{ "Event": { "published": true, "date": "2022-05-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-03", "timestamp": 1651622581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0951c591-19f2-4d6f-af83-6fcaa9e95faa", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179117e8-cacb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651573416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573416, "uuid": "f2c7a67c-f8cd-455e-bb7b-560ac5772391", "comment": "Malware payload (Quakbot)", "value": "78d466382d76fdb70e3a5531b0172cc9", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573416, "uuid": "fea5185e-9d20-44cf-be62-7db6e0a578bd", "comment": "Malware payload (Quakbot)", "value": "0150eb84d16f0330b2952c9c722fbf55e47d9697b27de9335de6113556e9b317", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573416, "uuid": "4b77ed48-9402-4f33-a50d-4d9c2e141e4a", "comment": "Malware payload (Quakbot)", "value": "c74cadefd9ad10442713869128b87f3b79a80e51", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573416, "uuid": "05c34b35-2d44-4810-98d7-949d7448f0a9", "comment": "Malware payload (Quakbot)", "value": "748265ff91a06d901f8d360967b58523a4ac65f0c1484f0653c426af2efd6560cc7e45aa6c0ade5a0ae8665c2c4cc41c", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573416, "uuid": "1317d5d9-70ea-4355-bcd9-ba69ad601fdc", "value": "T15A35E07AA21C942DF99D28BA506C79071E2C74B207051AC3F3D01EEAA5F16D2FD36E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573416, "uuid": "0011a5d4-0855-4478-b0e6-3ff4dc863638", "value": "c23efb5e323de7e921fc3019d6a2877b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573416, "uuid": "25a2e954-9f2f-42aa-9c6f-97d1245f1ff0", "value": "24576:CR9bz4kqgG32pXNqzeFMn43EsAn6qmekDixGaCDQ+bpnG:CR9bk1n4UX6qmekWCDQ+bpnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651573416, "uuid": "457ac6c7-8d20-4174-96bb-1268450f9bf9", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651573416, "uuid": "287e04e3-52df-4597-9d86-539e3bc6ef0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573416, "uuid": "e140dc10-31a5-45a1-a657-517904088cdf", "value": "5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0187752-cb35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651619279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619279, "uuid": "eb12a835-ecb3-43c9-94ab-8242ba4c95e5", "comment": "Malware payload (Mirai)", "value": "dd5d09c00365efbae37b25ffc9d845a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619279, "uuid": "4c903d5d-033f-466b-8cda-a7bc7f036266", "comment": "Malware payload (Mirai)", "value": "019764cc3df57708918ba1d7f6ca28894c82ed357538728b5f58182aa9d12b0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619279, "uuid": "3b601ed2-0e02-4cdc-a87f-a64204155a73", "comment": "Malware payload (Mirai)", "value": "f9a5ddc6f417c8f41f9914de5744ea3d78673f46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619279, "uuid": "4e349829-d2f7-4ceb-b873-17ada3497564", "comment": "Malware payload (Mirai)", "value": "960c0ade8030e09c72672d32e58c03b605e463ca306859a336aa91e75740c484679ca40aa35b4ebf2bfab8b04b9b870d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651619279, "uuid": "2b7b027b-743a-4f8d-a0d6-2bfa0aaf5352", "value": "T11CB35BD1F8115F6DFC4AE5B9942A4E08B831538536A30B1BB6B6FCD7BC720547A0ED81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651619279, "uuid": "cc818b4a-8912-44a0-b05c-8e1938e9a206", "value": "1536:HDyEts1qLYwDE38Rmlal2l/bWj0rmPuk8MmCrvRmUW8ekFt96ZiLtIXDLc+:pYYl2l/bWjGm2k8M3rv9t4Z2tWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651619279, "uuid": "c2037df8-c7b4-40df-95d1-ce0858d41328", "value": 107588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651619279, "uuid": "4cdc2d5b-087a-400a-91c3-7e37c9404682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651619279, "uuid": "69bd476c-f745-4871-affe-5e40d4945b77", "value": "dd5d09c00365efbae37b25ffc9d845a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fc94d7-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651580923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580923, "uuid": "acee9638-f315-44e3-b67b-bf401f669568", "comment": "Malware payload (Loki)", "value": "16d6ee9774b82607cf1567c172fc2e5d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580923, "uuid": "22577891-afc8-4fc4-b743-d42054e8c9a6", "comment": "Malware payload (Loki)", "value": "022629d782bd705f223a6a056d4c3a00d456cf6589b3c09b94fd3fa2d136ed21", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580923, "uuid": "eebb8466-8f2b-43c4-a757-594298e32484", "comment": "Malware payload (Loki)", "value": "92332a6708820be84ff7b210b56f79d931fbc336", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580923, "uuid": "636b19e8-c34d-4738-ba7e-903482d3e21d", "comment": "Malware payload (Loki)", "value": "e115343e93285e6b9662f95b489b129969a15ac919213665cb6000906808a74aa1007ba268b54d6b9e8275c32d6db7e4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580923, "uuid": "6024429d-64e0-4553-9d88-1e87913b6018", "value": "T13A1402D83121F444D91B66BF30EBC5AEC4BB6E542928FAC642473D5E72B0AD38D12B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580923, "uuid": "f3be80c8-08c3-4b4e-81fa-284d73c3c8fe", "value": "3072:hHLs0BWKEeMC443xFrmHrusg281ocErGmqz9hpEaoBp9Fb7QNQlFazodbjLK:ZnEHn+xY1T0o1rA9jEaoLHMNu2oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580923, "uuid": "858d8b47-09dd-43c5-b302-f40a64ba9ed4", "value": 200360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580923, "uuid": "845b5420-5f9b-46cd-a74d-504f31e80c4d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580923, "uuid": "3a5198ca-5554-4a49-9e11-170c89be4f73", "value": "PI-USD90,731.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c430fe8-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622145, "uuid": "219dbc72-ce9c-4e51-b521-9c789d06c3be", "comment": "Malware payload (Mirai)", "value": "26b1c170816187faabaeec0f278f35d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622145, "uuid": "ff40da53-f4c4-4757-88e9-5af9eb091fa0", "comment": "Malware payload (Mirai)", "value": "02654c8c24b215bf9a3b89beb51fb2ea448e11c2b50f3c70b86ce69424a5969c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622145, "uuid": "eb522255-cecf-41ff-b6e6-d0554509a0ff", "comment": "Malware payload (Mirai)", "value": "c918fed4bca171ac02099bb20e8a9da8afc8b6a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622145, "uuid": "5b5eaaa6-8523-4114-9497-d6901c0f0671", "comment": "Malware payload (Mirai)", "value": "03d8db7648ca18c2505fe45ae3df48934964ed2cd1f2b65f155829a917c54be72bc2ebf36d2f3c8aa2f6d2923460aa18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622145, "uuid": "2b291ab4-d90c-4154-b105-667fc2e91310", "value": "T1E4B32B56BC918B11C6D622BAFA2E158D331663ECE3DFB1138D245F6437CA42B0E3B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622145, "uuid": "13aba156-834a-413f-9611-fa665f57e86d", "value": "3072:uXlLmZ9sM2nP8FNni1xnm+rsJpLlCuD0KCiaj:4LmZ9Z2Va+Yb0KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622145, "uuid": "4b8906aa-9a40-473d-b7ab-8c0b4c1847a7", "value": 114208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622145, "uuid": "170d09be-d20f-40ca-9900-c5578d021774", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622145, "uuid": "f073a160-1823-4b01-9fa4-4898ca1b5f55", "value": "26b1c170816187faabaeec0f278f35d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36393181-caf3-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651590647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590647, "uuid": "a1abe2c5-c367-4d97-a5ca-0ce691d1d068", "comment": "Malware payload (DCRat)", "value": "ccdc0259976d22ad37919268bc80eacb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590647, "uuid": "c4905a9b-0d1c-434b-a3f4-777b5c0451a2", "comment": "Malware payload (DCRat)", "value": "02c28c68145b32cda5aae8264ad4f28fbada2cea171922ae00a60ada922d6764", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590647, "uuid": "52384334-7246-4a4a-b5be-6b5e4e3cd674", "comment": "Malware payload (DCRat)", "value": "df9beac0b3b777e031a49e327cd3f5563345746e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590647, "uuid": "e0f1406d-af1f-46b1-ab09-59d6c652b9a8", "comment": "Malware payload (DCRat)", "value": "820ea07cc65f00f7e62cff43a46b5616aa91574f2edd44059d0b7f0a03e9d6e65ade8713bbd807ee4a319bbb685120d0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590647, "uuid": "7d26deea-6129-4c78-b8ae-151281da0d06", "value": "T106F486382EEA5029F177AF7D9AE07596DA6EB6A33707994D007103CA0713B42DDD063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590647, "uuid": "fdc7e285-7131-4970-8063-2a6c57c8b3d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590647, "uuid": "7ee11c23-2f14-4e4b-be71-a6d9685477eb", "value": "12288:00GMaFvkOv4/bZxnOmPVgprFMkA+vrxHsv7B2JG+S/kl1feJlb:00G7VkOAjLOmQTR9JGdceX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651590647, "uuid": "6e4c2b1c-a69b-4a3f-a6cc-e6662657c308", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651590647, "uuid": "cacc6593-b3b2-4250-955e-9b84005c1e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590647, "uuid": "09f0a608-4543-4fe1-85bf-33e38ea86fda", "value": "ccdc0259976d22ad37919268bc80eacb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4033e8d-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582671, "uuid": "02917dd5-ef77-4062-91d8-141ec7e92e5a", "comment": "Malware payload", "value": "578a300f7f2143813069863f41fb6201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582671, "uuid": "67ad109c-74d9-4bdb-a65c-ef0172bd7a95", "comment": "Malware payload", "value": "035aac526e8a9856d9a206d999dfacfdf7e375f06d12e8e8104a57fba16a0652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582671, "uuid": "04af920e-132c-40af-87b0-006ffc48deb4", "comment": "Malware payload", "value": "9e65ffbd5250a9d951d3c442f3abaf190e83f9ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582671, "uuid": "f8fcfb52-7d01-47fb-a6a3-ac6d8744848f", "comment": "Malware payload", "value": "2f00386b779d05d0c4c97d50d349be2c7e931effea2ad3647dd4ee4651a9f198c1aff62e804ea7d0995193710158e47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582671, "uuid": "b85eeb1e-f7ee-4402-8947-375ade154325", "value": "T1D2157B327A42813ED1B21139817C5B76D83DAD2017A280DBF3E4766A9F74DC17A3936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582671, "uuid": "601cd7af-55ed-446d-a08b-a6fc2d977759", "value": "3e8ffe7554b44936643968dfd9b4dc29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582671, "uuid": "cc89036f-8039-4a77-aa33-af2848adeab8", "value": "12288:PuqNexew+Qk87sAepygdbug3b42bEKjWzhFN/3Rh7kUgZ2yqOpfAqNfgPltx:Ptexe5Qr7sA43xbEKj+N/3RWZPdoPjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582671, "uuid": "f1cc837e-0d3d-4a80-ad8b-f65bb138e60a", "value": 889072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582671, "uuid": "0f9bd7b6-6201-4fb1-b388-35ab03b6a689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582671, "uuid": "50f4ad93-30ad-4ba3-b99d-b10e50d10287", "value": "SecuriteInfo.com.Adware.Softcnapp.124.25435.30908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0f023e-cb20-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651610202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "02002b49-f187-41a3-9d92-2461ee2c886c", "comment": "Malware payload (Heodo)", "value": "e6b1d89d3fda333ec61140fedb7330cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "3ca2a6db-7223-470f-bd6a-8c4d0eb31007", "comment": "Malware payload (Heodo)", "value": "04887e5f7cd8739dcb3856fb39fc55e73a64e56cf2a242df289fd515a5003a9c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "8567924c-2811-4663-b15f-316e8bf3183b", "comment": "Malware payload (Heodo)", "value": "eede677d33affe37105b039e48a3a3d48366dd26", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "db213f92-0f9c-4804-ac96-70d841ffdaed", "comment": "Malware payload (Heodo)", "value": "b8feb13523903760c621d6abf05800a937924b4ae45636c47aba4d9badb72d49928b391f8366c396d250868e45490002", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "6037a865-cfbf-4e45-b176-60d68a54a03d", "value": "T16DC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "d9675090-4273-4515-9728-76c91ab2dfce", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "fb0f8b85-2e5c-46e9-b362-0a4acd19c595", "value": "6144:JhZ02GdOOgPYPKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfMKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651610202, "uuid": "02bf383a-3588-4cc1-8d12-f31cc9b23c0b", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651610202, "uuid": "b1d36179-6b37-487f-b07d-48534e3b49be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "776be61b-4993-4cba-a22d-fe2b36e6d00d", "value": "emotet_exe_e4_04887e5f7cd8739dcb3856fb39fc55e73a64e56cf2a242df289fd515a5003a9c_2022-05-03__203634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4b87cf-cadd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651581160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581160, "uuid": "71cd0072-f96e-4399-8007-bc2cf1be063e", "comment": "Malware payload (Formbook)", "value": "5a835f602ce0e1eea9acc3f6b36819b5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581160, "uuid": "52d7801a-8af1-4b19-9313-3dc6ee189bd0", "comment": "Malware payload (Formbook)", "value": "05007c4012529b5d5376909fae3f9c4103f49b3cc5e4342bb1fc790ffeb49cfa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581160, "uuid": "7c87e8f4-916e-4294-a1e1-e1281b13270c", "comment": "Malware payload (Formbook)", "value": "319e3bca310f93fbe53ff095c26b53a531c45929", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581160, "uuid": "e05c017c-ce64-4b6f-8fcc-e04bff9e3714", "comment": "Malware payload (Formbook)", "value": "141fa08034395da9952d14e751992ff09b225afd74e6b23274040014a0e0df331e3edfee47c7955db88c155e2f259bd0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581160, "uuid": "3233a9cc-e202-4f88-a356-7a8669b4e18d", "value": "T17F24125162E1C063C5A24B715E39EF62BFBE662311645A4B23303F597C31B82EB4F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581160, "uuid": "3d56d744-fe3b-487d-96f8-4614994e9f46", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581160, "uuid": "f13874d0-935a-4ee9-a9dd-70b9f5a690d3", "value": "3072:l1NjcVVnLpPunbepXhtjuuh4MhgK1ds8y0nlvOvjPZlKXWc0ThcsXxJZJ7ni3pVy:HNeZmyXhpP45hMvOrPZ/csBJTToVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581160, "uuid": "65bc8080-dec3-459e-ba70-c9926801174c", "value": 218262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581160, "uuid": "ca4b96c7-3489-47db-98c0-ed05c6c469d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581160, "uuid": "8c6f5fd0-6d52-4de0-a92d-635f3fef0927", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5306c4-cb2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651614605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "7dd76a61-a78d-4d6c-aca4-81f11ba166c0", "comment": "Malware payload (Mirai)", "value": "02db7d0eb20b4fa7ef90bd9bdada4c74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "236702af-7d9f-4903-b4cc-b014bd5396da", "comment": "Malware payload (Mirai)", "value": "0526f6ff076791eef7352762b4f61d92f95de30e81d142132d60a83327b39b62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "861861cf-3b99-43c2-80b3-430cc3dd8753", "comment": "Malware payload (Mirai)", "value": "99291c928c8ae4ca232749ca832c5c41894e6fc2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "7bb2ff2b-233c-4b23-b38c-753b65549ef7", "comment": "Malware payload (Mirai)", "value": "4da8c6f8787eee609474cb47720e57221b3debe7313c93becf38f1935a7fe56a0aeb3405750ae5aa408250ffa9ac746d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614605, "uuid": "d9aac4ec-7c8d-4512-9aac-6f29a9e31acd", "value": "T14AE33B46FA808F13C0D6277ABADF425533239B64D3D773069928AFB43F8679A0E23515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614605, "uuid": "c95836d5-2ef6-48ca-a5e5-b9f96e367c58", "value": "3072:txFvjfWcaOU+ZKKGAcSMfkdQv7ExWxRoM/95lrBSl:tnqcaOU+ZKKvcSvk2WxqM/9frIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614605, "uuid": "e5b8d3a3-8bec-4390-b698-0dddd9d61d56", "value": 149265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614605, "uuid": "d7543128-8454-4497-b7b5-f6c1e16e2e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614605, "uuid": "032ab475-390c-4cdd-ad75-ff215173d697", "value": "Cronarm7-20220503-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a48ab6-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585434, "uuid": "464575c8-da4f-4c98-9b65-c900e481ce8c", "comment": "Malware payload (YellowCockatoo)", "value": "3d5a2c222bb9bde14c5388eef40cd802", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585434, "uuid": "f2794496-a671-4ff0-8abc-46a71454ec95", "comment": "Malware payload (YellowCockatoo)", "value": "060433d3d02d3c50e9ebbd9b4149ca7f5b82428b09506fee6eaa97f38fa11380", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585434, "uuid": "7c33fd42-25c3-405a-baa4-631c02b290f3", "comment": "Malware payload (YellowCockatoo)", "value": "e78af42603057709711558876474d89f54760f4b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585434, "uuid": "18230786-b139-4bbc-a56d-049c2241afcd", "comment": "Malware payload (YellowCockatoo)", "value": "932661e0fbc484cb4e905a419b92b8ec9ae5b9b04f9dc8779e58a34d8e9c735f8ed651caf90a973882766a1dbf3b8bd5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585434, "uuid": "95aceb43-60e3-46b5-add7-15d887fb7adf", "value": "T17B048F11338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585434, "uuid": "ce79e230-4503-4991-9620-0ba360b1e656", "value": "ba252bf4253d929e8de91184cd3b8419", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585434, "uuid": "1e5d4e8a-fc8c-4fc6-8156-b99f24aaa4f0", "value": "3072:BNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D26:7O9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585434, "uuid": "02016229-b39a-40d0-88f2-60ef200df5d0", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585434, "uuid": "0ef67933-f006-4c93-8bea-aef5cdfb7797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585434, "uuid": "b078eedc-26da-4755-83c7-e4e059222622", "value": "060433d3d02d3c50e9ebbd9b4149ca7f5b82428b09506fee6eaa97f38fa11380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939b929d-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651588656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588656, "uuid": "8dc142b5-8c3a-42f4-9938-d0346b0bc47f", "comment": "Malware payload (Formbook)", "value": "72fc5a55dbcb6db5566996b68d3ec378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588656, "uuid": "b240f83e-b048-485c-a731-c3168e668160", "comment": "Malware payload (Formbook)", "value": "07025c10612dd161baa9c67fa04da140aa590c95b10e0079be1fbabcfeafff42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588656, "uuid": "18db7098-156b-4ddc-808b-655dc7dec532", "comment": "Malware payload (Formbook)", "value": "fec17a511cc04f0fc47cd6e3f6084ee9678b91c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588656, "uuid": "857cb2d3-0619-47a9-8e6a-2860fbfa3f55", "comment": "Malware payload (Formbook)", "value": "2e79a46144ac0fd285c3ab6312f1a0e3828bfc0696030c39725762781165a311d89c52a3f317ee733104e6e10ab3138a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588656, "uuid": "6eeafa53-0896-46fa-8cc6-584a537fc5e7", "value": "T1C0C40254BBBD4F1BD9BB4BF40435A12013BA2E4B3022D35A8DC379DB0D6AF541A61B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588656, "uuid": "f2982fb6-0895-4ea5-b9b9-23be8302d972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588656, "uuid": "533fefbc-1c0f-4369-b00a-9c90d3001525", "value": "12288:NtLWJe0KIBEglUDyiU+tTcVf1O5zuodYHYflBO+Qg5cOq02A/D:rQpmgmDfEGO+0NO12e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588656, "uuid": "efd92ccd-20ba-4c0f-8001-5449fef6d087", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588656, "uuid": "595d0a3c-d7f3-4ba3-a33a-1dd095f87842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588656, "uuid": "d9c655f1-f821-4e43-8af7-6d9349c33ec1", "value": "Cotizaci\u00f3n de repuestos IS01OCT5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d1634d-ca95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651550405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550405, "uuid": "3b5ec00c-76ff-48ea-9aaf-c1c0036d75e8", "comment": "Malware payload (Mirai)", "value": "4cd0168f8e02090f42c3ceb44bc52dab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550405, "uuid": "10dc0ebb-8202-42a4-a058-800d7b1d73c8", "comment": "Malware payload (Mirai)", "value": "07da3b4efb59e85e73320eb45648205570e87561caca6c333d71fbe9bb355a47", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550405, "uuid": "522ed4fc-1ac1-4970-a0a6-95a8669693fe", "comment": "Malware payload (Mirai)", "value": "65b9c5248042029fcd2726c5409b5f5d4238720f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550405, "uuid": "46636ce8-7f08-4f34-8320-56123e665e50", "comment": "Malware payload (Mirai)", "value": "463085e5919918c4b9aa218ef4f025a28c60428b0d700920e61b143bb866b8f8d03dc1e401ae6f55ccd2fdc971507a02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550405, "uuid": "55695dba-8b48-43ba-aa5d-d9dc29051fe6", "value": "T1DDF33A46B6409A13C1D617B6FA9F02493323AB54D3DB73069D28AFF43F87B6E0E52605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550405, "uuid": "5ad2157d-5af8-4537-85d5-da28b8c1908c", "value": "3072:V8/91NSvPDo1PU/aiR612gFHoSRe5SKr3o1ISfFdM/91oi9bmT2w+BV:V+IrYcao612gFISsVMISfrM/91oi9bmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651550405, "uuid": "b4bce328-9f80-4460-8f13-815b205dcbea", "value": 168012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651550405, "uuid": "2aa43455-f347-41bb-ab8a-22197b67a7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550405, "uuid": "70e8c5fd-1af9-4f6b-9357-be5b78a33094", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40685e6b-caa3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651556305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556305, "uuid": "4c56c12f-227d-4f68-8a82-ac004085a0a5", "comment": "Malware payload", "value": "6653ee6b23b0202ed70fd463ea6db336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556305, "uuid": "a8e4b3be-7e40-41d1-8b62-a23b69d89719", "comment": "Malware payload", "value": "0999d520a8f47851f8380302a4fab818efb8da7464647805e56ea283c39ac9cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556305, "uuid": "32092dc2-8e2c-4341-a794-9f0227d2e89d", "comment": "Malware payload", "value": "90330452e013a861f4e0e8db2309f73c5d2b7a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556305, "uuid": "8fca5ad1-1d78-46d9-b1b6-fab8da1c8fe3", "comment": "Malware payload", "value": "19e56a741e5253ab26134dd35c52ff020b6329210103b36058841652a51778924dc1e3a735f3d5ba9237b9c8994232c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556305, "uuid": "07651b51-a637-442a-9e7a-9c9250dab05c", "value": "T1FE06D8A4EACF10F6EA035D7191AFB22F573216064738EDC7DA480E43E53BAE6153611E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556305, "uuid": "f40a66a3-2561-45f2-9bde-b08c30db3b1e", "value": "49152:qsf+rT1lMu38Uo3nqxbVwSm83vUpSRFjrwaL/D3jcnJnGm7LzuRtXAyoJcl4:DE1b8UT19vcSzjr5/YJ06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651556305, "uuid": "9407f16b-5fd8-4e18-8439-a85ddd4ecad6", "value": 3997696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651556305, "uuid": "72726adf-b617-4d92-a9de-161805d24136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556305, "uuid": "0ea0ddff-f6e3-49cc-8f6f-49da3c71b513", "value": "SecuriteInfo.com.MALWARE_Win_GoBrut.4686.19378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7299eb1-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582676, "uuid": "60716f1c-5556-44aa-9ec3-18ab37bb2d55", "comment": "Malware