbafaf97df", "comment": "Malware payload (Neshta)", "value": "a3d59149a2b1ddb119228ca898c8f6ea1a9256b9567f00bfb1529283960b34d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633684956, "uuid": "6ca7031f-8965-4498-8884-d19fde1861f6", "comment": "Malware payload (Neshta)", "value": "458b1d290faa64ebbe4c5989229bacc060bd8713", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633684956, "uuid": "383cdbca-175f-4f85-9c14-3ac7c1ea665f", "comment": "Malware payload (Neshta)", "value": "91cbb7b143058f228effbc1e68d81a71225111a5100d3e0fb0f140dce5adaa3a36fc0678bcc27f1fd045bf7c52e4620e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633684956, "uuid": "e9b4e5d4-1ed8-41e7-a0df-04cc6df43f92", "value": "T180B412B8B367537BED3983F82C346180A3F560252819F7786ECD74D828767B85A60D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633684956, "uuid": "e9a0ebc0-6891-4a03-b0f3-77b3c8a39f75", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633684956, "uuid": "ab7617f8-3258-46e2-b09a-b3c0a8fb2c74", "value": "12288:rgYSAtU5KRjV6J5ByyID7OAMmNQku0mVimPaZMknR0Eb5yLdKC:r1SA02jM5ByymVNc0mVigaZrnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633684956, "uuid": "7722b096-b5fa-4952-9b12-13985232c42b", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633684956, "uuid": "0f0d3d86-d5d5-4f2d-93c2-70c5f2ee0259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633684956, "uuid": "5e3e2fb7-8548-4026-bbc6-b2683731e5eb", "value": "7d22685ef9d80598a24d2f096e527da9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2517579-2860-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633715631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715631, "uuid": "5aa1144f-05a7-432c-82ce-88346158b6ab", "comment": "Malware payload", "value": "56a2b99de187aab1871c30090a128320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715631, "uuid": "ab1fb2cb-f485-4b5f-8d94-8d138e19d815", "comment": "Malware payload", "value": "a4afda24bd6c4b504a7ff9c3cb1b54f1ecb899b8bc136809bf038afe41a44dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715631, "uuid": "81f42d55-918c-4bc0-ac4b-9cef2e105ae2", "comment": "Malware payload", "value": "df7027a8614c971a84b4dfcd2c8574e4307f3dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715631, "uuid": "6bf0b193-063f-476f-90a0-80ba8ab2df23", "comment": "Malware payload", "value": "d899b42176f36bb2e0087167988dbba2ae7699d074c5bf6b2ada306f35bf061ba20355f909fa6de118138f2ed5ff55ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715631, "uuid": "8e4ee982-729e-45d2-8e2c-c64ce4517d61", "value": "T1625533E069D04638EB6F16B974CD65B08394BAA00CCC7A6D9CD7E74FD61520DE8B2E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715631, "uuid": "9ff1c51b-f5a2-413b-8547-772da103f821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715631, "uuid": "aa6da664-3939-4a8d-9f8d-c9199aef9878", "value": "24576:lMG06DSdx/H/KYzEj4WH6dcWWwo2CI7HyYgk4KHD+CVC0+8D:6mSr/TQ1WWwoiHp0Kj+CVlzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715631, "uuid": "89d2d79f-40b8-4b48-8ec3-c9951ca6381a", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715631, "uuid": "818b6e6c-efb0-4e2c-a0ba-1499138720d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715631, "uuid": "f5b4ae9b-d6d6-40fc-8182-8eeb32c58dda", "value": "20985678875456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91be40c9-280b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633679069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679069, "uuid": "4870d15d-67be-448b-aa59-126028f1262a", "comment": "Malware payload", "value": "57f4c3daa3fb6c5155cb40c60d634688", "object_relation": "md5", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679069, "uuid": "19bdbbad-123c-4651-8f4c-897cff0680b8", "comment": "Malware payload", "value": "a541afa0e73c3942b8c3645a3ba1ea59c4d6e1110e271be34fdb6a8c02a299e2", "object_relation": "sha256", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679069, "uuid": "9ccef64f-ef98-4793-909c-7a23b48ce1bb", "comment": "Malware payload", "value": "6f81ccb61dcd79cc5fd23c2b6289c2350eee7c36", "object_relation": "sha1", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679069, "uuid": "ccdc6b93-232c-4d92-bb49-c76bb0ba827a", "comment": "Malware payload", "value": "dd525db79e9b1d3e6635026adf77544cc60e34af889065be28867163794c61eaddc78be30b120c27784681dcc9bc9b83", "object_relation": "sha3-384", "Tag": [ { "name": "Aerospace and Telecoms Firms", "colour": "#8E7432", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Novel RAT", "colour": "#746C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679069, "uuid": "f1b1b7f0-8493-44f1-b14e-883f45cd1618", "value": "T1C67329057BEC8673D6AD4BFDA9B251014370B0377A22E7CA1C8270EE2A577D44A507E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679069, "uuid": "81cb6745-21fe-49eb-b2ef-7a8f9343f3eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679069, "uuid": "9ee708f6-5f5a-49f8-805d-e4614813186e", "value": "1536:ajfAn/EH1kanRCMVamg0+kM6Shm1bDr1OgREBpzEhPs:ajfAntUCMV4XF6Shm1bDrIIEB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679069, "uuid": "0161cfa9-83e0-4854-8dfe-2dc2a6f06d3b", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679069, "uuid": "e6d95879-c43d-4ee8-9dcd-12b19ca50710", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679069, "uuid": "a7ed7b2b-f4fa-4385-8c6d-dd8f4c696455", "value": "a541afa0e73c3942b8c3645a3ba1ea59c4d6e1110e271be34fdb6a8c02a299e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07981252-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633693870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693870, "uuid": "d0c7e7b8-c90f-4802-9134-9acff849c3e5", "comment": "Malware payload (RedLineStealer)", "value": "34b1266c6b7f0838795c938fe196bcec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693870, "uuid": "eb7c3102-ec9a-49d6-9849-7fa451bad77b", "comment": "Malware payload (RedLineStealer)", "value": "a686eb7c19ed787b3892841f2ff81d60af1a08d5ab1658f7ab1fbc283a685faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693870, "uuid": "55d9d8ce-fb0f-4d65-bf9d-35165ff34749", "comment": "Malware payload (RedLineStealer)", "value": "8a13ad7eb183cb279f76426de57784671d886432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693870, "uuid": "1b5314e3-ebda-432b-b0ab-97d4f25bc9b7", "comment": "Malware payload (RedLineStealer)", "value": "8f1189e8ae8c622f8d6317cf379d2824a42d5cd83fa8cabe5e266e15928ee984a4776e9b0f869ecfdcc8e1cf0c24eb0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693870, "uuid": "267d37aa-c2f5-4f4d-88f6-22e63d61c9a8", "value": "T1FF64DF213AB1C432E66F19754F2087A18A77B8A15D21878F2FF516AE9F352D1FB20707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693870, "uuid": "3cf6e654-8a9d-42af-8152-eb02b0ca7aaa", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693870, "uuid": "f7262aa3-d89d-42a2-95cd-440dacbad14f", "value": "6144:7WLwvWLxM9bAAqQhran68pnCZNZcu5+TCywp9rvNvZwh/hL:wZxKbA4an68Q2u+mbN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693870, "uuid": "f59cff2f-659a-4d2d-bfa8-885d80929cda", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693870, "uuid": "550427d0-a513-4e49-bc3a-451eb2096066", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693870, "uuid": "698bf928-9910-42cd-be4c-b5b2e577450b", "value": "34b1266c6b7f0838795c938fe196bcec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baded6cf-2819-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633685151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685151, "uuid": "90db3308-0fba-4d3c-95ac-5d4f5f41e228", "comment": "Malware payload (AgentTesla)", "value": "cad9fd5b75d06bea670eeab1be86335e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685151, "uuid": "5ce87c7e-6981-423f-a3a4-473f0af63eff", "comment": "Malware payload (AgentTesla)", "value": "a875875202111978e4c51bfb9fbef5a4162b04c36fcd2632fc2698a1dc1faabc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685151, "uuid": "73da3d33-233f-4ce5-9b51-3a101e116dd8", "comment": "Malware payload (AgentTesla)", "value": "f5921c677a54cfa24bd2f2a4c3862e50cc7c6688", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685151, "uuid": "225c9b75-8ef5-4c63-aa90-a65c83c1276f", "comment": "Malware payload (AgentTesla)", "value": "a789442fb927422ee7d645684757d63e407ee89973b440a4e743085f0e4055140d8a5623b4f0425f4bae48200649b422", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685151, "uuid": "6f85ab42-37b2-4b14-923a-48743ec350a1", "value": "T1AB9423C459DCB064EC9BB37433B095168F9AB007E1FE9628EF80469C2DA3134F7A9567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685151, "uuid": "28032066-29ca-4614-b75a-a98882d5bec6", "value": "12288:4wwAVJuw0EH6bW6RkTAowut5EIwdilhLjXmHSQui:4wwAvurK6NZc5EVdqvmHSzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633685151, "uuid": "12112608-8e8e-44a4-8029-ef0227d7baa7", "value": 429986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633685151, "uuid": "01cd008c-4d61-4d32-84e2-7c55c1f6eef0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685151, "uuid": "60b56dfa-10d6-4439-b1eb-4974ba52104a", "value": "INV PL M20211007437.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d30d96b-27ea-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633664808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664808, "uuid": "060cc9de-4ae4-4e6b-a366-1016fd2d770d", "comment": "Malware payload (AgentTesla)", "value": "94123fedafe83c91152229658d5ff690", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664808, "uuid": "d4817a87-0c22-4453-9615-11d17f497e58", "comment": "Malware payload (AgentTesla)", "value": "a8d485aee40aa2894828ad0fb3e366194763c334249a641c484b78c539ade96c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664808, "uuid": "1af50946-28c1-4a63-9061-0ab1a4ea70d1", "comment": "Malware payload (AgentTesla)", "value": "59b587a4e5fdb9cc1cadaec8f215fb8c702e621d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633664808, "uuid": "0e19432b-b922-4437-bfad-5e51c665e988", "comment": "Malware payload (AgentTesla)", "value": "179adbdf46be7da787f3b029c36bd2b4f245bd8fa47e6732bf5f0920a2f74b62258deb4e03dff5298be037ee7de529d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664808, "uuid": "b75284f5-f995-4e75-9224-8c2220cb6f4d", "value": "T19AE35B4133D56711C59866B4C0E7573007F7EACB26B2D3863F8956E64E017F88E4ABC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664808, "uuid": "fe6e0817-c0f9-4cce-9426-a77890c73fbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664808, "uuid": "584f94fc-2869-4976-b609-02b9add26919", "value": "3072:/eWTHRcaAm2I4WRnAlbYRuZG8S0h0CTXYmvFMQ4b1LfW:2WTHDAAkbS0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633664808, "uuid": "5e4a5b20-ab8e-43a5-9f17-c9dd79357947", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633664808, "uuid": "e34519f2-5d91-439f-8ae4-efc0959ec974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633664808, "uuid": "c2159dd0-a80e-460a-9279-6534e3b6af74", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.23202.31179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02531aa4-2841-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633702021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702021, "uuid": "aa302178-9cb5-4c7b-b7ff-8caf138320fb", "comment": "Malware payload", "value": "7b2ea8fcffd2ce8548c4be3e42dcb60f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702021, "uuid": "3cbdb2d7-3128-4044-b3eb-ed909d02b603", "comment": "Malware payload", "value": "a8e1e13995a1af35365965d172b801e128f52da0afc6a6a6fc7180210614c2fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702021, "uuid": "e8494734-6798-4d3b-ae5b-aedfbc411005", "comment": "Malware payload", "value": "fac1828c564f90bc20a4be5f9c3c5e123a6f8fb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702021, "uuid": "d9780a50-1fcd-4b76-9f84-89372419760d", "comment": "Malware payload", "value": "641477cde7fd747b36650c82d8b47e6c739d8761090cc0953f1647033b36f4981e75191ce9339c7b8350ecf44f15cc79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702021, "uuid": "73b959d9-e2e3-4ea2-9d7b-830c7685a244", "value": "T1E035221370E4C073E84509B44899CA35EC79BD751B764A8FBF91866F6E316C2CB2AB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702021, "uuid": "a6140915-001f-455d-8ba6-e03ea15830b0", "value": "eea3fc82590b00602b34e6722a08f9a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702021, "uuid": "bcff701e-dc1f-4907-a85a-097d335a652a", "value": "24576:4CRVwYkTdTFVbOSv9z1BHMK6UJy2gVibh8kBFnohBgyeT8ml0i:hUTTV1XHxJy2aiblBFohmye1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633702021, "uuid": "4e704ed6-4666-4a4a-8cd4-13025d029017", "value": 1128485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633702021, "uuid": "71f4d1fc-7647-4d73-a0eb-70a04851fd35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702021, "uuid": "5e62a65c-b922-4ac3-b0f1-78a2ef4208b8", "value": "7b2ea8fcffd2ce8548c4be3e42dcb60f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c540864e-283b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633699771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699771, "uuid": "0a9a0319-14d7-46f7-83d2-dbd5b00e08c8", "comment": "Malware payload", "value": "3b0204b0459dd8ba67a5ffefd0115330", "object_relation": "md5", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699771, "uuid": "34719dc3-8401-41b1-ac32-cff9a79c2908", "comment": "Malware payload", "value": "a954c9f0b3b82dbe4e313537c77b681d3996605d57b55b3f0623b92b96ef1556", "object_relation": "sha256", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699771, "uuid": "d0fe26de-3716-49e9-8a53-e52897673a1b", "comment": "Malware payload", "value": "66a133025328547a50dce1b4c643fb042ff619d3", "object_relation": "sha1", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699771, "uuid": "3a21cb1e-5fa1-4529-9c67-2470b2e3ddce", "comment": "Malware payload", "value": "f11eebd440e52fbcccbf711df5e15a2ef5382b7039d04763ac777aeb7cf0048f875c37218f5c30c0351c2876cab91487", "object_relation": "sha3-384", "Tag": [ { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699771, "uuid": "fa3e641d-870a-4424-9c12-3e23c27f9369", "value": "T1F925628682299C9334A10588482912DE1D3C09593AA4DF7C75FF7CDBE65E76F00EDACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699771, "uuid": "7aaff9de-569c-45d0-8e31-94eecb12cbd9", "value": "6144:jeZHd4yT7zsNcbZ+O7la2c0UuoG8DyM8WqaXOEb6CoooLIf6m30o3rUGYuLqkKiJ:T0rckLKXLqkKIX7oTtBPqhP5vJWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633699771, "uuid": "f558b1a4-3c0b-46a3-b389-093540ae830f", "value": 1005275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633699771, "uuid": "db12d11c-f5aa-4fe8-8917-8d193b52b0a3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699771, "uuid": "0d07da99-abbc-4707-908a-a833071a95fa", "value": "Server_D_127879675869709708797096856970.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f82c620-2862-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633716378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716378, "uuid": "94bfc3ec-2cb9-43a8-9a50-695d491cf7bb", "comment": "Malware payload", "value": "fd7d67ceca04c4ead1508298b797d674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716378, "uuid": "481dffed-e42c-411d-9dc2-8fbd09116d02", "comment": "Malware payload", "value": "a9cce75c8c8200005f0d039312f4767926e1b3cc8aa1ced7cffbda3dbefb24c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716378, "uuid": "6e1fbe73-8de5-4370-85e5-b662e563c2c1", "comment": "Malware payload", "value": "77b3d5caad4cfc53003e9d1f6570b7bc14f1c716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716378, "uuid": "e9a55210-1797-4a5e-b379-fbb0964dac32", "comment": "Malware payload", "value": "8659ef9e1f45394706d2bc5f2f6491a43fe4121cde298b8c487c03a8e5d58d1f9b4fdd20b2ca0c23d05ee6f0dbe5dee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716378, "uuid": "058f062f-b438-4b1a-8d72-6df489e09bdb", "value": "T14B352215B7F2E031E66F02318D70DB64AFBAB8622173A15B77B52AFC0D613D1462A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716378, "uuid": "f32c81e3-8be4-466b-82e4-a702a8ab91a0", "value": "4f9c7d0d3671483fa7b1247d926d59c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716378, "uuid": "63588322-dc5c-4fc7-9757-f54d3e70c1ef", "value": "24576:ijXr96V5bF58MUsFV4Lp5eVL1mKEgP6TgHBik:iH96V5bF5jXK5eVL1ml8Oagk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716378, "uuid": "357d667d-c293-4923-94aa-529838526b87", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716378, "uuid": "90810aa2-fdca-4c3e-8239-909c4199167b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716378, "uuid": "440ce679-dade-4113-a23d-a329ae139beb", "value": "fd7d67ceca04c4ead1508298b797d674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978a3991-2887-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633732336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633732336, "uuid": "20622018-8d0c-4f98-80c4-1b8d0379f216", "comment": "Malware payload", "value": "b0e6d02eb01100dfee3e8026a1667fbf", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633732336, "uuid": "985eab44-f5bc-4ff7-bcbe-bd7e2e32dc0e", "comment": "Malware payload", "value": "aa09666c07f6fb1f0782c4da85d2f606c3da3b0679dd9882dca317fff8bd98d0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633732336, "uuid": "1958f52a-5bde-4f71-954b-4942cddfa211", "comment": "Malware payload", "value": "049c8769e20c2d4a94b6876a62bcc23a5705ec63", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633732336, "uuid": "0adfce43-3e55-4c46-bbee-d96060465423", "comment": "Malware payload", "value": "0b74998e9f29ad6c6b630205353a158ef9a8f8023bd26c6dc0976588623801ce64b2cbf50dc02714ecf16122d6ca6039", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633732336, "uuid": "ce504ece-ca69-4afa-b03b-2be9439fc465", "value": "T1C5F53364FAD59408C40BE73254C1618BA112959F2138DA1DCBF440399EBAFECB72BE77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633732336, "uuid": "3873aa64-f8bd-4e32-8264-c2e1c08398f6", "value": "98304:7a+ZbNb0zCZfhMyiyDRhLUC1nzE4yxrgVr:+2QehliWLUIz5yNgVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633732336, "uuid": "3662c77f-bafb-4c67-8049-02705dcf1d68", "value": 3605459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633732336, "uuid": "38b363a0-2d0d-4b13-8aea-c290d0edbe6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633732336, "uuid": "2a4056b5-da24-4047-9749-fe0108c964e3", "value": "aa09666c07f6fb1f0782c4da85d2f606c3da3b0679dd9882dca317fff8bd98d0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c237c3a-2831-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633695166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695166, "uuid": "5d0cec17-9bc7-47ed-b078-7b0431ec222c", "comment": "Malware payload (DanaBot)", "value": "f118818f7f84390a4659f186e1afe44f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695166, "uuid": "5d1eb28e-f186-4afe-ac52-5ba5d8b6fde0", "comment": "Malware payload (DanaBot)", "value": "aa45891e05a5365976defde1926bcf667f207b61af7cc455a1b7e1bd5fabba05", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695166, "uuid": "6dae52de-1a64-4b97-8d70-b96f93667916", "comment": "Malware payload (DanaBot)", "value": "2398e5c3628b88044bcefc0c30137d7b2ce88940", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695166, "uuid": "cd9ebefe-2766-4e9c-91a3-72374cdd88e3", "comment": "Malware payload (DanaBot)", "value": "5ff14738bfbf8d0a23fdc8b09f602d3217af134e0914bae0aae7da648213cd937fda0ad039e246f15c9c7247d22535d0", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695166, "uuid": "847ef8ca-0278-4048-b11c-7ebbc0279aea", "value": "T10135237027C5C0F9E7AF62708C7182611B7BB811ED30968A7B7555F9AE3A392C62D307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695166, "uuid": "7d2d03b2-cd38-4560-a59d-b5689281d8ab", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695166, "uuid": "b5d45138-02f9-4b0b-916a-0013502fbf0e", "value": "24576:BRxzd+PWnQDC8pSfdyaMeK1OlWIj563jg1GYtIrrpvsoed0ANO:BRxh+e+fatK1Ow3U1GMI3pMdFNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633695166, "uuid": "056f887f-d504-4533-b91e-8d2a89acaffd", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633695166, "uuid": "4f8488aa-610e-44f8-b567-179ec93a5196", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695166, "uuid": "3ce51e7e-74f7-4cfd-9a72-d4f52da22d95", "value": "SecuriteInfo.com.W32.AIDetect.malware2.5914.17238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f44fbc3-27f7-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633670341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670341, "uuid": "efa5ca6e-cff8-4891-9595-890ae7d28bf0", "comment": "Malware payload (AsyncRAT)", "value": "7af4c312bb2f0284f16f8f43fc1e1375", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670341, "uuid": "97937224-c0d9-41f6-9f07-b67ed9f89679", "comment": "Malware payload (AsyncRAT)", "value": "ab199809bf3d853509ba7a0d68899c0681b684db1c460b679f9632ac4c75c94d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670341, "uuid": "8b902d88-8f95-41dc-916a-c781224e3ee5", "comment": "Malware payload (AsyncRAT)", "value": "2b5b327ef6a4910b122d106c664efebbf2517678", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633670341, "uuid": "ae5055fb-e3a1-452d-bcb0-747c09191e27", "comment": "Malware payload (AsyncRAT)", "value": "fc96745b63475b59cf2997a41ae607b532a23f31bf4b9a35be4b4b172a7ec7adf89c5207e65caa36d8bfcfc159b1ea5b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670341, "uuid": "965b2add-b46d-4395-accf-a97c54a2b901", "value": "T1AA437C1273945327E67E2B3610B254101BFAE342A732DA1FBECC409E4F67B44C7A2B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670341, "uuid": "b29a1025-67f4-40e2-a547-288529914f33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670341, "uuid": "6e9a1433-77c7-4c48-88ff-88fe8fe8ff33", "value": "768:wvI5RYMz13mhcR5Gz7rT5A+CCRMQe0HRMCE2yUy5KMc5tuQsxYho5Fhl4:wQ/W05GBpMQemRMEyUy5K+QsxmoD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633670341, "uuid": "72f8e30f-8d72-4441-8229-671850c31234", "value": 56248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633670341, "uuid": "062c22cb-74ce-47dc-8629-09f7f62db03e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633670341, "uuid": "cff2cac9-3363-4df5-968b-20f426f8de6c", "value": "Invoice Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7a4e4d-2862-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633716242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716242, "uuid": "d08ac5dd-503f-4a0c-9b62-3228b6f17e2e", "comment": "Malware payload (DanaBot)", "value": "91b1dc3f70f739111bfa2b2e42ea30b5", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716242, "uuid": "f33b6378-62a1-42d6-adf2-b366015f1b06", "comment": "Malware payload (DanaBot)", "value": "ab2c8662c8101b040f3b5e41eb3639b1be3ce9da6ac155f7a4b0fbe63bb3fde3", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716242, "uuid": "4c968c61-a4ac-4fee-b621-366eee5cfe34", "comment": "Malware payload (DanaBot)", "value": "2bfc01eb36f7e9863d093b190939afbd04c015e5", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716242, "uuid": "aa0f4f00-c885-4ac2-a494-61266b6437bf", "comment": "Malware payload (DanaBot)", "value": "b656760696d0ba05e2021934272c445158593589e8f48d1dffd61a6309c49876e3a19fe594dad2bfebaf4efa234c4b90", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716242, "uuid": "2673eb6f-3610-4ab6-aa5b-2fc4e3901304", "value": "T1B2563371F67058B3FE2E8B75846F38329AA2BCB066319176CD1BE9DB0770D82D524B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716242, "uuid": "ea54f4ff-1e14-44c7-9f83-43a8f0d5b3c0", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716242, "uuid": "47259fd5-fd23-4b50-aaf8-65b98b65ac52", "value": "196608:I0LYFdxMbctHWVJ6QXw2iwx5ytLF5OcF9EnXciUJ3Qef:I0axftHWVJ6Lwut6cYvAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716242, "uuid": "5b6abbd6-3081-4329-aa4d-44452e8dac1a", "value": 6411056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716242, "uuid": "9e62a621-4ad3-4d24-9961-b495a01ace7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716242, "uuid": "05bae6f6-7480-46bc-ac24-8d2faf02dbad", "value": "91b1dc3f70f739111bfa2b2e42ea30b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de5491d-283f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633701235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701235, "uuid": "4f8ebee8-aae2-4ea3-acdb-0c48741b5228", "comment": "Malware payload (RaccoonStealer)", "value": "a4770bca912ec8bc41db7c8ca0603248", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701235, "uuid": "d39e58ab-5f88-44db-8bd8-b4ad4a23a656", "comment": "Malware payload (RaccoonStealer)", "value": "abac1d73d13e6decaf8216d4503cf0835a48afa117e9fc9dae92a1fd10f8a89b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701235, "uuid": "31793a93-bc92-4534-8b9a-394de25aaeb1", "comment": "Malware payload (RaccoonStealer)", "value": "981d52eb1c1217d8615453be5c2578f41697ed49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701235, "uuid": "fc9dc124-4588-4d57-92dc-0c3beccfd1af", "comment": "Malware payload (RaccoonStealer)", "value": "e3594b1ac42c8674efd23e1ec88c26bd157146b070b05d748607014c39c49d72dec0802499000eb58d692e2a9568ca13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701235, "uuid": "8a108421-aab3-4998-8a9a-5f2c7a3d91eb", "value": "T1CEA4021076F2C075E7AE1A30C871C6A51A7BB9525A30818B63F807EE1EE13D09B7775B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701235, "uuid": "1f69674a-e42b-4dfa-a0c3-dec05e00a02e", "value": "4f9c7d0d3671483fa7b1247d926d59c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701235, "uuid": "cf29d331-49c7-4547-805c-b7f7a23c0966", "value": "12288:h+9mhMVACXI4Hy4aCM01kQup7Jkz1VKRPam9pGmHJiQEr:hLkZ44H2rMkn2hVgpLJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633701235, "uuid": "df187d70-7a83-4e04-bcae-b8bb51e0a04e", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633701235, "uuid": "1f5c450b-6952-4ab9-8eb5-583c58cf89ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701235, "uuid": "dc83f1b9-d363-425e-b8c1-de99ffa5d943", "value": "a4770bca912ec8bc41db7c8ca0603248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087785ec-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633692583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692583, "uuid": "23860774-95f8-49fc-a8fa-2bfb832e0e47", "comment": "Malware payload (Formbook)", "value": "5533ba86d6ef48289e411bf1919a2d9e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692583, "uuid": "e110711a-88f1-49e5-9740-fa2566eddc91", "comment": "Malware payload (Formbook)", "value": "ac341d5bcc1cd581006c72bf3a2a8fbb43c5eefa5734b8591a20d552035302ef", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692583, "uuid": "4729b295-cfe6-48ad-a194-c6e1ccef56c8", "comment": "Malware payload (Formbook)", "value": "d5f9c169be0781c0addc7f400e4d7edeee71bc10", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692583, "uuid": "e522ccf9-7a77-4888-94a6-324cf8d6f495", "comment": "Malware payload (Formbook)", "value": "742da6c777d781bdc6536ac1b34c594549cc0a0ab7aa1ffc34c5e6df52e4959a40f997cb1510ce0f7a907dabda767bb7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692583, "uuid": "b3b17798-f1fc-4616-abbc-89964d7322a3", "value": "T1BCF4AFF876047DE6666F466BCE96ACDD03B5276389CBA4CD4064BBC305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692583, "uuid": "91518bd2-72b5-492c-aed0-b3a9e7f8a7ab", "value": "24576:x+Qbhmwx7F7k2wKKGVDsgNkiPk75Emizo9A8uTmHL/:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692583, "uuid": "6fb906a0-e43c-497c-adc3-e03606d9dd50", "value": 793731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692583, "uuid": "adbc8709-085f-4dd4-892d-4a8553b45ce2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692583, "uuid": "525f7cdc-3263-4e19-b396-d5902cfa15e3", "value": "115-209.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fe6526-2878-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633725925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725925, "uuid": "a929026d-0c08-4635-b0ec-cf7bcd8d3b01", "comment": "Malware payload (Mirai)", "value": "0f215eb3a4d1ddb3a262ed79e185ee77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725925, "uuid": "ab18c859-388e-4f0a-9957-da45ff1c9cdf", "comment": "Malware payload (Mirai)", "value": "ac5a95221b895545eb04cfea29693288d7b432ad313f6bfc9db2ddf86f085a63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725925, "uuid": "13492f00-288d-44ae-b88d-bad323fbec01", "comment": "Malware payload (Mirai)", "value": "0a2914f67b0416025a2222af1ec72e9168641e26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633725925, "uuid": "7442bc6a-15f1-4e1b-994e-22f0e3e353a6", "comment": "Malware payload (Mirai)", "value": "06d653b4732538859ba39db24fddeebc7c126424bf086ed250aff69c9cad82b28621ebff15fa92e2aa171d947c6979c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633725925, "uuid": "320ef972-af63-48da-8b10-9180d62b1dd5", "value": "T18DD39E9FB74B15A0C86203F40BCB4FDC2E532211AF1B89EB6C1E643E6D791DB55163A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633725925, "uuid": "f5985c0f-7b31-44ca-a0f6-4094654c8966", "value": "3072:o8289KpFdckFR0AOYo4yYhUtbgEk0Oxfgixmdq:o8cLBFRlODt0Em6dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633725925, "uuid": "99010640-0beb-4af0-ba0d-a5514ddc8769", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633725925, "uuid": "12081ad0-d3ee-4c5e-be08-73bb6e5455e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633725925, "uuid": "a57e5983-5750-4aa6-b11d-07ce0e3e7b0c", "value": "0f215eb3a4d1ddb3a262ed79e185ee77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b444f48-27ef-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633666818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666818, "uuid": "dcfcbfc4-5d25-4e1e-9be9-39e0dedfc3f7", "comment": "Malware payload (AveMariaRAT)", "value": "6198ab3e132a5be2a5169d0dc80d9a3c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666818, "uuid": "88621fbd-8144-449a-aade-d3494524470e", "comment": "Malware payload (AveMariaRAT)", "value": "acc1b08dfa622c097a4ee3f4b229390bdf27f00bb5f6faad059f9793ec55b3db", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666818, "uuid": "df1982a9-d65f-4960-bf62-f01eca8ada48", "comment": "Malware payload (AveMariaRAT)", "value": "08e4350c1e3160baa78baf7ddb55387c13e5f49d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633666818, "uuid": "56c184d9-ecf6-45fa-8f98-864a816d69d5", "comment": "Malware payload (AveMariaRAT)", "value": "1d11e702284416777ed8b27e312500ee82acbc09319f179fd49082fd19667be548bd756da30071485413c3ed56b38a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633666818, "uuid": "d48a4cc9-18c8-49f0-bb95-20c49ec755a9", "value": "T15084E1341FE89752F5F20F7069B402E09B7E781C8E3BD34D1A8525EA2DA3B59C610B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633666818, "uuid": "462342cb-ae9e-44c5-88b4-7988a59e911c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633666818, "uuid": "69e1c924-90bd-4b08-af06-1f21085dc7a2", "value": "6144:VBji2hiTaF9dCJL9mERt9RGTtKttotRtYDETAHOpUAG9LBaUig/s6yDYYhhU1G+:VdDyL9pD3OPGtBaUid/cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633666818, "uuid": "a4e2a972-944f-44ed-ac3d-107e26e7d1c3", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633666818, "uuid": "b1acb2ca-3ade-4c9f-a146-acd4540b7e1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633666818, "uuid": "6fc72cba-44f6-486f-8e94-9daff9af84b7", "value": "gAmcZ1ib1i8PlwY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658b0579-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633694027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694027, "uuid": "b841f0ef-45c3-4416-b178-fe7c6fbe7b19", "comment": "Malware payload (RedLineStealer)", "value": "c99e1388d9ff4d547cafec18e4242607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694027, "uuid": "6ee3f178-2c91-49fa-b4f5-0bfcb681699d", "comment": "Malware payload (RedLineStealer)", "value": "adb6b46816977d91e0fe46b09ba244573814f37262cea278a7be32e4e52a32e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694027, "uuid": "2e2f7bd0-cbe4-4f24-8d11-cee0dbbdd1df", "comment": "Malware payload (RedLineStealer)", "value": "4dc6fb76a0c1015e6fc4817fc9f83f8bb3658a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694027, "uuid": "d5095ee1-5111-42df-87d9-22ebd84309e7", "comment": "Malware payload (RedLineStealer)", "value": "f165f41153647743a2df7bcbd3f2e0e1a3a785b427721eac8887f784e62cdd1c16c68a2d3b93155f64e9ff604e01ffea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694027, "uuid": "53a1ad22-ae3c-48d6-826b-99f4eb7592a9", "value": "T11954DF1036F5C436E2AF56354E72C6A19B3BBC629D22A08F1BF156EE4F252D2CB15307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694027, "uuid": "2cbdadb8-23ba-412d-b7b2-380cb49ceddc", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694027, "uuid": "b35fedf3-1c64-482c-b3e5-19dff48b7df9", "value": "6144:bYdIFwrkxNm4PLNBVn1d92nG6muFNFEvrbYW/ia:Eaw0Nm4PLNBVnp2rmievd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694027, "uuid": "7b8ece71-e5b9-4786-a4cf-0bf920742ce2", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694027, "uuid": "dcbc6849-9912-4035-a504-3e523b74e3f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694027, "uuid": "4c677356-2722-49fd-9ac5-6d525ab8e502", "value": "c99e1388d9ff4d547cafec18e4242607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fb4602-2808-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633677739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677739, "uuid": "c26576a3-7cb7-4f9c-899c-fcda2b7c4288", "comment": "Malware payload (RaccoonStealer)", "value": "276e93e00b52bc897f3a3c4bbb18e279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677739, "uuid": "6cefdff0-e9b4-4c2f-ae62-ff09b8725f65", "comment": "Malware payload (RaccoonStealer)", "value": "afe05e1fe7e402cf44ccf592338f9cdbe6975795c9c3247cfad700f6eae88724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677739, "uuid": "fb8b495f-49da-4bb4-bc50-7844642613cc", "comment": "Malware payload (RaccoonStealer)", "value": "a9ebf5a389c744f032da67e8f081e5d6fb675135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677739, "uuid": "839ba989-4ff8-49e4-b5e7-3cf3b544bf61", "comment": "Malware payload (RaccoonStealer)", "value": "79b42eeafdcbce3e85e04adeee8cdb4ff07111e6c467888cebfcf8f882c7144d2328a7182a0e5c286c337d2a7b57233b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677739, "uuid": "63dc554e-79c3-4f82-8e94-0cb85431872e", "value": "T1D1A401207AF58032E2AF97348A75C7644F7FBC928D3194CF2BB556F92E652C08729352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677739, "uuid": "48041bed-2769-4f4b-b923-99e3a45f6154", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677739, "uuid": "49403da7-6912-49a5-8443-b11fa2724e01", "value": "12288:BUw5/kdxe8P5nN4Mh2ZzcUFsZDpwlw0mJ7:BUwdC5N4Mh2Z3mX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677739, "uuid": "6174beae-51f2-46f3-9c92-9e5753b83627", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677739, "uuid": "3eb22da3-da9d-4eba-8795-ec6a87415264", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677739, "uuid": "d53fa93d-491b-42b1-a55c-a0435612ed0c", "value": "276e93e00b52bc897f3a3c4bbb18e279.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa83740b-27dd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633659354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659354, "uuid": "b069d1ef-37c1-4f0b-ac1d-0745f7d5d7a7", "comment": "Malware payload", "value": "36225d7872d27a75885863a5a06e27eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659354, "uuid": "f6a9ce8a-3a03-45d9-a2eb-59625a083609", "comment": "Malware payload", "value": "b236f6d1be051c189b1be344fc2580068f4c743402313ebc61a76a15c628fa37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659354, "uuid": "34a3dbfe-ed81-4d56-b126-b4d64760e94c", "comment": "Malware payload", "value": "cb0cdbfb450dabbc4e2759837be7327733dbfd80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659354, "uuid": "76e2e729-c7c0-4638-9c9f-e3c372f9f2c2", "comment": "Malware payload", "value": "a8024cd609e228c561496e0bb75563c1907c74257e6071a5d01510a582fd7de6396b819aa53e4860d217300b40d103c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659354, "uuid": "fed61055-2c61-4547-b986-91c9b35adadd", "value": "T18EF533E528C18D91C56BF1F2393186912BB0DB6573C1DF4BE71749F6C6228CE932A4E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659354, "uuid": "21d13259-e274-4330-9851-451407ac3a27", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659354, "uuid": "923aaceb-0b82-4678-b61a-b128f9cacfb6", "value": "98304:o2Ox9CTJfaarom/pAD5plKG2sZ1cQbjIISP:THbromBgps/sZ1J4ISP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659354, "uuid": "2578ce85-e37b-4235-b76a-7affa683efba", "value": 3516928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659354, "uuid": "3bd85a5a-7324-4927-8f4e-3d910c0a3755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659354, "uuid": "116be544-7a67-4832-aafc-06c5b92eca69", "value": "36225d7872d27a75885863a5a06e27eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8315e79b-2806-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633676897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676897, "uuid": "af846e54-47db-41f3-8070-41b38c3e3516", "comment": "Malware payload", "value": "9e712eae4c8bd84125739c6857400fab", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676897, "uuid": "1ac5e20a-062e-4837-ab0e-8ad47a6e57a3", "comment": "Malware payload", "value": "b48385931cea9cc4da5d5c09ed577325b8672449b76bf67731ce543901851c40", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676897, "uuid": "ee92c846-5c90-47c1-a69f-7989c26a4bac", "comment": "Malware payload", "value": "d91e4a323efc2a297f868ec683cc06c23d5d6c47", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676897, "uuid": "7928273e-03b6-436d-8fc6-998185d96b3e", "comment": "Malware payload", "value": "3415baa2af3a14c6f4a12fbb0cdda8be9871d96c821c1bdebb30e52344f3c170e669644035d6940d593e7e2e9ba96a52", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676897, "uuid": "1de6dcaf-c176-45d1-86fd-a27efadf5f26", "value": "T119B58F22B2D18437C0772A3C9C5FA7A9A8397E112E38994B7FE41D4C1F396817D292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676897, "uuid": "8bf54e03-5a6d-496a-920b-991728517c3f", "value": "49152:kjageKOEqs5l+9iRARU6acwTPI75YLEA:rfhEJn16c05YAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676897, "uuid": "db2ef7bd-d8b7-4103-830b-8921cdad7090", "value": 2459648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676897, "uuid": "7f6cf11e-1e31-4c5f-b94d-ceb148dbf03c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676897, "uuid": "59071e2c-8aa0-4c31-b227-6055447caae1", "value": "factura - ukiouwkhnwppfjphvpll.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316c0ca7-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633668600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668600, "uuid": "708d1702-034a-4770-9a0d-0d1df91f35e5", "comment": "Malware payload (RedLineStealer)", "value": "80f8dcebe70cc447debbdc03caa9d6cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668600, "uuid": "9cc45d42-0352-4150-85bd-e06602dfeb34", "comment": "Malware payload (RedLineStealer)", "value": "b4dc1bf741e4b2e3874bbac1375c7a52225ac9aa0e0b71d9856546fbabd49213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668600, "uuid": "024454af-0579-4221-aa96-ba53b9151734", "comment": "Malware payload (RedLineStealer)", "value": "456d6c682117bad84f04492467d93e1ba2b75b2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668600, "uuid": "b91152dc-e92d-488b-81ff-a42e13c4027a", "comment": "Malware payload (RedLineStealer)", "value": "e68dbd4fc00e631ce00f3e4f932bd274a35544e765cd2c29f2ebec6f7ef0f07caa9cb12ec5b518da1b8948530b69c027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668600, "uuid": "fadf3840-22f2-4fdd-bb5c-58ce5dcaca24", "value": "T1FBE4F201B7B0C035F5B761F45A7BA278B92F3AA1A72884CF52D512EA5B34AD1EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668600, "uuid": "ac83d54b-1e35-4114-8b91-e320f63f62b2", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668600, "uuid": "94fea80a-3d1c-4c04-9b98-35089dc10a96", "value": "12288:GowrcXmlpYnUI1lelOAtiVPGl/hu1lCKxh8f7v:/wrc2sUfAAtidGmC17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668600, "uuid": "09ff1e2b-b61a-4a88-a57b-f896d4754f8a", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668600, "uuid": "dd93185a-add4-428a-a8a9-55288af17363", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668600, "uuid": "db8d233e-5528-4630-a8a4-f7a70c848f84", "value": "80f8dcebe70cc447debbdc03caa9d6cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5723e1-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633692567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692567, "uuid": "bac154d3-4874-4984-8a7a-c3b210399710", "comment": "Malware payload (SnakeKeylogger)", "value": "d91b3087f33287e1a30deb490ff069c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692567, "uuid": "7213d10c-a4d7-4a70-947b-8b4916bb0887", "comment": "Malware payload (SnakeKeylogger)", "value": "b7b4c46541fb4a2b964a150b09aa9380b39ed85a3b744b2a5338ae5935ac2706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692567, "uuid": "56b1089c-d906-478f-838b-4dc76e378f2a", "comment": "Malware payload (SnakeKeylogger)", "value": "edefa6936a94d0699399ccc9ef6961d3c8311176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692567, "uuid": "d64d4b8e-ffdb-4fc8-beb0-0b5a78de2d9e", "comment": "Malware payload (SnakeKeylogger)", "value": "d46d290b4d1e04210d9f8e37c37d4ec02fa8f069f0e4e8c47e40c0f052258abfd677eb4e8adf1ef0cd2b176edf0e441d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692567, "uuid": "6b13d2ef-83a5-4839-9cf6-bc5b9cb0dd37", "value": "T1FE94F1387FD08B25E1FA4F712E7002D05B7D651EDE3AC3191A845CDA3EA274A8750B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692567, "uuid": "113c7390-6d37-4ef9-ba14-744a7a5f1149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692567, "uuid": "63dede2e-5b93-4dd5-aa61-b7e67cfb4c4e", "value": "12288:ylDyL9pD3dU40XNeVWpHt3z0W8bnqe7ItKe:6+L7DKVkUXjnEqSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692567, "uuid": "cc0adbe9-aae6-4ca0-a6a1-c7f8d56cf544", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692567, "uuid": "74ae95db-7020-41a6-a751-973f06f32a9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692567, "uuid": "ade524f0-8bf0-4d1d-ab7f-c5596cb74e4a", "value": "BARI MEDI ORDER INQUIRY 3756653_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e71cc9-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633694046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694046, "uuid": "bba6c7a8-6984-4f59-a49d-76e3a4488603", "comment": "Malware payload (NanoCore)", "value": "6a4e9c8b6e38bab16622b8d26164b3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694046, "uuid": "e68ea4af-4dab-43ac-93d5-6dc76103ff63", "comment": "Malware payload (NanoCore)", "value": "b80e381178fe2bf37eb0101d9066864fb73cad0c825b807cd18d3f9a86a70147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694046, "uuid": "fdb24740-132a-469b-af64-4d12d8d7e17f", "comment": "Malware payload (NanoCore)", "value": "03e107e3fd378d414297721ac63007a220a4d1cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694046, "uuid": "f9ef5720-d05a-476e-bc0f-2c6a48adaa1a", "comment": "Malware payload (NanoCore)", "value": "df96bd24bc96886890a445a95956dfd9d7c75407a7e1bce507f773f68f88e24b040552e05611f5478d8517bee192f22b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694046, "uuid": "62ed1266-67c5-4ed5-ad67-89cacfe4f498", "value": "T14F251202B7C58872D6B31D315A39A324BD7D7C202E289A2F63D0496EDB74591A334FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694046, "uuid": "0997b21f-e42f-4ec5-9c21-1d1d254be0c3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694046, "uuid": "4cd20bcf-16ba-41c8-9ff9-6675302ca178", "value": "24576:rAOcZEh5YVTdbNPr9fOzQsEGWoWTq6ai0bagi7vzJ3CX:tYVJbJ9fXZTq6d4a5vVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694046, "uuid": "aa4d4cf6-2f49-45c4-8444-463db30c468c", "value": 1055730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694046, "uuid": "1c7942f6-f980-419c-b902-79f929d2a0d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694046, "uuid": "51633a5a-f440-4d8d-9e91-6c09457fe94c", "value": "6a4e9c8b6e38bab16622b8d26164b3fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b36939-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633694083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694083, "uuid": "701a5dae-b0b6-49b1-b912-f7c9cf3bfca5", "comment": "Malware payload (Formbook)", "value": "f107cdeee2d366efd82ec7684289f84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694083, "uuid": "a736bc22-cd19-45aa-a0a1-06e929ca60a4", "comment": "Malware payload (Formbook)", "value": "b8dc1db94b5752524bd51980516ac00c095ef291ca89d8096db6cb4b4dab91b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694083, "uuid": "70683efa-bb44-4215-bb5e-c08f1c891520", "comment": "Malware payload (Formbook)", "value": "49dd88f621645ef57fb97d30b57df60de4db8f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694083, "uuid": "3f34ed37-dea4-4240-a4c8-c9f2c96e4e3a", "comment": "Malware payload (Formbook)", "value": "779e4f44d53d8bc61d6aff9de3a47ac03939a895bfe3023881daf981fa3871ad1292702782c10e6e02b474737ed0661a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694083, "uuid": "b4c7a82e-c85b-4438-ac71-e661920e553e", "value": "T1D6455BE2A2917C3EC3720A796C37A654AC1EFA30753469813AED2D190F3566237ED347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694083, "uuid": "67d665a3-6c07-4417-98ac-7d5a19cfcee3", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694083, "uuid": "b61806f0-8849-41d6-a594-947e6b9d9b45", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6Nqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXAhmPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694083, "uuid": "9ac3d3f9-733b-4510-95b3-c47bb4ae534c", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694083, "uuid": "b6655030-0383-4417-8234-9443b2e13cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694083, "uuid": "b0250076-18f4-43d7-8dc6-a96588d958eb", "value": "f107cdeee2d366efd82ec7684289f84a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dec2304-282b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633692592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692592, "uuid": "ea3b24c8-c94f-4c28-9006-3026bd43d9dd", "comment": "Malware payload", "value": "4b0e79390bc35fae871c94f0b1ad75b8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692592, "uuid": "0fb965d8-153a-4f1e-88d8-936c45232cd4", "comment": "Malware payload", "value": "b91e355b44d51cfd622d8fb1e1b53959a1855635d28e35df88ba135ea49f69bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692592, "uuid": "126fb690-f1d4-407d-acb9-7db92ed9c7a5", "comment": "Malware payload", "value": "aeb481be1c9c923e4b29595112da50e3bf13be73", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692592, "uuid": "d72235e7-c60d-46bf-8f43-a4b735aac80e", "comment": "Malware payload", "value": "86cd29b8f0abb53f0901512d237cba18e10d5e48eaa094eb5473e48e21c9a148317b93df4a7e8ecd271c2917a860f34e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692592, "uuid": "3f35f99e-23ac-43a0-92c2-5ed9d977afa7", "value": "T113032F7DF19B0A88CF8687B8170B2F41154CF51DF3D994B236A8EB3866D1D7A921293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692592, "uuid": "86819b1f-e882-42ea-979b-d42e1f22e8db", "value": "768:w0V6PGYLceNpNRGZH/R7yYcmZWaV3fIkk7+uPzvDX1ipbJQuw6ap4wMf/:wIYAeNpNRGZH/R7yYcmZWaVPIkk7+uP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692592, "uuid": "6d467a06-ce50-4afe-9f1f-662213441d41", "value": 38904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692592, "uuid": "3b85f345-3550-418a-a355-7ee277c79713", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692592, "uuid": "8fdb5cf5-eab3-46f8-a3a4-1dcf37fbd15c", "value": "Purchase orderGT4366.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48d6690-282d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633693811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693811, "uuid": "ea5a4012-47c1-4b9d-be6c-9d38686c8e2f", "comment": "Malware payload", "value": "f6a627b01b8ac665add87b047e732613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693811, "uuid": "dfc17834-22dc-4f1d-b290-452270b0f708", "comment": "Malware payload", "value": "bbabc0cb29dc697735ab4b2d4285e9bb608f992393b734b7b20d4a4ba42a75ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693811, "uuid": "3df8ebfc-fc8d-45c0-bfaf-7bf78450621a", "comment": "Malware payload", "value": "b50d28f58d0892708db4ca09658547fba013f73d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693811, "uuid": "68277039-83a0-499f-a6dd-8d497e4122c4", "comment": "Malware payload", "value": "2fc05d6287dc04f925ac05540f6d7b89a96e10b50c640526644d4bca183e55077b20d9f0ebc0d240ae2fedd428d1c3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693811, "uuid": "6b403f1a-6628-47b5-910e-4b05b5507a70", "value": "T18C45239F5155E5A1C3368B36598720C937C17CA4A6224482EC3EF94ECEBD6B04FBE631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693811, "uuid": "13df6649-bb21-45bc-8ccd-e928417617f3", "value": "24576:8JIAmP4P4PmhPXkuRK04wly2uFUGLEWa1k8RWwM:mzmP4PwOP8olNLEra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693811, "uuid": "253eb4e2-dcad-47bd-ae95-8f2a62f0ce03", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693811, "uuid": "86ecf9e4-1a1f-4deb-83aa-29061410c64a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693811, "uuid": "12f42362-b7fe-4d2e-ac29-8fa612e74326", "value": "f6a627b01b8ac665add87b047e732613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0b9999-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633674094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674094, "uuid": "4389dbbb-9f0f-43b3-be68-4ae73224b033", "comment": "Malware payload (Mirai)", "value": "57fd3cdc6c43891230c173814fc5f9f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674094, "uuid": "e0b74031-1564-4805-ad5a-0d22b6834e53", "comment": "Malware payload (Mirai)", "value": "bcb74bb591605a3e8da3299391a79e9a049c3936832a229456f1e24c2e16805e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674094, "uuid": "cb1a2f0e-32f5-4a03-ac9c-a9ed44a1e818", "comment": "Malware payload (Mirai)", "value": "72b0ed943cabb8744e32804ae6e4466cabe26c98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674094, "uuid": "0bb41a6a-b6f7-4c5b-950e-f30abcb82016", "comment": "Malware payload (Mirai)", "value": "9ea632ab87487e7c0d01e274452c316b5bc7eb248d51e318c6206aa6f7b65021d36d07b552734b1d838623772cd2d680", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674094, "uuid": "5792b24f-eff8-43c0-b1e0-9c62260db172", "value": "T1FE63975D2E219FACFFA8863447B35E20924C33E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674094, "uuid": "7441b9f1-3188-4895-b65b-2381a798bfb1", "value": "1536:58B83DOpSxUzpP+vntvnCEvnNY8QYdMyH2q9r0t3bCTeJqmR:qK3DUSq5sz2er0trCTeJbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674094, "uuid": "035af2a9-5955-4449-8f61-0e4c2ede240a", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674094, "uuid": "300cc5d2-6a44-47aa-b96d-a1a1689be1a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674094, "uuid": "e0bd0dc6-11fd-48f8-a659-e01eb8f93a33", "value": "57fd3cdc6c43891230c173814fc5f9f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842448ba-2854-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633710400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710400, "uuid": "d8e35f5d-2d4d-499c-8012-b1b1bfbdedda", "comment": "Malware payload (AveMariaRAT)", "value": "27b39b21bafc4a47a9504ecff0e785d7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710400, "uuid": "83c148a6-b094-464b-8b2a-2b004b59a4e9", "comment": "Malware payload (AveMariaRAT)", "value": "bcc35ce72f7559e9cd1431d3fa0f7ed33cd7f3b5d0cb21970c8e399296527469", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710400, "uuid": "78730731-6454-44a7-961e-7bfc310d525c", "comment": "Malware payload (AveMariaRAT)", "value": "531ab011827017043933ca264729487265961975", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710400, "uuid": "f9494bbb-8a60-4ea8-b8fe-99ef12cfd271", "comment": "Malware payload (AveMariaRAT)", "value": "9b0b58571b979dffca5792c3e761bfb81b3997d0b14f904fc45645132b6aea26a23a61a7d63a39c400e0e6ab9c473d6f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710400, "uuid": "aeb53e15-2577-4aa9-9207-b0d17c8f16de", "value": "T152D2B70F6F444366D0AC097FD4F642109537BED58106E68B2E693D0EB97B919CB82E8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710400, "uuid": "ad6d56d9-bd51-4b75-b50c-d0e1f3d4a628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710400, "uuid": "d2ca9205-aa0d-40a4-a18d-8086dccc855d", "value": "384:O01/mY6gEqix4lUselj1yippe2EPvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvh:O0pm4etselQmHEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633710400, "uuid": "44cb6637-ee3f-4658-80f6-5e3cac5fee7f", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633710400, "uuid": "ae0313fe-f630-4741-b538-85802729fe83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710400, "uuid": "6ba16508-cd77-4b21-8e17-42ce900ec17b", "value": "Shipment Document BLINV and Packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57231fb9-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633667804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667804, "uuid": "97e6a2ec-0fca-49d7-8a0b-74e522b62935", "comment": "Malware payload (SnakeKeylogger)", "value": "5a93a9c8693c8444a20429e9f6254d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667804, "uuid": "d8992453-bfeb-4e38-b4ab-c5d689b8366a", "comment": "Malware payload (SnakeKeylogger)", "value": "bcc6263480a638122d075efff1a13f8c84eb3b4fdb42ab49174695b21bdb3f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667804, "uuid": "70fc0d03-dd32-4ecb-a2ac-55120f26d2b9", "comment": "Malware payload (SnakeKeylogger)", "value": "84b96b01e2806c2e6ddc9d0666cfc6b9a3d52455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667804, "uuid": "7dc39aee-8c0b-4d79-ae26-3cc0b0ce99c8", "comment": "Malware payload (SnakeKeylogger)", "value": "98820a0c17e90f8499a4b9ce3ebfda517571b3773a66e46dd982088dac302d4d9bd10d323170319cf82e818af11003e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667804, "uuid": "eb85889f-c59f-487f-9243-50372f6ceadb", "value": "T17625BE394D2682F787EEC62CD08C0BCEDAB6A4837B918F1ED495D7C60257B0BE49855C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667804, "uuid": "1d0f881a-2518-4155-8bdb-5388f13909fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667804, "uuid": "9b04e5c9-3aa3-4e25-abb4-7be030fd916f", "value": "12288:RSdw5h/9a0Fx+cFUyFJjKv1RZUwrLliUvEQLrr9FNIYPoJl:RKoXaaLUWJjoKwr5OQPZ4xJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667804, "uuid": "46cd9b70-4cad-41a4-9e86-b97454acff90", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667804, "uuid": "3cf507a7-f6b0-4545-9af0-b557ba25d325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667804, "uuid": "636e105e-cfc4-4a31-8d71-75b5c1b19b0f", "value": "5a93a9c8693c8444a20429e9f6254d53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7056eb80-2836-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633697481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697481, "uuid": "162f0335-edfe-41fa-8cb8-0a51e9a0ebb7", "comment": "Malware payload (RemcosRAT)", "value": "12cfdbcb62a3ec5f9de2c5c2efc759d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697481, "uuid": "0a88d9f9-f566-4f4b-b74f-e33a0806759c", "comment": "Malware payload (RemcosRAT)", "value": "bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697481, "uuid": "12e21a0f-3eda-4310-aee8-4452d5fae0ce", "comment": "Malware payload (RemcosRAT)", "value": "478d77fe1dcba768fbb30f8c845349dd0ffa1d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697481, "uuid": "d37e7c42-1cdf-4bfd-8268-95b8f1c9a93d", "comment": "Malware payload (RemcosRAT)", "value": "e2110bc9f0e3a62475ddef532101daeb3da6bf4115271bca83d1b9de7ea92fd973bdf4b7de3e858099fcc7b49ca4842c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697481, "uuid": "3210c8bd-a463-4177-a246-b3bcea0c4326", "value": "T119A49D12B991C032C17212700D69FB759ABCBD202D3549BB73E96D5BFE710C1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697481, "uuid": "6a4b6b5c-10df-452e-ab30-a4e75a0662e9", "value": "ec8ea73e2aa6f868311acc5b792bc222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697481, "uuid": "b66f7a86-8d2f-4ee1-849e-1581aaad75d4", "value": "12288:wYe6UWhaT5xnDdLv9rX+1jZJqxE/ZjEcyibX:m6UWUT5xDN9IjZJsCZ3ygX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697481, "uuid": "fddde302-d95b-4afe-a162-191b3d3bb888", "value": 469056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697481, "uuid": "99d865a5-8f8b-45b2-9721-b30bc6fc0a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697481, "uuid": "ac6cc62a-bf9c-4203-8333-6c72d95077f7", "value": "bd0baa9f0e69f70c827e05b8bae5a4b34f04b21be971c39e3831d584140d08d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cbae1c-2848-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633705282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705282, "uuid": "ce8f0465-c858-4ac3-87ba-335cc16f0f3a", "comment": "Malware payload", "value": "a980e0f9a2db31fb9a198c65c7e9169a", "object_relation": "md5", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705282, "uuid": "758c276f-bf31-480a-a43c-3fc255790b56", "comment": "Malware payload", "value": "beb2f6c31525335e904ac6767fe8c24e94f93718917455fca0b596f0fb4f26df", "object_relation": "sha256", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705282, "uuid": "02f6dd5f-7741-4f33-ac1f-7e2978f9a2a9", "comment": "Malware payload", "value": "b87e4d70fa34a27c9f9c88752ae89b4fefa41389", "object_relation": "sha1", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633705282, "uuid": "d2253b0f-2353-47d1-9600-8423c80a80e6", "comment": "Malware payload", "value": "a118b328810c62d0646d8a4ea0b5eb3b5ad0535be04a581294bdd7d8f22ca991881aff88a613ccf0a21191daf215989b", "object_relation": "sha3-384", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633705282, "uuid": "de7ff72d-a2e1-4df8-ab8d-40e8792893ec", "value": "T165142318CCFB94521D738AAFAF5079E43F6A9E2F295440198BFFC2D036A13B20B49547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633705282, "uuid": "a56e4f15-e4fa-4e11-bc0d-8fa4607e9a14", "value": "6144:5tWsJOB7I6T55OUstoTYqkpt9481WGlE/:55CIQhwaTE9484G6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633705282, "uuid": "23604408-082e-4349-8577-e1a777fc5fff", "value": 197724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633705282, "uuid": "fc825258-f118-48cf-9aa3-3ba71347c932", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633705282, "uuid": "d237cc8b-7148-445e-82f9-8e341dd187ab", "value": "doc-1877788101.xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7c2e91-2890-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633735970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633735970, "uuid": "7d4bd8dc-c2d0-4949-9b7e-8f51968a60c7", "comment": "Malware payload", "value": "ec80cb241bda30b5fdaaa9d64c826e68", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633735970, "uuid": "c5359444-d7aa-44e5-b0c6-9cde545961d2", "comment": "Malware payload", "value": "c04db0439c15d63fd909e0b1b6b3fffd0c27a2de85b186dfb02fe64de471722e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633735970, "uuid": "60901272-9cde-4136-a95f-a49159a19d57", "comment": "Malware payload", "value": "6497b986b3300de25ff60f4b15cf45ad175722bf", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633735970, "uuid": "52f9e64d-2cb6-43a4-81d8-88a57c3acfd9", "comment": "Malware payload", "value": "ae40b18828440e1437386c4d446064fa653ac793c57dfcbef481fbeabb88e569964a600eb961ff686786c711b4650a3d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633735970, "uuid": "5ac4cb59-d857-4ea0-950e-4f4da47d02bf", "value": "T178C6331BE901ADC7C35E423DFA0A4EA6360F44B4589BF29DB4407C9E17852670F8E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633735970, "uuid": "00bd2d6d-9dc0-4169-a064-7782c444b109", "value": "196608:syI+Q7tGl32pgutj1RPFbT9siZU4dO3U9oFya/Q99T0BfsRFW/yIJgYEnUQeqtTt:k+uYl3rulPFP9sOMUyFxY9AfsRwlPQe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633735970, "uuid": "8f8e4439-2b44-45bb-8f0c-af3347f3753c", "value": 12401443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633735970, "uuid": "46cc3972-33a4-4719-b3ca-d5bbd1fb60dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633735970, "uuid": "4775ed7c-eacb-479d-a585-afa70c48dac7", "value": "RFQ Lenovo 2023 WiFi BT Combo Technical Information v1.0.