payload", "value": "74ca0eea9686d381ea0d2c4183427755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582676, "uuid": "f73f9c26-3e6f-49a2-a067-4e1b2cb8c1ae", "comment": "Malware payload", "value": "09d386b91667bd6a0bdff6f9183874571c457964a331f172e011145826de37ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582676, "uuid": "ff6bf6fa-cd9a-4b85-9ab4-cf67a2ec9bea", "comment": "Malware payload", "value": "33f8ceaf85f1192ca953153f7fa9b0250b864e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582676, "uuid": "248a688b-79b9-4845-87a8-90896a3cd17b", "comment": "Malware payload", "value": "a2405c0a55c1009f1ff56ebb5a9d93cf95620449b7a1ac6d6bed471ea75b96bab218cab554f3cb7b6db64c5033106ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582676, "uuid": "c1d365ef-8c59-4413-a2b3-9f563c80cbb3", "value": "T1B095AE227B81803AE9920172917C4BB6E83C9D31576540DBF3E47A695F70CD27A3E72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582676, "uuid": "76f040c5-cc97-474c-be3f-7b42ed0d17ab", "value": "078d82c951b01d50355a27dbf3bfdb3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582676, "uuid": "24fd05c0-b135-41d7-9215-13072a66f48f", "value": "24576:kkErAcYt5IaedTmk2/4f6PixMKFaji3AYPAJxG1OHLI49IEgimQUWMp5TCRU5iUT:bgAcliPqzajPO1k5ITsUWq5TLtIvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582676, "uuid": "88ed3dc8-903f-4a57-ae35-eea183a34566", "value": 1950448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582676, "uuid": "90e2215b-5826-4758-8da9-671f53eca556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582676, "uuid": "935c5fa6-5db1-44f9-b456-c2d1192f9fb1", "value": "SecuriteInfo.com.Adware.Softcnapp.124.8034.32281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd895232-cb2c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651615409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615409, "uuid": "54c01244-1502-44e8-ac7d-02235f9406d0", "comment": "Malware payload", "value": "67533b60d5b30963b08836b0d71f86f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615409, "uuid": "d4fc24ff-0eff-4a49-b87c-cf1153e110be", "comment": "Malware payload", "value": "0aaad6cf1dea97143b279da243e1e12989693d656b40fd010645ab50520499f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615409, "uuid": "248a3487-dcb7-402f-9260-7ee4cbbb6285", "comment": "Malware payload", "value": "af357989048daca1dcadf472088909bdaab098d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615409, "uuid": "5bff7589-039f-4e4a-8ec8-550bf0d3e460", "comment": "Malware payload", "value": "8f03198ae9e01e3d90ade38860a6c531159e85556531b6b82068f020ace0e62c6b47aa6728246bb340b62c5e8f02b8d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615409, "uuid": "5e648bdb-e820-4c43-baad-4117519a96ff", "value": "T145C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615409, "uuid": "d42a5335-ae61-4e8d-a4c1-5f6d238ef919", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615409, "uuid": "2f26ee24-e215-469e-bc9a-f52cec458627", "value": "12288:S54yM33d3q3Z7BogIreNmF+U/9JckIAGfUeb:SKh3831Bo2N6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651615409, "uuid": "07e635b5-0cc9-491d-a708-b4473fd5a98e", "value": 568040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651615409, "uuid": "404851a9-4949-404c-9782-229922e4f5d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615409, "uuid": "2f34498f-e5b4-4f80-b476-8a10a55c5a26", "value": "emotet_exe_e5_0aaad6cf1dea97143b279da243e1e12989693d656b40fd010645ab50520499f2_2022-05-03__220324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe46e40-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581879, "uuid": "7204eb7f-14f5-4055-80e3-a44f99656ea1", "comment": "Malware payload (Mirai)", "value": "59659d596b9cf8cee25560637e2d1c37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581879, "uuid": "32c042de-9b4b-4061-a399-0ccb285e5602", "comment": "Malware payload (Mirai)", "value": "0c1b24868b83551927794a6091c5edea43ba4c9981b91089b49129be7ce231e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581879, "uuid": "93a1fa7a-3484-493d-9d7a-b0ffe88bf96f", "comment": "Malware payload (Mirai)", "value": "1883524c84a5bbe9dbbe3c5c4b035c861a566ce4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581879, "uuid": "67c66b79-0b8a-4995-adb4-6af0b8c6ada6", "comment": "Malware payload (Mirai)", "value": "3cd6e2cf8a33d0aa4354a113c85762b63af72870c0e6ec1813b630e569aa00b96ec94c218c0cf324c5014003083511a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581879, "uuid": "b2c93af8-8b7a-4dad-a23d-b74eeb50d624", "value": "T14893A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581879, "uuid": "14758b57-d517-4174-817f-e2b6d89fd0dc", "value": "1536:a5DnSB+v5wjQm2Y17xk49d6xZLu8vJ4TGo8S:a5TSB+v5wjQm91GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581879, "uuid": "a16aa896-05e8-4f65-856b-52ff813c132d", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581879, "uuid": "efc241d6-0dac-4fb1-b247-7ec46459b0a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581879, "uuid": "ee0ddc39-b38a-414a-9f97-970e8fcfb199", "value": "59659d596b9cf8cee25560637e2d1c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fe316f-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622134, "uuid": "2a9ba9b8-bd68-405f-97b3-0df87c44ec63", "comment": "Malware payload (Mirai)", "value": "4f5fd58ea124250f536ad38e5b195e97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622134, "uuid": "024e8fce-2539-432a-9e87-47af154a70df", "comment": "Malware payload (Mirai)", "value": "0c5c468b9269973e66f474f495e680b063bf44db96caaa3900da779fdb67eb40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622134, "uuid": "f54dbe3f-b5f5-41db-9455-5c3edeeb7c0b", "comment": "Malware payload (Mirai)", "value": "b43c33bbf1692fee35d97c3d10967d57482b141d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622134, "uuid": "8051e27a-0bd3-4b7f-a579-775b0b89c448", "comment": "Malware payload (Mirai)", "value": "79df6fe4bd246351397b3ca190bb0132b9c08467cd3b1fafca311144a4308a9c4c9f5c46e58401d850364ef4076214ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622134, "uuid": "3e62237c-9163-4615-9943-3001977c993e", "value": "T122B35B31ADB62E67C0E1647E01F74721F1E327CA32F8C62A7DB10D0AEF596602517A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622134, "uuid": "9338daa2-b72a-4bee-a893-c71f331d5572", "value": "1536:b9hgE1c8xlZk3vpMVUpSYpGQNyomilNh1GTNqG9ePhYVuVWIYM0OGXCfiV0/Z:xzlepj5spTqpAMBumZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622134, "uuid": "a4983bfa-ebca-4a1a-8452-a08dfa2f6a76", "value": 109272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622134, "uuid": "f565ce09-8e3d-4d59-b811-b210fa1f1bd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622134, "uuid": "d3782434-8e21-423c-b6a8-76a2b550fa41", "value": "4f5fd58ea124250f536ad38e5b195e97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0801080-ca7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651539420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539420, "uuid": "f9d73c81-27fc-4a4f-951f-44050203bae1", "comment": "Malware payload (Heodo)", "value": "9cba9726ec13ea9c4b70c925675c0f46", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539420, "uuid": "0c5595bb-1d3c-48b7-b9a1-7f86e6596d8c", "comment": "Malware payload (Heodo)", "value": "0d574288199aefc82e204ec710c6a4faacd8063b70b0108dcaab4cc9ab766290", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539420, "uuid": "3293b381-3a9d-4563-93c5-387ae27e98e3", "comment": "Malware payload (Heodo)", "value": "8d882163a5e624878b1ba87020d6f93fecb29ff2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539420, "uuid": "4772f26b-f447-4001-8977-c44ffdfbf34c", "comment": "Malware payload (Heodo)", "value": "2ecd2ea757395813dc053676502478430980ba695a61887cd4b738320e37e470bed5bd0049bd8e60c3e92fb1010b157c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539420, "uuid": "32bc5763-2491-4a56-a112-0f6927b7b4f9", "value": "T15DC49E5766994CBADE26833945D7D3322336FDD023135F6B6A60E63A0F37E906F84242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539420, "uuid": "a0fe3a0b-8617-4a41-a1fc-858f7b79b0b6", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539420, "uuid": "b6163475-c8ac-4e7f-84fd-8b523533dccb", "value": "6144:JhZ02GdOOgPY988Tw4cLuCYWV34OzJmNoogcKcF2sD18e2k6SV4s68dTcEgDAIpp:JhFfi88Tw4c6CAOFVLc3ZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651539420, "uuid": "01f9e0a7-723d-4f44-bcb3-39e50eca8800", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651539420, "uuid": "e3263db9-d95c-47b7-a747-6d7ea93c4008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539420, "uuid": "9175bd8b-b12d-4eb4-b181-e61bd63e88f5", "value": "emotet_exe_e4_5cfbd0907ba88ad1c56058f5d3344c9bdae6fcba9216d08cc54199767634e365_2022-05-03__005655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd5a79d-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651563602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563602, "uuid": "8cae4692-eb61-4da4-96cc-45f414d5d5e7", "comment": "Malware payload (GoBrut)", "value": "cc3a8e5a41d205b8cd0b2b68b4e376d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563602, "uuid": "b823bf34-0bf1-470f-96ae-b7d3d3c39b69", "comment": "Malware payload (GoBrut)", "value": "0d8f0596d278ee601eff8afb6dd8b0c722a483bd70617e2d9ea0df293734463e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563602, "uuid": "19b87c48-be21-4cbe-a7a9-a2ec4e54ebb5", "comment": "Malware payload (GoBrut)", "value": "2b95049a8d671544ea6c50b4955ade94824cee19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563602, "uuid": "607d0181-c295-4159-893c-af34e9d223c8", "comment": "Malware payload (GoBrut)", "value": "11099eaabf44a1ec2732748efae66288c9eba9e1c8f314ebd72f8120c9b64660f302fad43bb789e514ffe930a4c154fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563602, "uuid": "27391e7e-7d90-4442-a855-47f0dc49645d", "value": "T19F864B1BF8A614D6C2FEE1708A965222BF7134A5C33137D76F9086951B66FE4B93E300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563602, "uuid": "14019115-8b5c-461e-9cc1-53c899688068", "value": "98304:8bQUVZFz/Mg7nht3QFL9eKyBL1y8eiUlOX:InFTMyn/3QyWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563602, "uuid": "818d62e9-3f0c-4085-8db1-440c9c1800ae", "value": 8607584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563602, "uuid": "9a28ddb2-0106-4b0f-9546-7aff8e43ff98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563602, "uuid": "57a05b21-6b60-4107-b704-0d3e2f166265", "value": "0d8f0596d278ee601eff8afb6dd8b0c722a483bd70617e2d9ea0df293734463e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c1a33f-cab6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651564521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564521, "uuid": "49868917-8319-4ffe-adf9-ede4b908f9a0", "comment": "Malware payload", "value": "49305965693a47cac8fe54d325d50d1f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564521, "uuid": "d728e093-7bba-453b-b687-2e273f22db4a", "comment": "Malware payload", "value": "0dc975df4f929ed0422fb5c9a9582d3d5e11ab176cc3176e269b2a456d48d571", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564521, "uuid": "deb5b214-87fc-4dfa-be66-d7c657501d86", "comment": "Malware payload", "value": "7b7fbbe3f02ead6e985cf4619948ce003b4eb3f3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564521, "uuid": "829da4f7-0d23-4621-b854-6a51516d6d47", "comment": "Malware payload", "value": "1b4d6aa9dd385c2548d6083c2b66faba819a214a30cc14836c07a104f908bd72f25f37b4d2067f91e9593191f7638983", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651564521, "uuid": "8a5d9e84-5ab8-4dbe-86b6-0e68561f4fe4", "value": "T1F595F112FBCAA82EECF3C335477A4A6A55429D668343E7838964717C0DBB5C08E46FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651564521, "uuid": "5371bc2b-98f1-46ca-a2ca-4dd3e2cfbb42", "value": "49152:L7u2h4TxtyrD/V9oVrI1w4fmswmfC00Sql2x6I:Pu4Rv4E1AvKC00NlRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651564521, "uuid": "10e12a6b-3420-4b6f-90b8-4779639e9d5d", "value": 1999323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651564521, "uuid": "fb84092a-0d8e-446b-adeb-271b8f65a57d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651564521, "uuid": "396450cc-d3a4-4b00-a0ae-7b920b5d0d1b", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5b564c-cadd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651581240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581240, "uuid": "e10c4b27-c8f9-4fdb-9066-d601fd17a130", "comment": "Malware payload (AgentTesla)", "value": "772a0c10eeac16aa8b9931acfd760147", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581240, "uuid": "8b2563c8-fd71-4c30-ad15-b3c4b69d61ee", "comment": "Malware payload (AgentTesla)", "value": "0dfa1d90325e215c37b154a36d36dd62a7f6f36899d890f483242d900c0654d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581240, "uuid": "23aa4357-86e6-463f-88b1-9f4cbe96e874", "comment": "Malware payload (AgentTesla)", "value": "bb6671241cad0b1f5d7ac71a4644970cd2e287af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581240, "uuid": "441d0473-385b-40a7-a253-8d2eeb5f3a94", "comment": "Malware payload (AgentTesla)", "value": "7edcbbe5242323995333b4b7ac90e34a224550f077f1a733d06c21ea2629a76e5f499ac48d92f7c49c4653db9ef146a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581240, "uuid": "43e75e0b-1b72-4352-9fd0-1da542489fdf", "value": "T1ED741250EB00D4B2DC820372693B8A570BB3FD25B2B1559F23A5721D3F3BA53856A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581240, "uuid": "5844accc-c202-4f8e-977c-51d8ec5f7b49", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581240, "uuid": "493dbcc6-6405-4895-b178-8ca07efab5ef", "value": "6144:HNeZlQluXV6lG0wT6tKZjDeJCRckqyIk5iC8J0LprmTWhWHxXSQnskU1YW2NzcPT:HNduXSK2tMHDRckqyt5j8JwprrWHNSAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581240, "uuid": "d5d276c8-e86a-4c55-8497-25e38de068ca", "value": 340796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581240, "uuid": "5eeee82f-40d4-4c22-b5d0-8202b92c91ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581240, "uuid": "c1ad99b3-8bd3-4e17-a899-2a65666cf057", "value": "772a0c10eeac16aa8b9931acfd760147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befe28e6-ca87-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651544491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544491, "uuid": "0174249d-998f-4834-9185-2308092445f3", "comment": "Malware payload (Gafgyt)", "value": "e91c6001097566cc47c5fa8f6d477b9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544491, "uuid": "fc5ff889-6d34-4127-8418-a39af21ede42", "comment": "Malware payload (Gafgyt)", "value": "0e3a1f9c0cd88432832c86ec468d9ebf5ca102bcd28c9c937ffa04cd1a1ded5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544491, "uuid": "7f4f8c51-6f32-4395-902f-9c21c495a7bf", "comment": "Malware payload (Gafgyt)", "value": "b96b784b90844168d6c5943857c5d161a3531248", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544491, "uuid": "27cc0d9a-6d79-4add-9c3a-e3da0fb60bfa", "comment": "Malware payload (Gafgyt)", "value": "22d25c15c59733328c23d7ca06ce44f25381ab25662db3ca72bce4a89c8eab4da3a3d08067d68e5c446676091ae61f7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544491, "uuid": "fa2849cb-5e51-485e-9217-6d83fa6ff12e", "value": "T19AB31892F904DFA6F40AE63604D74B247630FFE20F932666721739A69E362D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544491, "uuid": "55aab046-5f19-436b-a6ca-4f50f9e9a043", "value": "3072:Mvi5osJXVl03YA8tyoeLkzmm/lpbOLCn/TNO:MKTJXVl0YyoYkzmm/lpbOLCn/TNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651544491, "uuid": "55958997-e879-41de-b0d8-4f55755dca2d", "value": 112236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651544491, "uuid": "e690d950-16b7-40e1-b96f-446caff9501d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544491, "uuid": "a247f3d4-35a2-4847-9b05-45240f658327", "value": "e91c6001097566cc47c5fa8f6d477b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e78ae1-caa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651557414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557414, "uuid": "02e954cd-81ae-49fb-8d4e-0fa7255b477d", "comment": "Malware payload (AgentTesla)", "value": "724a3ac5a2ba1347a0d7d330de6a6464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557414, "uuid": "c8b33017-d6fc-411c-9deb-29180447b5c1", "comment": "Malware payload (AgentTesla)", "value": "0eaab7f12ebdb826e2f379014bcf2275749f030da7f85d4ccc358f3c8251dc79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557414, "uuid": "8a91862a-3eb5-4292-8be2-7f209404a8f7", "comment": "Malware payload (AgentTesla)", "value": "04227d434cc389a493fbb9c207b02bcd65c24bf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557414, "uuid": "acc4384e-d520-4b23-a9d7-983d61b11d62", "comment": "Malware payload (AgentTesla)", "value": "0728229d6ab81e523477a3306db3544c2f6587512b52edcb908e031511061d981908ef74939d44e4140db6b74252abb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557414, "uuid": "9d895c2d-0f6f-41f7-976b-5c0129d35a7d", "value": "T19F9423BA7BCE71A34DE01E8CB85BCF8C6D5563954BB72463A9F321827386A64077C442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557414, "uuid": "8d6084f4-c36d-495b-afa4-b71fa1e939f5", "value": "12288:7ISnpyHWAxtYsnb5E35LI6MK3Kx3JcW8z/:7IUpyHWA/xbO3p0K3K5OW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651557414, "uuid": "511e5a5e-57fc-4950-9eb7-95afaffcc0ff", "value": 432147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651557414, "uuid": "8304f28e-e28f-41a4-871f-cb752504d601", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557414, "uuid": "4ea433e5-b978-4c5e-9ceb-b42efc14b8c7", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6039bd4e-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570961, "uuid": "5e176b91-4660-444c-92d2-d2cb31339103", "comment": "Malware payload (Mirai)", "value": "e3c77f1bb8cd9aaf19a4d5406dbcd386", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570961, "uuid": "242725fe-04eb-4a65-befd-39435e1b3c54", "comment": "Malware payload (Mirai)", "value": "1006c65ab4f126a3499fb248f96536234ffe0e46e880bd10dc9ff8172d708f1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570961, "uuid": "0d9eccda-1b4a-4604-86bb-6e035bb6b450", "comment": "Malware payload (Mirai)", "value": "27a3a4654cce201fc21b764f66df6650133114ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570961, "uuid": "c6d40e8b-8490-4836-b56c-a5f79220a6ab", "comment": "Malware payload (Mirai)", "value": "46e325fca09455b47c4a9451f1f68422dbef65d17ca3b8b5cd64a094ba20830d1a1eeaed325c160a52675ccdb4c8a12a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570961, "uuid": "ce98285a-13b7-478c-85cd-2f4a08253401", "value": "T1E00319A9F402AC3CF84FE679580A4E0EB93067C1D2835B2623B7FDB39C321956E12D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570961, "uuid": "06f9be0d-58e8-4eb2-a9d2-67cee6ede07e", "value": "384:ysOewWBIxzWjFZE5oUEH6hj98j9ea8EBAX4cnU1uOxItXl3wOTtSQYX8P2GV:dOepBnfvNkEs4cnUElAqtSD8P2GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570961, "uuid": "8d28098f-74c9-462b-a4ad-200d232aa7c4", "value": 38084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570961, "uuid": "916d671e-6b6a-44a7-bed8-e84ab7f61e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570961, "uuid": "807d4486-8eef-4cdc-b0ac-1728127e04bf", "value": "e3c77f1bb8cd9aaf19a4d5406dbcd386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28c1472-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581944, "uuid": "3f3bda0c-b314-4fa1-b4b2-f25368889f73", "comment": "Malware payload (Mirai)", "value": "a6d71391bb98a63ba516ebcea985d708", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581944, "uuid": "e9c8f62f-39e0-4194-9bde-bcdd19bc6fa1", "comment": "Malware payload (Mirai)", "value": "1063ef610fd51901424a00eb703365dd751d557c80e61d4ce1362eb3139228c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581944, "uuid": "808b2adf-1827-4ea9-9bfd-ba9e3d41dca4", "comment": "Malware payload (Mirai)", "value": "1e9cb75a2d906f320180cdcca0ebf40d046d6f6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581944, "uuid": "e8fa5a5e-b93d-4454-9fd4-20b109e171c6", "comment": "Malware payload (Mirai)", "value": "57e7e816f8cf4f269fd26a3e9e8cc20378acc63b5aa5b98d32268f75d3422ebc255b47984abc9d857c3cb32d57d0d527", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581944, "uuid": "3efa8173-190e-4192-97d4-5430e28fa517", "value": "T188634A01775C4E43D1A61EF8293F27E193EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581944, "uuid": "730b8c27-e0f9-4e15-9717-158ebbd9d7f4", "value": "1536:ZjVO2KsrO4zb5BdwlBpTaQnQSe1ECj5ds:CPsTHdwBNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581944, "uuid": "d119f2d1-9ede-45af-9875-f34f9a82e4cd", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581944, "uuid": "e06e8713-933f-4ffd-8dad-ffe6c3a1f0b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581944, "uuid": "2d376f63-c27c-4d08-9501-1a081a3b685e", "value": "a6d71391bb98a63ba516ebcea985d708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c18718-cb33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "759101c4-cbc6-43b7-9161-8f1873f07a7c", "comment": "Malware payload (Mirai)", "value": "0b074ba933efd70b06984fd326f7aea7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "5cd503c4-8e9a-4fb2-b6a1-9b0e6f9abd99", "comment": "Malware payload (Mirai)", "value": "10f1bb3c53a87c2e5c8513090ec365f909ac1eb1f1956c9be3c4bf9a4dbd8298", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "040267cc-975b-4ad3-bb06-e003d015f96a", "comment": "Malware payload (Mirai)", "value": "3a4b8e71015f2b28bce3e3c2d4fb27b247afd262", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "5c806aa2-5f4c-41f4-8496-dac00430ae98", "comment": "Malware payload (Mirai)", "value": "9ef52139f16a13deb642dc7d93e25205ba942f22333a830b3ea0b13dd32593e613c26e77ceff4f946004944c6a8d79a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618206, "uuid": "857eb894-3456-48dc-a659-810838d7e30b", "value": "T189E35C46FA418B13C4D5277AB6EF41453332AB90E3DB730699285FB43F86A5F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618206, "uuid": "970524d8-2a01-4e38-ac65-d6ca4f25fc16", "value": "3072:QnzrHCRq21EhTdniOwZL4OJkhm8cqWeeb4d/g72M/9L+vTnmow0IIJd:IzrH8lEhZE94gkhm8cZeZd/gyM/9wmoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618206, "uuid": "8c5bb512-8816-4dc7-a47e-681e82d3217f", "value": 147847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618206, "uuid": "a9cdaa37-99ec-45b6-9968-67bae0d0d54c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618206, "uuid": "1e7feae8-3c88-4326-97ee-ca0f3551971a", "value": "arm7-20220503-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ca10e4-cacc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651574185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574185, "uuid": "41f261a7-3e8e-4270-bcb8-ea74c93a2044", "comment": "Malware payload (AgentTesla)", "value": "94e9f4eb03c98d61a529796655d48867", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574185, "uuid": "f02dfc86-6bb2-4945-8b04-869ec6d10fd5", "comment": "Malware payload (AgentTesla)", "value": "1152a05dfa0de5b44d55a8024428d29e3156436bf18dc97a2f7377b0df558d3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574185, "uuid": "d37481e8-bdb0-4a01-bb42-3af524c6a7be", "comment": "Malware payload (AgentTesla)", "value": "80672c50dda655f6ab0d61ec67fd23636633fcc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574185, "uuid": "77aa25f8-62e0-4123-bb13-d95cd9097de6", "comment": "Malware payload (AgentTesla)", "value": "78c33cac1144d6b771dd26179f74e9be39eea00726af196d55125a678c09e467d2147ba313ac62d95b09b4ab1f64f11e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574185, "uuid": "0b822ee8-53c6-43c4-9ba3-5182d21e53be", "value": "T1B1A423D3B1CAD83859B5025864102E24A3E370D6FFE5873B5D50DBA831605AFCFEA762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574185, "uuid": "d008d0b5-2ec6-4e8c-b259-d380733e8297", "value": "6144:ncMFZk/hW7/aRoz/gDxKOQmfVCKSulOUcqXKKGryXODrsY5YLMcMJyc/IHZOcjWW:cMFsVREgDxKO1wQOU7jKkAV5tMEeBpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651574185, "uuid": "a08d61a6-d126-475f-b016-0137b643c033", "value": 465039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651574185, "uuid": "f3741c27-04d7-41cc-b255-b3924e7289ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574185, "uuid": "96ed7e78-96e1-4558-a345-5bd037baa409", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ac3562-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582665, "uuid": "2257972f-94e9-4675-93b3-815a30f6ec57", "comment": "Malware payload", "value": "842eac34883321590759ec8e7aa21462", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582665, "uuid": "db1ca81e-7ba8-4f0e-b70a-0315a6b9ff64", "comment": "Malware payload", "value": "12e8664174fd54eae410a7e966cebb3b175afdcb4f393775a7b04acc79cec377", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582665, "uuid": "7a25f956-561c-4ebd-b83b-45a3a1ae1f67", "comment": "Malware payload", "value": "752af4880a71c73a76135ed35025ab6b348185ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582665, "uuid": "dc875a1b-c330-4dfb-a96e-6f38cc3fdcd2", "comment": "Malware payload", "value": "d3548d59b6543d8d2299fd698f11c6b3a5e4ad5a6e41da1a00b8eea4e08ca25a9c3da89ff45878a5f539d1d089a81bcf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582665, "uuid": "8ce7673b-c5b6-4973-bdc9-88037d90a562", "value": "T102944A2136468B7ED16A273D403C5BB9D46D9DA01AF1C4EFF3B4BA6B8B30DC16938146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582665, "uuid": "918c4c33-cc05-4915-bc4c-bfd3417e9b9d", "value": "4ca25c3534f15aabf627093734dd3286", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582665, "uuid": "5b560bcc-feb8-41c3-ba8a-72295c2a8cdf", "value": "6144:3BrgDhVRmxeBpGTtqcaNAONcq0xOp7LAqNfvIIMUn:FIVIxejUVq9sOpfAqNfAIMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582665, "uuid": "de240a79-1f4c-495b-b6ff-e47204eba60d", "value": 422632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582665, "uuid": "986f5101-86d5-4081-94e4-9bb778b9db1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582665, "uuid": "00d5a0f3-ad22-49db-b965-d381dac716b5", "value": "SecuriteInfo.com.Adware.Softcnapp.124.32564.30449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad0cbfc-caa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651556349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556349, "uuid": "fdddfcea-1751-4508-862b-af3a06aa4fc7", "comment": "Malware payload (AgentTesla)", "value": "4b85281000aeffec66699a6784da7218", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556349, "uuid": "e7939d69-8447-48a6-90fe-dd2785259eec", "comment": "Malware payload (AgentTesla)", "value": "12eba5c4c798f1b224195812b4acba691105300fede477a0610852d63fe5a10f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556349, "uuid": "f495d0c7-5977-41be-a0cc-09d9611df008", "comment": "Malware payload (AgentTesla)", "value": "39c4e7897dc3c197e280af21361818f1ae6cf909", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556349, "uuid": "9f3307d8-985b-4d43-9f4a-026e4a6898c6", "comment": "Malware payload (AgentTesla)", "value": "9b4fa290487434f35f437465fc0f881f47a31337a243b079fbec6538bfffa0a82acd5a6f36af34c2d192f85f59cb36d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556349, "uuid": "8b9f9135-d49a-4233-ab0f-bb8cd9e7395c", "value": "T148A4339F959AF9FCB5F3103BDAE4B4815AA24E78DC5E432CB1DC19D09108B1AB04C567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556349, "uuid": "53a2c9fd-d962-4a77-ba68-b1496994fca6", "value": "12288:TZaha3on8GBJ3pbpscMElUm7n3SnsLM0azn2k2tdc:TZBQ8aJ3pb6EV3BM0a69tdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651556349, "uuid": "79d41f5f-7804-40fd-9be6-d31ce7a1b45e", "value": 456970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651556349, "uuid": "4c25fbe1-c749-4564-ba93-393c91d8d33e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556349, "uuid": "9dd89235-9938-4bb0-b691-fe6fe3d0550b", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8340d9e7-caf9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Pony)", "timestamp": 1651593353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593353, "uuid": "29fd7dc6-766e-47d9-82f0-926481cd49ee", "comment": "Malware payload (Pony)", "value": "4e8e6e2c2a35ba5ac2b93903584b473f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593353, "uuid": "f08843ca-90c6-477c-b989-e5342fc4308c", "comment": "Malware payload (Pony)", "value": "1358ae104519c839bd0061450f88c14cf807dfbea7e5125b92c476119eb05b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593353, "uuid": "ecd9d93f-5169-420b-b227-f4872a7e98a6", "comment": "Malware payload (Pony)", "value": "71ff3a7b9b9648cc5fe69d4f2f6c2f4ea10f6dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593353, "uuid": "2e5ded23-74e4-4bab-b688-3e60234e6f1c", "comment": "Malware payload (Pony)", "value": "b6bd3309aeb13d6d69d445b2f57cfb27c11a0c1f429561d2b635249aa9214d668016f9f27c2a3c6466363dcf2b6eac70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593353, "uuid": "f7420389-07e9-41ac-9695-e5ce23ae26a8", "value": "T1FDB40110B12BDBA9D27157F17631529023F26ABF7090E2187CD067CBB662F791E40EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593353, "uuid": "5c4642e7-4678-41d5-bc62-dfff0370e3ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593353, "uuid": "17f62e28-7b38-405a-9bff-fd286ac97056", "value": "12288:72L2Ij3h+k1Bqc/AifGE4Y+cIoguimQbiQs5U+:72p3Bm2leEneuiD45U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651593353, "uuid": "fad90848-c6d6-4a72-b94e-a18b57a1bd5f", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651593353, "uuid": "774da3e0-e91a-45de-a4e5-88051566148c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593353, "uuid": "fe94f3fe-20fe-4d80-b6b2-5814de908d2b", "value": "NewOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4557e4d7-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651563614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563614, "uuid": "09eb0645-4834-42db-8c83-fdf285242710", "comment": "Malware payload (GoBrut)", "value": "fff4acc0447c9f80c14a953d80b28e62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563614, "uuid": "a8c98ff3-3795-4716-94d4-d7f1cb336254", "comment": "Malware payload (GoBrut)", "value": "14a0ba74542b3a220f1db66555d08f8a4837e2805f3e87860abc7078b3b971e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563614, "uuid": "17b91939-e237-4bef-a848-4cfcae6d840e", "comment": "Malware payload (GoBrut)", "value": "c723bf882900abf83c6afa9a617c87df9e63f2f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563614, "uuid": "beb65a88-95c1-47df-9ca6-ed9d59072cb5", "comment": "Malware payload (GoBrut)", "value": "da1579faef34c5987d7cf2b7182e289587d2f09cf6db20554a7d1204868518541582ea5c4f995034e330b03113b78099", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563614, "uuid": "0eb409ec-acc5-4ac3-8ae7-28dd270bdecb", "value": "T145763A95EDCB10FAEA032D30919BA23F573112068764DFC7DB885F52E87B5E2593324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563614, "uuid": "1518e4d5-c20f-4639-be45-ba667568ab46", "value": "98304:q+XJlv4+RSU8djZrNZZq1656GUEZqTyXPdzaq/:bZlv7d8dRt56G7Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563614, "uuid": "3d7b6245-f344-4a2a-9956-5042564cef2e", "value": 7266085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563614, "uuid": "ffb86401-792f-485b-8ba4-c113e4f330db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563614, "uuid": "9fd52939-d869-4544-b41d-0a31174d1076", "value": "14a0ba74542b3a220f1db66555d08f8a4837e2805f3e87860abc7078b3b971e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5587a87-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1651581063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581063, "uuid": "67a5589d-babc-46f0-8482-652247ea6618", "comment": "Malware payload (ArkeiStealer)", "value": "db312ce23254138658ca9de7582b016d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581063, "uuid": "605071de-0c49-44e4-90cf-88f5712c02f0", "comment": "Malware payload (ArkeiStealer)", "value": "15581c22b60eae59d0e5e7c8a50f3d96d5d561dc417ef670098bb07226aca9b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581063, "uuid": "8c800cf9-c70e-4390-bb9c-0e7d861faade", "comment": "Malware payload (ArkeiStealer)", "value": "4ae5489ad04c83b42a6d906e13728b800cc82124", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581063, "uuid": "c28c069f-bd99-4a1c-a00f-9c8a2b67702a", "comment": "Malware payload (ArkeiStealer)", "value": "f0c1bbc3287a6979c71ca5313d49c479a52fdc5eaf79308217640e2f0a13a9567097400b1c6f44b893d49a0f9dadcd91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581063, "uuid": "bb4563df-112b-4886-96d1-759361a00c0d", "value": "T1E2A4BE04F4AA9231CE61007057A88AA65BECF9785F119A9FF7850BBF0F710A46D325FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581063, "uuid": "7db569c5-040d-46a1-82b2-9842624268ca", "value": "f11ba364dc70c327eb2f5bbaa7eba1d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581063, "uuid": "d89425a8-3599-4062-88c6-2349bb483e53", "value": "6144:7+2F/ZMFxynK20AHpNkAOgo7qrLA4RyzmLICKu1CuRVlVqP/5W7m4Fhkj/mXt1MN:7+QZM+it7qPAjvgCuRX5rkLIN3fsGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581063, "uuid": "123785c4-d806-4a1a-af1e-565a09c33665", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581063, "uuid": "fd7ad691-fb00-4efa-9fef-85c90077255c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581063, "uuid": "18cfd1cf-296e-4acd-a44f-9fc879cc2fed", "value": "db312ce23254138658ca9de7582b016d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909f8afe-caca-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651573190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573190, "uuid": "35497d2e-21a8-4f7a-8d3e-26a1ae501f93", "comment": "Malware payload (RedLineStealer)", "value": "97bb0661ab384cc22d4f32b12cbca6ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573190, "uuid": "313b8515-1c82-4903-9338-918ef685492f", "comment": "Malware payload (RedLineStealer)", "value": "15a59c4ac664d9378a28620fd635b1c70d8b62fd8e8933e1128718b31e67345d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573190, "uuid": "05b7325a-872a-4d8f-a3a2-81aaf0f40c74", "comment": "Malware payload (RedLineStealer)", "value": "8f2ed80c3bf7ad3f9b6fab58fcdbf4273b5b0cb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573190, "uuid": "79fe72ac-dc52-4b35-9ae8-2d506b1bc9b7", "comment": "Malware payload (RedLineStealer)", "value": "4c72a82576e57d52ba46cd70287a107be43113a5b8e9a03af1c40c12a0666b3adf11b4e3478884d8f082654530749c3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573190, "uuid": "b071d947-3042-491a-9817-dc96704a4f67", "value": "T1B484CF10B7D0D435F1B717F14AB993A8793ABEE16B2495CB22D42AEE5A346D0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573190, "uuid": "e03b5e01-0d9b-4cf2-b40c-f9e85d91bfe9", "value": "a143483d4d0f129b0ed032a728de83df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573190, "uuid": "3887e563-bbf8-4a8d-b007-bc6e8f5a0f6d", "value": "12288:9up6Ipk1J+WEauX6M1rA+zybYnVi73yc6Je:9+6I4JQXFAqiYnU2cEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651573190, "uuid": "639ea834-c716-40f7-b649-3428febe5f5a", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651573190, "uuid": "89cd8c91-7464-4672-a1d8-971b4c8cd076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573190, "uuid": "32b21ce2-074e-446e-8acb-9633ba127282", "value": "97bb0661ab384cc22d4f32b12cbca6ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886ad87a-cb34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618702, "uuid": "ffb6cd5a-3999-4cd6-9935-bb634dc1c241", "comment": "Malware payload (Mirai)", "value": "1d89974638ccacd114ad29b1c3438b50", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618702, "uuid": "f6abc32c-ce18-47d1-8eb2-d0681f663326", "comment": "Malware payload (Mirai)", "value": "179109e04ba1c89de37bb85c8246b0eb48d3eac41afa97e7aaa99f8fb9d61e3a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618702, "uuid": "5a8a361c-b535-4ef7-b615-7a9e4853f09c", "comment": "Malware payload (Mirai)", "value": "567a1c1714714de155b13a3c51223a06dc26ffc9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618702, "uuid": "86db0f4e-a5e0-4d20-a42d-c4669627bfa0", "comment": "Malware payload (Mirai)", "value": "ae00e15332083f5d443365c0c73bdfaa97b25b6b88728c6c14d90f8d8498b740bf77f823742c95cb1718beb6829ba375", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618702, "uuid": "4db7274c-1842-4fa2-8faa-d73786200289", "value": "T1ABA33B02B6C249FDC05AD53426AF7D36DC25F9AD033AB1A727C0FE163C5DE211A2BA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618702, "uuid": "b337622f-d520-4960-ab44-837df46bdb3d", "value": "1536:2LkxLY6Y2OrKHTGKoh+TRVROSl51oQnGvGO1pGq0fRDUyqXDLW68:2LQLY6y+HBoh+b0i2rpuDUyqW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618702, "uuid": "3ea9aad5-9933-4bed-8e5b-83c6f7fb63c4", "value": 102864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618702, "uuid": "70673a87-ab42-404e-81c7-f5b3688661e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618702, "uuid": "41c424e5-77ac-4151-8478-96a8aac8fc02", "value": "1d89974638ccacd114ad29b1c3438b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852c0d0b-cb2e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651616120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651616120, "uuid": "22a51423-17f1-49af-9e0f-0eb5da2a5659", "comment": "Malware payload", "value": "9760ff3c50bc85eebfc271cc27bbe4e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651616120, "uuid": "63ea1e6c-f164-47c3-9214-cff8855afb5d", "comment": "Malware payload", "value": "17be47c7ba7aa87ca1932cffc468be2615f963bfc8133f86efbf25aea04ab8fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651616120, "uuid": "7a492396-3d45-4d39-8e5f-d3a3bfcc558a", "comment": "Malware payload", "value": "dc6673315f5206d4c92f62b9b63c9fa44c6b6489", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651616120, "uuid": "a38f0d88-5711-4932-a810-5eb5b2b2847f", "comment": "Malware payload", "value": "f67d0dcedd3d8e03a01e101236290e801c377ff79b862f79a2c3440eaf466a87ef6036eca1dbbf3983f138425643c630", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651616120, "uuid": "466495de-1a47-45ca-b0ab-1b09e748c4a1", "value": "T125342BA75BC3C067E51B06B9C7595008B157C632778AA6EF37C5A71FC9383A2B7380A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651616120, "uuid": "5792df3f-9935-4432-b05f-020683aa2456", "value": "6144:wGOAWAyzLzHKwJrCf9dJJjI1rQlzLOu7H7pLYsDgiZ+/TccZr4+:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651616120, "uuid": "e364dfec-5aa7-4863-acb3-4a1dd4aea4a8", "value": 233608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651616120, "uuid": "ac4025dc-7f91-4f53-a018-4f349e7da18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651616120, "uuid": "d99f43c8-4f33-458f-bf50-218d7ceb6c92", "value": "emotet_exe_e4_17be47c7ba7aa87ca1932cffc468be2615f963bfc8133f86efbf25aea04ab8fb_2022-05-03__221516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffc7d86-ca7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651541164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541164, "uuid": "3918c40c-bb88-4c00-b84b-0a6a1f94078a", "comment": "Malware payload (Gafgyt)", "value": "2de69a267ce595dd304858922c2a9501", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541164, "uuid": "a8eb6160-b205-4ac5-997a-2e07d40caf45", "comment": "Malware payload (Gafgyt)", "value": "187ba2db2f9d78c806a45591d8a7cfbc812d864bcc9d12f737e4089d6f6ee6c5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541164, "uuid": "df719a01-240e-41ec-adbe-10c3c3068be8", "comment": "Malware payload (Gafgyt)", "value": "dd607b2fafd2fa5da46b293e085ea8eead5d19c1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541164, "uuid": "2c178226-178b-438e-b9f7-6404ea7da0d0", "comment": "Malware payload (Gafgyt)", "value": "7d6be13d85bb8ac42acc8dd52d5ca0a94214487af3aad5f27cb5541be73b8c7ca4aeeece28a78cc08de7d7de7eb8bbde", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541164, "uuid": "bcad6056-900d-405f-b87f-6ce94260ac38", "value": "T16413E117022FE1B8C83974F30A7503C8E492B819C555C6FF1D98377ACDA552C7E7AAA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541164, "uuid": "a3111ce0-9f8e-4a6b-b449-9585ceff718d", "value": "768:SoOeDv/hOx3oevMPFE6WCKu/XgCbhCgZROfxUJhnmsv9sPPr5tgZDIioEG:SSDkWaZu/w6hBROpUJhfFuxsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541164, "uuid": "51ffcb79-a171-4a8f-875f-76958b1f0575", "value": 44736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541164, "uuid": "4407b689-3caf-48e7-b6cc-6990d639735e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541164, "uuid": "ea0268d7-ab0a-4d57-a7ae-9271bdc92ef7", "value": "gummy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63543030-cae5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651584710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584710, "uuid": "02c4fdb2-54bc-4446-94de-085ed881a3b4", "comment": "Malware payload (Formbook)", "value": "8842068720dba48bb740f896c182b3e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584710, "uuid": "24acb88a-b139-4fd2-84eb-88bf466da4d4", "comment": "Malware payload (Formbook)", "value": "1a71a22a516a4181b4e5b954e802896bae168789bbefa6f359be7da386c2eef9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584710, "uuid": "cb1ffac6-888a-4640-b9df-5b5630700eb9", "comment": "Malware payload (Formbook)", "value": "83af1124b6e2fc54122055287689360d6e5e552f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584710, "uuid": "dc93d659-e9ea-4b3e-889d-15dd8a9ea76b", "comment": "Malware payload (Formbook)", "value": "e04a1b1dbf31aab9873d8a279c60b9f908d9ba29eaba4d438c56af61067c0e89bc0393429f5eeed74a3f26227288147a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584710, "uuid": "eefba94b-d596-45b1-97dd-28cf346f3a1b", "value": "T1E21412887650C0BBD6D50F721E349F3B27A9991224F45B4F13A02F9E3E324D1992E3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584710, "uuid": "aeab5c50-3732-4e1d-82a4-4cf9f5c89d87", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584710, "uuid": "c30a4de2-5150-4a67-b4cb-96d1bd021b66", "value": "6144:HNeZmBYxkeSb1w33qq0XjjfA4ZiAKfDqO:HNlwkdRwHqtZiOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651584710, "uuid": "83f39970-3d04-43f2-8e99-246f8cb9d753", "value": 197835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651584710, "uuid": "53470596-22f7-49e4-a576-85e1e215637f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584710, "uuid": "719d274c-0c6e-4505-9988-6580ddaee18a", "value": "8842068720dba48bb740f896c182b3e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a2899e-cac3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651570302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570302, "uuid": "6d88385f-dc31-4848-9650-632175a90ec8", "comment": "Malware payload (AgentTesla)", "value": "4bc894ea854da41b8d19d06172b8224b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570302, "uuid": "5a4ceaad-dfdf-4b3a-8b94-15a44623d97b", "comment": "Malware payload (AgentTesla)", "value": "1c27f4841c4012852e6bd2e8a9a75777e91e064f44648ec1f5025224d19e859d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570302, "uuid": "2525a3bb-4404-4fe8-978d-0ff1ce4aa5c4", "comment": "Malware payload (AgentTesla)", "value": "7b423802202e62644fe4487ed11ab437262e5207", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570302, "uuid": "a0bc16ba-e1c9-4831-9de6-4e8b04fac7bc", "comment": "Malware payload (AgentTesla)", "value": "9d74a526bde2fae130cb791681372d72c698f5ec9f0d06007ad9388d377a1b23f5b00cdffd426be68e6f15e93b25eb82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570302, "uuid": "f8ec8b31-b3b0-4403-9200-d468603294b8", "value": "T141A4236770869C34A9F9026424006D6553D330D6FDFB467B2911CDA935A02BFCFFABA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570302, "uuid": "187d1427-5633-450c-84d9-7611102c3275", "value": "6144:YcMFjsZhW7/aRox/SDNMOimfV4KSux8UcqJqKGryXKHrsK5YtMcMJy6/kken+56a:HMFAXVRkSDNMO7ui8UFDKkWd5xgRLeQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570302, "uuid": "6a96cd05-abfd-455a-ab01-f394591bed0e", "value": 465175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570302, "uuid": "7dd283ea-dd74-4ab1-a756-ba969653c0c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570302, "uuid": "3d9cf1d7-e3ff-4cad-af90-f1d2966e82e7", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f632cd-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651581059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581059, "uuid": "bc234afe-6d91-4fe1-ab36-e2e5b324abbf", "comment": "Malware payload (RemcosRAT)", "value": "f64e241f0ffb26418356b8e71874c2a5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581059, "uuid": "7ba0fa61-a381-43ab-be95-129286e1f32b", "comment": "Malware payload (RemcosRAT)", "value": "1ccf09551ed031fa0755e2d2c22e05f8136cce389c5b6585d3f3395041637389", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581059, "uuid": "b072a64b-1af7-42be-8466-afade8334df6", "comment": "Malware payload (RemcosRAT)", "value": "286970321a92150496b5d5b60b5a9305bce680fc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581059, "uuid": "4fd6e9e0-db7a-47f9-adee-6760e1292383", "comment": "Malware payload (RemcosRAT)", "value": "a6a4fb1a36de15c625a1eaba75bc8ede5f9fac5e713c17014a9a07210c94e4aa7a023f8cb04f1acf50225d120ffb8c57", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581059, "uuid": "e1da9537-98bb-4436-b237-a964e9dd45f1", "value": "T18451320D356FB46451323FB2DC6B089DD5324B82E67980D63E05FADADE3907CE68981E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581059, "uuid": "9e73342d-99e9-4d9e-a641-7db956467d43", "value": "48:hD6kQHkr/4uZ/MaAJr1rSz0fpoWWVfSFdcPoL0Bd1TlPb7zJ:XQHkLWJr1rSzI2JwXtLmRbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581059, "uuid": "a1421293-8032-40e6-8837-da8f01b56186", "value": 3112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581059, "uuid": "20c57f82-91ec-4e36-9c95-2a73f9cfae2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581059, "uuid": "29f2037a-b555-496d-87e1-3fc664406e9f", "value": "NEW ORDER 0522 202204280000883 pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bd9519-cac0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651568744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568744, "uuid": "b6ca050c-de77-4a38-af3b-090e7c078b2b", "comment": "Malware payload (Quakbot)", "value": "8b53f79c42f633bb71a1a0bd39bd1389", "object_relation": "md5", "Tag": [ { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568744, "uuid": "f6f10e8a-a98f-4d8f-ae26-72b2dff02418", "comment": "Malware payload (Quakbot)", "value": "1cf9f516d8e811d4fa40faffcfba73de8020f15272ee39164a158485dccb1e1a", "object_relation": "sha256", "Tag": [ { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568744, "uuid": "2688585f-115f-4108-ae7a-358b6f1f5842", "comment": "Malware payload (Quakbot)", "value": "fca6a22eef292f45f498587c4c55f983df4072dc", "object_relation": "sha1", "Tag": [ { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568744, "uuid": "1146d0b0-60b9-45c6-ab09-ad36c61a4488", "comment": "Malware payload (Quakbot)", "value": "9476b673256d4056ad16f3652352b97fbaf5ae35150fa4d3b42c943830baaf4c5590361034c083f42f80f4a20a76f94b", "object_relation": "sha3-384", "Tag": [ { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568744, "uuid": "fbdffc5a-2eed-47b8-880e-1ae3516cdd11", "value": "T14E45121380447432C4E5557831485E62392B789EE039BAE88FDB17FE3B591F9EE399C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568744, "uuid": "43c2069e-7012-460e-96aa-5dfc138aebcc", "value": "24576:YiG0mdDHrGZRjIo21FXm5Ob1mi0MriSo+fTA50MriSo+fTAw0MriSo+fTAA0MriE:YiGbbqRj2185ObMiS+f0S+ffS+fxS+fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651568744, "uuid": "dda19246-62ae-4468-93a1-286025b51ab8", "value": 1260266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651568744, "uuid": "e9238812-1fc3-4359-a8a6-748a0e05b159", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568744, "uuid": "fbf1c43c-fdfd-4e35-b716-5ba2ffb6f1dd", "value": "c_654027272.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf5bbe7-cada-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651579867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579867, "uuid": "fcf7403c-e7f5-4cae-9407-fd25f9cd6845", "comment": "Malware payload (AgentTesla)", "value": "d9a2da7a3faa83d26b671b9a8d33af71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579867, "uuid": "c2c3b591-e8f2-486d-ab63-c1d3f3fe5aca", "comment": "Malware payload (AgentTesla)", "value": "2015fd8944ff2b72d2e09dd0af7344283f1d9bfa4ca8a07e04e34aed7cd52421", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579867, "uuid": "11019d13-59d3-49bb-a975-37adb86aa791", "comment": "Malware payload (AgentTesla)", "value": "0d0fadcadc6cfce2572db1dcfad289fea712012a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579867, "uuid": "e367b689-b5bd-4293-ada2-73a9723cec8a", "comment": "Malware payload (AgentTesla)", "value": "336a251b7b35278aefaa54f11ee7d9c5e1a3f0d33ff70384f3435135b1e4e3e870bf86f2566c50e2590c7041baefa2f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579867, "uuid": "bad22f77-a127-4231-bbd3-7094bfa92075", "value": "T1D175F84E630A5547D948C6729DB32BA327A7CFBA5C534B16B286732ED87B3BC1540383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579867, "uuid": "1fd0782c-88c2-4a88-981c-ae128d33dabb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579867, "uuid": "5b17f26d-41f2-4dab-9707-040ac94e54c5", "value": "12288:JUDi2FwVXp0QX0QjA0v7znAV5FBk3WBMLDlpCZCAUwHrgtrgKDLw49gyyg7iXsps:KDD4p0QkyA0YV5FfmLDlqxoC4FY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651579867, "uuid": "2432cac5-e219-4bea-8d3d-9afab47dde28", "value": 1571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651579867, "uuid": "7780eaf5-2733-4810-a162-db102fa21dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579867, "uuid": "f7003599-3189-48b9-8f9d-63a9e620e55d", "value": "MT00788102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f579294-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651563658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563658, "uuid": "bd2bb10f-8026-4631-9384-31712c5bb193", "comment": "Malware payload (AgentTesla)", "value": "6978be5db793e8407b15f9dd67f8284c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563658, "uuid": "ecf0f821-8bab-43da-b017-4f3092f10ec7", "comment": "Malware payload (AgentTesla)", "value": "204af8ecdb5b7a543674f51e88e9eb792edea36e3684c2b359e1f381303a5ffd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563658, "uuid": "1948edf6-ec51-4cbc-bf06-5f47b4e47f89", "comment": "Malware payload (AgentTesla)", "value": "6224ecc471ee18e75de750abc79a7a268d68b9fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563658, "uuid": "a81a7abf-888c-4393-b8a3-225a4386ef54", "comment": "Malware payload (AgentTesla)", "value": "74c69df4b51c6dbcdb10bd5e7edaaad7d5d419c2d101d63ab1edb02308e1001d69a032484059a988db05f5e96c9f4aab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563658, "uuid": "e0e593ed-d8b8-4eac-971a-06734fbdb8fc", "value": "T1AF12BFB64316F8BAD02AF79782D954403D46A4D099B4D3898C8D5B3CCD343EE55C9A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563658, "uuid": "127e29b0-e710-47e6-b7cc-cc3598ad4ad7", "value": "192:N5gOU3LRy7Pd5ZVfuVfjvy56RIdgfZ8JBuuuV2jOSfBfpX:N5g931ybpVfcbv5KdUZ8JBuuuY1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563658, "uuid": "50c2cc5b-c0c4-439b-940c-fd79274d6cc5", "value": 9282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563658, "uuid": "a8b64a18-36bf-4e87-bb4c-60fff9413507", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563658, "uuid": "ea9eb290-296c-4a6b-8e01-1e1aaf94e90e", "value": "STATEMENT OF ACCOUNT (SOA).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023f9cfc-ca80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651541168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541168, "uuid": "9fc05c8d-e6c2-4e7a-ac50-c8541ee40b51", "comment": "Malware payload (Gafgyt)", "value": "0801e9aaa5e977fe9d66cf76190ca1bd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541168, "uuid": "06d6cc07-089d-4743-9b15-56f743b200a4", "comment": "Malware payload (Gafgyt)", "value": "21427c8db2c455ee57c43bf5dcfc8cc69b705f76c4df0609c919b7f0e9a0da45", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541168, "uuid": "fe49dbdc-6e11-47fc-9350-1cd38e39bf9c", "comment": "Malware payload (Gafgyt)", "value": "8e178314098eda785cd129c43ea17142d04040c6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541168, "uuid": "0d0e5c2d-0477-4bbc-bd2c-60b4754fd931", "comment": "Malware payload (Gafgyt)", "value": "0bf77aa9bb93abd4c1c9cb649fad466e592e946c5b6e37e1c0c18b79b243f3925b574fa9c17669edd5a2f023a84d59be", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541168, "uuid": "122d2cbe-2752-400c-be3c-4e462319e119", "value": "T1B713F1145406F893D8A11DF1A83F899B6605227C818B3ED9160CC2F7D9DB8E79FBEE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541168, "uuid": "3ff43dc3-93fe-4fe1-a274-0ca7361e30f0", "value": "768:HnAzXk9YbVc5PvO/jSjcP2ArA6tu17qdh0LfrVq3UNOij/a1:HcXkubVOEmlArA6w7s6X9je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541168, "uuid": "d2749d3f-0948-4286-9cf1-9f0124cc32a2", "value": 42196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541168, "uuid": "52f11d74-e86f-4f57-9754-b515049f22f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541168, "uuid": "def0f511-f054-4ee6-b4d9-021e45e19303", "value": "gummy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff0f5a8-cb33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "420f71cb-7f5f-4ec3-ab5f-2e9f31f9e0cb", "comment": "Malware payload (Mirai)", "value": "5d183475939025282630776a478661c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "d9becbde-a983-4593-83bc-992cb5687dc3", "comment": "Malware payload (Mirai)", "value": "21a042443387514dd4827d0afc812de272de0440aac19410597e52a0ca5b8b3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "a8d6a967-6504-44de-bc47-e898981f466d", "comment": "Malware payload (Mirai)", "value": "5d3e53fcbcb83d128e8ac4c54fc8dd43bfb1de10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "c8e7d0a7-8c51-49e1-9678-c24252fde4aa", "comment": "Malware payload (Mirai)", "value": "ce121ce552c56ddd8bdf37ff49d8e12307d4b47685d53139a156c0fa47e34578147d93bbb5ed4a5ec4f3122b9fd4a91c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618205, "uuid": "d0ac8dc3-632e-46f7-b6ac-fb062bd8565b", "value": "T1D0A35DD5B543E5F1D85600B13037EB32DB33E1B9121ADA83E3A89D36EC61A41DA0B79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618205, "uuid": "610e6398-22dc-40d7-874a-2394477ef882", "value": "3072:TSqZS78PR8caT3nMan16v5fYLHbyFKZuOj:eys8PR8caT3MaQW3vdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618205, "uuid": "9960466b-ad62-4a27-9abc-1e71e57e4c1a", "value": 105132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618205, "uuid": "bbe96a05-1732-4814-876a-1f0e47fc31f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618205, "uuid": "d945c568-aac4-4f71-8067-d10777576faa", "value": "x86-20220503-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab9f5e9-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581931, "uuid": "baf1232e-0748-47ee-9aae-a8caaf06aee5", "comment": "Malware payload (Mirai)", "value": "f185ab552c8080441692cc0a7078c8a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581931, "uuid": "392acaf2-5e2a-4688-b412-4a6a66f97080", "comment": "Malware payload (Mirai)", "value": "21de4aefcc75c515e609954f544c8781875217668bebcb318cdd07bd34115a19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581931, "uuid": "77873589-486e-4a50-aaf6-c44319b571a2", "comment": "Malware payload (Mirai)", "value": "1f7e9197d0f4e4c10b08b71caf53ca317e13e661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581931, "uuid": "cae7a2e3-918a-416b-8252-54afd74c2ff9", "comment": "Malware payload (Mirai)", "value": "d57ceb5aa5e1eb5f87f8d78ff1371b9d9ff9c7d21ff2d96c5402eea86dd45e0488c6c4bcd338806f4a08373ddbaceb6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581931, "uuid": "9fcb0bb9-e12a-4841-a097-3e313117910a", "value": "T109539E63C4641DA4C1544AB0B9288FB61763E60087633FF5426ACBA99057EFCF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581931, "uuid": "2f242173-b523-455b-815b-eb2423b8660f", "value": "1536:oagv1AOp/umClcqseVyYGsYh4VSijKmR7GrxhCKkdV8:ox11KmqseI4EiGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581931, "uuid": "32f9d59a-c9d7-4fea-9138-4d31985255f3", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581931, "uuid": "2f40ddbb-024c-42ac-9ca8-f3a1c1783a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581931, "uuid": "8ccb161b-7ae6-43aa-8395-bfdea4f64e48", "value": "f185ab552c8080441692cc0a7078c8a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fca094-cacc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651574192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574192, "uuid": "02c4d494-0101-4bd3-9c99-6c3e47b345b9", "comment": "Malware payload (AgentTesla)", "value": "f612e3c4eb366aaf472bffdc184087f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574192, "uuid": "8a9d2e25-d09a-4338-92fc-b3dfc363a526", "comment": "Malware payload (AgentTesla)", "value": "223d744d086489699f3089b8e40753285653dbb2b565ccb32a2eadbb9c204909", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574192, "uuid": "4f35f4c0-95c3-4d87-8491-bd2872649216", "comment": "Malware payload (AgentTesla)", "value": "10eebc97ea5330d18615a176ffec914f6a155217", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574192, "uuid": "68909929-403b-457b-a90e-99ae01d5d795", "comment": "Malware payload (AgentTesla)", "value": "3a35f3a8af5dfaaf984cf0ae9a9a9d0032abb8a168d574c6821f655b89fb55591231cde7e623a74c61f8907d16563349", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574192, "uuid": "e14fb8ea-c5c0-43f6-a0e4-af69d157c7aa", "value": "T17DA4236770869C34A9F902A424006D6553D330D6FDFB467B2911CDA935A02BFCFFA7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574192, "uuid": "cd2c302e-9056-4d43-9c13-4e73724c1053", "value": "6144:NcMFjsZhW7/aRox/SDNMOimfV4KSux8UcqJqKGryXKHrsK5YtMcMJy6/kken+56b:qMFAXVRkSDNMO7ui8UFDKkWd5xgRLeQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651574192, "uuid": "798cd442-c65f-4ca1-84af-5754696f7055", "value": 465201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651574192, "uuid": "7738fb25-fb2d-4f48-b701-21076d20a64a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574192, "uuid": "957ba05b-e01f-4132-b5dc-3dd1502bdcb3", "value": "Invoice 16-36-55.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11173f79-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585431, "uuid": "254e5b07-937e-4c21-9b79-0843aadbb7d8", "comment": "Malware payload (YellowCockatoo)", "value": "de58a6799238f05179b8f9cef6b5b6e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585431, "uuid": "09cc741e-077c-4b03-ba1b-0e64d5ee74d7", "comment": "Malware payload (YellowCockatoo)", "value": "22c397982a9a82bd023c25b5cab600ceba38835eda9ff98b14dc053e4bc72675", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585431, "uuid": "91e6e2ee-bad5-40b8-b4c9-a4b143eea5ce", "comment": "Malware payload (YellowCockatoo)", "value": "beb30c671c09cb60dcb6595dbe1709c95c4ff99a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585431, "uuid": "4f0d2572-9ea8-4555-823c-48a31cc002de", "comment": "Malware payload (YellowCockatoo)", "value": "019f75985a04c7335607bc0d7d90102128e10ec2c8ae78cc1c9389948f404c66d8f7d695527c82704eb08a42321bc70c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585431, "uuid": "f08ea3ce-0086-467b-adb9-17decd5a5907", "value": "T1B7048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585431, "uuid": "ed40d176-7ef2-44d9-a596-8aa87e2a8dd0", "value": "b4ce31a31b4e5ed7a215ddf797d3ccfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585431, "uuid": "a884de6a-e6a2-40cc-9efb-da25431f66fa", "value": "3072:yNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2V:uO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585431, "uuid": "787847f3-0f31-49d0-ac35-ff4770d9491b", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585431, "uuid": "c722d21e-35db-4d4a-a32e-58c239f8046f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585431, "uuid": "7cd6c43f-2369-42d3-840d-de3ccce86f70", "value": "22c397982a9a82bd023c25b5cab600ceba38835eda9ff98b14dc053e4bc72675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6005da5-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581950, "uuid": "ae63d01d-1a71-490e-a389-ee6611ef006a", "comment": "Malware payload (Mirai)", "value": "710132fa82de47ecde2d658bc45365c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581950, "uuid": "4b8d11d0-752a-49f1-890a-22b12459ffc7", "comment": "Malware payload (Mirai)", "value": "22d3d7506c5986c4272874e17a97201ac0ed961d78abbcc1c5c76557eb2a5c4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581950, "uuid": "8bf43b58-101c-4096-a90d-ee1fe4c20de2", "comment": "Malware payload (Mirai)", "value": "246ca8597326a238f62a18bb27f114aaf7ecee3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581950, "uuid": "8f25c128-9069-498b-b3e7-1516863abe6c", "comment": "Malware payload (Mirai)", "value": "433c952d841efedc8b61bb811698d4088ef4e3f7c438f165a36ccb5c8dfa7ce1734bbe60f9bed160aa0af08881407fac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581950, "uuid": "2201ba55-1ade-46d7-96b0-d955586b13c9", "value": "T137536CC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581950, "uuid": "566ce3da-dcef-4138-9bf3-66cd9b9f6860", "value": "1536:Z7qARubgzY/bEJy0Rcpv80LDHhklv4JQC9DSW:NP+eY/bEJ61XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581950, "uuid": "a8d06040-eb0a-4f90-b356-607f3d5ffca4", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581950, "uuid": "49430216-8147-4a6d-a202-7eadd39300ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581950, "uuid": "095fb0ee-53ad-43ca-985c-072899df0414", "value": "710132fa82de47ecde2d658bc45365c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812c99c0-ca99-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651552118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552118, "uuid": "28f1d4f4-9e02-4006-8724-9cec3b413405", "comment": "Malware payload", "value": "7de502ae68f4916cf1987520acdefb34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552118, "uuid": "3358528d-2737-4407-84b7-67919543d4a4", "comment": "Malware payload", "value": "230650c5308b1e537dd770a222145a3ed09f89baaa4a3ecf1624ac5c5982aae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552118, "uuid": "85b165cb-7647-42a1-9b5d-6fbb46f147f2", "comment": "Malware payload", "value": "6213ed26156951b17f3efd92ce05e65d7b6423b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552118, "uuid": "fb67a906-6e7f-4980-970e-a7b898990515", "comment": "Malware payload", "value": "340a7444a2be35282cb1a55430dfadeab465cd4a882224e3b63ca902cb535575a19ad32b48fb4ba416c8d2fc8c487820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552118, "uuid": "c5ea8946-6ca1-437f-ba55-f35090291786", "value": "T14AB4F00862C2926DC1A41674CEC1839D1AB67C427452D6C5B8E372FB9EBE7EFD30065E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552118, "uuid": "d9735d58-12f1-41e2-be45-24121c10d1ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552118, "uuid": "c6e2e27b-bb9e-4e58-9ca5-66fd4292fdaa", "value": "6144:PZN22YuO7sTBMILmQ5oTQzfy6vdrx+sg3RXs60PriI/C+vPOYJ/JubM8+C5rnt:PZU2L2I/oEfycdg3ZsJrM+eYhm+C5rnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651552118, "uuid": "d0473d0b-cac9-4c81-b1b8-cb1305b451f3", "value": 502320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651552118, "uuid": "602ae382-567b-46e3-88e6-0c5a66d3800b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552118, "uuid": "80f5e621-d602-457b-bff9-6072f203a1fa", "value": "SecuriteInfo.com.Variant.Strictor.270365.31953.14574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031b0f3b-caed-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651587984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587984, "uuid": "6b3436e9-bb32-4ec4-8d89-343f11340db7", "comment": "Malware payload (GuLoader)", "value": "4f6ff781df70cfbcafca48c5e0ae38ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587984, "uuid": "82d5304a-c5b6-48c8-b7d1-a1d898df8505", "comment": "Malware payload (GuLoader)", "value": "239812ca420466490174c43a5e2bb5040865a68bd66f820f6265bcbdcc7bd21d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587984, "uuid": "4bb9fe9a-0b51-4dff-9464-f0d1064dd72e", "comment": "Malware payload (GuLoader)", "value": "4e3e38fe47a17dd0a278d4fb385cc00ae6fbefe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587984, "uuid": "b3b622ef-2334-47e6-8f8d-e429d64cd9b6", "comment": "Malware payload (GuLoader)", "value": "c88cc35b0246e057ce9041c856587f542931208ec3c9b9f8eac40f70d22e3785746edfd25aa2ac495a38394ed0b0cfcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587984, "uuid": "486af7fc-5aef-4bab-9ab1-498177b4dc1d", "value": "T1CE452284B5909466F9863232E83F09621757EE2653D5874E32B4732D29E73224B3BF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587984, "uuid": "e3d05ca0-bb0b-4469-9aa3-5a63ee4b7f86", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587984, "uuid": "cff8c38b-af0a-4e15-bf01-dd0661f43448", "value": "24576:dYHYt/KfYSxnT0dyxoRy1xsL4Qtrm7TGbgPtnIZBGGNH0YpGYZCvyOb:yhfjJxfDsLLruTGbg9IZraYZWya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651587984, "uuid": "8b02f741-3d3d-48c8-a91e-fa0ed5a71cd0", "value": 1173776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651587984, "uuid": "dac75914-b626-4786-8596-88fdf995a94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587984, "uuid": "8f76c2ff-7c31-475e-b386-acb35dcf4f76", "value": "PO00007852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac97b239-caa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651558634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558634, "uuid": "df6f2dbb-6517-465b-8ce0-92352fc6d56b", "comment": "Malware payload (AgentTesla)", "value": "50a6f0ac1d89350fc39e136504eb0947", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558634, "uuid": "640d45a4-4a48-48e3-a335-9ceefe115c18", "comment": "Malware payload (AgentTesla)", "value": "249003f3a6049cbc1ee6d792349ae472d9d209762602effec5aef64ee99c2593", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558634, "uuid": "1ec988fa-f228-4377-98f8-cd89dac4ec2a", "comment": "Malware payload (AgentTesla)", "value": "26848e55a9e0732d817e22f030e27a222d9231de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558634, "uuid": "43d9a40c-af49-4948-866f-cf7427a0591d", "comment": "Malware payload (AgentTesla)", "value": "359f3eb55eab804f4aba66a81c7f28ebc259dfef058b217a7b30d5d8efb983756d7a0c6c95af9538a08304045565825b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558634, "uuid": "1b6483c5-56b9-4944-b771-254d8caabfa9", "value": "T13AA4339F9599F9FCB9F3103BDAE4B4815AA24E78DC5E432CB1DC19D09108B1AB04C56B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558634, "uuid": "c3ca6c41-aa0a-4c23-9cc6-b1ad4eca6ef5", "value": "12288:lZaha3on8GBJ3pbpscMElUm7n3SnsLM0azn2k2td+:lZBQ8aJ3pb6EV3BM0a69td+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651558634, "uuid": "583e8f49-d916-4aea-b3cd-1e079891f42b", "value": 456960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651558634, "uuid": "540cdd11-e86d-47c2-9176-5b5cc94714e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558634, "uuid": "08e348b4-af34-46b9-b61e-738611436b78", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cb1ebd-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585461, "uuid": "5d570b4a-f516-4311-947d-e2e4f41d0e3d", "comment": "Malware payload (YellowCockatoo)", "value": "fd0d9ef004b98f81cc52ac8105a15560", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585461, "uuid": "1ba0d232-b160-4497-9c54-310833540371", "comment": "Malware payload (YellowCockatoo)", "value": "252fd59bb897e0fa9430a7f28e2ef18ed876a619d7e30fad4551219044c99e9d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585461, "uuid": "8f7712ca-6233-4972-9177-eed60d2ddb3e", "comment": "Malware payload (YellowCockatoo)", "value": "4273f52026ff482dad810f957a9da260748478b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585461, "uuid": "522aa6a6-b491-457f-8abe-af500f76580b", "comment": "Malware payload (YellowCockatoo)", "value": "0c451abea32d25fba500e9d02caad193f289055540cddbf38454f5dca166bb0464f8d0a94e35fa4cf338b103db943868", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585461, "uuid": "56208130-1d6a-451f-a253-c946cf50091b", "value": "T1C4048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585461, "uuid": "b6dc6b7b-ebdc-4a98-8d0c-72ff30d8f2d8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585461, "uuid": "a7a247b9-e93e-4509-866d-030ad5637fc3", "value": "3072:4NrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2p:kO9wYxsks7Br7RdE3tTpkvJ+lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585461, "uuid": "c3b2b94e-bc43-4c16-b29f-103df11983bd", "value": 176896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585461, "uuid": "1f8a63c4-2586-488c-bfab-9bb708cce0a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585461, "uuid": "e2a4cf81-0430-4622-982a-37b6d23865af", "value": "252fd59bb897e0fa9430a7f28e2ef18ed876a619d7e30fad4551219044c99e9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada7ee51-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582687, "uuid": "329adfdc-d5d2-4464-b69e-5f6c8c857445", "comment": "Malware payload", "value": "22978993d2008d8b71967cbda442cb7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582687, "uuid": "a5d23a28-0a95-466f-bb4a-cbf31043438c", "comment": "Malware payload", "value": "25588223ba8b06c8279ca1d58f638106ba05cd82a12546cd07b227c917cfb3d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582687, "uuid": "7be0b906-880b-40ef-a2c0-5c61fb38aece", "comment": "Malware payload", "value": "091761e357ae4b4f9f8549630011d990582cb486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582687, "uuid": "d4149009-b76e-40ce-87cd-d29181721da9", "comment": "Malware payload", "value": "68bab233031cef6edc7ba84a1e8ea938e7eb50d416cdc4d9d42a51f14bba57078c61ad435c522656d12d2d385c1c11bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582687, "uuid": "fb4696a1-bde8-4683-b20d-14ff037a5e63", "value": "T143157B227A42863ED1B20236817C5B76D86DAD701BA580DFF3E4776A9F30CC16E39257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582687, "uuid": "89ed8df2-bace-438c-9bae-52a162536c91", "value": "f3f847208cde79f63a11ebf7fda42abd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582687, "uuid": "318c93cb-b205-414e-87ea-367d6f98b4a0", "value": "12288:c1ftmEFQmt3bOx9W92+Z/IZFP5/EIjoXXXq43ljm7DLHc4l0goyiQpOpfAqNfHxR:KtbFRnVHGoXq6Nm7PHc4lIQ8pmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582687, "uuid": "9c9179d3-d3b8-4612-9c78-b8c08d5ef29d", "value": 959208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582687, "uuid": "21661a7f-bd57-4892-adbf-3a3651fdd733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582687, "uuid": "34407a7f-f41d-443d-9d49-72c39a0905eb", "value": "SecuriteInfo.com.Adware.Softcnapp.124.2860.20659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bced2d8d-ca8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651547924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547924, "uuid": "620f04a6-0b85-4903-a74e-e840a4987a2a", "comment": "Malware payload (SnakeKeylogger)", "value": "4d798209b83c7459ac025ed6f865ca86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547924, "uuid": "0ac457c4-206b-4c1e-96aa-e574a7435356", "comment": "Malware payload (SnakeKeylogger)", "value": "279b911a8deff7f7887920f7580adfd320630808c39e481beb0d3c619242a718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547924, "uuid": "fc797808-1d54-4baa-90f5-47b4274e77e8", "comment": "Malware payload (SnakeKeylogger)", "value": "9444477b245dabd88a9908693995ec8a7f35aa60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547924, "uuid": "7281e60a-8572-47a9-96aa-3d28702a8514", "comment": "Malware payload (SnakeKeylogger)", "value": "10ad1e942e4d613d1fc1c2f13d099e7915bb78ad17081115d0380061d2e205ae96d0f9e2c72bb79d230cb423c975e485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651547924, "uuid": "55b744f6-3aed-410e-ba33-9aed0da61480", "value": "T19394ADE03686EAE3DE679B7723ED5F90126116725136F70B1F4023F40B43A2F2A65AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651547924, "uuid": "a5ae9fef-32b3-4b25-a548-def59e2d5b07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651547924, "uuid": "c7fbc08c-fc7c-44a0-becf-48f718baf53f", "value": "12288:ffSUoTbfPHXp8zM14Upmti3GBX5KGG7t:itbfPXp314amtZBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651547924, "uuid": "1efe84ef-c3aa-4565-b32f-af9dfef367fa", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651547924, "uuid": "2d4c99fd-b111-40e3-82b1-ee35f6b9bd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651547924, "uuid": "0b93f75f-c4ad-473e-9c42-33350e94fe8c", "value": "MT Marine Tiger 4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb6f40a-cb2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651614604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "73fa3dd5-4fb7-4389-8a51-c08f8f2f2b38", "comment": "Malware payload (Mirai)", "value": "efa2a4e43856474d21cca98bc0c560b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "79162f1b-6887-4749-bee2-5cca142dc13f", "comment": "Malware payload (Mirai)", "value": "27b43993a4fbb3c33b4c8a849e12ec2bf969608bb104378e72e6655f4acb0029", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "ad6cc4a2-b1f2-464d-a2c6-13216d3dc537", "comment": "Malware payload (Mirai)", "value": "0b3ce2a516aaf7f93e45b41c797272231522d308", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "17547353-542d-41d5-8722-3d628afc57cc", "comment": "Malware payload (Mirai)", "value": "975140f40af86c3cba822d223042abedcb06c9113502acd6403192c9bbcb7a7a078155d47a430acaf4fe907bcb9c8629", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614604, "uuid": "7a1455f6-c998-4554-b095-64f34a98737d", "value": "T197F32B46B6409A13C1D61776FA9F02493323AB54D3DB73069E18AFF43F87A6E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614604, "uuid": "b4f8a536-5375-4a3f-b5a4-a26313f5bef7", "value": "3072:g+4gTLiKkyed+SaMPuq1WxpwT3y4FPt1wSHY/SaPM/9HtgbmT2wJBV:gWzbSaMPuq1W7wTFTwSHYdM/9NgbmT22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614604, "uuid": "dafa53f2-ee8f-4708-913e-d0fbabbb5b73", "value": 168046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614604, "uuid": "3b4cdf35-a7f1-4fb8-85ad-cd173c07f07e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614604, "uuid": "ca9045e5-0a89-435f-aab8-81644fb02eeb", "value": "garm7-20220503-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893e3c40-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591216, "uuid": "6231b1b2-b908-4e56-a8de-079017b2b4df", "comment": "Malware payload (Mirai)", "value": "31fba762229f43bf4dcc0c8d15e4a53c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591216, "uuid": "731d358c-76f9-4a06-a298-658caf0e34d4", "comment": "Malware payload (Mirai)", "value": "283aae04ae802e277ad262ae32af47844f64ba9d7e3e2da83df327f0d6c333ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591216, "uuid": "007baef2-4e21-4113-9998-cd147df14dda", "comment": "Malware payload (Mirai)", "value": "ac8546d2267e57b7948a1cf30ad772193077a2b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591216, "uuid": "6f9eedc7-4c36-49ec-9614-23f0cb8c2b7e", "comment": "Malware payload (Mirai)", "value": "afc89eb749fbc545472f91e6b1fe1460b24ab022d12f1e94e91feed7da0ff4fee8dc9a08a1f904543dd3a3372de715b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591216, "uuid": "3285bff7-6396-46d7-b826-039d70c8f4be", "value": "T14A3308C4FA8B89F5D90749304067F13FCF31D9B941B1C6ADEF9A9E35CA67542920228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591216, "uuid": "97795c7a-84c5-4ec0-b7a1-d1d023c47691", "value": "1536:nfyMY0q0Yv5qP69kj0MGNLaj/90L7YkOUltP:fyMY6Yv5qP6moNLaz90fYBUl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591216, "uuid": "c9bee060-aab6-4fbb-8ae1-33ce808ab20e", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591216, "uuid": "b0749a90-90f3-4a16-b74c-22052fe20f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591216, "uuid": "dec700ca-755f-4c3b-9edb-c54a16f9ddeb", "value": "i686-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926f2a41-cb06-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651598962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598962, "uuid": "bfe07364-85a4-4877-8e02-8540b182ab7e", "comment": "Malware payload", "value": "78b7f0744bf3f8eeaf3817ed6c592fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598962, "uuid": "e1bed696-9b7a-4a4e-a8ae-755f56097174", "comment": "Malware payload", "value": "29478db896444dc2bed1ae2346fcb41e505152127be5d1798851964210c264a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598962, "uuid": "7de3b1d9-6242-4681-8513-49fb5768c1cd", "comment": "Malware payload", "value": "805aced41d496142c8cae29ffc867189074ff87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598962, "uuid": "178ad0de-6c61-4fd3-863c-b268dd06ff61", "comment": "Malware payload", "value": "6d0ac2fbff9ab645f613322d930bb56678640805d0e2d7cbc0d2cf31b1628e968258609fd46cd980cd101c573a3b05fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598962, "uuid": "64862e56-a32e-4df7-b6c2-dfbcc5820b73", "value": "T1D2236A439B6C2774C6864D39A921288887F3DD69660EFE9C5CC4B0038F7BBDAAD135D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598962, "uuid": "e89f6e34-2898-4ad2-8d8d-7dddd9f28e1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598962, "uuid": "be8a3a29-5813-4267-95b8-facb44753e60", "value": "768:dpHd/+2L6hJoHNzfgQy6Ju9VIls0zLKmp4Vs8mbtcZ:d3B6hJoHNzFXJGIlsgLKmp46vhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651598962, "uuid": "6fa2a0b8-e6c4-4b78-87e0-8ab2c16c5f3d", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651598962, "uuid": "4b15e977-0003-4ee9-9d2e-7a99a4747821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598962, "uuid": "cf19fdea-3fe8-4ea2-b9f4-af023bf2ccdd", "value": "Recibo de la transacci\u00f3n.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d54ab07-cabf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651568406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568406, "uuid": "c657bc8c-f1f8-4409-98e1-bc89c1349d26", "comment": "Malware payload (Mirai)", "value": "da2e3a62c85498b66d8b32dd6b0704bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568406, "uuid": "2b49a583-164d-4442-bad2-3ef879bc938f", "comment": "Malware payload (Mirai)", "value": "29ffe6b25e012e3c16246cd69846498e66e4102cdc47ea334cbc0c5fc2d6a01d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568406, "uuid": "2bad641f-a01e-4a0e-b608-0c8904a7bfe3", "comment": "Malware payload (Mirai)", "value": "09039a7246912d85ffe752b6294790ab1b11439c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568406, "uuid": "0bc21d69-89ec-48bf-88aa-1d2747a22ff4", "comment": "Malware payload (Mirai)", "value": "ba7ef9f6501e5c25f406623c2e60aff3df9a1973759d487fb32a2086b4a48756b8e4642d040b3820f6ea54b84516b9de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568406, "uuid": "28049880-78e3-4a10-8456-cccc2d57032b", "value": "T19FD2E066F0879786E2AA08B21CCE34090420E70F5C81F587AEF577360D93F60272DBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568406, "uuid": "da4cba22-1966-46a3-82b3-43179ad0b402", "value": "768:rd78ykw0/RCgm5dY+6GtVbZHFGH1OlhKMHxTnbcuyD7UryqU:57RLHY+5tVbKH16KMHVnouy8mqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651568406, "uuid": "2705428d-6ff9-4953-beef-6d8189020d8f", "value": 29616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651568406, "uuid": "b039ada2-548b-4765-891a-71673d009c63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568406, "uuid": "60d88273-44f8-4174-b968-a5c0bf3c15cf", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5299959e-caa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651558053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558053, "uuid": "99dc6731-5307-4c81-9d8c-f4b7042bc1c2", "comment": "Malware payload (AveMariaRAT)", "value": "40c03f14bc7b8f96d84f7fb3ffeae155", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558053, "uuid": "d5eeffb5-2738-4d80-bd4e-dc46ad6f805c", "comment": "Malware payload (AveMariaRAT)", "value": "2afb0a45a821e6892c80113fec8a6c334772d97d5a870c531b6e3b1129d9a15e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558053, "uuid": "de98a314-9904-4ad5-b2b3-a67bd9c260f3", "comment": "Malware payload (AveMariaRAT)", "value": "dd8475b9cef749d79ece14ea15f1921fca5ecf0b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558053, "uuid": "e78e1ec5-16bb-4b7e-ba74-50b3219eea5f", "comment": "Malware payload (AveMariaRAT)", "value": "4d8f0270f9d09e11eefa2809ed9b6eef620fa98a0961afcf5f30fcd1e7dc7c0554cab485473e990fe9032318b04c1ea1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558053, "uuid": "5266fc1e-00cf-4e90-9dcf-de86fb583fcd", "value": "T154854AD9B11479DECC67ECF389F45FE0BA106D7A530B4243912339A99B7D443EE180AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558053, "uuid": "0ab8facf-7da0-4413-967f-723f82beab1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558053, "uuid": "5ce505ec-510b-433c-83fb-9cd94f41a299", "value": "24576:1/LYRWn8vt+1MTO1bY0h+H9kAakuZpZrdnFc7IeXLcKcCDmg3O:JiLFT10sdhahrZr5wI8cKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651558053, "uuid": "d8396648-49bf-40f0-8cd0-188ab24f0cea", "value": 1704960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651558053, "uuid": "ada45c95-0904-458c-b2a1-7f026a364603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558053, "uuid": "64b23117-3048-4bf9-aa72-4b4466007d66", "value": "lol666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4291c7a6-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651563610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563610, "uuid": "b7f806c6-6279-440f-bb8f-94e267b6024f", "comment": "Malware payload (GoBrut)", "value": "7bced7b08ac4c4d65bfa04271cb8990d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563610, "uuid": "1b4294ba-551f-41d4-9e3a-f0811108c213", "comment": "Malware payload (GoBrut)", "value": "2b064090342c8c18043bef361e030a5522622af2d86ac6a294be01a4de15500d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563610, "uuid": "b12bebb4-490d-4136-a00f-f5fe6deeb8e0", "comment": "Malware payload (GoBrut)", "value": "fed23ab2773016fc1fc4fc4a5ea40d0159d1c16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563610, "uuid": "ac844dd3-ac3d-4eff-8fe4-fd8ee0607503", "comment": "Malware payload (GoBrut)", "value": "28578827268d721058f28886df27616341d39bef484247ba5a97479f27f88bafc3207b785dce19e80435352261d24544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563610, "uuid": "bc81fc1d-ca08-4ab5-a329-91c97c0c4238", "value": "T13C763A91E9CB10FAEA032D3191AFB23F573111068764EEC7DB485F52E87B5E2593324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563610, "uuid": "24fdfb10-7260-4ab7-a9c3-52800997ee18", "value": "98304:DE1b8UT19vcSzjr5/YJ09sUa2megmG5OFZj8KIXO:I98UJ+SzBSUa2ac8Kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563610, "uuid": "2cdcfb1c-2903-411e-af48-4aca269b1451", "value": 7311047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563610, "uuid": "b6c08bea-ac46-40c2-b8de-b388e492a1d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563610, "uuid": "50baa42d-8a16-4a84-9b09-49cc4fb0c1ff", "value": "2b064090342c8c18043bef361e030a5522622af2d86ac6a294be01a4de15500d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d22e9a1-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570983, "uuid": "76cb7de7-036e-4cd9-9460-1f7f6c2f33f0", "comment": "Malware payload (Mirai)", "value": "a7ce060013f7b6fab19a93e92e01c118", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570983, "uuid": "d7a68a28-eb98-4b63-b5d5-b1647ae7bfaf", "comment": "Malware payload (Mirai)", "value": "2d4261b8df4760b4a507e95de22dcebc108123fd30aef64bb55c843cbc8e47c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570983, "uuid": "3c5ff84a-1247-4b7d-8c9d-3227e1df8a1a", "comment": "Malware payload (Mirai)", "value": "139ebbbae71a2a2de475430a177bd0f5291950d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570983, "uuid": "4e6ef32d-5be2-417d-8e21-5b5713faee11", "comment": "Malware payload (Mirai)", "value": "087f342cb6b770c68e734e9bd167665ea66d1d7e522fd5a413257281993131f81dfe657af4b5db53dcde397b687479fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570983, "uuid": "6c44ebe5-09e0-407b-9a1a-d7c496bda38c", "value": "T134E21961F9D2462BC1D11376F6AE5A4D3730A3E8D3CA3627E9215B503BD521F1D27E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570983, "uuid": "33c91f82-a711-466f-9f5d-6d16d0a5fdc6", "value": "768:ERPwWi3a+7gA6qytW8bsGxN1l5e5ytXSHSAw:ENjiK+7Gqn5ytXSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570983, "uuid": "27318c0d-4415-42da-a153-c7f4e29ea035", "value": 32132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570983, "uuid": "84097f0a-f51d-4dc6-b893-895e1f5ea85f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570983, "uuid": "4740db74-4b2a-45ae-b253-58f1a76bdae4", "value": "a7ce060013f7b6fab19a93e92e01c118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6810ddc-ca87-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651544477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544477, "uuid": "96efcecf-f766-4414-8d0a-219702d9df35", "comment": "Malware payload (Gafgyt)", "value": "f9a6a6ac48a2a51a3fa32822ad33cfea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544477, "uuid": "99cff379-f64a-4900-9464-1aff0b445d6f", "comment": "Malware payload (Gafgyt)", "value": "300f4d04945c8ed5c4506892894f3ec07205b62dd855f1acff79720a7efc9123", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544477, "uuid": "8f2b0ce1-c9b3-45c9-9ca6-560b2d3f589c", "comment": "Malware payload (Gafgyt)", "value": "f17d96a658f7e8a36131c3e004bec9de9f43a59c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544477, "uuid": "4487faa1-21e2-4c69-ba6e-41f1c3699b8a", "comment": "Malware payload (Gafgyt)", "value": "8a42889ab736d661df3a6b33e14c47a1f2d876a3866d7e5a0a845426ce753b6d76496c32abc787eb55dc9a30b8043409", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544477, "uuid": "a89ab372-c112-4fe9-91f8-025414f9c7c3", "value": "T1C3A31943E5618FB7C0466A7525AB5E340B63AC922B4F1A853128B7F4033B5DEB81FF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544477, "uuid": "41d4ab18-32a1-441e-afd6-87dc3645e5b1", "value": "1536:SlUz4qaKHDRXmaKASi1jjMWYXCHeCeoa8AT8ymK4epbbSLEn/6NS:SlMaKHVXsAPjMOeIyZmHepbbqEn/6NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651544477, "uuid": "51140cdd-89e1-4a39-9b49-664a0e44e804", "value": 104485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651544477, "uuid": "e790fd66-f979-4f85-af19-29b3cd91c4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544477, "uuid": "060daa62-23f9-47fe-aabb-ddde11c205c7", "value": "f9a6a6ac48a2a51a3fa32822ad33cfea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb40aa6-cb2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651614608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "621d5476-fe95-4211-a68c-c502dbb1d4db", "comment": "Malware payload (Mirai)", "value": "ed3d63ce71b17d19d9c9674749ff892b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "6f4d250f-5d54-4608-b300-e43de0a59220", "comment": "Malware payload (Mirai)", "value": "30f0dba925ae643bd37b9021e8992af8f3571fe9aef2a6d3060b3b771e66f223", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "af931ffa-993c-40e1-8b01-bd0b04a0e7c2", "comment": "Malware payload (Mirai)", "value": "13938340bb4be51fdad19b48895849865e1ac51d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "87fc5a45-e445-4a33-aede-3825213064ce", "comment": "Malware payload (Mirai)", "value": "efd94cd2c0af3a16e121855b2ae940e90afa836d7258b2146f949aadb31bc225393ab650a89ff41460dbea354a183d3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614608, "uuid": "b6ce2871-4bfc-4fca-a29c-e84868d6356c", "value": "T11B631895B8814F16C6D152BBFB1E029C372617E8D2EB3303DD26AF21378792B0D67265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614608, "uuid": "aa4f848f-7ae6-4d7a-ab52-09d19db694c0", "value": "768:K9fnyvAzPNBa17yNunVNn6n7KvePrFGS9puj0WKXwg/EAFNxxMRuqi+5hEkcc/VT:6ntPN417Q7KWcShziRaNkcyT0vRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614608, "uuid": "15d6e168-5aed-4a20-8ede-0078ad1f1d7f", "value": 67844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614608, "uuid": "99c0b2e7-bae3-4e89-980f-6a15eb9e1729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614608, "uuid": "944d6180-ddfb-4305-a8d3-63f7ce3805bf", "value": "Cronarm-20220503-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cebe9e5-caf6-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1651591866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591866, "uuid": "a1d6a2d7-ac4b-4c4f-945b-84abc7e92e05", "comment": "Malware payload (BumbleBee)", "value": "31a8e37ea02df4001b6aeafda4e98f77", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591866, "uuid": "0ef52f76-a3d7-43ec-be77-2e264b007447", "comment": "Malware payload (BumbleBee)", "value": "312625d76207f42524246f391c56fb5aa6456f209c9ecdc62a66b4cf09743e49", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591866, "uuid": "fcfbc6d1-76bc-4f13-ab5a-67541372c110", "comment": "Malware payload (BumbleBee)", "value": "04e8bc0e0abcfab51db8936f09469c9ad517bc6f", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591866, "uuid": "9496f96c-d6be-4d7f-b04e-96026f1361e0", "comment": "Malware payload (BumbleBee)", "value": "42cdf4fbfad684b2caa682708d2df681a52351399e14dc87b43b46392584a04c1a32c57bfe98445ceaa84167cffecca0", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591866, "uuid": "5f2db86e-9ce4-4d63-b029-ae8ee02ae934", "value": "T15326C00682988D66FD9C5BF03C1D6FDF464DB7427969249D2BBA1881C3F2A7B103913B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591866, "uuid": "b3131528-cd55-4621-9f9c-845ec5204cb4", "value": "98304:YYSPeBPDPYz6I1aNhsj0q8WoYboIsMG3QclPdF04:YYV5QznQhcomPqQclPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591866, "uuid": "29b345ef-7301-4964-923c-123766aa98b2", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591866, "uuid": "50bccaad-eb42-4b06-8ad7-5497d919f0d1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591866, "uuid": "8912e9e2-753d-4273-a3b4-f9d3dca9ef3a", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850f31ef-ca95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651550407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550407, "uuid": "49fcfb12-3e79-476f-94d9-bddb1cfb5eac", "comment": "Malware payload (Mirai)", "value": "24585e0bc30ae5ad790a21fefc793b3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550407, "uuid": "db117113-bdbe-44e7-8d9a-07152641985c", "comment": "Malware payload (Mirai)", "value": "312d59cb494cc8087c5f4455d804404e21dc7c409f3387f83a557fa85d970ca8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550407, "uuid": "16028853-7e13-48de-b1da-7dbca65ad718", "comment": "Malware payload (Mirai)", "value": "d201c4de0cc68a922c75eadcfa2e0e160cfffddc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550407, "uuid": "0073bb91-72c0-43ee-b1a3-9f59db40c7fe", "comment": "Malware payload (Mirai)", "value": "92d4d34d033962604c4f52da31bffe33bed73728bb2ac852a82feb669209624fe24257a96e152c5933c3d1def7e835fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550407, "uuid": "5b17507f-dc34-407a-805b-6aacf019c9de", "value": "T1EE833A857840E622C7C552BBFA1F018D331627E8D2E97307DD285FB0778B92A0EA7B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550407, "uuid": "cf7dfd21-4324-4b73-bc69-85153caeae6c", "value": "1536:1g0aU8T0F7CBRwYCtKST/JnDUV+hGysDHmvPe9W1vwA7BxW:O0aFI7TYCISIV+hGyb3T5xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651550407, "uuid": "7cbda850-6805-42a8-b397-5246d3066ec6", "value": 87468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651550407, "uuid": "b95bb31c-e8bb-4f30-937f-3d9d163538bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550407, "uuid": "327f05c2-66c6-48a4-b769-2c3676c0a3ac", "value": "garm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9003426-cb1b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651608154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651608154, "uuid": "a0b05e0a-f775-4b39-9e86-16fee1c0a022", "comment": "Malware payload", "value": "725aec94f42c62acd4e471ec285d33e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651608154, "uuid": "9fd2a338-05af-455c-a566-f049d7ac0aed", "comment": "Malware payload", "value": "32d33c9215e496b2602f90be4799a05dd0fd7499d8fc2d3f2f7bbc14eacfc0ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651608154, "uuid": "f91b014a-c1e3-4b9a-aa71-eeb859873a06", "comment": "Malware payload", "value": "d3fd8adc9c8e4e8d9801851eac5de82a4855940f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651608154, "uuid": "912b6965-83b1-4cf6-950f-91be43c5e42a", "comment": "Malware payload", "value": "97df162e51d2c7b59bb1434616eb769666057c09fac996411fdb019995133d95419f6dbe429ab083a1f8c1ae6ca89d0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651608154, "uuid": "ad11933e-5712-4d05-8be8-24e80550b711", "value": "T19FF48A607B8CD9B09F2C5EE9609B2774C32D12AFD176BF43689034F4CAD9A502B192DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651608154, "uuid": "622a1e81-9bc7-4071-906d-998a63fb1d58", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651608154, "uuid": "19829ddb-fd76-49a3-9593-1da8549c6637", "value": "12288:pDBt8YHTZdJBAzvmi8M771Ic7jR/j66HPzwlZ1KUL+HdBDbNh:JzFdJAm4iYjPc6Hdzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651608154, "uuid": "c1384bdc-87e3-4111-ac01-fa48238e067f", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651608154, "uuid": "f6153681-5b92-4029-b239-c51d7af1b4df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651608154, "uuid": "d7097187-a77f-4f9d-ae0a-e23658ad5e62", "value": "solarmarker05032022.