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46918ab-27fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633673195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673195, "uuid": "acc98794-b9db-4570-af8c-05b2479de905", "comment": "Malware payload (Gafgyt)", "value": "d0e948a5a90e02769255e10a70ceca88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673195, "uuid": "92760ea3-5a1a-4a24-964e-5fbe54bfe930", "comment": "Malware payload (Gafgyt)", "value": "c078778435f08de6dde260ba409a04a13fc4ce82178df0468047f6b45bc8c467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673195, "uuid": "369defa3-a71f-4e5e-b9a0-14c5364906e4", "comment": "Malware payload (Gafgyt)", "value": "ee44e7979c9c175e08dbbece92c12365849d8836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673195, "uuid": "e567b656-dd32-4c6c-ae3a-7e3210e6407b", "comment": "Malware payload (Gafgyt)", "value": "9a20ddfdacde64d1cc092a30621f0c4ef57eb3be7844c06599e56c38057a37297aee18a04955ab9a5ce5f03bf4f8c203", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673195, "uuid": "562818e3-91ad-4279-9fa4-2d252eb435f2", "value": "T169B3F857EB11CEB3C81FCD730AAA8605108DA69746D97B6BB3B4D95CE70694F08E3C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673195, "uuid": "3390b7b4-3024-4107-a26c-2541cb13de3c", "value": "3072:UVDrSbKIAF4Dcs5hT+AwvzGlKdPwjF9uhs2lAe:yXIAGQs5hT+AwkKdPwjF9uhs2lAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673195, "uuid": "f708af15-e11f-4c6b-ab25-d8403c51b0e9", "value": 116116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673195, "uuid": "0f243e6d-525e-4937-a175-feef203d0e7d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673195, "uuid": "ed2f41ff-d538-434d-ba2a-66024eb742a3", "value": "d0e948a5a90e02769255e10a70ceca88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22504f88-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633659984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659984, "uuid": "c5b390fb-328c-41b8-9882-69520c0a07a4", "comment": "Malware payload (Mirai)", "value": "5a5fac949fd7ab07f45194e28592b5ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659984, "uuid": "6bf4514f-05cd-44c7-a966-9fe0aa55a18d", "comment": "Malware payload (Mirai)", "value": "c0cc40f6106efdeb2b251f7cabd18c1ac8e34c781c78a1dfc55d48d5eed1ac0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659984, "uuid": "14f26df7-993f-407f-be0e-c0eee297a871", "comment": "Malware payload (Mirai)", "value": "7a763203f11899ce420644d4453a0fee64d9e119", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659984, "uuid": "d2396253-7fe8-41eb-aedc-673a559d8338", "comment": "Malware payload (Mirai)", "value": "1c92c8c9d4594ec6200e963ed9e2b6f346db02a12cd780ad775d47aae205aecd7bdc1288535155f9137ffd0f9c2cce7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659984, "uuid": "6b1bc45b-5d85-4b38-bf9a-ba87cd8c11ff", "value": "T1ACC20842725C0E5BC1676E702A3F16D093FFEA6520E4B585325F9B8AC135F36018AF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659984, "uuid": "c4205f85-62c8-4554-b9f9-af14e794096e", "value": "384:4HD+xuvXUWXEYRMcXmeLCLHPSKJ70t6WXtwavGcY6CZMowlDS6IyDQWdBgZhDoi:mDFcWUYRMRkuVvRsDSPqbd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659984, "uuid": "98d06a1e-d828-4d5c-964c-3e3e7027ed13", "value": 25756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659984, "uuid": "2f17ea19-2214-4d8d-9e22-b3a24d4378e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659984, "uuid": "0a132736-569f-431a-a89f-8434741aac8e", "value": "5a5fac949fd7ab07f45194e28592b5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671bf9d6-2807-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633677280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677280, "uuid": "db9278c4-eba1-4119-8481-a57954b547a8", "comment": "Malware payload (Loki)", "value": "8c9828082df8346ef2d1b503cc40055f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677280, "uuid": "d57b3c2d-e5cc-42ec-85ff-01d8b25c40ec", "comment": "Malware payload (Loki)", "value": "c10441e9b77edf0be69022461fca3a9ebb988c5abc05ad45bd90da7f8cf49f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677280, "uuid": "de89cdba-0e12-40f5-9005-a10896cfb1d2", "comment": "Malware payload (Loki)", "value": "3260612edd662aab5ae5fc865ddfd6afa597e620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677280, "uuid": "d8b5fdb0-7d5b-4774-9e7b-c5e2d91f6ca9", "comment": "Malware payload (Loki)", "value": "e3bf34f556d14fdf929298e6afe589be24feb76a679397aa7cd91c0b113ca9c6723aedb58616246a2cd23b3922143049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677280, "uuid": "5397856e-8763-4b59-883a-2b6ebcfa4b85", "value": "T1CA4412A29AE1DCABE9B70273C176AA7DF376A50609607E8747502F3F2DF009F4422751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677280, "uuid": "e9d72503-5b0e-4a0f-b852-5996a5931265", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677280, "uuid": "0dc84bbe-d0b4-4920-b89e-0831d76223fe", "value": "6144:F8LxBsOj6fOk1zMREpKVaTUnfPJHp8/JfVoUnPIiY5Dw58/xX:/26GREp/ufPJHpLUwL5DjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677280, "uuid": "24aa58b4-5da6-4612-97b0-4d05ce1d2ab1", "value": 253962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677280, "uuid": "9270380c-1705-4082-81cb-59513afee89f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677280, "uuid": "f5517898-00e2-4a86-906f-d769f431ac40", "value": "8c9828082df8346ef2d1b503cc40055f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cacddc1-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633668592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668592, "uuid": "9d8f0235-4a18-47c4-9b30-acc5032c4f6d", "comment": "Malware payload (GuLoader)", "value": "64e46fda170f134d83080ed4c95c132c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668592, "uuid": "94417326-33ac-4da8-bf49-d39a98f42d39", "comment": "Malware payload (GuLoader)", "value": "c2ebd87e40cac50a214df0b7e4cedf1bba0e9d9173f71e172a9ecbe3a6e3d12d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668592, "uuid": "e38555c9-d3ef-47df-b13d-0d592847cd11", "comment": "Malware payload (GuLoader)", "value": "28c5db77a3c972c2455bdb41bafb2ea449543bdd", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668592, "uuid": "276032bd-4493-4718-8288-6703eedc6299", "comment": "Malware payload (GuLoader)", "value": "7d7d6bd7ccfc587c4e00e1a14fb6dee67e50e4c5254cc80c87bb20925f9d6cd8a668bbe0a9922b441f8073fefc5feee7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668592, "uuid": "8a8a632e-2132-499e-9587-70e3f718f551", "value": "T1F1E38DF0FA1CED40DE4BFB71172ED659474BECA542426237B194FE5E2CB2150E1223AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668592, "uuid": "19974e6c-d704-454d-8d6c-a63deffb4ef2", "value": "1536:YEvb62u9z5T2g0uQUyY2mimiRBD3w1zqHOiJPa1LnOLsM86ptuqGQPE1ype9s/EU:YE+2SzQg9z8mwg1MOiRapOqnL9yEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668592, "uuid": "1a4f3532-c883-4031-bfeb-d50ae55e87a0", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668592, "uuid": "7cd192f1-877d-4c3f-9e66-d3930c88208e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668592, "uuid": "0f344aa5-917c-4e1b-8263-489f1075bca9", "value": "64e46fda170f134d83080ed4c95c132c.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a358227-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633694116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694116, "uuid": "2f7dbb0c-1636-43e9-8968-c4396bcc6a3a", "comment": "Malware payload (ArkeiStealer)", "value": "97a67de6c513c817a96b65c3f5d48b29", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694116, "uuid": "38b6c86a-4d9a-47c3-9c9e-9481b324f514", "comment": "Malware payload (ArkeiStealer)", "value": "c4beb6af8d63d41d1215919cec9bd4e6883ad9a40d3628a15df2c192b389d57d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694116, "uuid": "089b6231-0855-4673-98f0-f8037900740e", "comment": "Malware payload (ArkeiStealer)", "value": "a939ee70f198a1ae0211d3928bcf03775e4ee0ac", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694116, "uuid": "f26ff929-6c91-4198-abb9-081f584eb732", "comment": "Malware payload (ArkeiStealer)", "value": "ccf62cd20d9f6bc66377987e5c72ae8d9fbdcc2741f006dffa1228329eac3add2f03d84c95046dde29441f861142d2f0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694116, "uuid": "ed3b353a-d3de-4de0-8b56-2b67357e15b3", "value": "T14FE40211F2928032E67F493C492197B55B3BF926DD31964B27F252FB6E352C28A69303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694116, "uuid": "09716338-6aff-4df4-9781-3930639727cc", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694116, "uuid": "eb870176-ef54-4c80-afbd-17277d6a6b74", "value": "12288:UsuwhGrbW9IEz6tFkL4kKBb6VVBdkfx2h/ODqvz6KUorRex6s8zuFJk6AiCmh:juwvZ8WV5w+Kez6KUAAQs8zuF26A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694116, "uuid": "48f92448-348e-4de1-9707-77ce248d53bb", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694116, "uuid": "713043c3-2d98-4016-8400-42a6f0691c83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694116, "uuid": "018dd4b7-334a-4528-955f-a731611329f8", "value": "97a67de6c513c817a96b65c3f5d48b29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a576c5f4-283d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633700577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700577, "uuid": "30ea7b72-d44e-4bdc-8548-382807fca204", "comment": "Malware payload (AgentTesla)", "value": "7d5bfc2bc31327790c8980596725a6c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700577, "uuid": "6cc6068f-4640-4eb7-9ecf-0d8b13b813c7", "comment": "Malware payload (AgentTesla)", "value": "c4e860758477ad4c3002e93806e433938e499860abbdb46aa6e5904d4af73d7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700577, "uuid": "cacbc5d8-e587-4f94-9147-6aeb6e62b31a", "comment": "Malware payload (AgentTesla)", "value": "fc6656ad07b46a076402e5c0d744b5d9f14b69aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700577, "uuid": "1a39b391-29fb-4b9d-a855-b7784d344569", "comment": "Malware payload (AgentTesla)", "value": "1d30244701560fe2ee67214c2a5b2f99ae46f157b3a081ec7267138af6b1abdd146350515c4987ae17c1aac50736d832", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700577, "uuid": "4191d583-0598-476e-be89-56177d0a3f67", "value": "T1D905FD5363AC8EC4C06792B4DFC1C4B96C19D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700577, "uuid": "97bcb520-51ad-41cc-8ce5-47e93b0168a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700577, "uuid": "fcb8003e-a1d8-462c-8970-b7ef4632162f", "value": "6144:BGQl6Uqvd/789GUnWmdpLhf8KaGFTh5UPYw3wxjrcaJntEqqfdQWMzNzoYljU9Nf:BqUIGGUnRdpFf9TUPAccEjfdVMzjgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700577, "uuid": "0e293a0e-a8ea-40ce-b67a-e9a57adf74fc", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700577, "uuid": "26dd0170-b614-4de7-9af3-50c10e001b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700577, "uuid": "2e0d87b9-6f72-4bd2-92a6-1e314c6023b0", "value": "PTFG87777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9f4692-2816-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633683916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683916, "uuid": "0c464111-566b-48d2-af7a-2a8ab800973d", "comment": "Malware payload (AgentTesla)", "value": "714818843e66e0abeafe284b3280bd10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683916, "uuid": "defd2822-7f60-4ed1-baeb-3783684afe53", "comment": "Malware payload (AgentTesla)", "value": "c6c7f5f2b566a3b06b5ab89656d8eab634f080916d70702a56ae31f0a6ff9172", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683916, "uuid": "a2c53864-42e5-4600-a8b1-c9e3a698da02", "comment": "Malware payload (AgentTesla)", "value": "9226074218420335a35fb02f1d254471efc0d952", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683916, "uuid": "95fe2ff3-2938-4cad-bce2-47aa10b44a44", "comment": "Malware payload (AgentTesla)", "value": "cbbdafe8fe62984fc810503bf8b1879d39ca558afb9e784de5dc48ce4f558b1c78f311916af7361e73ae8a5157dd957b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683916, "uuid": "d3944bde-582c-4ebd-90b6-ffa7925ba15c", "value": "T1B335F1A0A6C094A7CDE81E7B7A1ADE341B117DFCA11494A431DC3D9F79FAAF302542D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683916, "uuid": "937eb4a7-6a0a-44b7-af65-b9004700bbdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683916, "uuid": "4432364a-2cf3-43af-9faf-e391a0ac7096", "value": "24576:6NXNEMoKUvtKAdyB6j9hGesWIA1y9mSO3goGMMMMMMMMMMMuMMMMMMMMMMMMMMMA:abYtKvY9D7c9mSzMMMMMMMMMMMuMMMM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633683916, "uuid": "f4e05643-1e61-4d3e-b80a-8398e6942dfd", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633683916, "uuid": "3367d8fa-1efb-49c8-a365-95ad8b1b7250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683916, "uuid": "a981742d-e05a-44fb-8b8a-d22b5e6efe05", "value": "SecuriteInfo.com.Artemis714818843E66.18668.9983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040e4106-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633692575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692575, "uuid": "6a601ae6-04ca-4e7a-bd22-39b8255b9ee5", "comment": "Malware payload (SnakeKeylogger)", "value": "9f12c172a252e205470ad9b0d750b646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692575, "uuid": "afcd705f-ec69-415f-ab83-8c31e29f135a", "comment": "Malware payload (SnakeKeylogger)", "value": "c7266603a03ce21acdfa6a305bccb3abeb18d2be9008fbf0ed73be637db59e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692575, "uuid": "8be0879f-00f3-43be-8746-0a1a9a10fc41", "comment": "Malware payload (SnakeKeylogger)", "value": "96563dbb32d04a8db74b055239ddaec04260038b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692575, "uuid": "c0c76234-4e84-48de-90ec-5059624377da", "comment": "Malware payload (SnakeKeylogger)", "value": "350534cf6510dc57ac53c3fe8926185924cb41ef848c2184f4fbc7310e2543b9efb2baa9a1c2cf968b95b3f75d179bb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692575, "uuid": "17766d77-4621-4d63-964a-f82d72f180e1", "value": "T156F4F16A7204D0A8FBF774308FB5D6B193591F1CA5E64483BEF22FAED928727060B151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692575, "uuid": "6c9ccb0c-1676-4c1c-8613-40ee1cd6bec7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692575, "uuid": "e77c723d-639d-4690-8f2f-dde97f6154b5", "value": "12288:zRSWdMu/cMexHN8PB4Vb+Tv8rw73vwPAn+LF6Wf6ku8144:zRSWqu/cMexHN8+dQuwbn+LMuuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692575, "uuid": "cf938ffd-93b2-478c-9484-c7a090266a0c", "value": 747241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692575, "uuid": "042a4807-2edf-49a0-95cd-74c0debd3ee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692575, "uuid": "f4060685-2f8a-4976-b03c-01bcdf26e826", "value": "278098765432344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c208caf8-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633673996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673996, "uuid": "404d1715-69e7-4595-91d1-098e8a6b8823", "comment": "Malware payload (GuLoader)", "value": "47d2584810dce1d0f865ec6f30fff38a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673996, "uuid": "3a0dc74a-43da-4e6e-a4ca-b23a57a5946c", "comment": "Malware payload (GuLoader)", "value": "c83bb9d84d128b63a47ec49b3a89c05ed535182ff0cfee8f070cecc0ec5f32c3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673996, "uuid": "af7f046e-0a4d-4570-a75d-526019c76e94", "comment": "Malware payload (GuLoader)", "value": "c86c98f6d8f9ba5342399300a3b0abd96d0ef4bc", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673996, "uuid": "e407ec2a-c5b2-4264-8c70-2753075b53a8", "comment": "Malware payload (GuLoader)", "value": "95b09fc6603757a8a8af8a2d2fb59719d1cb880cdadf780783f23233f86a1d427c763b337a3b14f484ad87814e426859", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673996, "uuid": "e7a2c4dc-c973-4d66-b974-1028d0d61772", "value": "T18043020D46CF9B27AE60D6C37C584DBAA2317564AE5D01E526C431B2B28B7CF4960E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673996, "uuid": "44ac46a9-5214-47a2-b230-09ed9f026a70", "value": "1536:w8BiUKYWB3hAGTFXUV5FIHv8H/T0KYhIg8oYqaUQ:TBiTbUGTWVDH/T03hIyNaUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673996, "uuid": "887b45a8-b0bd-4917-9481-70fa8ebb2e0f", "value": 57360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673996, "uuid": "afbc105b-2900-40e3-bd97-329ffeb15a82", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673996, "uuid": "e879f14c-30b4-48a7-a0cc-68a981e3dbdb", "value": "Factura Pendiente.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5515c7d6-2847-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633704737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704737, "uuid": "245e0624-f3b1-4ad8-8365-c700b0b4c9b9", "comment": "Malware payload (Quakbot)", "value": "dee40af6dd65edaa4fa8e9a482d56258", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704737, "uuid": "137f2bf6-2793-40de-880c-32cc4e479a14", "comment": "Malware payload (Quakbot)", "value": "c8531de8e1d8bf5c1c19ab912da4bc1e9d9719cfa53559d3ffd635d13e1422bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704737, "uuid": "36b29bf1-608b-4ce0-8c53-1f95412b4696", "comment": "Malware payload (Quakbot)", "value": "2ca08a2279cb59e0ffe8ae146c92990ba686fc36", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633704737, "uuid": "790964ad-a637-433b-8929-574063de8ca1", "comment": "Malware payload (Quakbot)", "value": "8b07533f39cd6c3a0592123be38d73cc97e27452d98643ad7fe882c0c912356ddb054295ff0148b713e1cdbe09223ca2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704737, "uuid": "858f786a-035a-45ce-abd8-8cb5a118d696", "value": "T185D38C467797C99BE58903398EE3D69B3B72FC20DE32430332457B0E5E7A6A18C16752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704737, "uuid": "9573c389-3599-4197-b1aa-bf1c68268528", "value": "3072:/k3hOdsylKlgxopeiBNhZFGzE+cL2kdAmc6YehWfGvtUHKGDbpmsiimati+RLHc:/k3hOdsylKlgxopeiBNhZF+E+W2kdAmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633704737, "uuid": "e3846b97-e714-4ad7-81a2-7e34028e50a9", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633704737, "uuid": "e4028502-4933-4af3-93e2-fb2ea3f59bd9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633704737, "uuid": "0c512cba-4989-41f3-809e-7c17e0f86137", "value": "CMPLN_254540550.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e980042-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633694123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694123, "uuid": "9b264911-ae24-458e-9a37-baaa7e896b65", "comment": "Malware payload (RedLineStealer)", "value": "ab772583f428932e9f6f8d67f94a37cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694123, "uuid": "b2f5582b-5c0b-411f-8df9-31f04ec952b4", "comment": "Malware payload (RedLineStealer)", "value": "c9018d4fc466a0a8243887ef5ebf0f726937faf43de6ebe1d2c74f6c3ab247a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694123, "uuid": "de2fef44-c188-4fd0-be35-c57de23ba49a", "comment": "Malware payload (RedLineStealer)", "value": "c4ccafa2498c5198c04704afde5d7f61b6a3c0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694123, "uuid": "b6405d84-0e0b-474d-b414-a3c88b751a34", "comment": "Malware payload (RedLineStealer)", "value": "755f3a0fd35b2d39856c8170273d646c9cf824d1ebb251032a03a9b9dfcfacbacb6dcaabb2b167ebf60b3683e27dacb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694123, "uuid": "439164da-9c25-4967-86ff-05dc2fcc02cd", "value": "T194D4120532D1C03AF27F19350A71A6A58A777C925E3088CB2BFA56BA4E253E1DF35317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694123, "uuid": "68db2c03-0aa5-488e-a6d4-4f273d726dbf", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694123, "uuid": "23fe2f6d-22f7-4f9e-add7-bebbb6ab6285", "value": "12288:Ouwt1d3aZfxSbyoSW4LvhW7N4+tLq7x9EPOti/D8W:Ouw5aBxSbXsZY70VfUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694123, "uuid": "0565562f-5902-4cd0-b299-00ebf911c224", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694123, "uuid": "841954d7-4f0c-402f-b71a-5505b7bb7d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694123, "uuid": "98226cdb-8841-4e3c-863e-3801c2139839", "value": "ab772583f428932e9f6f8d67f94a37cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05edb907-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633692578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692578, "uuid": "dead0655-7ad2-4974-810f-c577f24ef070", "comment": "Malware payload (SnakeKeylogger)", "value": "f64870f522c8c1e0a592068883e4f6d0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692578, "uuid": "8524a372-655d-4f80-90b8-ba20b6ce62e4", "comment": "Malware payload (SnakeKeylogger)", "value": "cc053beed73f7c6ebf78e21fda6f6a8e2754dfeda29d98d22529816112854b1e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692578, "uuid": "0260609c-60e4-45db-bb03-ca14a45b97d3", "comment": "Malware payload (SnakeKeylogger)", "value": "64d129408264ec2fe2a295ef0ed3936fecad8b1d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692578, "uuid": "d68fe33b-6a54-4b20-886c-f7785182dbf6", "comment": "Malware payload (SnakeKeylogger)", "value": "9f01ee040769f73a7d40f11519a2b48157bb00057ce47de686ef7fa3b77fa663722e5be1ea84f6fae1f6cd01715bc415", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692578, "uuid": "3665c354-0c1b-4ef7-a72b-d7e8bdbe7d72", "value": "T16364221294D0D5FBC205A7B189A3BB38FF669D248301AA87CFF13E5B75B2D5319162C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692578, "uuid": "b4e915ce-3502-4b77-9caf-b72c2415e805", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692578, "uuid": "61022122-427a-43b2-8f15-3059df859323", "value": "6144:P8LxBUCOeSl3VaggrorFuiCRpss3pXfswmaScOJpxqpUN5/WO7t0nL0QLnv:MOeSZVsoWRm5JHqpUN5/9eL0QLnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692578, "uuid": "cc354a68-4c54-41bd-b0ed-863b5283ffb1", "value": 335396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692578, "uuid": "f1bd00cb-0626-4956-a640-fc1120fdba09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692578, "uuid": "7f1b77c4-f9b9-4c7d-b338-b05c41315be3", "value": "DHL_100821 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed460a0-283f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633701291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701291, "uuid": "e6df442a-1c1b-427b-a527-a1c71af92de0", "comment": "Malware payload", "value": "48bf72592e8738ba780292518da8a94d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701291, "uuid": "cb855016-4942-42a1-ba54-86992b075554", "comment": "Malware payload", "value": "cd2acb134d03f64842ace1506e12bd08edd686eb2e2189b2dca679845b3836ae", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701291, "uuid": "5c0f2d26-596c-495e-a28d-f7293ecc0f88", "comment": "Malware payload", "value": "36ff1ae6636fd578bedb2cbf2614702da1cbcef2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701291, "uuid": "403e9a2e-0f43-4455-8631-6d14efb32c3e", "comment": "Malware payload", "value": "be17536db66290881bade6c677007062ecb3a3fa61672a73cccab82fc77c69352d485c9590aecb50ec5012c26c94bd85", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701291, "uuid": "9584c8f7-f2aa-4c68-8011-dfa1aa2af1f0", "value": "T18BF4D173930AEEDF4F2D1C09E500E7008CBC7D675224C0F9FB99064A92AA8B5D9ED975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701291, "uuid": "adbecabc-e641-4863-8665-a260c7fe4fd3", "value": "12288:p30zkPsZ2nQUPzkLZs/P9fdAUKXmPi/VfulTtl0Nqg7MlKI5wd93+:1DPs2nxkLKd1AUKXcNtqNq3KI29O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633701291, "uuid": "ae9fdec5-953f-446a-b47e-ea43c31e060d", "value": 777674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633701291, "uuid": "16c4bb6b-9145-4a55-87ec-fc1a83035755", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701291, "uuid": "23a3982c-3e6a-46f7-82a2-b014226872b0", "value": "Lykaqrblfoeejdnaelbvka.