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1bc8de-cac3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570150, "uuid": "4e60e982-d59d-433a-9979-6097ed077d2c", "comment": "Malware payload (Mirai)", "value": "7d74a99346341425225e6593daf05dac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570150, "uuid": "7fc9beab-bc41-4cf4-8cb0-9c154195e0a0", "comment": "Malware payload (Mirai)", "value": "335e7bacf4cb36ffb8198d35a33dc77a7885cbe4cffb7074239eed0b2d438c11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570150, "uuid": "f6c4b82c-af68-4e0c-a337-6abc22ed10e2", "comment": "Malware payload (Mirai)", "value": "ec84ea4d5e7d332e9c8e05c59c4cefecb54da852", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570150, "uuid": "cf6e60d1-01d0-4c28-a18b-f4099d723b55", "comment": "Malware payload (Mirai)", "value": "0b8ebd8d502ebd7c45ac20b1345cc427003cff659f43a67a9268a49c551304faf36b4a92e8032e551e5f1cc2f83da813", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570150, "uuid": "c380bc88-4277-4615-a70f-0083118e184e", "value": "T1F3F21AD6F543D9F5EC07057090B6FF36AF31F1E96288DA07D3A89671A852542E903E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570150, "uuid": "21585bb8-8a01-4cda-acd0-47991902883a", "value": "768:UVvF0JZoZxBDfoNXnoLqImt/o6MOJ3mIJajFyodAN4WhVlCNuNXAsM:Uv+ZoZ77oNXB3mIJajFypaWh7GuNXFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570150, "uuid": "549b40f6-9c63-4d9a-aae6-0c7347f092c7", "value": 34544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570150, "uuid": "4574e3e3-7697-407b-9442-f7d0bdb3f9db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570150, "uuid": "e13e4ff2-2336-41ff-bc12-f3e271f40f26", "value": "7d74a99346341425225e6593daf05dac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c710f0b-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591221, "uuid": "e35ac183-b2e0-4440-8819-64bc2ba2e1e3", "comment": "Malware payload (Mirai)", "value": "109c04c46658b14ecea6f7d123d6d92f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591221, "uuid": "e26ad94f-fa56-49ac-bf3b-5939504a07a2", "comment": "Malware payload (Mirai)", "value": "33eef0c93b605ce87d0632bd362bcd033ee5c39dfb88f1d63e33ab27ea7e1179", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591221, "uuid": "bcfa893d-ae7d-46f1-8751-00a7c5a4a3d3", "comment": "Malware payload (Mirai)", "value": "50233e5ffe7a4d6ba672c57b44392a9e1820cdeb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591221, "uuid": "38b1b899-5032-4745-aabd-2bde3d03ce86", "comment": "Malware payload (Mirai)", "value": "2af2555bc6f7cc7b68084b5be9762ff5dbb53c97dd1eb07fd44907d4e3318545775cf4d5bb3334c4a4098d254c6faf34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591221, "uuid": "2dfa4638-b53b-4d82-a2db-e9574f2415d1", "value": "T19D33280BA58180FCC559C17443FBB53AC876B97E0239B1DA7BC8FF176D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591221, "uuid": "9f2ad704-010f-4a73-8501-0afa5106a249", "value": "768:Dbs093tGOHn2PAe6nCAQiGWexrecbwXg4ubt7HvE1rjWb571H7fungg:M0937QAe6CAQ/WexKq1bc1rs71H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591221, "uuid": "4d2498d1-37ac-4416-87c5-b84d214f8df6", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591221, "uuid": "0bf58973-2d94-4f5d-a67c-0a8246bb7590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591221, "uuid": "8edad9b6-c118-42bd-b188-e764c555d053", "value": "x86_64-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9264e000-caea-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1651586936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586936, "uuid": "1def175e-291b-4fa8-9ed5-c985825962f0", "comment": "Malware payload (N-W0rm)", "value": "d73797c98a16f2611e0f145a7c888afe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586936, "uuid": "ac72e963-0bdf-489c-999f-5cac29db7ceb", "comment": "Malware payload (N-W0rm)", "value": "357f63389b69cbf2daabde47da3f43b0bd853febcef627373df182d08c3a1d26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586936, "uuid": "4ea6e1d5-eb35-49f1-804f-d2b1b303c579", "comment": "Malware payload (N-W0rm)", "value": "13388b5e9f19304e1f6e48376d9ac6bfbcc65dc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586936, "uuid": "ebd587a4-c907-46a4-882e-2b0b96afedd0", "comment": "Malware payload (N-W0rm)", "value": "d22358d9e6fcc2c1026f0cce0173d580df2a9076b53cca3cf75f5ad5f7055ba10510832f5ae393cf96b917162b968bed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586936, "uuid": "47c832ec-c556-4521-99f8-a30dd6b609d9", "value": "T19684F11272E3D030C4D3D5304831EBB49ABE792246B4089B37646BB92F717A39BB5366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586936, "uuid": "7f6ce280-ea95-43db-804d-b4949ed3d24c", "value": "3fd3d8f4e588baa60f5ca403c2e12583", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586936, "uuid": "235db9a8-7b6d-4272-90cc-dcd1cb1e7967", "value": "6144:xwQaf7xvpVwvxtmk48Kxgy0CdDXj5WmhKK43k/rsKJMcB7:+QajVwDmHNxT0MQrKemrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651586936, "uuid": "12a0e77f-edab-4003-94e0-d10cfaed2497", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651586936, "uuid": "01de85fe-2187-4680-9d87-47cfd66e1175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586936, "uuid": "e4f195a7-bd57-4122-9433-95fde9e38b1d", "value": "d73797c98a16f2611e0f145a7c888afe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe9de93-cb33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "0b994a07-2fed-456d-98eb-b11bd33c4261", "comment": "Malware payload (Mirai)", "value": "3a3b2cc6c6c1ec261980572d0f57d555", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "76572f65-27ec-4b73-8036-54e2e4145db4", "comment": "Malware payload (Mirai)", "value": "368bf0a4bf6c6a7212dc435a0de1429ac90d72283d0a88048cc4eff1791195b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "212e2513-a9e3-4a86-a711-b7293ba0e301", "comment": "Malware payload (Mirai)", "value": "4e8a90f50c648fb90df327aae6d447bacac596a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618205, "uuid": "21ba3445-b25c-422d-876b-49a798e61039", "comment": "Malware payload (Mirai)", "value": "80a4599f0de2569f289783cf8b0734b180a9aa6a2027e38446a80303cd5a8b4135f8042f5819d1200ab7d8d2499cb71d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618205, "uuid": "57eea1b4-8bb9-491c-8b0d-1fcd0a1c9b0f", "value": "T1BA933AC4B68395B6DC0246B430A7EF32CA37E4FA1217DAC3E7E89A737891511980769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618205, "uuid": "b40c5bc4-1668-40a1-a53a-6f019cbf350f", "value": "1536:Rfjqdrady5+9K0G0jGYJAzo+6KDEJWXrPpmBTsRCWLP1bwyEaXDLX:RrorOy5+9Kr0jzJ1fOPp2wwWLtUV6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618205, "uuid": "92da224a-44d1-4e20-8ba0-0f66e97bee37", "value": 92660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618205, "uuid": "f163a3d8-4162-4915-aa38-cf57cc045a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618205, "uuid": "3ca05242-0ac8-4ef2-b363-c6895d92d58b", "value": "uYtea.x86-20220503-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be6d6df-cacd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1651574470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574470, "uuid": "27d08756-05bf-4469-9191-c32dfbc0d6e0", "comment": "Malware payload (Nitol)", "value": "5811b4fa365f26d48899c6574cb0bba4", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574470, "uuid": "7b02d467-1245-4600-9781-b323c46d52a2", "comment": "Malware payload (Nitol)", "value": "3804c0349cf2c6728d22997f16b767956629632f4672fc095a26b776da3293ce", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574470, "uuid": "d8e688a5-5403-4be8-a33f-52f3a1393b58", "comment": "Malware payload (Nitol)", "value": "70077f86d860dff68dd1136c4b4d7591e90799c5", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574470, "uuid": "b18da906-136c-43fd-9551-d183d90d88d2", "comment": "Malware payload (Nitol)", "value": "74b8759ab1550b0acf220ac23fd1eb298f7720f17e258dc9778a962e95db391d9cf0f17ef2c3d86a24fda1b24a447e51", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574470, "uuid": "7aee5c95-9a7c-4627-9a87-adf5bab41d2b", "value": "T14C161738E520C42EFCEA167D8B6AD83DD95CFD216B0985CFD584E8964D38EE838718D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574470, "uuid": "d7c79adf-083b-40a2-aa5b-deffbe80b3ca", "value": "f59268d6ed130cac1f7553a577de1a9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574470, "uuid": "cb8472e7-2a1c-458a-af0a-35176d6b3984", "value": "49152:Lsy9DKK+dKCzoGyGuuPLLs9wfejzxLyy10bLoBFguwYOdtFf:AVCQBfepTCUwnn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651574470, "uuid": "dc404997-7fba-46f5-a1d8-7ae18ea48d2b", "value": 4419584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651574470, "uuid": "9ab65df6-3edd-49bd-8327-007a14fb9964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574470, "uuid": "b7d63c6a-4733-4e4e-b71a-2cbdb62f43b6", "value": "XCC02\u6d77\u5916\u8d44\u6e90\u6574\u5408\u5f15\u5bfc07.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3a7ac4-ca76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Pony)", "timestamp": 1651537054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537054, "uuid": "dfd89d44-4267-40c4-a903-c6105ee407e6", "comment": "Malware payload (Pony)", "value": "0937ad49912c231a7b996268a685a5a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537054, "uuid": "99790f69-ec7e-4513-8a27-69252923f936", "comment": "Malware payload (Pony)", "value": "38dfeabf5526511effa346e9ced2145d4d2b1ffbc065146d3869e27fc235cd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537054, "uuid": "01dc4f4a-e3d7-430d-9233-075ec1d4bb15", "comment": "Malware payload (Pony)", "value": "4d9abdc517ecdb57cd259f0e9cd64a8090a4ba44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537054, "uuid": "d4271e73-6130-4265-aa94-e3819f87f8a2", "comment": "Malware payload (Pony)", "value": "72b99e73c3af6ba4102a33d35291141c3bdcdc00fd01df7220e36b52f74f9eb73bb230198ab7fa5ec0af925882f15d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537054, "uuid": "f9d46e07-c8a5-4d61-b0de-22307490ff7e", "value": "T1C2E47BD1BD8ABAB2C7757C35DADD3F8E8EE1B353E8465279022687D2C5362130A0B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537054, "uuid": "a3cb25c0-4ea1-4dbc-bbb6-bfbc4ef4561d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537054, "uuid": "f89159a0-1d6f-417a-a96f-e78101d647ca", "value": "12288:boXlpC1W3oyjTnhj5VS1YGp9wY87iTrKuqYYAQzCO2idcec/SWHfUULBVtTNbF2a:bY3C1oxl69dJT+uqYYAQL2idcec/SWHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651537054, "uuid": "a78a7872-76f6-4ff5-9f76-5918a560bfdf", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651537054, "uuid": "b624e464-0970-49cf-b080-8c5ca0684191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537054, "uuid": "66b4d96b-72cc-4730-a149-578f15ab37ca", "value": "payment advice.doc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c76e12-cb26-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651612714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612714, "uuid": "b142353c-0c28-474d-ac71-02ee99261c15", "comment": "Malware payload", "value": "7df79de2f5e31263208ef83caca7b1f0", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612714, "uuid": "e5474056-3340-4b98-b977-843d85f7b512", "comment": "Malware payload", "value": "39d242660c6d5dbe97d5725bbfed0f583344d18840ccd902fffdd71af12e20ec", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612714, "uuid": "d4113cff-5ddb-4867-b2ac-da64a3397403", "comment": "Malware payload", "value": "670224a6b59827de20a93cbe754edfb510cf3cc3", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612714, "uuid": "30ba1978-f093-4493-9726-9c3301f9cc69", "comment": "Malware payload", "value": "be03583ecac53aa242343e7462462b77111e144fce97f34ecc59baf9858efc936abeb7d71a113cb049b9fe0daf08ad20", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651612714, "uuid": "700f8e44-670b-4b53-8205-0df252f6e5a7", "value": "T15D46336857E61689FA721D782431A06189FA7B55EC21DB8CF3C1320ECB67D0ADB36D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651612714, "uuid": "c3e2f7ae-a17b-4d20-9771-5d6aaeb6ffc4", "value": "98304:atClVkoOSfJNp8FUcwti78OqJ7TPBLYVrsk9N8ivyhAdsPSQx3UGgdd:alobhH8FUcwti7TQlgVN8iNIShd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651612714, "uuid": "f489ac72-5a7e-49e1-9238-08bdb33d6287", "value": 5434336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651612714, "uuid": "e65b58b4-b87d-4da5-b0a6-31e7ddffd700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651612714, "uuid": "aeb38c86-3daa-4b99-82c8-f62ae01d6cee", "value": "39d242660c6d5dbe97d5725bbfed0f583344d18840ccd902fffdd71af12e20ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d18759e-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591222, "uuid": "5ec864c2-8aad-42a1-96e3-52057308d3be", "comment": "Malware payload (Mirai)", "value": "08b8d9475dd998cef2ca9f8e12f8205c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591222, "uuid": "3ba78ce0-348f-4ad3-8953-5e49c2d40d48", "comment": "Malware payload (Mirai)", "value": "3a7ce8c173b7b75ddf1f96802b03b4fd05dae8ba305e0ddc2ba3a2bd541a20a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591222, "uuid": "7b0683b4-19da-41ca-a7ea-7e3a5b967df6", "comment": "Malware payload (Mirai)", "value": "5abff308c9ee8c0b326ee0286eba9e029c5f6a41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591222, "uuid": "f8bbd281-8798-457a-900c-76592fd16efe", "comment": "Malware payload (Mirai)", "value": "f4149f0ada333037fe08cba50602eb0255fab9f32beabfe317fb3f7bedafd3bbdc34110dda852f7311bc3f89964af28f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591222, "uuid": "b3f9abee-29c9-4e81-9683-e2d2b561bf96", "value": "T16B63975D2E219FACFFAC863447B39E20924833E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591222, "uuid": "cc70463e-f1ac-4f3f-9ce1-bf75a46927cb", "value": "1536:J8xD3DOpSxUypP+vntvnCEvnNI8WotMqnWBrUN5f2Y/ua2e7:6l3DUSqEcJWBrUNR2Y/u7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591222, "uuid": "9d3d4718-b702-4c82-a1f9-8b8a55c07d51", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591222, "uuid": "e7c9034a-466e-4edd-894a-cb79c7872e99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591222, "uuid": "f2724a6e-741a-4d4f-bf13-c3035d2545ef", "value": "mips-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e528b8-cad4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651577581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577581, "uuid": "94df7bdc-0b3d-4cb5-adc6-8deb98acdccd", "comment": "Malware payload", "value": "ad66aaf1c72f201b74a48112c351cd7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577581, "uuid": "999cb15d-b58e-4bc0-a391-c1bbaf86d99c", "comment": "Malware payload", "value": "3ae2e32f443cf7876fc636f80b2880b2170314aaf0ce3a32dac640eb063d7313", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577581, "uuid": "951e5dc3-578a-40a4-94f2-29b20ce325d1", "comment": "Malware payload", "value": "57f890e6092c889a9e2868722491c82fabaa9905", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577581, "uuid": "a9e7be83-467d-4538-844a-13be5972dfd1", "comment": "Malware payload", "value": "847d3b002319201c0e860ebc30eb7f9af951214dec4de1fcf13deea4555af550c3b5497317b928b6f8b3501cdf26d5d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577581, "uuid": "5ddbab70-e3a7-4c3a-b687-c9c2f68d5411", "value": "T18C653AC2A292BF62C25D0F36C0FA69284771C5517213F74BFE8A136118D27BB5D86D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577581, "uuid": "0a478de0-0ec7-412c-b942-376a0082aea8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577581, "uuid": "22ebc493-a3f7-481a-86ed-b077ed8fb382", "value": "24576:jw7V8LQEhFiCCozl+TOG5fqIGtHUEs8ibRrW:jweQEziSl+HVGtHL9ibRrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651577581, "uuid": "130bdb1c-1425-4aa0-8176-4be5e18028cc", "value": 1486335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651577581, "uuid": "a6f2047f-7fe3-4a3e-b27d-ecc4b0cd160e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577581, "uuid": "16e570e9-2be5-4faa-a6ae-838b463e7005", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bdfeb0-cb34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618695, "uuid": "9481e81f-5c37-4744-83cc-3b2104d16fae", "comment": "Malware payload (Mirai)", "value": "cfdcedd9839d75bd43cf6a9843ae80c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618695, "uuid": "7cac608b-7d1a-4d4b-952b-648604c90fec", "comment": "Malware payload (Mirai)", "value": "3c79469cc8d57f8d550af34cbfa804233b30a780acb5883af7536197d2027b8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618695, "uuid": "dc7e1254-cf8a-4e47-9fda-6e36a85674f7", "comment": "Malware payload (Mirai)", "value": "10b7fb213915a8a7f770f8998778e1098e82065f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618695, "uuid": "db62b72f-c7ba-4bd0-be90-5071499d2a49", "comment": "Malware payload (Mirai)", "value": "a1790c2074a2467a00ee6f9a6e532b5375b674c0af451daae1324e8d77155743a0986032c2af725aeeab5729be3d0dbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618695, "uuid": "b7710388-0e15-418c-a0ec-bd5e0a193ff5", "value": "T16F932A46BC91862AC6D023BAF67E628C332163E8D3DF7107DD241B656ACA11F1E37E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618695, "uuid": "d3c50c03-7cc0-45f1-922a-b253c3140218", "value": "1536:4lMQFmzIJufqF+ruZ6pgOk4htT0+5wMEbAU+SYyofs5u6JWbda8HVa6Zuge52Ots:4lMQFLi/g5YBstJWx31VeY9ljV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618695, "uuid": "5624ce09-c582-4427-b379-38d72e1d0518", "value": 93232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618695, "uuid": "e5ba0c05-d190-419a-9abf-72ba8376f232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618695, "uuid": "72498139-f0ad-4e0f-b370-b89736adfd92", "value": "cfdcedd9839d75bd43cf6a9843ae80c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f790ec74-ca7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651539002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539002, "uuid": "f39ad278-4b78-4df6-8bf9-20c6012c0e31", "comment": "Malware payload (Mirai)", "value": "b205e56d2dd4836e494f9d1945dae873", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539002, "uuid": "a025163d-7781-4f56-9e8c-772a0695e361", "comment": "Malware payload (Mirai)", "value": "3db997a3d66118aba9a87e4c93a7c0359ecc794597e233ed3a94c666f282b02b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539002, "uuid": "8596f8b2-d729-422a-903f-af1967c145d9", "comment": "Malware payload (Mirai)", "value": "280d9827b12a8000fe0d1267ced1055e8d5fae01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539002, "uuid": "9e857ae3-a211-474b-89c3-fc8d38907913", "comment": "Malware payload (Mirai)", "value": "fcf03bb56759042f5610eca5bcb8e44d2807b3c35739cb4a54a2d37f336e273c59b97e7cfcde8ca2c8ddcf1cebac3665", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539002, "uuid": "58f58ef6-54c6-4524-be6f-4041a76c4ff5", "value": "T109D2D1A3C3AE42AFC8CD31B59D6F264D5C63D31E9294DAF1AB9824732790F1D3D09605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539002, "uuid": "c8a36395-f177-47f6-ab31-193686ef2428", "value": "768:t/Eau+WdxQ+q9mMQEKiznS97xXFLI1jP6HnbcuyD7UryqB:aau+WdxQx9mpCmVRFsFqnouy8mqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651539002, "uuid": "f5ae6ac6-b89b-4ce5-b9d5-d0298df63f97", "value": 29176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651539002, "uuid": "6d915d52-8195-45c1-bb48-4ee90bdb0ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539002, "uuid": "3e646e08-91b8-4c8e-9cbb-8fe04f4a14c0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189006d2-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585443, "uuid": "ed4fac8a-8eed-4f2a-855d-fff4aa4daeff", "comment": "Malware payload (YellowCockatoo)", "value": "172286bcb0baba1f89a227520673c9e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585443, "uuid": "b3cb478d-fd14-49ad-9b3d-f08a8bd9d859", "comment": "Malware payload (YellowCockatoo)", "value": "3e5cf8e700b5131d3a328041bcfb8e8108d75449ed1652e6d3518399274e8ad2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585443, "uuid": "73e41dc9-e340-48d5-ab23-fd2139f5d6b0", "comment": "Malware payload (YellowCockatoo)", "value": "e067ab63dbc8d3d470e94cd3673ed513c33dfb56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585443, "uuid": "02b00308-066a-45ca-aba0-7d7dcff976cc", "comment": "Malware payload (YellowCockatoo)", "value": "b73ac962c2eb808b530d14672a17e5d12d8b1ce0a999a2d8f61880498188faeae229eaef9ee0d8da810661322216909f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585443, "uuid": "8593406f-abeb-44fa-8e7d-f86cae2a74f3", "value": "T1E6048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585443, "uuid": "05d14d3e-56f5-467e-b6d6-d4ef67d7528a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585443, "uuid": "09396e12-7038-4d7e-89a4-a218e8315aa8", "value": "3072:pNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2M:zO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585443, "uuid": "42dec1c2-3c05-4842-932e-4deaecdf3f25", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585443, "uuid": "f2cdf199-6748-4c47-9593-318e7b1cd921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585443, "uuid": "7ab5e810-3941-4983-8579-d0bd66492922", "value": "3e5cf8e700b5131d3a328041bcfb8e8108d75449ed1652e6d3518399274e8ad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dd21f8-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651563612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563612, "uuid": "04675060-6df0-4c3e-ae4b-10cacebae1dc", "comment": "Malware payload (GoBrut)", "value": "9416017581875a6bcb6d0e247f14fc7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563612, "uuid": "83d2b989-5864-486e-b017-6fdb290b87b1", "comment": "Malware payload (GoBrut)", "value": "3e7a6ee9417bfb27901ad78091068fae44ac4e578164db8ffdcc8489b39c8e50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563612, "uuid": "1e2715eb-a85d-4d68-ba7b-b05ce4b2c858", "comment": "Malware payload (GoBrut)", "value": "ebd3c7adc01cebfe4f252ac0adc2315d98111a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563612, "uuid": "bad503c2-f8aa-4213-a878-a0cd076f3b92", "comment": "Malware payload (GoBrut)", "value": "5c6634702a6a4a592f860902ab9117cd471a71a34a5e8e8e9629fc804846c39fbf200912111500f508d80b96fbf9e916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563612, "uuid": "8048ad88-75d6-427f-b1a6-dee04ffef009", "value": "T1A036F860EECF14F6E9031D7151AFB22F673112064B29EEC7DA481F56E93B6E2193311A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563612, "uuid": "30b925c3-4f91-46e3-bf97-f7aedc8bdb99", "value": "49152:qsf+rT1lMu38Uo3nqxbVwSm83vUpSRFjrwaL/D3jcnJnGm7LzuRtXAyoJclbsUaE:DE1b8UT19vcSzjr5/YJ09sUa2mM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563612, "uuid": "cb76f188-c157-497e-9df8-b456966e7db4", "value": 5246976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563612, "uuid": "2f133915-b16b-40fc-aaab-d4021c97f85d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563612, "uuid": "b62a018f-0bc3-4b22-9a96-066dc088472d", "value": "3e7a6ee9417bfb27901ad78091068fae44ac4e578164db8ffdcc8489b39c8e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a532d4-ca8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651547473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547473, "uuid": "9a76788d-5ad9-4429-9903-3e283cd7250e", "comment": "Malware payload (Heodo)", "value": "7edcadb74b2f7f1e74b4e1d71d63a293", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547473, "uuid": "16f42212-dc5e-439f-b20c-f64d7988c4b7", "comment": "Malware payload (Heodo)", "value": "3eb89259e4cfbf6a9747c39f11dc7bcb193ef5bc1a42dc29f20db82236cfde54", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547473, "uuid": "5ebc8558-eba7-426b-b2c8-f62c5016cdd5", "comment": "Malware payload (Heodo)", "value": "09b87e64d5af7f7d9642f7fb917956b51c944397", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651547473, "uuid": "4c734fa4-949b-4d78-879c-c555a45411fe", "comment": "Malware payload (Heodo)", "value": "2085764de0e91e6ae54eeb65bb1de0d3928a3d9877c5a7f217b7b649d4c2061fab527882afa35a8482283505594b1510", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651547473, "uuid": "10edad79-005b-4260-b359-1120c9b2abef", "value": "T11AD4AE01E65D85B9E02FD13C89F387A2E2727C98877953DB5694EB3A1D739E05F3A200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651547473, "uuid": "a51c9565-23e6-45ab-9247-e16463d5ebe1", "value": "12288:JhFfFJbMWeHylXO7N2qBHiyzskF1CubVnmn:Jhx/MxHylXO7Nz/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651547473, "uuid": "c4a4f719-3362-4451-86ee-1a333de33ff7", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651547473, "uuid": "65aecddd-7b7b-44a9-9198-297b16e2519f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651547473, "uuid": "ff7027b8-c2b0-46a7-bf3c-89e27059ea72", "value": "emotet_exe_e4_09fa0e5e3e54c211914d0745845c128703af1bb8f7293e7912dd0c4d31a077a7_2022-05-03__031108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ed344a-caef-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651588841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588841, "uuid": "b9dcd1bc-db7c-4ef5-ae5e-e4711f093225", "comment": "Malware payload (RedLineStealer)", "value": "835d31ecb6ec4fccaa7edc9ce4e31e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588841, "uuid": "8546fa89-4600-4863-8373-e179c99215d9", "comment": "Malware payload (RedLineStealer)", "value": "3f0603d5d06aa8cf7dd6b205725a4c79b173f228aacf55b3f3278468d889fc97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588841, "uuid": "905fff8c-cb58-4231-85b8-6022282fb28e", "comment": "Malware payload (RedLineStealer)", "value": "2b0cc72b379bc16ed4f38aad7ff174bc85fbca70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588841, "uuid": "2b5034ac-ea4e-4a25-9b97-6f44b1e1211a", "comment": "Malware payload (RedLineStealer)", "value": "47111a1f8a4e19b1cb6e226514ba604efbca72b01adf99fd7d8b842314669dc15d9dbb93b5c6a20d7d6b330419fe0afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588841, "uuid": "e26d637f-0ee0-42ba-b680-6605641f23c5", "value": "T142F44B5CEEF00158D1DFAE7006ADE16D03E21B8E1D523D5E4FF0F6879A6C25AA6061CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588841, "uuid": "8e0993dd-3ef0-4f8e-91c1-ec7afcd462b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588841, "uuid": "2e726d5d-ba6a-41aa-8b9d-05e59c93de0a", "value": "12288:3n9e1Y2ITs7i6mJiJFYha2wSH/xTojspQlpLv0CLQXODhxmxOnCKu:3nwe/Td6ya2w2/xrpMMCLQXcPmx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588841, "uuid": "c63f1f72-314d-4545-9ca0-ffc50beecdd5", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588841, "uuid": "3a66351b-9e1b-4f2e-abe3-4aeecddb0a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588841, "uuid": "c0cabec4-1384-43a5-885c-7c6f9841d6ba", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940cae70-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651563746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563746, "uuid": "f7dd7ca7-8914-4a49-930c-2a996245dffd", "comment": "Malware payload (RemcosRAT)", "value": "84f5578ecec108c863f1d2224c54aa41", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563746, "uuid": "d53c4004-0304-4990-96c0-2abdaea60a23", "comment": "Malware payload (RemcosRAT)", "value": "3f4801a52c0a8b120fb837901f304237e69504beed0bf1cb052e3ff85779ebd0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563746, "uuid": "fcef30a0-10e3-44ec-a1d5-5fdd4c39e991", "comment": "Malware payload (RemcosRAT)", "value": "974d1baef6cccfe46af2c8ddbf7dbfba3848277d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563746, "uuid": "7675a59a-4d68-4cf2-a19d-e7bee79e4675", "comment": "Malware payload (RemcosRAT)", "value": "eb06796f5c9984f78c38611057479805ab381a701258dea3cd773fcf7583895c7cb8319134fb76046f66100d07302e12", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563746, "uuid": "566bd71b-efc0-4e73-82de-38e2027fd75b", "value": "T11194232F942E934F9AD9751AFAE9D95A65FD4D300A44F0FFB1A08DC0E90E70C94528F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563746, "uuid": "4554d6c1-bd50-4526-b2c0-cdf17ac1c8fb", "value": "6144:yM3JR4gBxbOxUumDeAEri5CuH3KduhwS6GahyWJ8bpAms2kJH6qV/wXowDMhWF87:l71OkeAEmk+3K6wShMQpAxP6mwXUhWu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563746, "uuid": "2e12b883-1257-4705-8964-d1380e88e1fb", "value": 433006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563746, "uuid": "ac91ffbe-29fa-4ae4-8fc8-42f949fd3c05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563746, "uuid": "96c932e9-5e80-47ff-a28e-5a9182502267", "value": "INV#1191189.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5a803f-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651581049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581049, "uuid": "8d586b83-dfe8-4b2d-9d44-d420340d21c6", "comment": "Malware payload (RemcosRAT)", "value": "2b0006d4c714f262bad0d4cc10f00bff", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581049, "uuid": "29b37bf2-34d1-4284-8e43-bea2fd5edfec", "comment": "Malware payload (RemcosRAT)", "value": "3fe916be5e5a50bf5e86929bf43ebd941685e899d7e9a07f0d8f9591884994dd", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581049, "uuid": "68de015b-7904-422e-9f3e-9c5c140cfd1f", "comment": "Malware payload (RemcosRAT)", "value": "63f7ca80b0df2caf51271a307270191509970c6a", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581049, "uuid": "1addd6d3-f3aa-4f1e-b0cb-2d3e1517bb06", "comment": "Malware payload (RemcosRAT)", "value": "2fca9a531ab3ff4a0bcf284e3028a28da1145242cb6bc4902933d25e11f78125b6413d224fe933612af4a3797b0dd3ac", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581049, "uuid": "80cd33ae-0411-45db-9a35-72d466dc76ec", "value": "T13B514F4E305B391412337F72ED07089EE9F2B793E5B941533A19AADBCD3A12CD69151C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581049, "uuid": "37f9f0fa-6a5c-4f8f-bcea-c7216f864fd7", "value": "48:RJPkBv8GeD62Ma0Fe65waJi1rSG0PNUlWVh/wKw75nNsC0BdHlPJd:RBkBv8GdJ86TJi1rSGKVQhNeC6Jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581049, "uuid": "d2998b49-9676-4b94-87f8-d2504a76a1de", "value": 3112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581049, "uuid": "133982c2-fe0b-4ba5-b0d9-5ee407d88568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581049, "uuid": "f0e3fe3e-0ec5-4f28-ab76-521845d0c195", "value": "Scan 1000276325462 document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae2ff6f-cad5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651577824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577824, "uuid": "827c0b6c-68f4-4ab2-b81c-5e98b0824786", "comment": "Malware payload (RedLineStealer)", "value": "054673314559aa5a96bec52a63e401bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577824, "uuid": "e2b2868b-ab7b-48c0-9de2-1934fa2ca7b9", "comment": "Malware payload (RedLineStealer)", "value": "4035294bf7f0ff54530e66db45dfe19ec280d03d14ea5e0bab72ab6f8690a8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577824, "uuid": "427a433a-b1b5-4322-a091-33a2c8a6b3a7", "comment": "Malware payload (RedLineStealer)", "value": "69877d470faaecd1f88c69578ef028dce37b8eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577824, "uuid": "0d2e5d25-1add-471a-a861-e50a3f711e85", "comment": "Malware payload (RedLineStealer)", "value": "81c93ad8ad0a5921162839ac3ddc668fb38b51b0f38160576338552517cb7795f552d4400a98ca016a3c1373414a6c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577824, "uuid": "5e3cef08-9c8b-42e7-8a7c-f9047e0a0011", "value": "T10E35BE52B740C9E3C81C0135A85BA3572FB0B45B3F42ABA73349575E9EF23C57B026A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577824, "uuid": "9fc444cc-3220-4746-be77-072b40015af8", "value": "1260128ced57c3c803c7e904fe44ebcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577824, "uuid": "cfb1dd48-f3e3-48de-9801-46a8bef85319", "value": "24576:9tWd+ztjZhFq/4hQP6RmdZhy8CMqHk/m1bNTPtcVyY/X0fm0CTFUoxd:3Wd+ztjZhFq/4hQP6RmdvorHku1XcVdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651577824, "uuid": "08fb7331-e106-4c57-82dc-7f0f0c9e7ab4", "value": 1157808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651577824, "uuid": "21a547fd-4397-4306-a773-7986687bd534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577824, "uuid": "a09d7fe7-9789-46ff-b2a0-0d39a63839f2", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf46ba15-cb20-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651610205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610205, "uuid": "844164cc-5b38-4156-ab36-e66ee57d25f2", "comment": "Malware payload (Heodo)", "value": "36ee4d1e205116954a42a195e590d947", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610205, "uuid": "d77c923c-aceb-4abb-903a-7721fe660dcb", "comment": "Malware payload (Heodo)", "value": "414a904a7358e748231b6161dd4a3ca75ead0ebd36e236013c9d787143fe46c9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610205, "uuid": "c0de3980-bde2-4bcb-9881-f7eb0eff5a73", "comment": "Malware payload (Heodo)", "value": "92806303181cb36da6e10884f90576511238f86e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610205, "uuid": "0759e20f-8467-44bf-ab15-444d36b1bf0a", "comment": "Malware payload (Heodo)", "value": "d2d921353a1d1d1d562fcbf0f0fdce75e8cf15b137a00d077fcf5180fe03c8f931dcdaefd7af42d61cbd194f72a53f08", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610205, "uuid": "541c85ee-829b-4420-9f8c-5adca90f6192", "value": "T167C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610205, "uuid": "76318b06-5da3-4a43-878b-61b8ce5d76eb", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610205, "uuid": "1ae46d52-fbf0-4198-9ca4-4fb704958c97", "value": "6144:JhZ02GdOOgPYaKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfBKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651610205, "uuid": "f9b1427c-df2f-4b28-bed3-dfe66407fdbf", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651610205, "uuid": "e799902e-d897-4d13-a504-0b3f1b168c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610205, "uuid": "cc38f317-19c5-44a6-b46c-67cac6def9ee", "value": "emotet_exe_e4_414a904a7358e748231b6161dd4a3ca75ead0ebd36e236013c9d787143fe46c9_2022-05-03__203635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bbbd4b-ca80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651541165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541165, "uuid": "414e12e1-6f6d-45f3-a103-f30c4d6b7bad", "comment": "Malware payload (Mirai)", "value": "4ed9d9368e38f18bf0406693b65b0be0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541165, "uuid": "40c6403a-720b-45c7-8c49-f868592c7a58", "comment": "Malware payload (Mirai)", "value": "417f47aba03c3323082027d5813029033174af23a789b03b7e37f4da8c483ae6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541165, "uuid": "c275a0b0-7036-4a92-9c9d-047b0e699dbf", "comment": "Malware payload (Mirai)", "value": "6d6de82ec9f26930d6e9c94a3f5d84c05ede31fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541165, "uuid": "3bf9402a-e41f-4149-8f1c-9786e0674545", "comment": "Malware payload (Mirai)", "value": "1e289b668bcd35ba26cfa6d939c821ffd6ca454f1d390dcd7e85d0de40ee5eb73aff1e493b501260891e549833b7caa5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541165, "uuid": "9335e9bf-2192-4a94-9ce8-02116dba796d", "value": "T1E35302E6E942E98797E15D35DD310103202F4A9EC3FFB5B6F121EEC46871EAA8ED4940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541165, "uuid": "950c9061-d18f-4aeb-b8a3-34ba11f105d1", "value": "1536:Qz6z1tEb9uvqnaMtqDdtVuintRICwrFKio+hq:W6uu+NtqDdtRtRICwrYiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541165, "uuid": "a422337e-7e1c-4239-90af-2a6aa523912c", "value": 63548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541165, "uuid": "6f6688fe-4b78-49eb-a8b3-e5962eb009d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541165, "uuid": "8f3d80c5-4efe-4fc0-9e78-463de2629996", "value": "gummy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc50319-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554341, "uuid": "64b39c77-fe80-42d1-b92c-9a73eb3afa66", "comment": "Malware payload (GoBrut)", "value": "3e9b6a7bcddd52ff509f775876146464", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554341, "uuid": "915f422b-756b-49a9-a371-86e544b4b54c", "comment": "Malware payload (GoBrut)", "value": "426f407414fb07db97da4d88630bf7a5be3ada280b39d5eff11cb727b772e1eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554341, "uuid": "4a43f5ad-774b-4c37-9a06-8e9d1d3085f0", "comment": "Malware payload (GoBrut)", "value": "d57de50674cb4d1463a3c55297a8b61f2389e637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554341, "uuid": "9ce98178-6472-42a7-a940-d38c4b4d938c", "comment": "Malware payload (GoBrut)", "value": "cc91729c6d51bdf0693cd25f5bd59062afba7a6d155a928abbcd0345fea5e1c40c435f72502408739b827e526c7f74c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554341, "uuid": "58f2a620-d26d-4d01-a140-9f7ee92ab3b1", "value": "T17BD533BCD27783344AC2713C515F8A83E0E3CBED9D5431A0475D7C210EA7AB5BAA2A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554341, "uuid": "78200c67-e791-41e3-a964-4f451ccd97d9", "value": "49152:Itm70wqFk+DowagvMTdxi1o3Rhc9oA/QguWY+em7KVtd/0qFyhVB:Itm7VQkMZ7Ob3RmSA/Q8Y+o/0+yhVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554341, "uuid": "3861d2f1-97fb-4e3a-9341-e97cf0954695", "value": 2809880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554341, "uuid": "eb7d098c-134d-4490-b099-219ecec12af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554341, "uuid": "47daa939-a73b-4771-aeb2-a5925b63bf48", "value": "426f407414fb07db97da4d88630bf7a5be3ada280b39d5eff11cb727b772e1eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc1048a-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554366, "uuid": "34d6d398-7cb6-474f-81f8-1c767bc3e57b", "comment": "Malware payload (GoBrut)", "value": "f04a465853dedc5a66a63d9e06117657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554366, "uuid": "0ec964d4-e220-47c0-8521-ed8a1f1e0337", "comment": "Malware payload (GoBrut)", "value": "4497303dbe9ec4c66dc50b8464fb2a899462c3dc30ecc3cfb6211e484bf20595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554366, "uuid": "51f68d71-0736-4bd7-902d-bd8705beb90f", "comment": "Malware payload (GoBrut)", "value": "abb36d7b4b7c7cb1d29212d8fd7a5fead07c0836", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554366, "uuid": "0bc566ca-df18-43b4-b007-7b436e76cdf2", "comment": "Malware payload (GoBrut)", "value": "a8fb1829712c6ec4c72d712accfbbb9eafdd3aa7b56d78ebfe29c0c55005cbc3ab29eec95b5778ff77f5cb37c7ce9a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554366, "uuid": "a2983fba-7db4-4cf2-bc88-c3e7946cbc77", "value": "T1EA763A91E9CB10FAEA032D3191AFB23F573111068764EEC7DB485F52E87B5E2593324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554366, "uuid": "c8ee1ad4-af75-4ea1-b3c3-5cc994732ea8", "value": "98304:DE1b8UT19vcSzjr5/YJ09YUa2megmG5OFZj8KIX:I98UJ+SzB6Ua2ac8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554366, "uuid": "bc00d9c4-3b1c-428d-b57d-883330a98884", "value": 7314370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554366, "uuid": "fcf81134-2bc6-426e-ab6c-71a0ec29a278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554366, "uuid": "2a33e6c8-c701-4ebe-afe1-ca051a583587", "value": "4497303dbe9ec4c66dc50b8464fb2a899462c3dc30ecc3cfb6211e484bf20595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82ceb60-ca7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651539004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "d79e72fe-8db1-48d6-9ae4-50a5bd86dd87", "comment": "Malware payload (Mirai)", "value": "b6d24cce749a255132926cd4643854e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "64c087da-ea64-4a85-9351-2e53b4e1752f", "comment": "Malware payload (Mirai)", "value": "462d1e689cb3799b1c30544e7c45f26ce4fd896cd65dde67236052c8495629c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "49e2158a-3e6c-40c6-bd8e-85597b5b0b55", "comment": "Malware payload (Mirai)", "value": "fddc056dd8b9080e91f88cfe83afddcaff87f980", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "78591bb7-66a7-4410-bafc-71e34e5d166c", "comment": "Malware payload (Mirai)", "value": "ab81cd4a7514e36415ed750bd443b0305ff6d6c2d3f081e66a9049e56cb43b4388b4733a6e2199938164c2c705cfe4c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539004, "uuid": "8439b772-bd59-4fe3-909c-c317a5fc3bde", "value": "T1E35302BDFC4AA0E34B302B77F0BA0AA6A70A283CF545A096163DF3154DD4D4356D8DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539004, "uuid": "8d32fec6-524a-4e82-8dfa-6b6bb6f968ea", "value": "1536:OQJAV28Ebz4l0eT5ayctUFj+6Q1lPeJiPJxUeniv:HCVebC9xctMb8eiYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651539004, "uuid": "37b74cc9-f2de-4a0f-b695-246c303758b6", "value": 62516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651539004, "uuid": "f3089e14-d7d3-47db-b086-89892bc3fd86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539004, "uuid": "b05cf9b4-4174-4e1e-983f-c02cddeef964", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d567fd50-cad4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651577600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577600, "uuid": "68114644-c49f-462d-8b09-81e1adc7e235", "comment": "Malware payload", "value": "6c273bc0f825691cd2bf7cbbeb2d1aab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577600, "uuid": "0ca108e1-c30f-456d-b1f9-1ae2b1fb3666", "comment": "Malware payload", "value": "46f06fa7aee29cb24dbd48c8eec816d97ce059d796f3b2e85010db9aecdae37c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577600, "uuid": "f743a134-f0d6-4c8d-958f-e5a8222cba60", "comment": "Malware payload", "value": "84126ea4e5350e12607d6c1f1bc84fedfaa4cc8e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651577600, "uuid": "9c44d18b-89be-4508-a0d3-a94e69037f89", "comment": "Malware payload", "value": "265d372e81668274da4992c4739ca08a3da6cd487c5965a57577344d36362ea7d40ada6b9f23061439f38a48c53864de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577600, "uuid": "02bb2cc4-70d4-426d-87b6-b076ac8f32b0", "value": "T1B6751A93F992FEA7C0090B3AC59F042803A6D655AB13FB0A798913251D637FE5B4DD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577600, "uuid": "392cec07-8f57-48e3-8cbd-339034b172e4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577600, "uuid": "49753c10-0163-400b-9ac5-7e7628f22520", "value": "24576:sz8tXa0JXqZxBAkGQyaDHybh8jZO2NTF:48tqiqZ0tQlZOST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651577600, "uuid": "9d24f2e6-aabd-4bc5-80a1-943e96ecd952", "value": 1620479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651577600, "uuid": "44155e41-cb2e-4135-9e8a-240bcccbf5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651577600, "uuid": "729e8a84-2183-4028-a2d6-9aa2e7eb59da", "value": "2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90e889a-ca87-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651544454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544454, "uuid": "9d2b2296-7d44-4eca-83da-d0c3c31e68e0", "comment": "Malware payload (Mirai)", "value": "41ffc0b027876f74b68cf8d1da8cb3dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544454, "uuid": "bec386ce-b64a-4f7c-8e93-1129f3a91460", "comment": "Malware payload (Mirai)", "value": "478e54120d50557e1a44ae028b658d7a21df97582db6985b971161f080e2591e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544454, "uuid": "8436cfe7-c559-4d90-89e1-d5a1435b8575", "comment": "Malware payload (Mirai)", "value": "5937cb876df8f1e6fd6bc3729cee7ae31399ecea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651544454, "uuid": "9ffcad58-6ba5-4f07-a283-a3a6464cd9fb", "comment": "Malware payload (Mirai)", "value": "db1b82fdc0affc52667d96ea0202f4995afe43355c8c3302d2f9e9d0b3b0a60ad5a349f6bf2408e3bb0934594a940787", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544454, "uuid": "f9d2f6a0-235d-40a0-8d78-012a00f6e6b9", "value": "T18D03F172F0808D44D1F13DB69DBEE2C0B79CDAA622524AFA50E16F496CA477112C7DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544454, "uuid": "ee57a7da-b712-492c-ab36-c9858dbd6fd0", "value": "768:Ln4fXZUesEg9P7vWPys/vARMULArYBEt5WIJS8q4uVcqgw02NWXhWVZ0jP:Ln4+XJ+H/oaGAAEt5WH4u+qgw06WXwV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651544454, "uuid": "9f3beb15-3f8e-4181-b477-611f695ab1cf", "value": 41260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651544454, "uuid": "e00281e8-aca8-430e-97fe-91521b9f223e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651544454, "uuid": "de6bac75-6b75-459d-b7c1-b70aacfa12c5", "value": "41ffc0b027876f74b68cf8d1da8cb3dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab49dca-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554335, "uuid": "36d06325-2a04-48c5-9e20-54a3ff4835dd", "comment": "Malware payload (GoBrut)", "value": "81cb3ff588977f1502a09c46137111ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554335, "uuid": "d544c07f-7a9f-4111-a02e-07cd73eb2cf1", "comment": "Malware payload (GoBrut)", "value": "47a28d7a3c87af8dfa1066531f3a73947d5162a1d09ef2a4b0a1847c12ab2a64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554335, "uuid": "22e2e7bf-01a5-41c8-b6a4-af90eda4a575", "comment": "Malware payload (GoBrut)", "value": "f71a625e995194cbb355d8bd3e5d01b544bd2bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554335, "uuid": "6d01b193-1ad8-45cc-a158-8683be519ffb", "comment": "Malware payload (GoBrut)", "value": "fa3b5f665a2015bc9fd451bdeb7b616ea95b527d95e6ae828b817e8a19cd974198d2f3075e78088d09a7de164d6e03c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554335, "uuid": "134ddabc-22c8-4f86-a6ac-f2c649b9a574", "value": "T115C533D03791E38C5F19B13A1B1EBA11DCEDF132A1A99143873DBE5A2F63664DAC42D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554335, "uuid": "a52a4c7d-8dba-41b5-871e-99de8ccfb63c", "value": "49152:1q4TDswC9nb+Feo7ZWCIrWT8vgnNsqy4o9kIaUS0hxJz5j/x:1/nqyFVuFvUty4qLJz5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554335, "uuid": "c3ddeae4-0ae5-4629-87b7-8af6f4e15a62", "value": 2628880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554335, "uuid": "e9aa6e36-7853-41b6-b7f0-d9bd43326cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554335, "uuid": "acaa89c5-32f4-45d3-a490-f0b230faa3dc", "value": "47a28d7a3c87af8dfa1066531f3a73947d5162a1d09ef2a4b0a1847c12ab2a64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd4aff4-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581912, "uuid": "1caa7ce4-6dda-40a4-8851-bb945814a857", "comment": "Malware payload (Mirai)", "value": "067b37928033eef82f5683c7b2d4220f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581912, "uuid": "4bd80277-88ae-4dea-b543-953e5c0f036b", "comment": "Malware payload (Mirai)", "value": "47ced55d7eb0f1fc884ef68162ad132e2c2fef4c8de7f9179e7793bb0552dc06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581912, "uuid": "02c87441-840e-46cf-9025-a7dc6842f1d5", "comment": "Malware payload (Mirai)", "value": "e91f3f61aaed04cc29ccf18f34463c5970d1b069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581912, "uuid": "dd64ed53-364b-4b1d-b328-95eb30c5e4b6", "comment": "Malware payload (Mirai)", "value": "f5975a554a97748e96f49621d7d47450cd349fe6b8e13788978cdf84edbf629afb3f9b66b798416b792bf6d104bb8fd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581912, "uuid": "52c8efd5-7b65-403e-a8ea-103f6a88ca52", "value": "T115231996BC91DA0AC6D023B6BD6F60EE330163DAD2EE3247DC145F2476CA90F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581912, "uuid": "d19c41ab-a8ae-4cf8-9a1d-112976eb3199", "value": "768:MILmQU8Fug1UrvDjSS2xYOx+2bziW9WX2yF4GuTnHbtwpYMS1HKKlvqBJ5e2Oy6K:e8IgSrbjSSF0iJ2yF4/n7twqZ1HXll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581912, "uuid": "e5b89d92-eca7-4300-917b-0bf707f720a7", "value": 48268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581912, "uuid": "4cacd05b-5f3f-406b-bb27-c11a78102df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581912, "uuid": "49ba2b02-b211-41f7-802e-ee20e0f2fda3", "value": "067b37928033eef82f5683c7b2d4220f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6113571-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581923, "uuid": "28846542-7353-4485-a242-353bb65d7701", "comment": "Malware payload (Mirai)", "value": "71d26a01d0f30e15e4b4150ee0ec7148", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581923, "uuid": "10ea5c51-7ec1-4fe7-956f-48e981bafc60", "comment": "Malware payload (Mirai)", "value": "4965df9cb0c6ab54bb197bde63762acc45389b9a699cd956c378872e27d2a43b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581923, "uuid": "7297bed8-98a1-4d46-b7a7-28ad15f4808e", "comment": "Malware payload (Mirai)", "value": "10636e450a5eba374119d05249a534f6b6d712bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581923, "uuid": "2fef6bac-1c32-4ae9-a338-c482e1868bc3", "comment": "Malware payload (Mirai)", "value": "ef1d15c1ccdfc4825acb12676465f48153f1c3c535f923fcbda13f0c3400ea2e26e9da2c39e9ad245f1d3f229c7191e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581923, "uuid": "483d0cda-02df-4302-9ef1-25b9c44ea32e", "value": "T16663964D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581923, "uuid": "464b3069-e250-422a-b8a8-f97926e43d6c", "value": "768:RzZWyvL5MsRXxPx2pqV2UMz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2U+GecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581923, "uuid": "97a15c04-d766-4838-87ac-5fb36cf5952e", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581923, "uuid": "22d9040f-74c2-493f-b5e6-e83594aeb448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581923, "uuid": "1b640dd5-e6e2-490a-9270-8568c0f853a5", "value": "71d26a01d0f30e15e4b4150ee0ec7148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ebdd0e-cac3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570165, "uuid": "d68cfc8e-b346-4371-a536-a92a76fd0c65", "comment": "Malware payload (Mirai)", "value": "760bb43398df027aa20cac1f9a3cd1d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570165, "uuid": "d25291ef-c978-4b66-8861-28d962bc61b3", "comment": "Malware payload (Mirai)", "value": "496b5322bb4226028d65ef2d1a6a108c748a008a0735c54e68a341434aa50422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570165, "uuid": "1e53149d-77f5-4cbc-898a-48a98f8e35d6", "comment": "Malware payload (Mirai)", "value": "bcd1666f68c46ada2a0aa18e058d9adef7982fb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570165, "uuid": "c7dd7002-94ed-4537-a91f-1a0660950b80", "comment": "Malware payload (Mirai)", "value": "5ea3672e7ec4949a77f0b7edd193d3acfa51ad9b113df43d0c8ea6ec2c609b341fc1d2da5f73feca3c24728758066ee3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570165, "uuid": "a0f2c509-df4a-4bfe-bc41-3265491caa90", "value": "T1A1031951F8829623C5D01376F65D5A8E3B2467E8E2CF3217AE222F603BD691F0D67D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570165, "uuid": "91dae184-5739-4b3a-8e12-58e2074f9a40", "value": "768:bCKzr4/rxsCX3xJM5zZXyR4l/Y3XoxMQpNjeAcw:eArEdsCX3x13XoxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570165, "uuid": "d50d4233-6e49-42b1-898c-a4d4e90b311e", "value": 38716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570165, "uuid": "770b6485-1e48-44b0-b928-ac3ae253fc0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570165, "uuid": "5985e86a-3bda-4382-ba34-fd19ca4e3f6e", "value": "760bb43398df027aa20cac1f9a3cd1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9645631-cacf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1651575459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575459, "uuid": "fa25796e-9c58-488d-a01e-5900217d324d", "comment": "Malware payload (Nitol)", "value": "9a35c082d7015c0890060028f98f06d7", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575459, "uuid": "1f477d55-a42f-4d93-8ac9-a9870f7e44d2", "comment": "Malware payload (Nitol)", "value": "4bdbc1b83fe73b80fb593ad34a23da59b1fb78367a66480d6311af01e5c46818", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575459, "uuid": "a537da77-78b7-40f5-ad71-0b106b5ee7b2", "comment": "Malware payload (Nitol)", "value": "0bfa9d32976fa9a2af29dc10da7426ea84caa6eb", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575459, "uuid": "ee844c57-f8a9-4e9f-be89-0c5ec81694c0", "comment": "Malware payload (Nitol)", "value": "e45f725d3f3b0bc04e1075e0328c9efb23bd1968e8acf122cd133542c5270298a15a72beffc6b431c2d507a94fe20061", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575459, "uuid": "231ca386-0e1a-465c-ac8f-d8ff4c64450e", "value": "T18F534D0E76928EB2C05505303E885F6766BDF9B30B252C12E74026EABCF4D84F5ADD4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575459, "uuid": "c29d8e96-b6d5-4acd-b0f9-d1bc99d8dab0", "value": "d8be88459980a60ad0a8236d31e3afca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575459, "uuid": "d9eef21c-8720-49fe-b0e5-869cd17a42ba", "value": "768:H//0LiLn76qFStUB6G0N8WbjM3DFrvu14NmBPS3/JNHoGd4DuzfXMV0v:fcLiLnmzte9GQFrvNmxqHoGdDfXMiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651575459, "uuid": "6ce136ac-7ea4-4afc-8be7-3e5d71bf1994", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651575459, "uuid": "f26cf240-68d5-40d7-8850-743db6d3da57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575459, "uuid": "5cfaa0d7-68be-4a8d-90dd-51ac8ec7c043", "value": "4BDBC1B83FE73B80FB593AD34A23DA59B1FB78367A66480D6311AF01E5C46818.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c90020-cab3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651563219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563219, "uuid": "a3a70adb-6036-4354-9d67-09bba242cc39", "comment": "Malware payload", "value": "b3867290d1f8ca1e3de9aab346c48a0c", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "DiscordDownloader", "colour": "#8DB6F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563219, "uuid": "9b02045a-8922-4eb9-b8d9-c3e1613c542f", "comment": "Malware payload", "value": "4cc19efb4a9b54ed026a15239f7d2185d9a9cde5d7fbd53d805d4599cd6b5cdb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "DiscordDownloader", "colour": "#8DB6F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563219, "uuid": "b05ee83c-af3f-44ea-9479-c330eb9f69cc", "comment": "Malware payload", "value": "bf420b77ad2533cc44cd6f834e34a930ad6b2867", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "DiscordDownloader", "colour": "#8DB6F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563219, "uuid": "fe5429b8-2e22-430b-aefe-913d86ca9274", "comment": "Malware payload", "value": "cd4cc1f2b0b40b8db7abf14c03e0c2ef748a4b06d8154a0786aa7b30326c3deab70cf75e3c9fe49c2caa72177880196a", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "DiscordDownloader", "colour": "#8DB6F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563219, "uuid": "af9e982a-38aa-4609-8611-fc4c0d785c7f", "value": "T13ED2E82427E98228C2BE5B7C9C7246059375E54B7D02DB5D39D4608E3F3BB418A13FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563219, "uuid": "82e6f56d-64a7-4d94-b483-5473e8e10900", "value": "768:QqLtMKv8GOaPZmitbQZDz9R1eCYcV6Tizh:QqqQPOajbQd5ea6Tiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563219, "uuid": "a5d5b886-e04e-4cbf-951c-55728fcd1970", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563219, "uuid": "6de2bbf1-e79f-4dc7-bddd-80a7a80e676d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563219, "uuid": "a0dd6a4a-38cc-496d-8811-b9af9110a03c", "value": "4cc19efb4a9b54ed026a15239f7d2185d9a9cde5d7fbd53d805d4599cd6b5cdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073c9c3a-ca80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651541176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541176, "uuid": "b3db79cf-1421-458f-ac4e-f1d73fbeb1ba", "comment": "Malware payload (Gafgyt)", "value": "9c6ac6cdeaa3088d56de16ccb288636d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541176, "uuid": "9b1d8450-15ae-4aba-9a23-bc304eb17302", "comment": "Malware payload (Gafgyt)", "value": "4dee3e1102202ca10b23a7cf75d5ace64a32054e921685b8a42da6033dc55be5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541176, "uuid": "d0df5633-a931-41db-b344-b5f4d1568d9c", "comment": "Malware payload (Gafgyt)", "value": "e6596be1af4fa2937f4cc675d1d309d73415071f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541176, "uuid": "e5b36b4b-3b5b-4d62-a637-00f27e3f5393", "comment": "Malware payload (Gafgyt)", "value": "69a21e3ebdfc61991c55bf43c87fc895b45786445a8d353a4df5bc17cfeec0058cefefb3db93b778c4ec19e8f240d363", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541176, "uuid": "89926457-101e-4e07-88b8-8a770c7e6ebe", "value": "T15F13E076E1A0C2EAE3BC4072357FAB4714D94768E50C1AB257C433727A43B9625C8AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541176, "uuid": "9d93e722-f3d4-4bd5-ba8d-c1f9cf803c31", "value": "768:wBLaP3gG7Xz8Vft6ejZ6d8Miwkj15skS7nbcuyD7UryqBxP0GMdH:ftA2ejQd8Wy5sk8nouy8mqnhwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541176, "uuid": "f49659d1-1ac5-4c3e-8069-1d764a0215bd", "value": 41532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541176, "uuid": "cae3ce8a-5fe7-46a8-96a7-873081889ccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541176, "uuid": "5efe235a-4f81-4df2-8b3f-a3230872a764", "value": "gummy.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc8b84c-cac9-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1651572915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572915, "uuid": "d111795c-45e6-4dc5-b382-de8589d67f27", "comment": "Malware payload (ArkeiStealer)", "value": "d51c6dff0390d4bc5863d39780f9b976", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572915, "uuid": "6096a1a7-5fdb-4b42-8e5e-b612492b4516", "comment": "Malware payload (ArkeiStealer)", "value": "4def4ad12c7aab38e6248c20e211272f1c920a0295c8beda6228543e58c2129c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572915, "uuid": "0ed1143e-7293-4d4d-b16e-511ee7c06d35", "comment": "Malware payload (ArkeiStealer)", "value": "3cf58f57e91dc35c831e529006ddeebeb3e168b7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572915, "uuid": "702e1d7a-4773-466a-b0b5-5cf29bcc5460", "comment": "Malware payload (ArkeiStealer)", "value": "b7e0d25ae60293e5e1a07580ff3b9e968dca1a008e107d9aca9dc9d1d8e093925d7ce3b71b8a1504d4e74cefc9ea60b7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572915, "uuid": "ffa2b70f-16e1-48a6-845c-9f0a4dbf3ecc", "value": "T178F3F1570169121EC0F16F7ED1D17E3ACADC3A1E366CCA283A9C2FEC876D448572748A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572915, "uuid": "30e4928a-6218-4c92-9c7f-286b0908f459", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572915, "uuid": "8b84f579-8f16-462d-9353-6e84091d21fe", "value": "3072:U3T4Zw0W+H2fJpl7oeJbCBR4mfaKgowMUW7nv16JSp8Bb8EG:U4Zf2fblk6CB+mSKHa78EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651572915, "uuid": "0b612103-b243-4229-ba97-9c2082f0470a", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651572915, "uuid": "4bec0f37-1bce-4eb8-9f6e-5de98abf2caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572915, "uuid": "4bff2bbd-a3c6-4b8a-8a21-9da542777456", "value": "4def4ad12c7aab38e6248c20e211272f1c920a0295c8beda6228543e58c2129c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d11c0c8-cadb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651580351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580351, "uuid": "e4052c4c-13e3-408a-badf-494095a56d81", "comment": "Malware payload (AgentTesla)", "value": "672620a8f072e949ebec5ea3c8319e9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580351, "uuid": "edb230ce-530d-419e-af69-57b904354cfe", "comment": "Malware payload (AgentTesla)", "value": "4e5f78c248460423b7fdcb4e5369dabf99f106f04aa8b98bbd7713d060e6e2eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580351, "uuid": "c6e6debe-8c73-46a8-96d7-4763613667c5", "comment": "Malware payload (AgentTesla)", "value": "516f450b7a1864c2bb0d5db30dedb902b685c5ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580351, "uuid": "9d1484fa-81e2-49be-aa26-91f5d5750e1b", "comment": "Malware payload (AgentTesla)", "value": "77f3fa62114e1b9b07618f493a1ae869df75fb6bca75d0b380cb235e87c4e646e7c517273c5b7f6bb98becaf58196900", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580351, "uuid": "de0727b7-e106-417f-aece-6567b879dc91", "value": "T17ED4D09A33E8EC14E13E37746C64E09887F1E1CB17BA836B50DAD1E57B317452B921A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580351, "uuid": "cf2645ad-b0d8-41d7-abf3-40ae022d1003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580351, "uuid": "1ae71b37-2684-460d-b528-7f47428f3829", "value": "12288:4IhFdtq0Gme8HXdEFafdJHnIrs+n1QLYeDow7tpw:bhFdtl5R3aqHnp+OYBOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580351, "uuid": "cbb39502-d0b8-413d-858d-0d19a1e7b6f0", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580351, "uuid": "33ea199c-4b52-4006-b45f-5a02f2820b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580351, "uuid": "90199903-4fa8-40dd-9175-1cb49b10a56f", "value": "104 PICIF RIYADH SOSHEET 1033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a99ac5-cadd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651581135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581135, "uuid": "3d8feeef-487c-4857-aec4-1399646504a4", "comment": "Malware payload (Loki)", "value": "b7d1584e4a767b4eba8f46997d75c20c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581135, "uuid": "2bef741f-a991-491b-920d-27aa2d4fcf88", "comment": "Malware payload (Loki)", "value": "4eb6180be03b71d0d63f458795a479eae12df53e6298d817c0bd24740995b389", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581135, "uuid": "5ec74f29-a184-4ae1-981f-568669cbaec9", "comment": "Malware payload (Loki)", "value": "1572594d38f076aadcdd582c2777892ff0fb60c3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581135, "uuid": "e726d769-658a-4865-ab43-92fa1dfa6c4a", "comment": "Malware payload (Loki)", "value": "0725c170f7affdbf2ad61cb1d0702a0f159aa421d759fb9244933b745bbfd1b4ccb23b4a30d24cd7924c26e59cc99c54", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581135, "uuid": "ed05c823-f8aa-45fa-bf4e-cc51a2a16256", "value": "T1CED439C0F58196E3DD1A9B3256BACE3012222DB95534F71F2AC83FE73BB76971025582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581135, "uuid": "6513903f-734f-4859-bf6e-288efdfaf799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581135, "uuid": "379c0ddc-5a2d-4b4f-ab24-1626e68c8a6f", "value": "12288:Dw+jCBtBy1Zz3QMtMaJU8W2URBX5KGG7t0P7r9r/+ppppppppppppppppppppppJ:t+Bt6Z3vJUSUTBGm1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581135, "uuid": "d89e10f3-928c-4d10-b2b3-3d75e090781e", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581135, "uuid": "52397521-9fa0-485f-a304-6f633d344199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581135, "uuid": "3c01b2a0-b0a8-422d-9ec8-a5fbf919cd38", "value": "FACTURA DHL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1810b98f-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651570840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570840, "uuid": "69af00fe-4276-44fd-8f35-eb2627db7437", "comment": "Malware payload", "value": "18904cb889dc3ae9b936b314cd8f2339", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570840, "uuid": "d5c1657f-9272-40c7-8078-552d6ef0be92", "comment": "Malware payload", "value": "4ebc234f72cecb5f6c62178f8c0ee1c723dce33838fbac6f6d364247af4ac8ec", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570840, "uuid": "e5f6a6f0-3e4f-43e2-bd76-be77f2e6837c", "comment": "Malware payload", "value": "6e7947e27c92d617fee90a79f599b99345c544ff", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570840, "uuid": "fd5c89c1-ba90-4b7e-ad14-c8273d53523f", "comment": "Malware payload", "value": "df70184c97651b5b58688f467141e896dc480ee434c891e4203fe6faa8d295c853cdf95414914e905ce6f409650bc251", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570840, "uuid": "b98f724c-7cd0-4dd8-976c-e7a670962e18", "value": "T193C30A1917FC9576E6BF1B796870202803B5F4933923EE9E1F80A4DA7D32B9186117B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570840, "uuid": "c31bba19-98e8-4302-a6f7-5fefa2ac5bc6", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570840, "uuid": "9c213082-6928-4a68-9c7a-aaea70f3f84f", "value": "3072:Up9T2mniq0qd5mvKN2W8QZCuhYX48bUt+w37nM1/AmlAnMzobl:y9T2mniq0wmvKNDCuhYxbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570840, "uuid": "f1586261-af23-4efd-916d-5ee046591345", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570840, "uuid": "29511dbf-1dab-40f3-bc70-082d5309282b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570840, "uuid": "c4067d4a-c8b7-4405-ab21-0830c4ce076a", "value": "4ebc234f72cecb5f6c62178f8c0ee1c723dce33838fbac6f6d364247af4ac8ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a15916a-cafd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651595110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651595110, "uuid": "a6c42010-a164-42b5-9b12-cd5825172358", "comment": "Malware payload (Loki)", "value": "81b31ef6c1bb7842d387b9a1a680ff17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651595110, "uuid": "5769d90c-25e6-402e-be94-f3a8c6e62ccd", "comment": "Malware payload (Loki)", "value": "4fcb98c0d290235f50b5ad42ccd1d6514621ae40028cb965966ab586ef85d201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651595110, "uuid": "a09012bf-387f-494f-ad43-da35f776e319", "comment": "Malware payload (Loki)", "value": "ba2cb3d9e569854e4d7f80750137328d2a37ed8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651595110, "uuid": "da9bff7c-bdc6-4598-8e47-14a264eb43fa", "comment": "Malware payload (Loki)", "value": "914ff8e5c89fbbb5f0c7771487f1f466b4e3b16cb0034f0de35fba1b42987e07e90728bf047f08cb08425f86e48abec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651595110, "uuid": "93be9675-d702-424a-b844-be6aa384fdae", "value": "T148548E00BB90D034F5B716F449B993A8793EBDB19B3451CB62D82AEE56346E4EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651595110, "uuid": "23706bb6-a520-4e05-9f49-58ab45109720", "value": "e5b6e06744f7650591efa113fc2dfa45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651595110, "uuid": "b834a9a2-1e17-46aa-bb9d-b6d0a718ae33", "value": "6144:fup4CJMpICynpVCXhh9cMIiZ8/V3GBYiUJpXe//:WyCJswwhhKMIiK3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651595110, "uuid": "631b5245-df62-4fc8-a600-6118e56b9c25", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651595110, "uuid": "5b1f6ef7-249a-4e79-94ec-e885a1d8ef12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651595110, "uuid": "3af42eb0-20a0-49a0-9e02-6ace6cc08402", "value": "document(1).UUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367c837f-cab1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651562301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562301, "uuid": "3897eccf-8104-411c-954d-a737f0934ddc", "comment": "Malware payload (AveMariaRAT)", "value": "4f3cb63554e8f86ee7ef55b81c8e5813", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562301, "uuid": "c2119e7b-0432-4bc0-9761-13074b24affe", "comment": "Malware payload (AveMariaRAT)", "value": "508af91f6a041f7c6484e5a94e921f034efc13d5e27877042693a938709b4c2d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562301, "uuid": "0461bcee-5c85-4e58-8ff7-37ee8d92531f", "comment": "Malware payload (AveMariaRAT)", "value": "6ea06d00fe0d682fa44d3ecdd403975f77faeed1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562301, "uuid": "5ed6409f-5ef4-4580-bae1-22b4a3fbc83d", "comment": "Malware payload (AveMariaRAT)", "value": "39e04702ec0650efb18e4b4d796ca3c4096198d820c2ab71318685327869874cca6453b0777f8d13466386e2dcccbd17", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562301, "uuid": "f5c20543-00e2-4f85-8f4c-3d15681c72c7", "value": "T1D4259F62F3914577D72616344C4B5BE56A36BF313E26AF4A6BF81D4C2F39380382A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562301, "uuid": "f512b3d0-06e5-4850-bd72-dfeb74340958", "value": "d238327224fe86b801d8740c7ecac4f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562301, "uuid": "87ce3615-a03a-4615-8491-4dfc84a1c2bd", "value": "24576:8KzElevxJIGQGoP/oCqvqpFtVSn52XcNV:74Ox+ZdpSn52Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651562301, "uuid": "dd8727b2-4ce9-417e-9002-607e6478c644", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651562301, "uuid": "3424b7f4-8f76-4caa-bea5-1fc92f65979d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562301, "uuid": "f1dd4954-5903-4ee3-8959-306cc58229fa", "value": "Narudzba u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ef0bab-ca99-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651552120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552120, "uuid": "3478ef27-4f19-4ef3-9949-64b572e142b5", "comment": "Malware payload", "value": "ddfc7437b582b9e81bd3d79d4a61c317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552120, "uuid": "60697cd5-6c78-4976-a4f5-b5ab208e52e7", "comment": "Malware payload", "value": "50cb91150fcc6ed8233dfff5c033ad18c394c1e684ef42cc641ec0d7b5937497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552120, "uuid": "36fe6d7a-d23a-42f1-a337-5c2aaff8c839", "comment": "Malware payload", "value": "56ed929e7a460b93057aba8544009106f965a275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651552120, "uuid": "2a4ddf85-6937-4f61-9b76-f76c5618a31d", "comment": "Malware payload", "value": "dd95336e1752cf6f7c7ad36dde5a9a9ebf8e5c4fb1947dc700bc524cf381a33c2a96d487f1e43523042dc36daf1f3005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552120, "uuid": "d79a5b43-5d73-49b8-89a3-e22220bd6536", "value": "T1A0C4231412EF0332D67932FD86AD13E223FA5954B152F399BE2871FA4753F9E1025B82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552120, "uuid": "d35b0f49-11b9-48fb-bd50-30a2e26ff361", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552120, "uuid": "9886fb44-8fda-4ffe-aa44-a084f6cdb463", "value": "12288:S62L2IUT53lDlvqWUWj+FpfSABsUMaXCvmLJcQqdX30Y8vL:r2+T53lAFlFpKAB5hpqQgd8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651552120, "uuid": "1b265826-5238-4422-91af-d43188be6372", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651552120, "uuid": "93972b9e-18b2-48fa-ad8b-b2912af89c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651552120, "uuid": "a1460895-f009-4661-90b0-5095bd51d7fd", "value": "SecuriteInfo.com.W32.AIDetectNet.01.16735.15557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a551c20f-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582673, "uuid": "d8999c2e-da74-40c7-9bcf-b3c41aad84d7", "comment": "Malware payload", "value": "e9acd63775073970d6029eef207c1658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582673, "uuid": "b07737b6-ec53-45ba-a631-f681fcfd5ce6", "comment": "Malware payload", "value": "516c51e9a6a66816dd6899762b596dff44a27504fe5aa0c7a54cf759d41c456a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582673, "uuid": "8e92c997-896f-45ff-8d76-0a91072da328", "comment": "Malware payload", "value": "40c6474f0a89c5a9167ec7125f52329cce5e2685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582673, "uuid": "86cf3ffe-a48f-4586-b81e-be30044a56d9", "comment": "Malware payload", "value": "1c97d651ee1210941d3221e5ce75ba1343ab3b0071df81a74c14493c0c8b99e7e570d08a92d582922cbeaf74081db6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582673, "uuid": "5ebcf51e-a91b-42a6-9cea-4b4295568769", "value": "T1AF157B327A42813ED1B21139817C5B76D83DAD2017A280DBF3E4766A9F74DC17A3936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582673, "uuid": "26f5c4e2-51d2-4bc3-90ac-aec73dca3f1c", "value": "3e8ffe7554b44936643968dfd9