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c300780-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633668645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668645, "uuid": "da93896e-ebf7-4f8e-8f19-d7552c4e4f9d", "comment": "Malware payload (ArkeiStealer)", "value": "a50798a5a2712978f92ea4966dfdfa20", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668645, "uuid": "b828c040-1c71-411a-9ad1-b2439d2a0a6c", "comment": "Malware payload (ArkeiStealer)", "value": "cde5735b60241bbad2c006ecf9d850fbe5ea62959613d6ac81102cb085cc4c3b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668645, "uuid": "18552180-ad96-4af5-a116-5bfdecfa3bd5", "comment": "Malware payload (ArkeiStealer)", "value": "e17471521f5168cd280d11dca1fecdd15c6cfd92", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668645, "uuid": "16add9f6-4f04-414f-81b1-53411df4e298", "comment": "Malware payload (ArkeiStealer)", "value": "4d0cea7c90be8c541d0c3539fde5f9e2ffb83c0588e3fd4fb886e079f2217e2162ec5950ca54eebb011527e9a5ffacb8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668645, "uuid": "36bfb783-4f64-4cd5-975f-c45ca156be5a", "value": "T1D9F40100A7A0C036F1F656F809769369A93E7EA1B77990CF12D126FA5B346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668645, "uuid": "8555af4c-2450-4bf2-8fa8-becfd8931604", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668645, "uuid": "d80efe74-c8ef-4a83-b96d-10b1b8cadf64", "value": "12288:r2n6HRn6VjS07qxIkmhCc6OiMGivrHWv4yPFXGdT9WOzIx2Ar:roCR6VjScUIiOiMG6A4yP1GvIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668645, "uuid": "aa16730c-3305-428b-abc2-a15872550df2", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668645, "uuid": "96076c8a-6089-430b-8a5e-eaa6efbf2ea1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668645, "uuid": "25b91e0a-b70e-4591-98b3-7a12ed08daf5", "value": "a50798a5a2712978f92ea4966dfdfa20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8c7678-2832-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633695947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695947, "uuid": "c14914e5-e857-4865-a1af-0fc634af0508", "comment": "Malware payload (STRRAT)", "value": "55b6d37d0be4b9792bef8af5b9445c2d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695947, "uuid": "03bbc2c7-d891-4fd8-bc81-14d78f073678", "comment": "Malware payload (STRRAT)", "value": "ce5f2adc02825777533a0224dfc5d5f79c1fbb22a03fb180caf49f63d49f40fa", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695947, "uuid": "63f76446-adad-4ff3-95be-364c94dda727", "comment": "Malware payload (STRRAT)", "value": "03962afa2b1dc7f01855c024b49361fe4c41452e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695947, "uuid": "13e81350-db28-4208-abc0-f6c1f35e4843", "comment": "Malware payload (STRRAT)", "value": "e49df2fca93bce52937c0c899ac2887071b6998ead757d83b08b2bdd1e3b5d59cbb52da2d7b0fcd5b16e27a9a18d2e1a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695947, "uuid": "b0127de1-34b6-44b4-a8e3-5a6091ea82c3", "value": "T1BD04012FBAAEC4E1E50F603195899623FA0E57D8D20A902F16FDC5105E34D2E4BD368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695947, "uuid": "810ae5f1-a8af-4764-8b82-a266794827cb", "value": "3072:BudYwrxqK+lBXwXMnqvuQlZ0j4lRPbiEMqaKkIUy2mXhSySvnswCEK5TzL9lLvL0:LpK+DXMhuQlHn+JmkIUnZySvsVTzL9FI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633695947, "uuid": "ba425080-bf61-4919-850c-049a45370c8d", "value": 188565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633695947, "uuid": "ca945407-b349-4edf-b3bc-e5d5fa281f7e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695947, "uuid": "e8b6a9e7-1e02-4c1b-83f0-c420e12d2999", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e37ca7-27e6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633663017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633663017, "uuid": "331cdcd6-f046-4141-ba88-9daa501f5ad2", "comment": "Malware payload (AgentTesla)", "value": "c0096cfcb36c7f80e6ab0184dacdd05c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633663017, "uuid": "0c51cfde-a46f-4f3e-875f-800bc34bc24f", "comment": "Malware payload (AgentTesla)", "value": "cf7a66ad6cdfb22b3f24e49184aa6d3e3f987266f27852d333c5853ee3f2a645", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633663017, "uuid": "1eb71a17-e98a-4f70-85ae-b05a6bc6fee4", "comment": "Malware payload (AgentTesla)", "value": "4e956fc29782366ecd11e714795c9d55698afc19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633663017, "uuid": "11207a7c-72ce-4ab1-aac0-861c09031604", "comment": "Malware payload (AgentTesla)", "value": "b835b08bf313ba73304953c77fca1c166f6ef413d5b367177181144d446463690827ea0f7c1c743ff14bc2e6195a6109", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633663017, "uuid": "fe643c4a-7f73-4da5-a9e4-5e7928fc0f19", "value": "T17AB4F124AFD48B11E5F64F302DB502A09B7E394D9D3ED30D0AC514EA6EE375A8710B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633663017, "uuid": "a023b905-648c-4be2-880c-a23b34c0c1c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633663017, "uuid": "3563e488-1803-4629-870e-32a3eb2817f6", "value": "12288:Q/pDyL9pD3hs2Sq16FZ1BSuTqJNqNLCJa01:s+L7DxseQFZ3yqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633663017, "uuid": "1513af54-20af-4247-986a-dfd9f9ccad0c", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633663017, "uuid": "5e63502d-e40c-47af-b7f6-787e5f1609b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633663017, "uuid": "a8ba5d74-2f38-4f61-90b2-0738adba21a7", "value": "CI.PL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f502970a-2838-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633698563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698563, "uuid": "88b42806-8bc0-4322-bb49-e8b381755516", "comment": "Malware payload", "value": "384e745051470d1abb87ee0e5c45b5f8", "object_relation": "md5", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698563, "uuid": "2c919037-65a1-4d87-a3fb-8c023ce7d105", "comment": "Malware payload", "value": "d0629e46dbe2e7fad310e3cdbc95a0fafdca24a84e24aba0133b8310617044c0", "object_relation": "sha256", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698563, "uuid": "61e688ed-f1da-4e93-9cda-78f3f890e6cb", "comment": "Malware payload", "value": "4179744737ae6dd4c20b77f343faa872434556ba", "object_relation": "sha1", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698563, "uuid": "db54cb47-aafc-4737-8954-4d7d0454588c", "comment": "Malware payload", "value": "fbf7e5b21e281ac49c78d43e46e459df784b2f16892ca5c1fb847e81d11bc1f368377e39e8beca4cc843a50dc4725955", "object_relation": "sha3-384", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698563, "uuid": "44e14f80-e743-4d67-92cf-81d7db6e92f4", "value": "T18E838C17F58380BAD98100B000652B76953AD9520779DE83EF96EA5E0C309F1BD3F76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698563, "uuid": "c42c1492-85ef-47d0-9d89-afe3b178c49a", "value": "7c1cc1b9b3f56e8a194bb856d5b05845", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698563, "uuid": "fc0b4eea-9aae-4d6e-a52a-1e35fee026cf", "value": "1536:0Z0kR+jOfH06Ntc2fT8TC6Iv2cyKt0Ml487SUUq:kNQjIH0XfGp5yKSc4vUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633698563, "uuid": "08fbc72b-fe99-422e-840f-f9e5502dd234", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633698563, "uuid": "c721ebba-962f-4230-8ac2-86de81936499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698563, "uuid": "47489330-cd1a-44a8-8612-18fe30162138", "value": "taskhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcf7859-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633668728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668728, "uuid": "4242f378-5d8e-42a3-a99f-ac5fc1037fae", "comment": "Malware payload (DanaBot)", "value": "8e534726c172372dc88fbbad0541f704", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668728, "uuid": "2dbf96e1-4be3-497e-823f-238eb8d76b5d", "comment": "Malware payload (DanaBot)", "value": "d17aaca4732a3fed223312753a3567ff986947f64cdbd52dd49f3497d05e862f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668728, "uuid": "9ba726c7-913d-452b-ac54-5c6d5a4e9465", "comment": "Malware payload (DanaBot)", "value": "9886455e6f75996db3541e059de45d8cba38de6f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668728, "uuid": "95f71c55-acc9-4910-9cfc-b4abd3822dbd", "comment": "Malware payload (DanaBot)", "value": "80719eac07652c77aea75082ce9dd97f6b357ac953cfc3a5defe2a129c281a9573cf811084420c8f8fb2c946f1c0d153", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668728, "uuid": "d18859f9-1998-4e33-bd61-a0e6b1a064ee", "value": "T15445121067E1C03AF5B2A2F44A7A83AC993F79A06B3550CB62D469EE57397D1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668728, "uuid": "60386fa1-39b5-47f4-bc9c-aa20c109b41c", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668728, "uuid": "f8a0c083-5251-4ac3-bef1-c1e91d5cd303", "value": "24576:qx9yJH+vMHTarJMcvmmDcS/ROYYOwNsIutEVLcnYPqG+Q:qTkH+vMHTe+ymTKOGIuts0YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668728, "uuid": "dcdf689d-3a0f-4633-8463-8cad58675301", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668728, "uuid": "7312cbd6-cf10-4a56-bb5e-7f9022524965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668728, "uuid": "44a48e8c-5dd9-4380-bec1-1574ea489c90", "value": "8e534726c172372dc88fbbad0541f704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4a533b-2854-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633710413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710413, "uuid": "50be2ed4-723f-4b28-8739-a94c81a43170", "comment": "Malware payload (AgentTesla)", "value": "9cd9748a91b8db13cad875a7eae1eaa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710413, "uuid": "fb9fa6bd-c124-4734-9ca0-9bcd94c4d512", "comment": "Malware payload (AgentTesla)", "value": "d26ea54271fa264c9c535d446e294df51da9b48df79523a2f7a7bf04b8a5ba29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710413, "uuid": "efc3940c-e769-4cc6-9f80-05d9c634b216", "comment": "Malware payload (AgentTesla)", "value": "b743dd8788140fa52056359237e70e871574f0a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633710413, "uuid": "099fb96a-5464-4683-b16d-ad913f810385", "comment": "Malware payload (AgentTesla)", "value": "8873d049659ca4acdb37cb24fb30b113075256e2d8cca3b2996fc554a821769654bec97e994f5751898f037d45873b5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710413, "uuid": "1ea8d5a6-c10d-467e-a329-6582c327074b", "value": "T1FFB4CFED726176EFC85BC472CA592C28EBA0347B531B6217902725EEDA0D987CF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710413, "uuid": "bda02c4b-e996-472d-927e-a911954998b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710413, "uuid": "c16eba2f-9a2a-4ffa-934e-117af5ecf876", "value": "12288:9XJmnJIJ37lLySN2U3GEOgo6gYGbxPRcCWFK9JTyIaesSeE9HQV11bAt:V0ILhr3GDgj4PWCt9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633710413, "uuid": "cb39c4ed-d192-4283-87bf-2aa48e7c74f4", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633710413, "uuid": "007c82d7-6013-4e37-9e25-57b887795d75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633710413, "uuid": "8117c405-3121-47f2-9b4b-1586db9ef5d1", "value": "MfwMun8iYeLX35H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f941befb-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633674089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674089, "uuid": "1b12d00a-294b-49e9-9a7e-8522985e6bbb", "comment": "Malware payload (Mirai)", "value": "6ce8ca6ba3114eb492476a2e3c56b028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674089, "uuid": "2f7f6d6f-4d90-4c6b-934a-48ec6b025dd7", "comment": "Malware payload (Mirai)", "value": "d2c98bfb9911681abab2ffc1e4e497e8dd68651036e0c3327f535384b4800b7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674089, "uuid": "6c490fe4-62c0-49d5-a82c-4d6255a0d152", "comment": "Malware payload (Mirai)", "value": "18932b009a7578a051f452e8526ef93a020d42c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674089, "uuid": "72a19857-1274-4e8f-b1ff-a03bbcdbe1c9", "comment": "Malware payload (Mirai)", "value": "7463f0f64c581738e5009a6d6394a15bc30e6286f99253a2e2519d88877667c6d69dca6058d72380cf77c156484eaa17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674089, "uuid": "69ff87d8-8634-4adb-ad06-5eb9a1156414", "value": "T132132986BC829966CAD01776B62E108E3321B3E9C1CF3217CD245F1177C9A2F4E37A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674089, "uuid": "45ae4f81-3e52-4115-bcca-6340c4d9d3a9", "value": "768:4e29cZjBmP2XBDFlumI9NY+uanihajaer8pgwmiSWAySxoNZmBNJ5:32uZFmP2XB3uVO5OihajaR2wnSJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674089, "uuid": "e46f1c9b-bd6b-4e9e-8649-62f92df8d43d", "value": 44128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674089, "uuid": "02965887-15f4-4c36-8c58-890a1d1b3430", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674089, "uuid": "12b679e0-7a8d-4817-9bfe-d2a2c750e0b1", "value": "6ce8ca6ba3114eb492476a2e3c56b028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6025b830-27f2-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633668249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668249, "uuid": "183d35f2-3ebe-4452-9abc-7239d42b6d9a", "comment": "Malware payload (Metamorfo)", "value": "d978623b66ea6e319225b1df1039429f", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668249, "uuid": "ece285d6-b8e1-47ea-b35a-bbf4329f5da8", "comment": "Malware payload (Metamorfo)", "value": "d3345dab00110836e562eabf33e57e1c597227a71a05558cba4cf6f52f8a6985", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668249, "uuid": "9d910ca1-e3d1-416c-9159-60d613a2a6eb", "comment": "Malware payload (Metamorfo)", "value": "2c6236f4928107256437d8d81ed577d4ab9dbbb3", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668249, "uuid": "22e561e0-f87c-4841-8bb6-c9e98fd52d13", "comment": "Malware payload (Metamorfo)", "value": "e8f96ad9072ec35d95aa15795d17c4a4afe642b228400e8f7d1154727d13971ac8648c0d4d4693544d422e85269e9722", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668249, "uuid": "330d9c22-2896-4a20-84c6-7bdd100b17cd", "value": "T1B931BE091ADA1329C3B7CF7A107BA2464A76FC51AE934F9D80C497DA2891154FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668249, "uuid": "13f53541-c968-49a8-8adf-f72599345e71", "value": "24:8+JUHRlVo5kcbA+PLDjr+/P+PsW9z41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+Pj0xX1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668249, "uuid": "a16b2a6f-d73a-4a22-897b-ab49409cd4b8", "value": 1552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668249, "uuid": "01145d4d-63b8-46e4-bd98-fe728f4f4bd9", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668249, "uuid": "a45ee34f-53e7-4d57-b034-85cde986e570", "value": "foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46d3792-2812-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633682161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682161, "uuid": "4af68fb0-27e8-4167-af29-99469f3a6b21", "comment": "Malware payload (STRRAT)", "value": "a3845ece3c01cb6efa30cdfe19eed0c8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682161, "uuid": "c4483f70-6a96-4921-a0fb-b6a5d3364d8e", "comment": "Malware payload (STRRAT)", "value": "d395bf27f8ffd2b376344b18e17ecb056ffaae9dd121056e870354f33f8fe37d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682161, "uuid": "2d3dcfe5-2262-41b6-be4d-cd4645a33937", "comment": "Malware payload (STRRAT)", "value": "4ce35178e0914255e302828e1fd77285a6d26f1c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633682161, "uuid": "c4e87b3c-2026-46fa-955e-bd2d8835bdf6", "comment": "Malware payload (STRRAT)", "value": "7ebb20eb7a49ba7e6cbf05c4fc64aa83a8a566b0797f4e182dda00c6d38f007ba9c0aa4a31f27f7f2183bb367ce2fb32", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682161, "uuid": "a33d2945-fd45-4272-a5a0-1fedc46c9bdd", "value": "T13D04F12BB84EC0EAEF0B0D7286459176799E40AC5046D13F6AFEC4815D72C6F0B176AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682161, "uuid": "653562f2-56cf-4669-98bf-6830797439d6", "value": "3072:FlPHE3LZQlWPE2pE04EYYzru8ACawRCOKNbmd2X9bfn+mYsiHE4KAaJg:Tc7mlWM2K0WYiwIdxv+/xkZDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633682161, "uuid": "c59c6361-4582-4183-afdf-ca7880d2c48f", "value": 188535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633682161, "uuid": "dbd88d54-aeb8-40b9-83bb-d34972c1d985", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633682161, "uuid": "7643055c-62e9-481c-8885-06853ef3219b", "value": "Purchase Order280921.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb85fe8-2844-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633703651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703651, "uuid": "f6bec847-223e-49d6-9766-ade73e39f9f0", "comment": "Malware payload (Quakbot)", "value": "0f05113640674566c175e9ce933cf425", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703651, "uuid": "5bb58e74-7891-4ce8-a4d7-c34ea45b4728", "comment": "Malware payload (Quakbot)", "value": "d4bb580b6bcbe67b209827dcb3938f5a87655c501a0ebc3596a05ee0815b548d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703651, "uuid": "cbacc92b-fdb0-495a-8630-497d0b4a70b2", "comment": "Malware payload (Quakbot)", "value": "4a6c5b31c4181c55e44089273eb6426c47509b10", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633703651, "uuid": "96b2fbb3-ba31-4a54-8810-7b441f910539", "comment": "Malware payload (Quakbot)", "value": "54ec76842417a3770aa607de54be4df196499822d5c7caf2e825d5dc9d275fe58739164d18669137fa957d722f31a7c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703651, "uuid": "8bae5cff-ae37-489c-b8c4-7ed63ee937f2", "value": "T17AD38C467797C99BE58903398EE3D69B3B72FC20DE32430332457B0E5E7A6A18C16752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703651, "uuid": "7951acbc-ca02-4112-94d5-2c15bfbdc62d", "value": "3072:/k3hOdsylKlgxopeiBNhZFGzE+cL2kdAmc6YehWfGvtUHKGDbpmsiimati+RLHc:/k3hOdsylKlgxopeiBNhZF+E+W2kdAmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633703651, "uuid": "58ce5811-30c5-48e5-b287-fe3b339dad8e", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633703651, "uuid": "567705d6-53d6-43f5-87fd-17962b1f9244", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633703651, "uuid": "af4f7953-557f-407a-afa2-a4957883cb80", "value": "CMPLN_837180024.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f92cfd1-2862-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633716244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716244, "uuid": "1a85a094-f067-4663-95b1-e4ed8afce545", "comment": "Malware payload (TrickBot)", "value": "5ae85b4077b4ae64b4a5c8c09572cffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716244, "uuid": "ceea8986-0a19-4a00-a33a-9996b589fbe5", "comment": "Malware payload (TrickBot)", "value": "d4fa44048095c1177007ec54df4b73e6a70e8b092718605eef93a573c79a54af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716244, "uuid": "18e8c3da-bf7c-40d7-91d5-eabdd64afca9", "comment": "Malware payload (TrickBot)", "value": "278a7e2b0d9f069f58252772aa7e2ec6334c8062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716244, "uuid": "b5692012-3005-4607-a32b-8b92d2897a83", "comment": "Malware payload (TrickBot)", "value": "4d02c76c82b193abc6384eef8b87d857e99910aca840c44decc178e66560e454511a55f1387be6abdfa515b644ecbade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716244, "uuid": "5424716f-84ab-4f77-b5c4-9a13d18214f9", "value": "T122A4D023F1E4CCF6D1F712700EA65BA9B63AFC10CBB0EA5753805A5D1C76A858923367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716244, "uuid": "aff13dc5-b278-4a8e-b676-28bf0ecd09f0", "value": "f8cb6cf7a746c79f8c917be532cea46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716244, "uuid": "85078b27-6b1b-499b-9686-9cdae960e4b9", "value": "6144:X9cZrtODhev9zIVcoYkh2Kb//xHEZ0rmMTG9VVwF85HA5ke1W1DJSqFD:tmIDhmkB/xkOF0LNA5W1D5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716244, "uuid": "90bcdeb5-a8a5-40d7-b2b0-815c03e11543", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716244, "uuid": "95c7acc6-9876-467c-998c-89616c02ad59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716244, "uuid": "813014ee-6690-4ba2-8e14-81161bfe78e0", "value": "5ae85b4077b4ae64b4a5c8c09572cffa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e85d7cd-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633659978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659978, "uuid": "0b1df861-df62-44e9-9d6b-a17ff23564a1", "comment": "Malware payload (Mirai)", "value": "a818f6de75347d0233e778a1db48fd61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659978, "uuid": "8f2cb56f-d473-4516-9401-cc9a4c2d0c46", "comment": "Malware payload (Mirai)", "value": "d5bec4f0eab0a9650f80be67118ca911d0127f4045c180e53a347ab33b042e88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659978, "uuid": "8f9bc8a7-74fd-4603-add9-711995a5c6ab", "comment": "Malware payload (Mirai)", "value": "be29646835e45e80a0f64442adb58148230f58b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659978, "uuid": "4684ee33-9fa0-455a-b9b1-1624a931cc6c", "comment": "Malware payload (Mirai)", "value": "3c7fcdbe37f35ab67514919ef60d785aef88b9ec03bb16db5bfcfd2fd14fd03a5b7da603549f092c57845a445d9c3f6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659978, "uuid": "11ebe109-054a-4a53-b97b-175d7b10991f", "value": "T1AFB24CA3C8AD5E44C2588338A4B54F392B63E005D7570FFA165AC691D047EECF6193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659978, "uuid": "e1f57b20-5882-4e04-97b3-58c7563a105a", "value": "384:0aJRgsso+Fh4Nq2m2tNKJ1xO4I/q8lXCbg7BVMTx91woC/JqBgcAL:0aE1zwq5ksvw4I/q8FCQoKJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659978, "uuid": "98990f7d-5d16-4916-8ad9-356395997e40", "value": 23396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659978, "uuid": "5947c041-748f-4342-85d5-fea632dc3086", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659978, "uuid": "ad162d57-10e5-4ed3-9287-f617b1f9fb6c", "value": "a818f6de75347d0233e778a1db48fd61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cab1d1-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633668573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668573, "uuid": "a84c14e9-f73a-44d3-95bf-720bb39e5e10", "comment": "Malware payload (Metamorfo)", "value": "576f6d5cc0ddfe165b5437f8a45af7ea", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668573, "uuid": "c9f0def3-ae12-4ed1-b5a3-258a48b1cf47", "comment": "Malware payload (Metamorfo)", "value": "d5f06b2528c34e2808eab60247903f55c1537a195900dfe55766a498819cd744", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668573, "uuid": "c8646c7b-8951-49dd-a8ec-bdc07c8b7f50", "comment": "Malware payload (Metamorfo)", "value": "b3add06d8bd6f60e94dc1d315c1f2f8448b24fb7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668573, "uuid": "4e79c38b-776d-4e3c-8b02-3816b110f95d", "comment": "Malware payload (Metamorfo)", "value": "4597bf2eee70437147960f7af8d3d2f4aa3dd2dcf2670996bf9260017ec539cff097d8a51f9178263acf6d662bbbdb81", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668573, "uuid": "ed4149ac-7b15-4fb5-8bb0-19ae1bfcc96e", "value": "T189319C051AE61729C3B38E7A5076A2464A76FC51EE934F5D80C497DA2851050EC35E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668573, "uuid": "30ba8aae-00e4-45bb-9ab6-728d96a7071d", "value": "24:8+JUHRlVo5kcbA+PD+/P+HrgFMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+UeUM1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668573, "uuid": "614e082c-30e8-4ed6-8acd-6be346864864", "value": 1550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668573, "uuid": "71776b29-d701-4b1c-aea2-12146626a790", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668573, "uuid": "38a9ac03-3dab-49d5-99cc-6bdf496f7e77", "value": "curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6030824c-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633673832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673832, "uuid": "ce767e35-027b-4bfb-96d7-60bf6f05c35f", "comment": "Malware payload (Mirai)", "value": "6fc5d2ad31b10ec7beda85f662025a09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673832, "uuid": "91e1965d-9c35-48a2-bda2-fccb73248c36", "comment": "Malware payload (Mirai)", "value": "d5f817f00683d4dc9570389584c806580591928b3ba00db5a34235790a1ab095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673832, "uuid": "fd2e1e39-1851-4867-8203-55749eacbdf0", "comment": "Malware payload (Mirai)", "value": "2b363723dcfecc28f03e0798a0f086a285a2a95b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673832, "uuid": "df4203b8-210e-4c66-a249-a5257be4272a", "comment": "Malware payload (Mirai)", "value": "38e5f0874e185ec301fc21debef2af575aad63c3ee15281124fc31b0142f62e947154487372855a91f7149c7835f535c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673832, "uuid": "c4f53122-1631-4b79-97ff-692e34e37c9b", "value": "T1A7C34C46EB808A13C4D51775BADF424A3323E755E3DB330689189FB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673832, "uuid": "cbbd073c-d912-4951-9631-6e62a38e40b5", "value": "3072:+KhtPUfCBPv49iuFcpQe8ZVu6M+WLwM/9TGyz:+KgfqPvSiuFcpQTVI+WkM/9Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673832, "uuid": "da509e57-0bf3-49c8-80f0-b53df1da197c", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673832, "uuid": "5e4e1d38-2fdc-431b-b6b5-5691d6457385", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673832, "uuid": "6f7cd417-595a-4adb-b822-5fd857718f25", "value": "6fc5d2ad31b10ec7beda85f662025a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25aa1fb-282d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633693834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693834, "uuid": "b7e34d55-3ef4-4210-bf1d-44650c2194d1", "comment": "Malware payload (Smoke Loader)", "value": "88ac119caa32b27e7d7e51266c3e76e5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693834, "uuid": "787b3836-43dc-4892-9add-0888cbe99dda", "comment": "Malware payload (Smoke Loader)", "value": "d6d09e51d2e7eb9f29b4ee44530696f893ba14a7c1d119cb8f1e41cd7861eaa6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693834, "uuid": "143d8162-b752-4111-97f2-0670244233ad", "comment": "Malware payload (Smoke Loader)", "value": "d474ba953ef501603a21d5fd002c0d041f508e10", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633693834, "uuid": "1c34c5ee-21ed-4f03-bf27-93c6ce73eebb", "comment": "Malware payload (Smoke Loader)", "value": "89859371b246c406dee643a42d17aba1bdf2e63211c3528622da264940e6267b95b67940d2aacf0e05abaf1a629005b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693834, "uuid": "aa052ebc-ebfe-4dee-a539-f9d6aaf70926", "value": "T10C149D103AE18473F36ED9304D71C7A18B7BBC625971998B2FF596FE1E642D18A29303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693834, "uuid": "53b1bbd1-3700-44d1-b6d1-fe526ffab0da", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693834, "uuid": "05a2d249-ad8d-4b6d-9b9d-00f34034599a", "value": "3072:+ddCy63Oqc5xyJl4wZg3UfHUKI8Ct0PzhXuHXFbxdrJtZPwyaXHNhgC:+ddEODxyk37v8CtazhOvrtba7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633693834, "uuid": "e2a22dbf-5387-4735-ab62-cd9895db7bb4", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633693834, "uuid": "18266023-7062-4163-993e-4208033734d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633693834, "uuid": "b1e8fd4f-847f-4e18-9683-f7db74b488ec", "value": "88ac119caa32b27e7d7e51266c3e76e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb638c3-2823-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633689558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689558, "uuid": "69c7188a-cbd3-4868-9f5b-664a67434350", "comment": "Malware payload", "value": "5808cc235f8d337366bfb7e13204c8de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized sftp", "colour": "#033E4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689558, "uuid": "e0c3fe50-8a7a-4c68-a65b-cc0d629f34d1", "comment": "Malware payload", "value": "d7ad1bff4c0e6d094af27b4d892b3398b48eab96b64a8f8a2392e26658c63f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized sftp", "colour": "#033E4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689558, "uuid": "12565966-acff-4d45-8f81-0100f7b6d3d1", "comment": "Malware payload", "value": "27e868c0505144f0708170df701d7c1ae8e1faea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized sftp", "colour": "#033E4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689558, "uuid": "deb24b05-1bac-4e3d-9942-dc9b126ee26f", "comment": "Malware payload", "value": "6259f92137bdf4dec9cbd02d5a594a72339513297c50b7b1d805b73f79b12091cdeb59e2d5b45e08a53b2c9da70c79e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized sftp", "colour": "#033E4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689558, "uuid": "e98df74d-ec14-4b0d-96fd-581bdf339495", "value": "T140248D0FB2A244BDC966CA3046ABA631AB31B8D44622773F3B5C66B41F76F601F0D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689558, "uuid": "ebacc993-0ce3-4aee-83b7-0ea88755b834", "value": "3072:yzGIwtP6GGbrh4M1fqIMJwvTYsU3i6Tl6zfAfgObhsknAPXB19fdNcArDHH+V/yI:yXEEvNdU3ilSgotAp19fdNj+VKsk0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633689558, "uuid": "8ef3a8cc-705c-46ec-b766-8b54d36b6b03", "value": 215112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633689558, "uuid": "c2bc37e9-858f-4e65-ae67-de775aec9e95", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689558, "uuid": "f4866e06-ccc7-445f-89be-b2e5a3447cb6", "value": "d7ad1bff4c0e6d094af27b4d892b3398b48eab96b64a8f8a2392e26658c63f30.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8977d7-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633707008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707008, "uuid": "161aceaa-988c-40b5-878f-0bc35154f72c", "comment": "Malware payload (DanaBot)", "value": "b2f3633813b880e6d67b0c3a12010d0d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707008, "uuid": "d74885ca-0430-4c20-ab97-8b390d0c6e2d", "comment": "Malware payload (DanaBot)", "value": "d7fccfe57f600475492fa8d41dde2c2d0d74fdc8e4d7151cb280dfb030441872", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707008, "uuid": "f503935b-461f-4b64-9444-a561b80b3659", "comment": "Malware payload (DanaBot)", "value": "21edbebcb237b16897514ac6054b55e90c91ad8a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633707008, "uuid": "bd39fe9c-b092-4cae-be1f-7abff083da1d", "comment": "Malware payload (DanaBot)", "value": "f09d5c8ebec374fa5d817432ee96870bc4f2594da6aa4dde2188aea563aad8ff98b9380237b75e251dedd335b6eb1c32", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707008, "uuid": "16a0c8f8-3a52-48da-90a0-2095563f8920", "value": "T18E563361FCB28575C28EAEF68FAFD11D5C5A7A421300CB1FADC4A54FA4325829CF1E61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707008, "uuid": "bf090042-da44-40c2-8147-3e3ac75431bb", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707008, "uuid": "4971cd61-47c5-4273-afa4-87bf96e7b8f0", "value": "196608:TXKbtRkOmNDgl37AVsB7rMscUSyG5oGHHtfC:TwEng575eI6oGHHRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633707008, "uuid": "8e78d518-1c30-43a0-a9b1-a44489b641ac", "value": 6395613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633707008, "uuid": "5640431c-3fda-44e0-81f4-eb968dfc8233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633707008, "uuid": "7639a0dc-1b32-4102-81ca-a545568356dc", "value": "b2f3633813b880e6d67b0c3a12010d0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b042b8ff-27dd-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633659364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659364, "uuid": "5cc398a5-5a46-4455-8b64-cd916adf66fb", "comment": "Malware payload (DanaBot)", "value": "943f942969b1d3ce25f0f6c95229dbfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659364, "uuid": "2b66a886-83f3-4171-b089-f444e0cc194d", "comment": "Malware payload (DanaBot)", "value": "d80ff2378e1da1fcdf9f21f57c5498b4f55ded34c425b6bf91f489319336a8e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659364, "uuid": "5d42749e-61c7-495d-810b-0458db824b48", "comment": "Malware payload (DanaBot)", "value": "c74b22a2fb533c4a2c5fa93e0720763ae016ec0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633659364, "uuid": "1410aaa7-08f1-4916-80c6-8a3e4f2510d3", "comment": "Malware payload (DanaBot)", "value": "9a2fe456a4ac9b8e888c0d657a7b19be00f5a0e4faef64cf9e17c966e6ecdfb513d2fcd49b9f12449c472b02fb8374af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659364, "uuid": "591235d3-d351-46a3-9471-f348a6bccfb7", "value": "T190563387AC201027CF3222F78E170596426FF82E97B1C5464157A9BDB5B8F6FED88784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659364, "uuid": "5a8052b8-c199-47f3-a752-6ee8d8a7edb6", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659364, "uuid": "92ec8979-f586-47ed-befb-4876f27fb9f5", "value": "196608:UsfzfmJs/V19TjuryGiG2tOyUxUXQiwAdW:UaP/V/TaO1GQxQN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633659364, "uuid": "553cbf63-b86f-4083-b7be-0d94afde8249", "value": 6362428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633659364, "uuid": "d1978c38-13fe-4d54-8b5a-5ee2d085013a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633659364, "uuid": "92e7f692-bb32-47a5-a68c-dc01818fa397", "value": "943f942969b1d3ce25f0f6c95229dbfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e9ee14-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633668686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668686, "uuid": "fe289af3-2d60-432d-92e1-9f7cb66acb4e", "comment": "Malware payload (TrickBot)", "value": "5b33e538bf9bd16e41e33eecbb71532f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668686, "uuid": "d3eb423c-5405-42cb-9f50-f70e356ca42e", "comment": "Malware payload (TrickBot)", "value": "d914b7cb85b4e14c5cdc9c624fa9fe2de5bc1675133473c1920416617ca6d0dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668686, "uuid": "a897f0d7-1e35-479d-9660-e5e922de2dd0", "comment": "Malware payload (TrickBot)", "value": "50a56a44e552585e59b196506945916835217b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668686, "uuid": "83f92877-79f9-4f51-8fd2-bd1a7fd9fddd", "comment": "Malware payload (TrickBot)", "value": "6d4e7e4e854db22e940b72e12a360a7fe56eed961e05d1b3e71eba9a27736ed0bdfb76e162ebc633174696e13a0a9d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668686, "uuid": "b18a82f5-2531-4d23-8d6f-e06b3afb8b1a", "value": "T1A294F121B7D3C9B2E4E724305EE2536992B8FC325FE2D3BB5344760E29B66414428F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668686, "uuid": "d4f0d2d4-6b58-4ee8-a93b-8efee6c00f90", "value": "b1c1f07e240ef018fad7f2180be11c4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668686, "uuid": "54b00114-250a-453d-a419-ef43264409d0", "value": "12288:mrg9znz7Swjfqoweguteki58iq0Gu0NvNNyiuYY:mrizzewjZ3guHihG9yiur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668686, "uuid": "c2c7b8b4-ac15-406c-af4d-c7beefc75002", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668686, "uuid": "f8dc48a8-265a-432b-aecf-443b0e5f839e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668686, "uuid": "2a41aeba-cc24-4052-867e-06f9c61fd802", "value": "5b33e538bf9bd16e41e33eecbb71532f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451bdf02-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633668633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668633, "uuid": "5431debb-d412-45bd-9d4a-85ca7b145d26", "comment": "Malware payload (RaccoonStealer)", "value": "15d79eafc49ba37f4456b09808e4c87d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668633, "uuid": "6e940c4e-bb9f-4c62-95f7-4ddf69fcb820", "comment": "Malware payload (RaccoonStealer)", "value": "d93931a4805f6ba426222b756f48c649fdf28a2ae51b9e4fde0d393ee5b340a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668633, "uuid": "2a72213c-d40d-40c2-848e-1c95c32fdcde", "comment": "Malware payload (RaccoonStealer)", "value": "495317fdce4f1086c993dc967eecde1481adeb84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668633, "uuid": "9f01474c-de96-41a2-8074-fb9d9dd76e05", "comment": "Malware payload (RaccoonStealer)", "value": "933658fb7e85f63d1f3c0c0b4c9bcd4289e129995c21c0896dd2d381c02021a4127af2ed926a766b63c83a936af084bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668633, "uuid": "8b4974d3-2818-4207-8ab4-c9b3a9cc335f", "value": "T16AA4F11065F1D079F3AF96744EB1CB66867B7C61A97180CB2BF0C6EA5E352C18B12327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668633, "uuid": "47974301-4fc2-4062-bc4b-d6b02dfa8a6f", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668633, "uuid": "eba8ade2-76a4-4315-be35-125ff0073684", "value": "12288:/btVXoL4eybaNOcwRt4CPtOIk5g0nA+4Iwkat6eWu:/btRN9RKCPQIn0AhI1atc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668633, "uuid": "dc53a756-73b4-4fda-9b83-ba035434cc03", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668633, "uuid": "a51b5140-7662-4d7c-a8a2-da489f051ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668633, "uuid": "e58220da-1ebe-4649-913e-3f897b0a1f1a", "value": "15d79eafc49ba37f4456b09808e4c87d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2807c1ae-282f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633694354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694354, "uuid": "12cf54c7-0114-4c37-8c66-bd70fcb9d9ad", "comment": "Malware payload (AgentTesla)", "value": "673ff53d2fea901d6fd04e8dc6f5ac30", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694354, "uuid": "4bd72a4f-5709-41dc-bc5d-3c08f29ba7a8", "comment": "Malware payload (AgentTesla)", "value": "d93fbbbc8e7c9b0295db60d2c8ba8ac97e356719ec49cb4b044922115ca6716b", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694354, "uuid": "f50dc13c-af62-45b5-87fc-8073dd921150", "comment": "Malware payload (AgentTesla)", "value": "6d05fe2cf92a5ec679552e3e3832b81e096edf89", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694354, "uuid": "5fdeffbe-9701-481a-bda5-be927c2e9144", "comment": "Malware payload (AgentTesla)", "value": "8e672917776e441ff4da60197bc3a16afc2a982c4903b5db5c529164db36cd6fd85e117c6f5ea6a966500480d3cba849", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694354, "uuid": "c2c8d085-ee17-4d51-bab8-2dd41c3b3668", "value": "T149C423A22A5432B5A98533D37F67193F7C11192FAC93EE5DAC890CBC1C535F6E226360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694354, "uuid": "7758970d-3fb0-4909-90df-6ba07bb21792", "value": "12288:5LZbMwPYK7Wd8Vj1mh9chb66W1kENLq38RlCw9ZaXg6wmfRE6E9mP:5L1MnK768HwUb/gw3kw4ZvRmfe6E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694354, "uuid": "f5c0e806-959a-4bd0-910e-58f7ce7ae6d2", "value": 574364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694354, "uuid": "80329c9d-2afe-4bec-862b-dbc5c833269b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694354, "uuid": "30b29b08-cff9-4d35-b8e8-dd34d4f108d5", "value": "Shipping Documents.zip.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4973c7c9-2861-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633715885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715885, "uuid": "1873249f-c754-49bd-8b05-b412659b11fb", "comment": "Malware payload (Vjw0rm)", "value": "da308c62cbd20f444b54464c47e74091", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715885, "uuid": "0626c2f3-5920-45d3-bec5-6336ee3dd08f", "comment": "Malware payload (Vjw0rm)", "value": "da496f93b454f899587298a910578d3c133dab195a298462ffbd2e1229b14abf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715885, "uuid": "6501a6a1-f90e-46f6-b550-fd916a62cabc", "comment": "Malware payload (Vjw0rm)", "value": "496dc2eebcd81d7bf1ec3fb00ba3f9dbd819962e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715885, "uuid": "c006a63f-d37e-4f2c-8fb5-df2816d38505", "comment": "Malware payload (Vjw0rm)", "value": "128d617ae80933ce02e52bf88ec8cb5fa178533b3fc217dc9100a4f3fb51fc6eeecafb9491797f7ac2d994861e365f46", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715885, "uuid": "5c08a2af-aa13-41f0-9b0a-03c4796bdc6f", "value": "T1DAC23BCD6D11B689D630A17075BE6E9CAFF8930BA401138D391DB3409F32289D6DEE6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715885, "uuid": "a79f44b6-1800-4940-b521-a4fa335430d2", "value": "768:QlLxBV+0tOpZ77QfKLIuyj+H0ZFv6T5uBay:Ql/VScfKLDL0M5gay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715885, "uuid": "b4ce046b-b86a-4ecd-a281-99055ce39c26", "value": 25949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715885, "uuid": "5bcda491-1d67-4737-a952-4adc3b82426b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715885, "uuid": "1158a038-a230-4c04-84c0-8881f15abcad", "value": "eReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95129335-2865-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633717729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717729, "uuid": "5ef8face-c43c-4fba-aa9e-4ba93f645d96", "comment": "Malware payload", "value": "8b5451d46cf8234364c8d926154470d4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717729, "uuid": "4ea00b1e-dc51-4955-95c5-9b56b332b24f", "comment": "Malware payload", "value": "daba5f034e0ce17c7ea68ef5733e1cd9ec51ca5e0777fb9f659816be930fc4f4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717729, "uuid": "e2270632-a396-4a9f-bebb-25a27bdf4924", "comment": "Malware payload", "value": "f1fd25ad41fe962801457af0987d0426dc862f3c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633717729, "uuid": "ddb1e9ff-a90c-453d-b8af-8eac1c198a16", "comment": "Malware payload", "value": "9e94f1a7cb2a8642bc3dd5d3e34870d98f009a530f8714d4760e9401d63d888bb974c9035438d7ab8c2677ef10c78eb6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717729, "uuid": "09071480-98d7-45a1-be2a-da8503dba5a6", "value": "T12DF533D78241E878FD967630D1A384F23A20054398A7676A312F4CB5EF3BDB1735ACA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717729, "uuid": "3f8f5724-0d7f-43d3-8abd-3d833b3ce062", "value": "49152:35XqL3I+d1qwRQOIIxKG3PpMUgN+Zi5WkkaW6mOCBT+O0LCex1EVtKpI5RNnf:JW37d1quQEPpMWZbOmjCO0/yjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633717729, "uuid": "a1c860a7-9358-4824-b069-689ee2bd406c", "value": 3336914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633717729, "uuid": "8c09c170-e2ab-4dac-935d-16ee46dc0c60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633717729, "uuid": "d23ce313-f710-4925-8ecb-836b45f12ece", "value": "mervecanlishow.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd37ac7-2860-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633715627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715627, "uuid": "ce63d37b-739f-4bba-b142-6c1d837ba9e8", "comment": "Malware payload", "value": "36e9e777a287633985d227dc35acd20b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715627, "uuid": "e9d3a506-8e62-4280-b353-118785e6d476", "comment": "Malware payload", "value": "db5cf7a01196d1ec6fa3dd54f7e6a4efcbd462e0f125e225d062d58305e32a50", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715627, "uuid": "14c933e5-b0be-40f5-a9de-de33ff3862ef", "comment": "Malware payload", "value": "18784c75f78f54275de4c19cec3e968da5b83f1a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633715627, "uuid": "2791c544-0eef-4bf1-a661-88c3efbef848", "comment": "Malware payload", "value": "a9c17733c67388760e66293d7348d893d55f2305c192bf616bbabeba70eae8cdeada340f7607e3bb27bc6132b414ed27", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715627, "uuid": "d141497f-3f99-4f04-9848-30d28968f6d4", "value": "T152B57E33F6D18937D17726389C5B67689A39BE102E38984F3BE41E4C1F35680B9252DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715627, "uuid": "3de62f4d-a6a1-4800-8512-12c50310074d", "value": "49152:6jBWQKQVznD9M8Br1uRm4TPoy+e7YOYLEA:aZK0zxM6r1s37YOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633715627, "uuid": "6bae319f-9d1e-45ed-a057-4e615439eec6", "value": 2468352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633715627, "uuid": "015b0140-5287-45c7-99a3-e7a26f387c0e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633715627, "uuid": "329e643e-d161-4c68-880e-9e4cd6bad0a5", "value": "factura - lmvhmokfnarprjayhiva.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca53253-27f3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633668618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668618, "uuid": "67ced95b-38ca-4fbd-a2d7-3d042f64f1cb", "comment": "Malware payload (TrickBot)", "value": "02755e1ee736ec636c93c31aa85c8427", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668618, "uuid": "643a1182-db0a-4423-85cc-789847ccee42", "comment": "Malware payload (TrickBot)", "value": "dbd1cfed3d0b57ac4b4affbcd942287617d1f7bdd322ba2464d22020e4e29200", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668618, "uuid": "524cd362-e77f-438a-92c5-53765e6276ef", "comment": "Malware payload (TrickBot)", "value": "e4c9bece77fc79e54ec10dbb8e94d5a1485e2573", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668618, "uuid": "04d9986f-c739-440f-8e21-e45a6c83efb6", "comment": "Malware payload (TrickBot)", "value": "f32d1ae8ec0ab8a5d4f6e1e73a0a4e0fd051cfeaea8ec6a57db70f228f260f768a8b4bb302cd7613ccc41226a8446459", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668618, "uuid": "02d57ad9-ef1b-4fe5-b1a8-9ddefa8ad4c9", "value": "T17DB4DF02B3C18836D67B223A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668618, "uuid": "5465d53b-9fea-4ed4-9234-be7cf83dbfdf", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668618, "uuid": "a8954afe-8335-4aec-a884-71f96bc40b7d", "value": "6144:b3oOkxQXFDzaLtFD2aD3xAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM1v7qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668618, "uuid": "2090828e-eaa5-4d2c-8d16-62efceef98a5", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668618, "uuid": "dcf37224-79c6-476f-b2d0-efd55a498942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668618, "uuid": "a623f04a-3d2f-47a3-87ae-57d4aa4aa846", "value": "02755e1ee736ec636c93c31aa85c8427.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a5cb57-287d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633727822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633727822, "uuid": "1ce3ec87-23e1-428d-a59d-0171bc3e59fc", "comment": "Malware payload", "value": "1a19bb4c028d7943e65587dc94f38ffc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633727822, "uuid": "dbe67c6e-b9e4-43ca-9b81-4c179c335259", "comment": "Malware payload", "value": "dbf947a367cfe28cc7e5e33af9d8aa7fe3166d74d787200b1bcce777ac65efcf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633727822, "uuid": "711fa498-42ed-4f4b-be16-b98eede90dc2", "comment": "Malware payload", "value": "7a0a462391f53d3421862125b944b1cef9ae988e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633727822, "uuid": "2f730d51-ea51-419b-a8b3-12f56a772882", "comment": "Malware payload", "value": "f0151973643b0e6b04824cb573c5d44add206dfa5f351522a49db3ee216096c5a3b1a271d8a1bb5419d940155a6cfea6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633727822, "uuid": "457083f5-8354-4efb-a2f8-8f910b8673e7", "value": "T165E49B650A94B7A2DA6C0FF280492AFDC52E9D7F2A32F1CE9D94300527F3AD67135D42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633727822, "uuid": "8f5365cc-9836-435b-bce9-10eb2095a3d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633727822, "uuid": "f9e8734c-2494-48e3-bfc2-bfd5da136029", "value": "12288:wgxRTlOaEQFD6m7kyR3HrHeu0YuizEEwreL:jOaRFHkGHr+u5EE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633727822, "uuid": "a907f9ab-feb5-4f56-b41d-4ad1aa207de0", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633727822, "uuid": "0b6fe4ad-5d6e-4af9-a1f6-f512d24dce93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633727822, "uuid": "06f72e11-1048-4153-85f6-e5c8a5b8f2c9", "value": "PO CPWPKL-1901088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94efa263-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1633706562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706562, "uuid": "4fb5ab15-04c9-468e-9ea0-c8f2a177b612", "comment": "Malware payload (Cerberus)", "value": "1f56fe05b1b82c6a68b83d76fdf3b770", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706562, "uuid": "4e490490-b902-4aeb-88da-09c8bc92a56b", "comment": "Malware payload (Cerberus)", "value": "dc517d32e0aeeb26c133a0f33ab0d6e8d9025c906d3210021fa08c8cff652c0d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706562, "uuid": "935600db-4f7d-478e-8dea-0caffc03792b", "comment": "Malware payload (Cerberus)", "value": "981474c3b70a0f250402f74c2973386082ee61d4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706562, "uuid": "3405f3eb-6023-4178-a319-48e55ab061b9", "comment": "Malware payload (Cerberus)", "value": "30edd5ae121e82a1cbeabc4b3fd84f840320d9aead59d763225554a160a2bc30c9a54dc2d846fe1e2a0e2443a8748208", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706562, "uuid": "173adbb5-f3a5-4716-9f4a-72b940508227", "value": "T113F312A2932421F7C467A4F916D763E326B589C54EDEB343498C5019CC3F38AAE2DEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706562, "uuid": "9f0517bb-a721-42da-9190-2fbd6435c30f", "value": "3072:IRKucU3/oIQjt9EkZVoXw8ZuDB/yDTdWca9qjN3eg3HxyL0yAiKzg:sKY/ngtCMVoAKuD1+za9qjN3f3xyL0y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706562, "uuid": "b6ec6556-cd07-462a-bdd0-d0d0fe689a38", "value": 171642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706562, "uuid": "5ce7ef69-7e31-4b73-a645-9dfb1026dda3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706562, "uuid": "f0cf0924-51ab-416d-9613-d1d2275868fa", "value": "Play_Update_build_flow.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb04dce-2806-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633676965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676965, "uuid": "7a61fa4c-fd63-4905-ab37-62fcd8ad8bfe", "comment": "Malware payload (OskiStealer)", "value": "226fb48aedd3b2dea5ab23df5c51cc5b", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676965, "uuid": "68aaff5e-da9a-47c8-8d82-dad3f6e0455d", "comment": "Malware payload (OskiStealer)", "value": "dd0edf81fbbae3e51a0a23c1350642a3ebbfbce5b53e0b6918e5989f1c6e8fff", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676965, "uuid": "16f47e74-970a-41c6-9ad3-f4cba0647499", "comment": "Malware payload (OskiStealer)", "value": "9386ef7bd0bef18c13f9db71c6c3cd90ba878b2b", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633676965, "uuid": "2863158e-60d6-4e97-8e4c-fc02f1c0c10e", "comment": "Malware payload (OskiStealer)", "value": "bc26ea73b31433cce368747bff60263bc861ba6aa5e70e6395741957a15971914addf10e98478f0bedc96b0b7b72a7e3", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676965, "uuid": "3902a446-4795-4cea-a092-4e772e84e211", "value": "T1C4046D6CE8EC5906D4962BBB72345F088F74EF02F8ADAF0DA2D3F1F215B89599144217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676965, "uuid": "1c86f456-8a61-4ffb-881d-b238cde6e709", "value": "3072:bCD5tYXSD5YtkpaUpyHtnZzC05/ag/xQiL0w9foS2PkxxKV3wubwvw:bCD5tntpaUerWcYi79fAkxxKtbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633676965, "uuid": "41086acc-c386-41f9-a54c-0c402a1ab18b", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633676965, "uuid": "2be248f1-8578-490e-8fe8-495ddb929af7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633676965, "uuid": "6f46308a-0be9-4c5f-a190-bd3f1a15506e", "value": "5400040115 Pratincole Pacific PRAT-RR-21-H070 DELMAR MARINE SERVICES PTE LTD.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6403fd5-2837-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633698055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698055, "uuid": "0f75fbd2-e7ac-4232-98d1-f68e26292371", "comment": "Malware payload (Loki)", "value": "cf25f9692bdc65bcab1eab8f554c3cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698055, "uuid": "bb8432e4-a9a6-4931-a016-f0d0c037a1f9", "comment": "Malware payload (Loki)", "value": "dd5cce0d262cfcfd81b3f4984b54a7b9fa40b6f332628c76eb26c7501aac0fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698055, "uuid": "9bf6b609-4607-4f51-ae6b-39ae10031868", "comment": "Malware payload (Loki)", "value": "4ffb92e88eca32fe310e72221f3f419b7778bedc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698055, "uuid": "4f03ebfa-4814-41ed-b337-bdd1ed4d3341", "comment": "Malware payload (Loki)", "value": "2d4164136e2aca5a960380897575cfd26184eb2d2c6d7b21f6f974b38dd6e797da81fa07463faa5a72241f9917cdbdda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698055, "uuid": "036098a0-382b-4601-848f-4647528e5a12", "value": "T12EB4D02B035E5DE3DA1D46758C4063AC51A0FE578354431A32A5F83A4EFBBC3CE29A75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698055, "uuid": "0f2e5e78-6740-40b2-888e-53a57567fdd7", "value": "76ea2aeb5c14d3a13754cce9305b7392", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698055, "uuid": "2e159507-3ea4-410a-b05b-2f9b1a72cc06", "value": "3072:XKEUM9oGGQI2O/TqfaqmShVYB1vT0Nw47W3z+2/ZZuxCpn8SoobbwInO1OtQx:aElCGnI/Tpv3j09suInyOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633698055, "uuid": "8a8c9b52-1fda-44b9-8ed7-58c1129b9783", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633698055, "uuid": "ddaf2024-0bd6-4eaf-8866-4b78d325640d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698055, "uuid": "204d9204-f224-4295-a2b4-8ed249288e75", "value": "DD5CCE0D262CFCFD81B3F4984B54A7B9FA40B6F332628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652ba251-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633673840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673840, "uuid": "35199f1f-3d23-403d-9037-f16ccc1944ff", "comment": "Malware payload (Mirai)", "value": "8cd6d823a8283714336e0d674315c5e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673840, "uuid": "8f2fbe84-0922-4a91-9bd5-a1718ef19507", "comment": "Malware payload (Mirai)", "value": "de0c49a7ba7275721754bb4e7b0b281f7b69a7cb562857a4d673fedf0cb2d120", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673840, "uuid": "aa76444d-6ccd-4399-baad-a8f1f428445b", "comment": "Malware payload (Mirai)", "value": "6f0e5a864864a13a62896b4aea019f2a4e949050", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673840, "uuid": "e704a73e-4de0-49ca-a753-8b0c7c22e634", "comment": "Malware payload (Mirai)", "value": "22d660cd2c6514eb1337f92e150233eed5e213d5b1f7b11cdae03cf5d49c9817726acafed38ab47a64aeec001e5c42fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673840, "uuid": "321fc890-4b48-49cf-9e27-66fdf2b79b80", "value": "T1C4532A46FC818A11C9D413B6FA2E118E33136768E2DF7212DE116F2477CA96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673840, "uuid": "609d184d-04a1-4f91-ae5e-f8c73f8aae8a", "value": "1536:ccnCgWg3H9Kkh4AwihJq4geha95kGcnBM3iVj0Rhd6:dWUIPAwMqX79kj0Rhd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673840, "uuid": "bcff6be5-849b-412b-8206-53bf8bfd0cef", "value": 62840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673840, "uuid": "18035882-c95e-45a5-af85-756451b95a5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673840, "uuid": "e06aed71-66df-4ce1-bb58-ad6918ef44f5", "value": "8cd6d823a8283714336e0d674315c5e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d8445e-27ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633673818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673818, "uuid": "73a09745-5e9c-42d1-bda3-7708c9e9b38d", "comment": "Malware payload (Gafgyt)", "value": "7a8678c888e7a0e9f19757bf25107c2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673818, "uuid": "8712dd73-ac39-4c09-a521-a8358ee78126", "comment": "Malware payload (Gafgyt)", "value": "dee921c6d58e40aa6292d2b43b2c2f7aea8c2df8efc45392b407d3ffd97c6f1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673818, "uuid": "0e043af7-99c5-4069-a245-9875c4b0036a", "comment": "Malware payload (Gafgyt)", "value": "5a14d5dd202983b96c803a526f5156ff073c8176", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633673818, "uuid": "dd5d78da-e42c-477f-8f03-c7030f03b344", "comment": "Malware payload (Gafgyt)", "value": "4e17470e8dc8cd1e57baa1b2261eaf227cf1270b68adef1f1356aef2400a18d85c6d94574ea1f2427f6c5a831fcc5a53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673818, "uuid": "4085ded7-333e-4b41-9767-6fda0794deba", "value": "T168C33A06F5118B53C1C3177AB78F561977232BB893DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673818, "uuid": "e7dfc6c3-060c-4e87-8981-1911fe20650c", "value": "3072:1fdba48qhzluesfvxU5hrPrlHvYLmyDQUdQUXVTn:11balqh0xU5hrPrh6myDQUdQaVTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633673818, "uuid": "a4fbe328-4497-4e01-84e5-6382a21dcfbe", "value": 118713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633673818, "uuid": "89926457-2ae9-40e6-838c-b935471a6268", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633673818, "uuid": "b9dc3562-2f79-4ecb-b1f2-44f80b8e55ba", "value": "7a8678c888e7a0e9f19757bf25107c2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76693f8-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633706674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706674, "uuid": "31c52314-4284-4ee5-9d46-3e7af6836e2b", "comment": "Malware payload (AsyncRAT)", "value": "5f4f8901c283ff1a04974a46f16502d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706674, "uuid": "a9c84102-0194-4f6b-b537-065d9ac6e2e4", "comment": "Malware payload (AsyncRAT)", "value": "dfa1635c17715c6831d89ae96f40d29952f92da506242d12d3f019e39a29b98c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706674, "uuid": "34080e4a-f665-4773-9f70-73d1bb648f40", "comment": "Malware payload (AsyncRAT)", "value": "e157158667d7e01557bb7d5b79b8e7a82c968676", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706674, "uuid": "dcef3b4c-61c8-49dd-8a74-6cfd7108122b", "comment": "Malware payload (AsyncRAT)", "value": "8680867467f08f8c39b025d8c7581f7bb69598b9d86342d7a22a85471f09ab265515d0c425fd8f29fab85e3d98f68681", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706674, "uuid": "729b43cf-3270-434c-a0c2-98753a9f2030", "value": "T14A11627EC04359CB2701F2702BEA5CF98578F6E5D6CE80D53A6183EF2ABD010284E19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706674, "uuid": "c4ac1ae4-0d53-482d-93cb-e3d64fe4c9ab", "value": "24:OJrTTTTTTTTTj4oO89+OKHQg8erTTTTTTTTTjbEEo6T6:OlTTTTTTTTTj4o3AOKHS0TTTTTTTTTjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706674, "uuid": "e86dc519-3ece-4699-8665-a315d6457dee", "value": 891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706674, "uuid": "978dee12-e163-4206-bbdb-efa72761ae4e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706674, "uuid": "fd9f2015-bdd4-46c3-ac3b-f074a88a82c1", "value": "(10.08.2021)SLKE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b0153b-2809-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633678116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678116, "uuid": "131587f5-42dc-4bd6-870c-5f7ad049e8d4", "comment": "Malware payload (DanaBot)", "value": "000a8ac13b6903a952c8d4e4efd3cb30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678116, "uuid": "409e3b8c-4d32-41e8-b7ce-6c42eceb1e17", "comment": "Malware payload (DanaBot)", "value": "e0108e85a42f0cc059183ed0b74a689e08f0cb76c59b731a7543de3e881937c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678116, "uuid": "62ea3e92-9cfb-4b1b-b6d2-b0773a38c8ee", "comment": "Malware payload (DanaBot)", "value": "58426c4b9e95b133dce7f2aefdffcd5dbee11f04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633678116, "uuid": "754bd2f9-0e12-4e63-ba7a-85511955b406", "comment": "Malware payload (DanaBot)", "value": "234063639a6d06b612505d95a0dc93d4db395cec82143e0933e0d01a95b44a944eca34b7e3231da2edb1554e0a6e11b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678116, "uuid": "6c869a3d-9867-498a-b5d7-1dd08dbe1645", "value": "T1945633402AD9DC72EAB748B48F29DD1BC2A79E618B68C11B6742711F397BC110712F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678116, "uuid": "8dda0586-ffe3-4630-acc0-84a962d58402", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678116, "uuid": "97c4b947-28eb-4d81-9097-ec10192875a9", "value": "98304:zZxpfLjjZjGTIRN85gm1JkCYGSX34U6cuq5ddctOo8EhYY22LjvlWKVMq50Yohmo:z1fLpmS6OmMhGA34TculIWzTFWKTohii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633678116, "uuid": "51fa0f6d-03f4-4dd4-9280-cfdcbce8d607", "value": 6285413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633678116, "uuid": "149e75bf-9f37-4aa2-ac83-e41043b45c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633678116, "uuid": "fc13999c-60e2-4930-90ec-42c4df4f07b6", "value": "000a8ac13b6903a952c8d4e4efd3cb30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307ad876-2834-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633696515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696515, "uuid": "68be0825-ee63-4c5d-9eb9-211073a7adef", "comment": "Malware payload", "value": "b3ccda93e3d400f6b405cd8ec37ecbf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696515, "uuid": "81265bf9-9eb1-4b8a-81bf-bd99838a3533", "comment": "Malware payload", "value": "e1fd5e8d40f52e3c0985519110bf98cec846d9ff4796b9ab0d563b937a9e0375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696515, "uuid": "65551132-f289-447b-b19e-032153609740", "comment": "Malware payload", "value": "76cf1135f5408dab9ce2cb6c3de3bde6695b1ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696515, "uuid": "adc1ef65-282d-46c1-bca8-0d1502b8cc2c", "comment": "Malware payload", "value": "cdeb39895c71e1d62c4520ac60395682a2b7b816ece7e51ec3719c9fa657bacf53c8f8c42b27334a6cade146312980e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696515, "uuid": "f28fb995-adf0-415e-8dd2-8c4f317aca23", "value": "T173C512C2A55594B1DAB870F2B862E5122DE63CAC9CC3454C3EF9F23E4072997CD3691E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696515, "uuid": "58aed32d-6ab5-4800-b3c9-9f115b5df459", "value": "49152:hwgdNYoYW4IETrsgUvu9N8ivdKDhA+WsPP6QmUTftIsmNm/5XhG34AiROgO8:euYVrsk9N8ivyhAdsPSQxgU11lwZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633696515, "uuid": "b3b5319c-b66d-4767-841a-9d389405e163", "value": 2586608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633696515, "uuid": "0e352e99-435a-4f4e-a9cc-70da4be745a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696515, "uuid": "2a29d666-fb6c-470d-99ba-ac8164c27ce0", "value": "e1fd5e8d40f52e3c0985519110bf98cec846d9ff4796b9ab0d563b937a9e0375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc0fb66-2803-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633675684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675684, "uuid": "c8655a4d-cb51-4f0b-9adf-f5ba60cf2c95", "comment": "Malware payload (AgentTesla)", "value": "0189f55c9bfb7ab458e2133823918be3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675684, "uuid": "ef819807-af8d-4170-893c-7dd1df21c172", "comment": "Malware payload (AgentTesla)", "value": "e3ed553dbbc2b79dad0f148e95f48a87c7c1c859cb09aee734a67a7eb50035b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675684, "uuid": "208a278c-9fa6-4b05-aa4b-4a3943182a22", "comment": "Malware payload (AgentTesla)", "value": "dee4da15e113ffc6ac77583c2e95aac4296d51d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633675684, "uuid": "7a34ce22-9247-410c-8463-78f90eee8846", "comment": "Malware payload (AgentTesla)", "value": "c75cd7705a0a196d016aaed83441cbdd53dc5b944b5047db9b41b9715aa47acd6067a2bab32362654b3a8d200dec690a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675684, "uuid": "3321cab4-beeb-4ce1-89bb-67c73852c443", "value": "T17AB4F1246FE49716F5F20F7419F406A05B3EB81D8D3BD30D4A8858DB6EA3B4A87107A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675684, "uuid": "549d9b72-a661-4bf2-a78d-3b5b63ca2f9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675684, "uuid": "69f94141-85a1-43bf-bb1e-15ba8dfc3d31", "value": "12288:ScDyL9pD3jBByldNcAUIalCL5Q1cAxqcsvJMX:b+L7DFBy1c3CL5Qrqcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633675684, "uuid": "0aa95b76-e40e-4621-ad75-81c352ffe8df", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633675684, "uuid": "e4a15767-7e69-4266-a6a6-1d5d28dd9a85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633675684, "uuid": "cbc7f82f-cfb7-4d67-92f9-e6cbe0b39ccc", "value": "Orden de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1a807d-2833-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633696052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696052, "uuid": "f5c013ab-f093-4d46-bcc0-2580b958861f", "comment": "Malware payload (RaccoonStealer)", "value": "5166aed90f2993888874af165c8fa1f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696052, "uuid": "38a0b4d2-c9c7-4ab9-9fdf-daa6259a4458", "comment": "Malware payload (RaccoonStealer)", "value": "e4843efa63e35463c7d1ef4c9a9b9e5375117aca0b20a185321da61ce8650489", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696052, "uuid": "e65e86ca-1c74-4606-a111-4f48636f28d1", "comment": "Malware payload (RaccoonStealer)", "value": "7a7e928027b5c88777388f961e3837d636d8f1d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633696052, "uuid": "c2107882-a384-4cca-89d1-35de3a5f9b65", "comment": "Malware payload (RaccoonStealer)", "value": "910ea55e2437aebad94e097110e6890ba64e96a0a27114dcdb1b4155a3d4188f4adff94d01caaa6a1fa945f43ea94bfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696052, "uuid": "b0a30e98-9c2b-4cfc-9e48-6d861c6ad03f", "value": "T12EA4F10072F0C031E2AF95744F76C7A14A3BBC266A3594CB1BB767B92FA5291CB5530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696052, "uuid": "35e510f0-6a6c-431d-a139-54d09ef57e96", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696052, "uuid": "d10fb4ff-80dc-4eab-a9ce-ee58983cd9b6", "value": "12288:ylxirWpYLFBD6J8rv+P9Rq0RlxnlA+/8fTRK:ylxGYwFF6ij8lzz1kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633696052, "uuid": "1d2ab124-6375-4554-9a10-0e631e384ea7", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633696052, "uuid": "6fb9c133-7e05-4984-adb7-a984530fd655", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633696052, "uuid": "6b8f5560-4f2b-4e04-9eb1-1ffb9a60644a", "value": "5166aed90f2993888874af165c8fa1f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33021139-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633660012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660012, "uuid": "0d746587-bcd6-4b8e-9422-305d6c021628", "comment": "Malware payload (Mirai)", "value": "35b32aac837e24e224f280a1ae137ba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660012, "uuid": "2cac4338-61fd-48a4-8e49-58f798502d0a", "comment": "Malware payload (Mirai)", "value": "e4b7a48df9be0d1264eda4b81008b90ef2e85a556bdcc9ab55a1534cdcbaefb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660012, "uuid": "791605b2-6870-4db8-b7f9-7005d27de991", "comment": "Malware payload (Mirai)", "value": "3c2d032cc9672c32ff299edce534ba73383632e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660012, "uuid": "8423fa97-0357-44bc-b704-8b2e26b0ee3c", "comment": "Malware payload (Mirai)", "value": "f824db97f7262947750c776aab12450b6816b5367318c4d89a9882053f69fb82b36f359556b980f5903edb3dc745655a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660012, "uuid": "0ff73f7d-b7b5-415d-8d4b-2af0f86f1183", "value": "T1A6A32B4AEB814B13C0D61775BADF82053323DB15A3DB63065918AFF43F86BAE4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660012, "uuid": "14dedb4e-44e6-4925-a66a-b8c183ec1248", "value": "1536:Y1ndz3ZjtQyW+8H7fetx5UHiR+9M9lPEiYqDrE+dTYEQDXZzw/9mEH6EUm:oJjtvtLtjUHiRdKqDA+dTLQDpM/9ms6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633660012, "uuid": "affa2bc7-e86c-452c-9ad0-ce2742e23428", "value": 98354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633660012, "uuid": "36859fd3-659f-46ae-8610-b927b62ccf5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660012, "uuid": "eb45926b-023b-4530-a0c6-615ece8ce223", "value": "35b32aac837e24e224f280a1ae137ba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7c8341-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633692214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692214, "uuid": "412b4575-bd4b-47a4-a667-c966a3e4cd3e", "comment": "Malware payload (AgentTesla)", "value": "b6a26b6912def25202d5c5b3a7cef7ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692214, "uuid": "f3ccc89b-914e-4280-9269-583df1591d15", "comment": "Malware payload (AgentTesla)", "value": "e4c04b184aebbb0c4cd7533d2432c5a3699ea15e3fdebcaeec49edfea97cfcf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692214, "uuid": "d1903aef-d05d-4d5d-8d3c-cf90f04a9b10", "comment": "Malware payload (AgentTesla)", "value": "c61a6ca3cf061a2ba382a77d5e697f1dea1e99f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692214, "uuid": "08c6778c-6b8e-4bcd-b430-537aea204e1f", "comment": "Malware payload (AgentTesla)", "value": "157290daace8666dbf3235aa31eda8484f03c5731c422e78e2801b00d591a56abc210c04819214dd18cdfc9d104fb01c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692214, "uuid": "43eed40d-62ac-408a-bb74-cfb19a82d597", "value": "T1B0B401345FE49725E4F60F3069B006B06B7E684D8D3BD21D5A8814EA7EE3B568310B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692214, "uuid": "62d7756a-bbfb-417f-96ee-11c001494be6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692214, "uuid": "909330be-7639-4d4e-8812-a0f274423e62", "value": "12288:rADyL9pD3+r4m5GEh0AGdu768pSIt/cPU0Xnt0m:0+L7DWY60AB7VpS0/AU03t0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692214, "uuid": "43b6eef0-4725-4549-b6c3-b7d82ca38540", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692214, "uuid": "a7e5e4e7-b616-4789-9bce-367a3062356b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692214, "uuid": "726962b6-9eca-45cd-8f1d-de7c6594fd56", "value": "Petikan segera.08.10.2021.xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a40591-27d5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633655671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633655671, "uuid": "ed7bb152-0fdb-4f7f-9448-0bf82a21df4e", "comment": "Malware payload (RedLineStealer)", "value": "8bc89e5b9e175cf9f421f9ccbc0bc7bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633655671, "uuid": "045c13a6-04e4-4013-8a10-d12e32aae5f3", "comment": "Malware payload (RedLineStealer)", "value": "e5c5ed9b49632298fb4d1927636e7a97fae95bdb5b13e1a5942a5b93dd21d2f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633655671, "uuid": "885eed0a-58b6-4bd0-a69d-cf8b1179c8b1", "comment": "Malware payload (RedLineStealer)", "value": "a76a5284bb1ad1d8b1f6030d7bbd7d360d4af429", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633655671, "uuid": "af337fff-2b4d-4656-b36d-d09a03b47448", "comment": "Malware payload (RedLineStealer)", "value": "fa5fdda55eeacbce894922bb9842cc79703d0475f4cdd78b648f8b15cbb8f057969204a3722bfd65fde563adcb559be5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633655671, "uuid": "43e87958-68e2-447f-90e2-92d487227d9f", "value": "T108D58C052BEE8710FDFB1F78A97A85A507737C40AC7CE16F61A5325E0A30B42D9B1726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633655671, "uuid": "dd3f2d2f-78a9-4923-8fa8-a3f30d865aed", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633655671, "uuid": "e87821f8-7d86-43be-a752-5306f46f8d69", "value": "24576:+rWDIPtBmP8IkB+7Qfxrg1JtsTUWQ9Dt87C5ZPkEBIclMaLCX9xImBJm6vAWg8:EUsB+7QKFZDt46w1XvImwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633655671, "uuid": "b6f4e6d9-3d33-41c5-81fe-a20b3b2b0d88", "value": 2926080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633655671, "uuid": "ee025b0a-d9d5-4be2-89de-286ac0917c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633655671, "uuid": "1e74369d-6e8a-4a31-a750-c574a78d322e", "value": "8bc89e5b9e175cf9f421f9ccbc0bc7bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6411124-2862-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633716523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716523, "uuid": "ca407380-a967-453e-aaf6-598586f94166", "comment": "Malware payload (RaccoonStealer)", "value": "71c3c6ef549daa7a9e2fe5cecb83031f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716523, "uuid": "ed3e7791-ecfa-4e6e-9537-9c9e798adb8c", "comment": "Malware payload (RaccoonStealer)", "value": "e6080d51c23ff3825d6dda3280757ba1ce88be4b06d10bf9960a0d79973b43e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716523, "uuid": "702378d6-bbff-4673-a537-cb1bee7cc9de", "comment": "Malware payload (RaccoonStealer)", "value": "29b6c64e806bdc864ca37a62e50478c3179284a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633716523, "uuid": "0635f637-d9e7-4c29-83c3-7522d4f9e31d", "comment": "Malware payload (RaccoonStealer)", "value": "dd198c5bd628bf433b0baa079c5ae2f08d16ea33e4b8c89eb9935d24bc510b9633a2939fde2df6afbf5a974f5c05d2b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716523, "uuid": "9139320a-c373-422b-a7d8-c4ab49e4f112", "value": "T1321633040AC11586CDF0A1F79141BD7DC29C28FD0DEAFAE98A656F6223B6970121F7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716523, "uuid": "8bdfccf3-78f1-476c-b8fb-6e1d53bdc5a3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716523, "uuid": "5c51d28e-237f-46f9-8da9-81896300c5e3", "value": "98304:J95uL02QwDp/oy0GO/KPjFHmtrq6jFCbJb:J/E5D9o97/QjFH8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633716523, "uuid": "d98e5abf-1551-4990-b52d-2fb93b0b064b", "value": 4371812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633716523, "uuid": "3a6b4a1f-5f48-4ce4-b1a1-e643f4991802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633716523, "uuid": "43097540-5c91-45f3-8b97-8e3caf4446fa", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027527df-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633692573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692573, "uuid": "fc33593c-3f4d-485c-b4dc-416e91e730c4", "comment": "Malware payload (SnakeKeylogger)", "value": "63dca7b4ea9009b434520c574b45b7d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692573, "uuid": "943e0365-3e1d-4c5e-b23d-ffb171f12f80", "comment": "Malware payload (SnakeKeylogger)", "value": "e66dbf270dfc58700d1ce9926452046e209887e14a89172ef5c77f4c97fe5171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692573, "uuid": "38026bdd-1a5f-4bfc-97ad-a24555739b39", "comment": "Malware payload (SnakeKeylogger)", "value": "fdacbd0b2a997b6623e55ed12986cc9380c8e7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692573, "uuid": "4168b307-c544-40a3-80f6-3c71a613d38b", "comment": "Malware payload (SnakeKeylogger)", "value": "43812b218e049b39b02649e033d52100ed6f6f143cba8741418fde800860704a16c5d8d130a7585e07c14092dca66f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692573, "uuid": "8c19bfd9-ba6d-4473-a819-80ebab3a3d6f", "value": "T1E66412236AD606F7D168D37097B2995AD3BA9E181101054BABF53F2B3D72A838363097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692573, "uuid": "b60bb877-402f-4d51-9d85-1a97b5db3811", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692573, "uuid": "f2735daf-0a27-4788-a91e-6c4fa2883dce", "value": "6144:P8LxBUCMzHdd+KtEosZ+ArnkUwj3phBHK/nFlmRZLWEYxD:M2HdAKg+IkUwLFOjmbWEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692573, "uuid": "4debd157-dd21-41db-9a76-112bfb2ac92a", "value": 334798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692573, "uuid": "c38c5028-5b31-466f-aef5-f6748e75ffe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692573, "uuid": "f1010000-89c5-4750-9879-46103885fcf2", "value": "AWB 2617429350,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a787ef0-284f-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633708102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708102, "uuid": "bd796f05-ec80-4f53-bf06-3e1002c2acfe", "comment": "Malware payload (Quakbot)", "value": "beead185db72fd2d923ad7e096328403", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708102, "uuid": "83383ba2-0a40-4e8e-88f9-9b624db64fa7", "comment": "Malware payload (Quakbot)", "value": "e7063272f09f51950ae0d2a745c16563beec3877ab498ea1ff44dbf6ed4eb66b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708102, "uuid": "1a08ba31-c14e-4ac9-8fde-870bd5d11b5c", "comment": "Malware payload (Quakbot)", "value": "308cd5509e068544d0f41d4d9e83e3e717ee340c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633708102, "uuid": "a048fc0a-4d00-4e0e-92f4-0094e762bcce", "comment": "Malware payload (Quakbot)", "value": "e5a4efd11c516fbcaed6fca6218fb0f646e64d30f6a80a58be67247ec5c3cc2e568938fd9d155ed815fd1bf732819a0a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708102, "uuid": "eb66f08d-2f01-467e-a03b-9e6cad9926fa", "value": "T17AE44A013A40E431E6EA55758E29C6F51A5C7D44DFB0A4CFB6E06F2F2AB94F3D229702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708102, "uuid": "a67aeb17-945a-4421-9cd3-6c37d1e7976f", "value": "f5038317f32b373acb4cb42e83f6092c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708102, "uuid": "44a86a96-d228-4298-a500-9e5727bd6439", "value": "12288:kthXMCbQtfmiGkbe0WvbojNSxfjUmBrCyA+WuQBYOI+vxprpm:iXPQtfmiF8TUArCyA+WusxJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633708102, "uuid": "178ab9cc-df60-4209-a1e7-37eae6b20aeb", "value": 665520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633708102, "uuid": "6e43dfbf-1a8a-4d43-9a35-380e875cbf6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633708102, "uuid": "2d87b668-e26e-44a1-a615-cbf26fef0794", "value": "e7063272f09f51950ae0d2a745c16563beec3877ab498ea1ff44dbf6ed4eb66b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37242d94-27df-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633660019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660019, "uuid": "55cc5e67-2374-4085-a7ce-7986fb4a2ad8", "comment": "Malware payload (Mirai)", "value": "1a3e2aec72387863457a1a68fb8770eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660019, "uuid": "79c72e83-9979-454c-a046-e8eee05e3159", "comment": "Malware payload (Mirai)", "value": "e70b2f6edad9e9d9a88bce134ec495eba22e09c974bba888200eec3347765ecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660019, "uuid": "1909efbf-88c8-4c1b-9ecd-47c61c8e279f", "comment": "Malware payload (Mirai)", "value": "c8aafcbbd72790aa07e1fd9c3c8242b6eee19cbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633660019, "uuid": "751fd1a1-d854-4cee-bafd-fa98a1d9a977", "comment": "Malware payload (Mirai)", "value": "f61efb45bbc0c02f91a3f4b4702e4c5fdd2097d4ad9f0a806495d11bda6926c16a87a02c3021414315d9f1b77e0ddc9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660019, "uuid": "cea437f2-8990-49ba-8c17-982c24e47df6", "value": "T198A2D592A8C15A2BC6E0A37AF59F454C3360A7D8D2CF3B17C8155F807B85A1E0DAFB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660019, "uuid": "6a55b2ce-c298-4d40-a59c-aa5ef37f7338", "value": "384:6nSvsk80MEcUsVtl91NFdVtl91NFdVtl91NFdVtl91e9bsfYyf321T1zGRPrw8kx:c8sk80MEcUsVtl91NFdVtl91NFdVtl90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633660019, "uuid": "76c92dc1-0bee-47e4-9164-ba0d4d56d343", "value": 21688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633660019, "uuid": "c84a6abd-bd39-4df8-bc24-339c70349aa0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633660019, "uuid": "b6f2c6b9-8859-447f-a86b-18194da3feeb", "value": "1a3e2aec72387863457a1a68fb8770eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a98864-280f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633680735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680735, "uuid": "b922923c-447c-4103-b91f-c07306849b74", "comment": "Malware payload (AgentTesla)", "value": "9cf64c4ef42036513faa9c8f5e5f7861", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680735, "uuid": "9822dfc5-4313-4ae6-8b96-37806a89a7d9", "comment": "Malware payload (AgentTesla)", "value": "e762700a619f80536189a18a44dab017f8583150011cb146f31fae72d7acc1ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680735, "uuid": "72de1780-648b-422c-a547-18c5b76c777d", "comment": "Malware payload (AgentTesla)", "value": "418ebb100d1c3af40412366dfe94ef76d1fddc81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633680735, "uuid": "0eed95cc-d524-48ac-a0ae-a63e645bf06d", "comment": "Malware payload (AgentTesla)", "value": "1d1b648bbac8f8cbedbbacfba631d2114e2975281fc0b23900a8fa3b7046f79913e042ec44660f8beb3cc58881d7e2d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680735, "uuid": "59346ed3-b10c-40d8-b7a2-2c11197960f1", "value": "T1B83507002295C601D1B637F4D864CAF097657C55DA29C28B2DF1BEEB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680735, "uuid": "f2aea8e4-bacb-4f23-bd5f-f4d6345bd153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680735, "uuid": "ed524c9c-43f6-43ad-9fa4-226e2e6e67cd", "value": "12288:nEb0CDyL9pD3n+0ShLS7q+wr4AO0brMn/+dvZxL2bW:Ed+L7D3+1k2ayKbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633680735, "uuid": "db584d28-ba59-4043-94f4-0ce0b0af7b62", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633680735, "uuid": "c515d0b3-0941-4f26-bee4-1158040707b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633680735, "uuid": "b8235a6c-3a0b-4be3-9906-6ba73beeeab2", "value": "SCAN_COP.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cd69a8-2831-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1633695160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695160, "uuid": "cf152a77-2ff9-4170-8fdc-d5cbe956ac7d", "comment": "Malware payload (CryptBot)", "value": "41e914097223971ff35fa7cc7060567e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695160, "uuid": "27d6fca1-3aac-40c7-ad22-e6a41c92e48a", "comment": "Malware payload (CryptBot)", "value": "e917d16aa3c2d421903d598a6c993da5e76ea3e393e460af5c8d6388a3c3c95f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695160, "uuid": "4c343d82-8e35-4783-9dfe-5fc1bce5bc67", "comment": "Malware payload (CryptBot)", "value": "dc60235cb38ec27a74fc3e440981177ccd4d9536", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695160, "uuid": "f7ca8899-54c7-47fe-9785-3dd6b39f9621", "comment": "Malware payload (CryptBot)", "value": "2fbe6221124be030e4cb0e5e6924c3715ba6c3fb35715601d76871ebfbb666ef035c34cc4c7c2364364462f8a4bc6c20", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695160, "uuid": "88bcda8d-8d40-488e-9a26-7c858c7d6ffc", "value": "T12764E00036F5C832E76F6A350D7187A54B7BBDE1D938448F2BF456EE8E316818A2570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695160, "uuid": "a8f2592c-b1a5-4e94-bcd4-1416351604a2", "value": "452a573570b57080deb33a6b6e9df7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695160, "uuid": "1308ea98-d7c0-4e40-bd02-bafa250f595a", "value": "6144:tFe8ytx43PN9Ep63H1vaIH9F2PrTVFRQbVA:ypxAPN9zHMaMCVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633695160, "uuid": "6b75810e-76d1-46c2-9dcb-bef9d8617fc4", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633695160, "uuid": "c438d29a-bd8b-4839-b2e5-e17770a39e72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695160, "uuid": "dc14c9c6-c9b0-4e0b-8828-24cd68689b65", "value": "SecuriteInfo.com.W32.AIDetect.malware1.32515.18904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6a83a1-281d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633686951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686951, "uuid": "b6da5a26-3583-478a-b811-7a870cc8b02d", "comment": "Malware payload", "value": "9fd7dd518ad01bdf4916f2ece374108d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686951, "uuid": "0ebcd70f-ba3e-4589-a484-6df1d502f4be", "comment": "Malware payload", "value": "e9fb8abce887b419b47c051ce47d59b3333af3e57cecfd4c0882f1b0fe1717f8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686951, "uuid": "557d9631-a4c3-4de0-a8e2-1afabe029a73", "comment": "Malware payload", "value": "d6fd53ab548689eacc81af998d66a2deacb7da02", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633686951, "uuid": "6833c233-aa20-48be-ae47-3d58764542e0", "comment": "Malware payload", "value": "56d04690882f2025cb9475be171e9fe15b5acf0411096d2730a208f6e0ab4079a1ab5c334bdf992b0034bdf663b1e804", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686951, "uuid": "f80d2bd1-0d44-47a5-a649-8367b7c56bf1", "value": "T17F02E474CD2CAE92451DBA847B21BD8414ED693B4E7CA0FCFEA20400B655E4EFB37856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686951, "uuid": "fa1a9b2e-cf7d-4ee8-b676-1325aa1bb422", "value": "96:m+pHTr5T6T/vXhDGR8jyhwjFhXUJrQmSbJnUge5e8Kme//R2kTJze3WW/Aur5eHo:mwTr5qvXhjyhwRyJrMJ2XA9ZwmOho2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633686951, "uuid": "30b9e41e-77e2-4db4-b4f0-da134a2322d3", "value": 8832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633686951, "uuid": "0ff69967-1f72-4618-9528-aee17e181d6b", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633686951, "uuid": "d26aa18b-4459-4b73-98b9-cb13fd174c79", "value": "Launcher.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a47c33-27dc-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633658775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633658775, "uuid": "da013f3e-2ff5-48bc-94fd-ca48278876b4", "comment": "Malware payload (RemcosRAT)", "value": "4ab979089c41766242fa6ff017378b12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633658775, "uuid": "030cfd08-8380-4520-8408-9e09cb3867f9", "comment": "Malware payload (RemcosRAT)", "value": "eae7adaac2b1487116d7357378d26e226b0786092d4000825685a587673f09ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633658775, "uuid": "c2406ba4-58be-46a2-8887-eeb81d731c1a", "comment": "Malware payload (RemcosRAT)", "value": "3d339b8e3c25999e93c69e8ff56282758cdd975d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633658775, "uuid": "782a96f0-a284-4420-bfed-c0d2318305f5", "comment": "Malware payload (RemcosRAT)", "value": "b03fdf96a55fe344934f1b2ccf985c519bce34d3138f1816109d561ef118ca0ad1440ed87c5e42f70a725dfeb28269ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633658775, "uuid": "a546a453-6dcd-4f21-a583-f81773b9b8a5", "value": "T1561523CFD1846401C98B047B79E7E6114AF06F822626DA06516CBBEB7F737D708ACD1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633658775, "uuid": "f06e165c-69a0-413a-80fa-83215243bc9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633658775, "uuid": "5d93a363-7e45-4a3b-9ac7-14db360cf056", "value": "12288:4gecUzpxGAtuGkpOklCejuV29mt4LfhRVUwGMzD4FvNl3goY4kHhmMbAf4pAH5M4:1eNNxNuJlAejg2Yt+f5f+DNkHASAfn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633658775, "uuid": "1cfc7324-dff5-46a6-85fa-e0888b0b34ae", "value": 901088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633658775, "uuid": "2263b152-5fe2-4097-9aba-4a67d4ecdfaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633658775, "uuid": "6028aece-cbf0-48a2-bc76-4b2f478df75e", "value": "KB20211008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd6f879-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633668055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668055, "uuid": "fad9542a-32a8-4b19-9b28-5d561974b026", "comment": "Malware payload (Gozi)", "value": "9a453cc31ebfca29d8df565258fbf8ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668055, "uuid": "5fbe9598-b0f4-4b24-819c-06abfc691a23", "comment": "Malware payload (Gozi)", "value": "eaed947e04ed7659fbba2287e6965b2c0960035aa539b57a9f9e15504a01ca0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668055, "uuid": "9ccfbe52-dcd1-4258-b1ce-23ed7c350d37", "comment": "Malware payload (Gozi)", "value": "5eb3be88abb84f63e04c92bc3e35a82a01689971", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633668055, "uuid": "de66d595-eba6-469c-9c1a-e6e6fc8419df", "comment": "Malware payload (Gozi)", "value": "b6208d77a5036ae705f9e18c163c3c575efc97b84ab6ccb8ce8445f131852e8a994022a000d1fed43b5138bd7a3151e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668055, "uuid": "327cb7f1-7503-4614-9abd-fd1313ad85bf", "value": "T19DE430443A54F510E6AD6972CF2AC5F907157D09EFF1B48B78E03E1F2AAE8A3D516302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668055, "uuid": "b1bdcbee-d22d-4af2-bb60-268d1aba6449", "value": "8d2de2ae605a2294ac6efde10e33795a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668055, "uuid": "5c4f8aac-7932-43d3-9528-28905f3b4ff5", "value": "12288:6vWBEPfqPoo44cvquI2Pg/8wsPrcPgIDU1Iu3vEI8Vck+5gS2oQkoKeyFtseQOYc:6v5Pbo4ZgaPrOpI1IkvIVc1qDoQko/yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633668055, "uuid": "b88eb776-5c76-4a50-b5cf-0f7370f6fc7a", "value": 662688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633668055, "uuid": "cc5afc26-b4be-430e-8ddd-35a418b29f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633668055, "uuid": "a54751ad-58ce-4c5e-8530-4d381f595741", "value": "9a453cc31ebfca29d8df565258fbf8ce.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f5f6ca-284c-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633706992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706992, "uuid": "330c60c2-a3dc-4ac9-9dae-24919915b138", "comment": "Malware payload (AsyncRAT)", "value": "cffaf12162200e10f64fed1ab0d14109", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706992, "uuid": "5c7f9554-5430-4cf5-8d68-04841787adb5", "comment": "Malware payload (AsyncRAT)", "value": "ec595d4dcafdd37725beb193c59e9b5b512214e047b1e5f768beb5317ab0ef5b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706992, "uuid": "f75067e2-5baa-496c-8dff-7f5d0855f806", "comment": "Malware payload (AsyncRAT)", "value": "fd2b4e78efd41422792c5f4cd66e57bb0e39d8b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706992, "uuid": "31456b0a-0b8b-4304-ac9d-47d73cb34637", "comment": "Malware payload (AsyncRAT)", "value": "66ee4fdf100cad6719cffacd1dfad1499c521ac5f416531e620d84a4323442e6fd26259014f1477d30b86a41c5b15a61", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706992, "uuid": "8834585f-6ddd-47c0-b96f-8b599b3101da", "value": "T1004533C43D10A63BD4A15BBC7865BD0A61316CE65E6CD6D3FE31B350E6BE232811C16E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706992, "uuid": "d72813b4-dcac-49ed-8645-1d002c6a6d4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706992, "uuid": "18d86abf-5caa-41aa-a457-dbf53b3aad9f", "value": "24576:DVco/W3GmzRIX2cOFT5IhF0xV7rxVdWUBjyN/:BvWWWR66517rxDWUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706992, "uuid": "5ca0708a-72a5-4d45-a7e1-aae3b6e4008a", "value": 1200640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706992, "uuid": "8685c57d-6d3e-4d20-ba4e-eeed01ed89f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706992, "uuid": "5b108f0d-19ef-4cef-b5bf-8cda7ce7e808", "value": "cffaf12162200e10f64fed1ab0d14109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae93b423-284a-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633706176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706176, "uuid": "ca56428c-49f4-4bd7-bca2-33916f36b0f2", "comment": "Malware payload (Metamorfo)", "value": "1d9e579c286369209274d6a3dc4199ec", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706176, "uuid": "6f7d4007-a208-409f-8240-e0ef30324730", "comment": "Malware payload (Metamorfo)", "value": "ed67426b28e7013c1552aa7ba950f97f3671bc1e97ee56b4ca81f3efd5ec795f", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706176, "uuid": "bd94cb37-bf0c-48eb-80fa-72f73962f740", "comment": "Malware payload (Metamorfo)", "value": "e11f4ac27bc7f7dc17ec0177448f384ebfebc593", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706176, "uuid": "0caa92f4-8118-4387-bd48-89bc6af48c5d", "comment": "Malware payload (Metamorfo)", "value": "a6077bc04f9d0b23daf5236fe0b20dd70cafdada230176e9f73f079c32877ad5eed08c1cc3eb9c83161a25e756047e9e", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706176, "uuid": "908375c0-1bab-4835-a804-a8a99f7b4e21", "value": "T1A2447D06B3D5437AE4DB13321B8F93628B72EC788663412B1259790E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706176, "uuid": "a77e6220-2b88-4fd2-b737-25ce68856b25", "value": "3072:smci/0903DaY4Axwgz88ereWn/7w05g0MMcB3RUN46ILJ9+ZB5yOanHM:smZ3DaY4AM8er1nzT9rgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706176, "uuid": "a61deabb-013c-47db-b610-50aa05d9341e", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706176, "uuid": "f32169d9-fdd5-48b9-b311-2a7ba85e336c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706176, "uuid": "f45001ad-5031-4edc-a16e-77326e74ce48", "value": "1d9e579c286369209274d6a3dc4199ec.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285242e7-283e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633700797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700797, "uuid": "f92838d6-456e-4a68-a1c4-dd708afe5d6e", "comment": "Malware payload", "value": "434dddc176b0af840d2a2f53c8b8136a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700797, "uuid": "608e5dcf-ca17-4214-a956-559d1e1cabef", "comment": "Malware payload", "value": "ee8d431ff260c5d729ffecc6579b32262846dd598d9f9ef32bbe6527304c4bce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700797, "uuid": "b1189a54-213f-4d86-a0d7-49bead78bbde", "comment": "Malware payload", "value": "8bc7fefc5e89a54e5d280046082e975123e58f5d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700797, "uuid": "6252585b-9ed7-4882-a9d9-d6ad623d168b", "comment": "Malware payload", "value": "00588bfcba816c15fa44c1a808f8e1e04083b279ce07cebfa259638bb93738b623b1d3471a681767acdd887361176394", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "md5:ff8c3736ac246c6ec8cb08a3cef7e0cc", "colour": "#6447CB", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700797, "uuid": "21fdc874-6201-48cb-b700-d08bbb169aa2", "value": "T17122D444A3F449B7DAFE073946933BC6CB79F9464F03DB5B208511236E473932190AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700797, "uuid": "501a96e8-ff19-403a-ae72-89a8b58095cb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700797, "uuid": "8a85d52f-4f94-4c85-8841-64fb2336d86a", "value": "192:ykbykYDjCkawKcjiDyJ3ZkHy8/V2p1jvv4DRnI9LMu:LykYbNs0ZkHdVGK1INJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700797, "uuid": "d7aee2ad-fc94-4083-ad12-ef0d6f7a88fc", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700797, "uuid": "ad4b79b5-b5c3-4d07-b528-2d4c860676fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700797, "uuid": "6b6593d3-5ab2-45ba-90f9-8c636a757998", "value": "extract-1633590973.340585-HTTP-FxbP4DpEZShB8PfQ4__3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb95ac3-282b-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633692590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692590, "uuid": "2595aa33-daa1-4763-aab4-e007bfdbc9e6", "comment": "Malware payload (STRRAT)", "value": "2c9fb604352f9fffecb65da5086975a6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692590, "uuid": "d78a6db7-2bb6-41d4-97fd-47fb677422a4", "comment": "Malware payload (STRRAT)", "value": "ef42f95df82923e30fa1b92a352749c4272214734b49eec43bb64b64ab146134", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692590, "uuid": "782906a2-11cb-4380-ab0e-c1ef2b339418", "comment": "Malware payload (STRRAT)", "value": "b16dc3ef2f2b20175c2d57000d3f35b91b95d0a1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692590, "uuid": "1c07e8c0-6ce3-4bb2-ac27-ebfc123921dc", "comment": "Malware payload (STRRAT)", "value": "ced2489dc5ee572c091a53f78419c995f3bc93ed4a2270da44d3f6e8f422042cc52676738ac24812f5ae4fba11dae6e6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692590, "uuid": "c35d9202-0529-4c2e-ac0a-d255bbb02122", "value": "T1AC04010BBDEAC4F5E00750B361488273D64912E4A586B51BBEFD04662D30DAD1F63BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692590, "uuid": "380c47b2-e90e-49c9-9e88-d322d2e68ed2", "value": "3072:wzMQu1auk0Dds2vNdW1rmdI2G7c6G3NxXsKSFBHp8eegRJDSYgXHAGgVfWEKvL:wQQTukwbzy2I2G7rMNxXKJR52A5RCvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692590, "uuid": "4fed4dcb-78a1-4429-9d72-706e10371f95", "value": 188502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692590, "uuid": "6cabbbc8-557c-4802-a4b1-c37a166574c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692590, "uuid": "2ebd35e2-6dd1-48d8-b903-61fe4b91a0e7", "value": "PO 870EW3144.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9077d85-2823-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633689470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689470, "uuid": "67acbd49-22ec-48ef-930a-34db853907ac", "comment": "Malware payload", "value": "115620dfb71e59b9dad47a7ab99c88cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized cat", "colour": "#2F6954", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689470, "uuid": "e0717188-d2e1-409b-8e40-366ac80f4df2", "comment": "Malware payload", "value": "efbd281cebd62c70e6f5f1910051584da244e56e2a3228673e216f83bdddf0aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized cat", "colour": "#2F6954", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689470, "uuid": "3aeb6ba2-27b2-40e6-84cb-625a4da14a04", "comment": "Malware payload", "value": "1f52db8e3fc3040c017928f5ffd99d9fa4757bf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized cat", "colour": "#2F6954", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689470, "uuid": "ed78309c-9fb5-4db5-89b5-ba9884cc6ded", "comment": "Malware payload", "value": "9a6a8d939d6e3a3065ddb74d4c42ba479a80193531fcb645ad777b90acad62edd008f3e504e6ec71c2e789da3bae79fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false }, { "name": "Trojanized cat", "colour": "#2F6954", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689470, "uuid": "723b35f6-59c6-4ed4-a18f-7bcfe49ed85e", "value": "T123152317E16144BBC54A453451E35736A4B2BC36A6B2273B7F9C9A332FB2F009F18B64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689470, "uuid": "d3bdcf29-3df0-4b80-a764-b407bc5b8f2d", "value": "12288:HZSJ5zcIr7pF4TaFANVKO6GiJouVB2FvH7SWRz9HNacWBn48EYKuGUrs6Jzo042i:HZSJuIpFFIiVcd9ftLWBn2b/UsMCpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633689470, "uuid": "1cac73d4-a0df-44c0-b463-a29fdd556647", "value": 903000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633689470, "uuid": "059aee8a-a698-4b1b-b40d-a37c0b4f0175", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689470, "uuid": "577d7366-6365-44a0-84cb-ac2e7aa5c4d8", "value": "efbd281cebd62c70e6f5f1910051584da244e56e2a3228673e216f83bdddf0aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe8bd44-2836-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633697427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697427, "uuid": "325219cd-b988-4579-9b2c-78323e71fe5f", "comment": "Malware payload (RemcosRAT)", "value": "3f4f150ed7ab62f3f08315fa85a1e1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697427, "uuid": "a4febf33-30f2-4a3d-b7b8-4588f0702723", "comment": "Malware payload (RemcosRAT)", "value": "f0896ba259cc40a67474db857cbca2cd43099f5b49be45c3e3a3a34a06765b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697427, "uuid": "0d388b99-1926-40e3-9074-6765fadeaa5b", "comment": "Malware payload (RemcosRAT)", "value": "24890995fabbfb50230729d5cceb4d5a92199a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697427, "uuid": "c6594df5-1e17-4679-b46e-6dc502425ab1", "comment": "Malware payload (RemcosRAT)", "value": "22c58b4b486006773797ba750666b5494a02b7f154baf52cacad43be6c4660982d1b557649cdf74f3f97b3de83900279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697427, "uuid": "7942c8b6-ad03-494f-a6bd-a49f8c3cf49b", "value": "T12E057D22A29144F6D1BF1A385F2B76D458ADBE3039F86C4657F42C087EBF2913D1D982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697427, "uuid": "2671299c-fd7e-4e53-8939-e32aeffc6851", "value": "976d50e20c688f6aadbee0d3008b47f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697427, "uuid": "b294e30a-4e44-4eaf-93ab-d4fe96cd06f0", "value": "12288:oNpYTxZSIWZyFvKOvZFRlMyaTYJxfxY93ruwD5A/FS5ZyCxUiU/OyV3fO:oNpOKAvK8RliTYDArv+t9C1UDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697427, "uuid": "2a24090a-ae67-4a75-8d7f-fcb97384ba7f", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697427, "uuid": "56e4bde7-7b68-4098-85ec-b9ea1ca96b3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697427, "uuid": "dcd92005-2865-46e9-afa3-96da744292ca", "value": "f0896ba259cc40a67474db857cbca2cd43099f5b49be45c3e3a3a34a06765b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a4b88d-2800-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633674111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674111, "uuid": "0466c371-083c-4bd7-8171-6db57a16d598", "comment": "Malware payload (Gafgyt)", "value": "8f83a7cf945023b79cb9478c710c81cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674111, "uuid": "4b87162e-98ad-485c-bf62-448e3a77c0ad", "comment": "Malware payload (Gafgyt)", "value": "f0be48620edd0c9d22603ed5caf995c16c99c444e7ceb6e655535de98388cd7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674111, "uuid": "053aee8a-5a42-47fe-83cb-3768f2e1cbec", "comment": "Malware payload (Gafgyt)", "value": "3c3f6458122ce613e7d7f1ba6759885e14b98437", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633674111, "uuid": "156ec438-7dae-4199-81d8-573c8ec857bc", "comment": "Malware payload (Gafgyt)", "value": "741c0ef8d0e59a1e9d8d180e2dd7079d41951a464e95dfee28241c34360952b819bc9df3ec588192f3e33780e391a0e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674111, "uuid": "344091c9-1d4e-4077-b27b-c7a2f8952c88", "value": "T196A33B37BB230E23C0CA547211D71731BBB5D3D938FA5243BAA16DA86F166803962FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674111, "uuid": "6f645327-947c-4443-a902-c7c97af5d9d6", "value": "1536:+uLtrURNM52NSt1Xt6puphaLqHrKzO6F6GIj6uEexTe:dURN82kX1phaLqHrKzO6F6GIGuEkTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633674111, "uuid": "f762a6f6-fb00-404d-8d87-15139b30d4ca", "value": 102035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633674111, "uuid": "85fa3447-70e0-4a08-8529-3f34ece7a5a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633674111, "uuid": "bd045f12-a15d-4d0e-b2ed-0587fe19327e", "value": "8f83a7cf945023b79cb9478c710c81cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972bd446-284b-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1633706566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706566, "uuid": "c4e0fb17-f7d8-43b8-8313-c3a23d3789bc", "comment": "Malware payload (Cerberus)", "value": "57ccc63a99b258a26c37b21badd863ba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706566, "uuid": "4b2dfeea-ecb4-4e79-bd8c-619f27aa1996", "comment": "Malware payload (Cerberus)", "value": "f1032f9b9e45f54f1f500992b880a609fbcbe5de074e2e4374e57caffad7c530", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706566, "uuid": "8a78885f-1d96-42cd-8aeb-e48349c8dc87", "comment": "Malware payload (Cerberus)", "value": "4d3d31bd31db3e3bf477bf1d79e1b0564863e17c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633706566, "uuid": "2a0670f3-77da-43c3-8581-91b5a2799c8e", "comment": "Malware payload (Cerberus)", "value": "d2d6c8926b2361932ed4b7293c8182cc3d7a4995869f3882aa25a04cb87414e337fd2f4fc53f842d370294389b2dd8f2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706566, "uuid": "63a51d36-e51d-454c-81ac-38dcf18d19b4", "value": "T1FAE533D64E26DC3CD29B1E31C2B280A62A6047C7254B996A7D1E41BDFF53C64038AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706566, "uuid": "520c919b-b27b-49e5-8dff-5b9061e42fdf", "value": "49152:do2Rnqs2ga9q9q3GpMCLlALHF0rCh7XlPsU7NSfKUsKa0QZUa9P2F:dZ592Fqy6MnLlS67VUU7cyDKalZUa9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633706566, "uuid": "058f7071-1d13-4917-933a-71ae7e929049", "value": 3158156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633706566, "uuid": "28849935-7bd2-49b3-9df3-90297ef52080", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633706566, "uuid": "cf0cf8da-7458-4522-b95b-95a1cd01b038", "value": "Turk_Ifsa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a4001c-2824-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633689674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689674, "uuid": "a76c83d6-3363-47ff-b5d0-cba12407bdd7", "comment": "Malware payload", "value": "fa73b2fd914a0cfd5e7d3161af903b6c", "object_relation": "md5", "Tag": [ { "name": "Backdoor 1", "colour": "#BB68DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689674, "uuid": "25c52d47-c095-45aa-9a79-c27c86bc5fdf", "comment": "Malware payload", "value": "f155fafa36d1094433045633741df98bbbc1153997b3577c3fa337cc525713c0", "object_relation": "sha256", "Tag": [ { "name": "Backdoor 1", "colour": "#BB68DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689674, "uuid": "1203e60e-20db-4e77-8432-f7d651fb8e4c", "comment": "Malware payload", "value": "38b09d690fafe81e964cbd45ec7cf20dcb296b4d", "object_relation": "sha1", "Tag": [ { "name": "Backdoor 1", "colour": "#BB68DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633689674, "uuid": "ef2d869e-b0ca-4056-8a9d-8f664401bbef", "comment": "Malware payload", "value": "bd19a18af360496e3009ff2bc254a1955a520420115b2250a324d1b91784783ce91890353ee42463a34151b536945c6f", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor 1", "colour": "#BB68DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FontOnLake", "colour": "#B26F58", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689674, "uuid": "42b60d98-b0f4-49a4-ae41-a03f16c33e46", "value": "T1812533F67A086872DACE473552A0345954D37EB6F315BB427C408AFA391C15C6FCAF24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689674, "uuid": "98174302-114f-452d-b55e-725f5b0e4468", "value": "24576:d7TARDcd98L4pGiG9N5bBomzrL13Isb+O6RnXikmxQMWS:xAOMrXNJ313F6Xikmxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633689674, "uuid": "66adbbdc-7055-4475-a7cf-f2d35995be02", "value": 1030320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633689674, "uuid": "dd2b2840-bb55-46d0-ac65-e1ef2d138806", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633689674, "uuid": "5fcf8e40-8561-4864-9b4c-558643a9853c", "value": "f155fafa36d1094433045633741df98bbbc1153997b3577c3fa337cc525713c0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bf9879-283f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633701244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701244, "uuid": "674ed282-3c08-42e8-a3ce-b180d27adb55", "comment": "Malware payload (AsyncRAT)", "value": "facac9092fbd9878bd2b5a0bbc2d0055", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701244, "uuid": "69e3130f-8d55-40cd-8d2a-b885e734e73f", "comment": "Malware payload (AsyncRAT)", "value": "f2809a3dbd2d8364421edbaffacd9ef549947cf0f955ed244d2a8bba55d65810", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701244, "uuid": "b3b3f449-6477-4f55-9e89-c455930ae495", "comment": "Malware payload (AsyncRAT)", "value": "4d3364a8f06db3c95eac9b17ff75a2c2a7abee47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633701244, "uuid": "73ce8a52-3632-4668-acc7-3a9012f2ef81", "comment": "Malware payload (AsyncRAT)", "value": "aa2eb8cfd51b535ed79c4f7ec90ae44c7a78dfbfbc80cd7beb11fc5032f699a526a6670d00e8bb2f7e96b989c977c18f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701244, "uuid": "71882174-6e31-4350-b556-e5b6eb2689a7", "value": "T122944E7C256E5E4CF79094BCB1758EFF23A2B82F45A774F3901CE1D70AA9BD05902226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701244, "uuid": "470a3188-c910-4ec0-bad8-2aef436ea718", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701244, "uuid": "135c6029-2451-4cc8-91e3-fea4d794c7c9", "value": "3072:CwAM4NjvB4vMdq5hs5Uz/nVu4wLT+4aHBgMwYX7aVKiEgjfSTsxCatgfVapBXt:Cc4vq5hs5I/nc4w0oVKiEgbaratgMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633701244, "uuid": "37dc8c5f-79e1-4a24-8b30-a895c23a4d6e", "value": 427400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633701244, "uuid": "cd9669c6-e47a-4144-868a-e627cf49a2cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633701244, "uuid": "9c2ef37a-7296-49eb-9aaf-5ce92b67cecf", "value": "facac9092fbd9878bd2b5a0bbc2d0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d0a06b-2832-11ec-843c-42010a9c0014", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1633695957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695957, "uuid": "bba39c7f-6098-488a-8fbc-1aeff61d192e", "comment": "Malware payload (ParallaxRAT)", "value": "d79b92f1166eaef053315c94c8b24a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695957, "uuid": "42e00bba-38ef-4238-8707-03e582b4cc0c", "comment": "Malware payload (ParallaxRAT)", "value": "f4a48f22b86d2f6d02f91a39c1bbb72bea98ab0495be8c3153392c8c8d44eb34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695957, "uuid": "31deb18a-eb4a-47f3-8d0c-c357fc3537b2", "comment": "Malware payload (ParallaxRAT)", "value": "62d1612c4f9bbdb60324236f0083fa97c64530ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633695957, "uuid": "696d309d-09fc-42c5-b32b-d87e8c994150", "comment": "Malware payload (ParallaxRAT)", "value": "8415e6c56826da08794df9ce765a310b6805f9b4afe063b52a8cf263bf4c16eaec3162f3d081a79b98795fdd82954744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695957, "uuid": "976cdb7e-3048-4705-8f2e-bba9d26fba8c", "value": "T19CB34850B4D04172D933E2B53D49A3D4EBDF9B691E22A92B3FBE0A117DB18327B11742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695957, "uuid": "78503b17-a4d2-4964-8b31-eeeecd1a502b", "value": "3072:lSXHUiHV/0yf8DCHNVC7GXMUP5lfD7to91t4f6FsBhh0JS:lSX0G/0oqUP5/S1tLFsTh0JS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633695957, "uuid": "06806f6d-c4bf-46fd-bdfa-71d86cf9d33b", "value": 109726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633695957, "uuid": "4a08c951-3574-43a0-9fa7-a2983822a145", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633695957, "uuid": "2329aa13-5b03-4348-a13f-798a23c7282b", "value": "D79B92F1166EAEF053315C94C8B24A4D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f390899-27f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1633667710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667710, "uuid": "929df97f-c444-4188-b192-60b3da9bed02", "comment": "Malware payload (SilentBuilder)", "value": "67bc0b9a18bec086acbe6d0e94a8c285", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667710, "uuid": "586fe123-f9d0-4bb6-9f45-8cb24e28e76f", "comment": "Malware payload (SilentBuilder)", "value": "f4f2e8efe9c1513a738a74226454d282c63ae68f944ba2b7f5ef53e15becf70c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667710, "uuid": "563dbb42-6b31-4da9-aabe-10a62cd10520", "comment": "Malware payload (SilentBuilder)", "value": "0a77679417f800dd242316e0e7177cc6560943a5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667710, "uuid": "6bfce45c-284f-45e2-abab-ec26f628fe13", "comment": "Malware payload (SilentBuilder)", "value": "9e1240754f30348aec7f7293a5dc09d8b3442650778fcb7875b4e208181bce9f429e03ceb4838199c90e26adb6a03061", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667710, "uuid": "60a9189c-e5d9-4390-b20e-b67bb9efca92", "value": "T1B534E14AF575C84DFE4AC73A4CCB0B9B5376DC228BAF0646B285B5516EF0DBC290214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667710, "uuid": "0ec4bf64-c915-4b78-93ec-ee41f90add8d", "value": "6144:MKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg99HW3cZZRprq15Obr4vO8PDklovS3WHA7O:b9HVTrmkbr4vLDa3/Lvf/1eulBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667710, "uuid": "43917304-2bb1-4466-a7cb-99c125448090", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667710, "uuid": "56cd120c-fce2-4b38-87b4-b790fef1db4d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667710, "uuid": "fe8d44c9-0033-41bc-aa03-c1c165ecd448", "value": "doc-1614195213.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f26c78b-27f0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633667495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667495, "uuid": "72d65bd6-4b5e-40e6-ad67-c57ddd92ec8d", "comment": "Malware payload (RedLineStealer)", "value": "9d7ec34d94e5a2ed95b0378be8e3a8ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667495, "uuid": "57ba2451-2b01-43ac-9db4-98b2bce9a106", "comment": "Malware payload (RedLineStealer)", "value": "f649dfef953b094f7e2ee6d5aeb6d5c0d7fbb94ade3101689d930bf7fbe5e391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667495, "uuid": "74df8cb6-c692-4b87-a304-f85b8727fa45", "comment": "Malware payload (RedLineStealer)", "value": "8451a83c4e6d8537ea8d7b10b2d737926534f400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667495, "uuid": "47b6a9a9-45b6-4a6f-92c7-f6282f791cc4", "comment": "Malware payload (RedLineStealer)", "value": "b43dd89a8a5cb745f229a37519b02015d0cf26c9aa0f7b9ddc75f63c0955f459132ae59378645529d255fa75864bc393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667495, "uuid": "3387a219-588d-4157-8e0e-6daa8be3f5be", "value": "T1D154DF5036B0C437D2A74AB05474C6A16E3ABC226B24718F76873F9F6F732D17266392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667495, "uuid": "58d14142-afb9-41d7-b897-61214301347f", "value": "169d152bc3371452dbec26f63a5e0c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667495, "uuid": "de1e1205-7f95-4a8c-9dbe-0a7d74456f2d", "value": "3072:jJ8Xn5NK5qq1WyJWZvv7G9ahLJSYJje6WuXwkxIT8szm9huCtItdu/pJaDHuZ:VrqEWPhYah9nJjZWu/O8MAItduBJac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667495, "uuid": "1cedd5e5-892e-4b41-aba6-e459cf7a9c76", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667495, "uuid": "917ca2f8-8814-449a-894c-668d361967bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667495, "uuid": "be330554-0484-425e-9f3b-fd2c83124f91", "value": "F649DFEF953B094F7E2EE6D5AEB6D5C0D7FBB94ADE310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a6a6cb-2836-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633697432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697432, "uuid": "a52ede06-c176-42b5-b2bb-09ce58edb14f", "comment": "Malware payload (RemcosRAT)", "value": "c0c466c05283d61c378303e0812c6705", "object_relation": "md5", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697432, "uuid": "5a6af283-e608-4d16-b5fe-48e4227eb6b7", "comment": "Malware payload (RemcosRAT)", "value": "f64a508cb627cdc22c5b92cb3fb316ebf899d6bfcd34afdbd6ce1f79915b1b25", "object_relation": "sha256", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697432, "uuid": "93311f88-36de-4df2-9b48-240c43a5c67c", "comment": "Malware payload (RemcosRAT)", "value": "73c214bb3784871efb1b4dbc51a43e229ac92ca6", "object_relation": "sha1", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633697432, "uuid": "e0d938a6-bcb7-448b-b566-fe6dfadeae9e", "comment": "Malware payload (RemcosRAT)", "value": "661eb0fe9c9c13425dc57b91898a42eb3589b1401c23d2cb18f764b3f187d05075f396b40cfdcf65d1c671940a5bf354", "object_relation": "sha3-384", "Tag": [ { "name": "officialsw chickenkiller com", "colour": "#CEB9E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697432, "uuid": "ee573356-93de-43b3-850f-c5b9938ed42e", "value": "T14354239380BD0164FE49BA26D540DB818647E1E98E43A4C064676B7C9EEF77F3D2C683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697432, "uuid": "537eae45-56e2-49a1-91b0-6c2c6d171e29", "value": "6144:YTcPPgWZaWgnBYbdHgpVw7ynbCpDDXB2/gB60SL7bgo6pmHY:YGgSaWksdHg3MtvBcY4LYo6pkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633697432, "uuid": "7251f30b-6114-4e81-b2da-64e39f7a0485", "value": 297541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633697432, "uuid": "6446e48c-006f-4ad5-990b-43a3dff3cc15", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633697432, "uuid": "be2ea91b-a28e-4646-87ec-2bfbbd15831d", "value": "f64a508cb627cdc22c5b92cb3fb316ebf899d6bfcd34afdbd6ce1f79915b1b25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecbbe06-27ef-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633667146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667146, "uuid": "45c87b3f-26c2-4168-b2b1-ba337b4b27c4", "comment": "Malware payload", "value": "4d9d9852244f8d0e19d04dce14cfce8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667146, "uuid": "39ba8460-a359-4e0b-8217-97e511b0bb8b", "comment": "Malware payload", "value": "f68cf2d7540359cd27bae6aaa15274efd2444f148e1632a9d4bf90facfe5c927", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667146, "uuid": "5f20b08f-f1e9-4149-bf3e-2fb3ecd06301", "comment": "Malware payload", "value": "06b167f221f87f251608d291b5b4b91a3476ee62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633667146, "uuid": "9cfda466-cdfc-43ed-b656-1b97c133767b", "comment": "Malware payload", "value": "cf93b4a103453adfcceaa0f8ec05dda99c483d05e196d77c92e6fa31f9ba7b7344757c6204a709ba69201f6633a08d7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667146, "uuid": "aaff6980-d401-4c37-8d09-182e20d56aed", "value": "T1FC936C41B3D241F7E9E1893100A6632F973E7A245B24ADEBC34C3C525D53AD99A383ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667146, "uuid": "c9d94f2f-2364-4688-b382-a1df66c68ca2", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667146, "uuid": "46af3edb-3cb0-44ea-9df7-e77f62ddd6f0", "value": "1536:77fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfZxuUYOr:Xq6+ouCpk2mpcWJ0r+QNTBfZff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633667146, "uuid": "371bae75-67d7-470a-b3c5-f4ed901ade51", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633667146, "uuid": "6db3745c-30b5-4df9-8a7f-494e19776959", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633667146, "uuid": "eb3a3687-e11b-46d7-91d9-566b94a00b1e", "value": "4d9d9852244f8d0e19d04dce14cfce8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7053b4-2842-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633702787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702787, "uuid": "d2032a49-d0bd-4617-8332-5205b7ffe964", "comment": "Malware payload (GuLoader)", "value": "ccdb722933163f05edf5f9bb92059bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702787, "uuid": "eb13a50c-8bfc-40cf-a0fa-9ac8be3ab282", "comment": "Malware payload (GuLoader)", "value": "f7b86cc775d8ecb7e547afb7c11f99973b4827121d980d510509af2e34128e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702787, "uuid": "ce937a2e-3110-4d79-b603-9f4dff06879b", "comment": "Malware payload (GuLoader)", "value": "5d66d3bb6b63ba1cb0be17efc5672e723e04f720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702787, "uuid": "dd0118d8-9a4a-480c-b90f-a869e44a9b55", "comment": "Malware payload (GuLoader)", "value": "dea4022c5b27f6b1ef080cbb9e1cf3cbcb704c663cead734128747de0cbe18f6ab437342650cdb7a40111fbfc286116d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702787, "uuid": "e78280a4-f479-4a4b-9288-e3f1c9a9f5cc", "value": "T141935A4078B7E7A6F22746BAD63453F804C1EF61F9C7D32B25643E1B3A32E8156902E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702787, "uuid": "386f4891-d9cf-4852-befb-17f4a866e1b5", "value": "9708811aae63f6d3a9ad8576cdd1c510", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702787, "uuid": "92f4d70e-6bd9-45b5-bf93-27b9c66e4121", "value": "1536:86lKhFwB/xVKlFUNQO6u8rP+h4DWTg2miA0jFRG:3KhFwxxVuFU6Tu+nMoirFRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633702787, "uuid": "df5beef8-663e-4e7f-8534-6e452d5694b2", "value": 90114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633702787, "uuid": "6852fc7f-643c-472c-8f1c-b5e6b5b13400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702787, "uuid": "8c4d0f8f-eaff-4129-867e-0d1a52ec69b8", "value": "BROCATELLE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382be75e-2820-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633687938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687938, "uuid": "84477b2d-a6ac-406a-b031-11c91b034ba3", "comment": "Malware payload (AgentTesla)", "value": "b8d912bff52c5d91d84c89822fff124c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687938, "uuid": "8d04d264-6d45-40d3-9e10-5872c6a92a9d", "comment": "Malware payload (AgentTesla)", "value": "f816d4cd42d174bb597b3c222f95f2fd6d3d3690c1e2f6f4772883642eb63cbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687938, "uuid": "cb2141f8-7c7c-493e-a1d0-db124e52af1e", "comment": "Malware payload (AgentTesla)", "value": "67c8006e8f4f30a9564110af73e82a5a351f78a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633687938, "uuid": "b33553e3-f6b0-4eea-8c9e-d073e481bc02", "comment": "Malware payload (AgentTesla)", "value": "13f8d785084412b6c564fc8b766fc205c8fe30519e78056edf084f1ec17e9622f4c3316d8624f263d155fe1334a6dacf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633687938, "uuid": "9f773fd1-069e-494f-af34-179d5db50bf5", "value": "T1BCB423FFA87175B113954D0AF428BE75A7CC0AE78769ACEEC2C4CD2784F2CD46129264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633687938, "uuid": "41502afe-63fa-4f88-9c2a-109f3620d7c7", "value": "12288:xjiDTPqtoQrusdaoNDAUuQj3YsZtWAonKOEWAAfstLIu7HX2mLG:FUTqfYIX3YsZH+KFefw973/LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633687938, "uuid": "e2d025eb-4ff8-4f5e-9b4a-cdbccc295ea7", "value": 519658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633687938, "uuid": "2da1f748-c97e-4416-a861-58694542ee71", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633687938, "uuid": "80c48e39-b7a6-4e35-841d-dde733c05ee1", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5498b47b-283b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633699582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699582, "uuid": "8cc48b3b-2ef8-4b45-9dd4-ab7ee9ca1f0e", "comment": "Malware payload (Formbook)", "value": "7f0a0bc19a6da99c8ab7f8f77a1a6a59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699582, "uuid": "9753cef8-4e2e-4314-88e5-0fd84a22ac85", "comment": "Malware payload (Formbook)", "value": "f840ca48e6381b385534156b8245c39dee4d1c95e18569c91b5537ff2f20aa7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699582, "uuid": "2763eede-6cc2-4634-b80c-a08eb8642964", "comment": "Malware payload (Formbook)", "value": "0d961900905b134eca222792806e63bd7a43cfa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633699582, "uuid": "7e0d16cf-8b83-46b1-a338-0c1cd7087feb", "comment": "Malware payload (Formbook)", "value": "fc583a3fbdc84abaea79e09f6df973e6c1c3b34ae217469d719cac5cbc8bd452b47c0005638ed42a7685e77a9c078dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699582, "uuid": "4e6761e6-e637-4a92-add4-8e0144d95d72", "value": "T144441202DBD2D037D062973021A71FB4F7BF8A1C3263660B8BAC4EB7E9B55C305295A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699582, "uuid": "e839a369-d466-441c-8858-b50920492645", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699582, "uuid": "82823801-472e-4461-a380-1f0136e7de75", "value": "6144:F8LxBsRJ0tejXT7jiZLGWeCNPZb9Y5mjHZmYxb5zDp:/R5njiZjeCze5mj5mYzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633699582, "uuid": "9b876fb4-a623-429e-9982-dca172f0d5f8", "value": 260317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633699582, "uuid": "0b8f9114-e175-4594-bf71-ad24cae925bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633699582, "uuid": "3dbc37ce-5eb9-4dbe-9e63-11bcb35981f5", "value": "yutrre123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c1c987-280c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633679561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679561, "uuid": "5c019640-f313-4e21-ba36-dfe4e14f8398", "comment": "Malware payload (AgentTesla)", "value": "727732c3b80cf89ff4936a2a69419413", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679561, "uuid": "530e447f-5dde-484b-b951-f99e953dcbde", "comment": "Malware payload (AgentTesla)", "value": "f9980bf2f061ba96a00800d8b9854d181f4e2f2741d04163391a0bb564829e17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679561, "uuid": "c6c310c5-71ee-4170-ada7-8e0e311368b9", "comment": "Malware payload (AgentTesla)", "value": "5faa70df8b811e0fde9daa5fd74dc9b34731aa8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633679561, "uuid": "5590460b-6a3e-46ac-bad9-c326620305b4", "comment": "Malware payload (AgentTesla)", "value": "8453a4d575464242f5d9d7b44f1bdc7fa32061f8c9011407bae7853ef560797a8d549d9083f79ddd63897947b445a20d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679561, "uuid": "5fac9630-0694-4252-9a45-b7654f3575ee", "value": "T10EA42317AAD277276F1D88BC6B45913DA57BE8FB87C8181245A0E07B93471CA20F273D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679561, "uuid": "f6885d6a-352c-4a1a-ba5a-76cf5084c971", "value": "12288:gezSa2v6iDFJ7abJRTkJ1yIxOpRkB9yhF8g3BgfPZz:gaOzDFgbLTk27pWB9yhvBgfP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633679561, "uuid": "d35d9133-765a-4b17-aa3d-124f4b28e599", "value": 454116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633679561, "uuid": "28d357d0-fd66-4644-9cbe-405460b1a554", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633679561, "uuid": "33b4d373-b231-428b-8de3-f9fc465332af", "value": "COMMERCIAL INVOICE SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64b8cea-2839-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633698887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698887, "uuid": "cdb77d8a-e963-4a1c-beca-f9072835dfcd", "comment": "Malware payload", "value": "ad6f636a681eebfda7351bd3403e56a1", "object_relation": "md5", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698887, "uuid": "9cecf00d-0cf5-485a-b720-8a0e8176035c", "comment": "Malware payload", "value": "f9e5579f1a4cf63f24594bcbf643be28323f75a113e40ee1b07e3b29339a50b9", "object_relation": "sha256", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698887, "uuid": "486bd176-65b1-4898-b3a0-59782a141489", "comment": "Malware payload", "value": "7abf30a2ab538781f60828694ee5c31d39447a16", "object_relation": "sha1", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633698887, "uuid": "b8fdc234-928d-42a3-b3f7-d58acefb51c0", "comment": "Malware payload", "value": "94a263cdd224135ffbba824e60360c5b0e79e114bc8dbdc0a04a02799acc7901519238de3b57426e5625da3b4f2b9a62", "object_relation": "sha3-384", "Tag": [ { "name": "202.95.18.219", "colour": "#86CC66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698887, "uuid": "ea85bf16-d84c-490c-88ad-49389565b8c5", "value": "T169D39E17B5D2C076D4820430087597725A3EF8220779CB9BBF94A76D1E706E1BE3E3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698887, "uuid": "95b99200-b33c-4a9c-ae55-510b35eeaf9d", "value": "3cc9a0c18d64fca8633b87d002097dbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698887, "uuid": "0475c58e-956c-425f-b4c0-d72495758ab0", "value": "1536:W9oF0dK+J1KuxqCHQLbMAPgO12AZ0kR+jOfH06Ntc2fT8TC6Iv2cyKt0Ml487SUz:Ww+J1JQD8QNQjIH0XfGp5yKSc4vUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633698887, "uuid": "d4e8dfb4-285a-484e-9eb3-fcd66aa8c709", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633698887, "uuid": "f4c5083d-a0cc-427a-b92a-229a5782ecfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633698887, "uuid": "594eb976-98bb-42e2-ae9f-970d7912cb7c", "value": "edg1978.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048d4d09-2815-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633683127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683127, "uuid": "314e458e-6038-46d2-891b-e48b5955e207", "comment": "Malware payload (Gozi)", "value": "740463ed3266f7aee8331978f50c731c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683127, "uuid": "b5dd9d93-f90a-4859-9048-73ac48e315f4", "comment": "Malware payload (Gozi)", "value": "fa9e12a03b909482d5bacd2d7ab1a8d672528bfcf43402c04b6d3a30702b0c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683127, "uuid": "e16710fa-4dab-489f-8d0f-43ecda821b92", "comment": "Malware payload (Gozi)", "value": "a9310948476693d72be937f23e1b53b3607bf92f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633683127, "uuid": "8878c4c4-4eec-437d-a203-4c868c681cfd", "comment": "Malware payload (Gozi)", "value": "554b985e80c4c3d10a5ce49c3068ed650823785cdef9602b7a5e35cdf32d13a4486b55b89a39beeb2d524638d0c98569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683127, "uuid": "7667a288-96dc-4f52-9cc4-3ea091c67004", "value": "T1C3E3D3D2B98D8936C402E07E2F3FD497AB1D7C3305516983B24E7B86D7B11EA28B5316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683127, "uuid": "75307d2a-1e70-477f-9bdb-1e8d6369d5e9", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683127, "uuid": "841b6c30-a9dc-4d81-b41b-71979f5acf22", "value": "3072:tPM2YNAkMB0fkeX4QKDmBnmY4tmT9tzh/jrVB:tPM2YNAkMBykeX4wrLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633683127, "uuid": "619f3cee-67e0-4bd9-ada0-0bbdddd65c4c", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633683127, "uuid": "aeae60c2-6c20-48ac-b795-d28cae292069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633683127, "uuid": "135f3116-2e31-4a57-9aa7-eedb30919c50", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b42d67-283c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633700061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700061, "uuid": "5afb4d64-51ab-498f-8a45-70d6e65ba03b", "comment": "Malware payload", "value": "c58ce5ce41820b1ebb0e68a47319615b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700061, "uuid": "48608f9e-022f-4982-92c0-417afa565ae7", "comment": "Malware payload", "value": "facc90f0250d4111ffae1cdff697c436a76281538630f582d775108e45d0da89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700061, "uuid": "19a6ef59-bc41-4274-a344-48a7de9eac21", "comment": "Malware payload", "value": "8882f436fb8cdc760728c9b2db30cef28562d413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633700061, "uuid": "442bc3a0-0ee5-42d5-bd78-fcec2acbc123", "comment": "Malware payload", "value": "f2ed56b7895ef66d6c59ad2f35dd8d311e73dba0d737cbabbece19e33f5b541aa310d8f2b9f6c86705afc15305b80965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700061, "uuid": "33da027d-ac66-4d11-8a8d-02a899d030b7", "value": "T19B663343B28B0078F8892F39D6709609DDF3BEA6A6F535483DB0DA1F507C79248367A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700061, "uuid": "322d6c88-2130-4fa2-afde-a42ebba90107", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700061, "uuid": "689508c0-9e56-4f37-b39f-c216492cccae", "value": "98304:xZ/NtE624sr9Ttp/AYUfFF12X4sljrdvBSDSIg/UZJqtoJSzmDcGUEJCJlqLxjf:x5NtN2brfdUfFFcvU686+JVHJIqLxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633700061, "uuid": "177755f5-faa5-4f43-a0dd-66fd977bfbf8", "value": 6995912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633700061, "uuid": "9154208f-0a9e-4506-b4d6-e2415abc3e6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633700061, "uuid": "12cbf309-5dfb-4d5a-ad5b-15e72259224d", "value": "facc90f0250d4111ffae1cdff697c436a76281538630f582d775108e45d0da89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb80440-2808-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633677853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677853, "uuid": "fb0af9bb-e104-40b8-94fb-887f6f822355", "comment": "Malware payload (RedLineStealer)", "value": "a77ee6db00615190335f07a90d53d574", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677853, "uuid": "b64b2aee-1c85-46fb-acc4-a5e06cd1bb63", "comment": "Malware payload (RedLineStealer)", "value": "fad4ad4447529624bc9a6ebc612b2b582bafd3efa6a3f7e603fb3ecb3273d1f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677853, "uuid": "0e63d53a-3be7-4c14-8522-b4e6cc98ee63", "comment": "Malware payload (RedLineStealer)", "value": "0b28417abfb4c43360d95ecb8bd454e711bb8f8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677853, "uuid": "e3dd03ed-be2f-4231-b942-44b87e875bf0", "comment": "Malware payload (RedLineStealer)", "value": "0c31d1abcc9e74fadb6e07d4770722e3677113f7582e4618810fcaee1650ae6aed8e28ce22e4b000959e0d24bc823da1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677853, "uuid": "0bdc600b-6b3c-45f4-b1f5-71f84b4a9e33", "value": "T14284BF00B7A0C039F1B252F85A7A9379A93F7AA1773494CF12D516EE4679AE1EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677853, "uuid": "05849820-b00f-48e5-b09c-e3673688884b", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677853, "uuid": "71ce0da2-c82a-48f4-858b-fa6eb23a033e", "value": "6144:hbaUsNsG5S/vQcerxKgr2FY6sGUTSNSKr+nyLZMZiHzt7:dW152vJiBr2IGUTSAKr9LZMUx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677853, "uuid": "9034cb88-14b1-40b8-8dd2-f6ea7a465ecb", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677853, "uuid": "cf415ef3-e018-4c16-bc6c-bf618d7d35ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677853, "uuid": "d817d740-dc63-49cd-949e-92d028b254b4", "value": "a77ee6db00615190335f07a90d53d574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b65d35-2841-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633702215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702215, "uuid": "438c12e6-780b-419b-b4f0-7bcf62299f89", "comment": "Malware payload (Quakbot)", "value": "892e3dd9b3ea64ab60203a47a877ab74", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702215, "uuid": "8b52af0f-72f0-4154-abdd-8a030de83000", "comment": "Malware payload (Quakbot)", "value": "fbb74b940d6b2fe209916c4d724717bbc168d3827ae5f70ebbace76d9023b7f2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702215, "uuid": "5cf2203e-5f8d-4a77-a6eb-83176a86dc67", "comment": "Malware payload (Quakbot)", "value": "6bd92ecfccb7272f43a135ca2018166f898c20ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702215, "uuid": "63e227ab-890b-4470-a11a-5eddb7afebca", "comment": "Malware payload (Quakbot)", "value": "d0ffafd9948e68ec0fce34939eaa18b6a1115c2b6c15c86e6cba71adb89b85dc92377979afa76ee728bb014d5a42d738", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702215, "uuid": "6bbf75a9-9b33-425f-bcb0-508b615b5bb1", "value": "T145D38C467797C99BE58903398EE3D69B3B72FC20DE32430332457B0E5E7A6A18C16752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702215, "uuid": "8bcc12da-598f-4e99-bb15-b9c33368b1a0", "value": "3072:/k3hOdsylKlgxopeiBNhZFGzE+cL2kdAmc6YehWfGvtUHKGDbpmsiimati+RLHc:/k3hOdsylKlgxopeiBNhZF+E+W2kdAmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633702215, "uuid": "8cd8a09e-4f84-4ec2-b08a-a033719b84f2", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633702215, "uuid": "dd4c0aac-bda7-4aa6-9f85-d7ad95d723c2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702215, "uuid": "0a9553b9-71ff-4d58-9dfc-ba1b37c25a53", "value": "CMPLN_1893002073.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64be4913-2819-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633685007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685007, "uuid": "22d0d204-e683-4777-9a44-66c359ad9934", "comment": "Malware payload (Formbook)", "value": "477507eb2efd3e13f3689dc3d4eac75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685007, "uuid": "646afefb-56b3-42eb-8cae-adbfc98cc883", "comment": "Malware payload (Formbook)", "value": "fc012967b327039a1bf1ac88cf5b5226cd5534083759a0920018d19d94cc3453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685007, "uuid": "793daebe-5a9d-4044-b90c-dd94914b0792", "comment": "Malware payload (Formbook)", "value": "7a9053cc90945cb85e50ffc68acd84ca6c3ea787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633685007, "uuid": "bdc04de7-53a9-49cd-bc7f-2cc89b62fce0", "comment": "Malware payload (Formbook)", "value": "761764b756443a61f188ea60d6341a8d04d2b3973a058908e90805a6ba9e327318b54c1391db0aeac404d002d91c1105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685007, "uuid": "62f4b450-9e87-40d4-86a5-feeef7f4c5de", "value": "T125C44873D986D298C97583FCD22B738313245C61E8F9DA6E16723091177AF8168BF623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685007, "uuid": "c03a2503-7703-48f2-9655-96f0ce9120ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685007, "uuid": "99ca38d0-bc48-4409-adf6-cb1c01db8613", "value": "6144:qX54SGkCfHQmsqvFoouv6i6eFPS5DAPLMbPYTrdJ8kU0ocYnKhtUSOJI9x:i4S4fce6z7T+APL6Y4kTocYnKrUSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633685007, "uuid": "52aa4b87-7727-4ebf-b659-f49e8b7099da", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633685007, "uuid": "9d0ca697-6373-459a-9259-d6c31972e0ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633685007, "uuid": "e94a3468-1c99-4097-b103-01a8e61cd250", "value": "188428754-041540-sanlccjavap0003-2190_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbb575e-2808-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633677745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677745, "uuid": "8bd1bf30-f756-4443-abfb-8069c8e18a79", "comment": "Malware payload (Loki)", "value": "d6e8b2fcbf1470882b1004d3f576f74b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677745, "uuid": "2ea919d2-a50a-4091-8218-9beaec4cf5b0", "comment": "Malware payload (Loki)", "value": "fc208ecce25f9fa2e30d6a5b43bf563274fb5737368229ebc2334ecb2b024d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677745, "uuid": "0d0a63b2-770c-4e5b-9a6a-33e9a078003e", "comment": "Malware payload (Loki)", "value": "66c71428ac839dfba71b5b8466434952334b0792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633677745, "uuid": "c30510fc-9d57-40ff-b567-37c6f1e257fb", "comment": "Malware payload (Loki)", "value": "54e6002510dadd03c195c7d8a6058341f17596e0a2106ec6aedb52acc178aae3c47b955eab5446f9776a3ab4b7b98008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677745, "uuid": "ab58b1fa-0d0a-4461-9d88-9e6f93f77e9d", "value": "T16C15C4002295C711D1B637F4D864CAF097656C15EA29C28B2DF1BEEB79B1B03CE11A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677745, "uuid": "845d1405-ea67-4375-b11c-b973503acb12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677745, "uuid": "feadaadc-2249-41aa-b669-e4c1202e6e62", "value": "6144:XIn54qv0dyE3sRDPhiTaF9dCJL9mERt9RGTtKttotRtYDETAHm+7+0c+xWQ9p1fQ:X4v0dy/DyL9pD3n+0SUuEv0+EV4i88L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633677745, "uuid": "5d3cf56b-c036-4292-80fc-280ff977802f", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633677745, "uuid": "057bbdb4-9a0b-4ea3-8648-dbb2a9773672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633677745, "uuid": "268a6485-3d0d-435b-b8df-e871d12509d9", "value": "d6e8b2fcbf1470882b1004d3f576f74b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eae137-27f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633671102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671102, "uuid": "652cf1c5-fb1a-4c80-943f-6a61461e1761", "comment": "Malware payload (Gafgyt)", "value": "bc1fe5b16d4447376ed1b13f73588c5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671102, "uuid": "1b47d4e2-5fca-405e-b4a9-58ccf9bc03ac", "comment": "Malware payload (Gafgyt)", "value": "fce16360f4e15f5b9af16f9c0abb746fd5943c0f25898bc5a4693e485bc65da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671102, "uuid": "ba7a9eaa-80ef-4033-b172-fc5a21e2d49f", "comment": "Malware payload (Gafgyt)", "value": "45fab979b34d9c1558c27cee64d70538aeedf901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633671102, "uuid": "c142b17b-8d91-45a6-b3e8-287798b02a55", "comment": "Malware payload (Gafgyt)", "value": "1888b6a901d1c350a403b279d0e9468806b707202a11634888c203ce823a5bac97b5624460ee833f35f31e73bbea3fc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671102, "uuid": "7c597354-a525-4bad-829c-c35f50ce28d8", "value": "T1C0935A13A612C67AC0879AF01BDFAA215D23B4BD1F62730A73D4BCE62F069E51D59F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671102, "uuid": "b62904af-e505-4947-8db0-9b4b752a7c7d", "value": "1536:H7kDWfdXaxaECLn4bWjcgVKi0GahU3/YphaAVFtf3Ppg6I9umOwj5YOL0e:b5dayLn2vMKi0GgAgphaAVFpRg99umO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633671102, "uuid": "d9860c8c-d480-4366-84e5-849145eb04f6", "value": 93681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633671102, "uuid": "e240ddaf-9c65-4d81-8b5e-2986cc68034c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633671102, "uuid": "1f30b301-8e31-49f2-9040-f631628a65d7", "value": "Derbs.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27271c0f-2841-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633702083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702083, "uuid": "37a0240e-1f4c-4a79-8709-10ecb58a3297", "comment": "Malware payload (NanoCore)", "value": "0f129aa97048f7ec0557b211349a2ce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702083, "uuid": "65e40ad2-b7d2-47f5-9952-06aaeb362996", "comment": "Malware payload (NanoCore)", "value": "fcf3b27fdc54c53a1f7510abf8bdf748bd3199813d0294738feba29c7c1054d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702083, "uuid": "6f3f8096-2842-4515-8cb2-d2ab4bf547df", "comment": "Malware payload (NanoCore)", "value": "b597185c94fac60cd7e25db83bfb39ed07409289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633702083, "uuid": "2c7b311e-4e84-47b6-8baa-10b51bf4b44e", "comment": "Malware payload (NanoCore)", "value": "8fff1dfe166e6b2b16cff1cbc08d2a8bbc58c4d180d46b13eb3a9b2f2c101e17e4d2bdb9c29021bf87f6d97db3c95410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702083, "uuid": "0ac48a3a-3cff-4582-8f92-0baf2fbed096", "value": "T1524501607D082883D69F89F23C8E41E6DA51B934B355AC0F22D0BD2EC56B6F05E5E5EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702083, "uuid": "cdf545be-699c-4f7d-a156-fc94f3fe6495", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702083, "uuid": "a7731a74-27d8-4dbd-889c-f4509023ac9a", "value": "24576:Qi4th4HdHtaqrbvYfCxkRPaGynuJ4Bk0xdh1HVsx+aV3gyGw:P4tCvaqx0Ht+Bk0DNswq3g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633702083, "uuid": "d69ad7de-ae70-47d6-87d0-a2a696c7892a", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633702083, "uuid": "0e1dea6f-1aa4-40c9-9a14-e47a06152dee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633702083, "uuid": "21c54417-e04e-4a42-96e9-7c349e23b5d4", "value": "Peixoto - QUOTATION LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8055d8ae-282e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633694072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694072, "uuid": "69e1aab1-d5a3-4fc3-b582-668ab6efb6ec", "comment": "Malware payload (Smoke Loader)", "value": "aa0f192baacb70f697a4b0d26ba31025", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694072, "uuid": "c5083e89-08bf-4b6d-aa15-be71984f40a0", "comment": "Malware payload (Smoke Loader)", "value": "fd3eb2c332286230aec05ce76be22ca0f36b3c972b0173a8d34bb0037d057be5", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694072, "uuid": "5c65a416-aa60-4474-8bb6-49685c4464b3", "comment": "Malware payload (Smoke Loader)", "value": "97766e7409df8087f97c69f76f3f4dbc9161c8dc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633694072, "uuid": "1cfc0c5a-2d89-4044-b774-c6042940ba45", "comment": "Malware payload (Smoke Loader)", "value": "8ac850f538bafe2592826fab56c3a7c895248111eb39c6009d29383c96541073e79351ba4ccdabdd531d398966463b50", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694072, "uuid": "c11ea298-9c1a-4960-ab1c-c23fadac6104", "value": "T135149D1076E1C072F26EA9344EB087A14A77BC729D71968B3FB156FE1F792D18A25303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694072, "uuid": "87ff33e5-cfee-4012-b52e-d052b5fce7be", "value": "0dd592f35b48076810a8314d458b6b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694072, "uuid": "78e22f8b-d7b6-4189-989f-9d5c74d49df4", "value": "3072:l6SDOECYVtwNB8hj0H1SZVLg3brWnk6qr0ipW0ry0ZPwwEGDnkDTxZhgC:l6SwQwNB8g1eVc6W0iq0OTxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633694072, "uuid": "5ece345f-0a2c-4be8-af84-c456376b9409", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633694072, "uuid": "cc7ecb4a-db63-4a68-bad3-0a8587a6268d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633694072, "uuid": "12264c46-60d4-43b7-ba72-73b022c320c3", "value": "aa0f192baacb70f697a4b0d26ba31025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01a8ce2-282a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633692488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692488, "uuid": "b9e26f9f-fb2d-419f-b6af-9bcf75601c77", "comment": "Malware payload (GuLoader)", "value": "13d16a3f115f4ae9b80a33ae81b958c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692488, "uuid": "8ea1dd49-f3c6-4d1c-b4a2-73069d6979fc", "comment": "Malware payload (GuLoader)", "value": "fe47b3f25d7507d14d58e517404fe34405d8f96d39ee61bb3c0f7510738ddac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692488, "uuid": "7e891a79-32d2-49cc-bc43-de2776041ae8", "comment": "Malware payload (GuLoader)", "value": "b80ad1819b7710ebddf7a055f57d97f1c66726b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633692488, "uuid": "aa8aad3b-f394-42b7-a6f6-b549f55a4bd8", "comment": "Malware payload (GuLoader)", "value": "b8361ce15cb4c3a6ef8444937065031217388004aa2042e5ba3dc793f7618987cc5bf82b49bf0a61182cacf8efde641a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692488, "uuid": "0ae71fdf-39c7-49e7-a73f-426246068e31", "value": "T179C35C43A5999896E8F58D330875EA7C097DDCD17B3F465FA8643A0AD8373C038E462E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692488, "uuid": "adf120a0-5520-4e59-bd68-335842c81674", "value": "6d249e1568282ee606be9bb3b60f6715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692488, "uuid": "7d5f0218-a0f6-4c44-82f7-cbe403efe9b2", "value": "1536:tAJYxMJZkjqVVb6SmVkrQS1ld3xF8JEX6RSGdD:wVbNmViQeFsy6RSGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633692488, "uuid": "ce5b7a53-b410-4ede-bb62-ed802c915bbf", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633692488, "uuid": "c3d4c627-dc27-4ed0-8772-c27a1858f42a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633692488, "uuid": "19ad3f99-4163-4786-99e8-953519d15a5f", "value": "P. OFERTA 211008 Balearia Eurolineas Maritimas, S.A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358ec9f1-2826-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633690511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633690511, "uuid": "5731595c-88fd-4351-8cdd-a2949c7bb8fd", "comment": "Malware payload (Formbook)", "value": "fa3bd9cad3793c9cf8bdfac4159cb366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633690511, "uuid": "b13e155e-42e9-4b5f-8a50-03390aecf23e", "comment": "Malware payload (Formbook)", "value": "ff577215d4aaa29ae63860167282ceeb0a703daadfdaef2155102500c269caa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633690511, "uuid": "74d3b187-5d14-4746-b728-3bbb0510f2cc", "comment": "Malware payload (Formbook)", "value": "54edf2049e0e177e6be114ac567b9a7c413a3b61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633690511, "uuid": "c165f964-c8b4-49c3-8e5d-8f43b6a101f1", "comment": "Malware payload (Formbook)", "value": "9261534bc7cbdaebbb5a24bfaf792b64694ce997837ae24a2f7ded9dcfa20e67656895caaf4dc7ede2b8d382d7c49691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633690511, "uuid": "2df66dfc-5f1a-415d-8193-12c2459b2f31", "value": "T17D455BE6B1803C6FD33205796C375264686AFD74AD34A6DE33ED0D491F3AA113ADC24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633690511, "uuid": "3ad3505d-cb34-4a6b-94d1-5d7ec1d453d6", "value": "c7742f6c154c117ccc5799912fd8bda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633690511, "uuid": "207a7740-5ae5-4d58-98ee-2ed357ec891a", "value": "12288:ya88qKSZvx8Lj1uE/FW/OolPkFZkmy08EsuIyOonA6Pqsn4YPqyBO/JPcjSTdP3D:yaNEiX1uC7oDA9xXAHmPTY/Jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633690511, "uuid": "ca022d58-4006-4054-9a94-7ca5bfafe7b2", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633690511, "uuid": "064aca6e-485e-4992-9795-1829c10a368e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633690511, "uuid": "a5010753-d9c9-4889-b9d8-644d75b13e42", "value": "Order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }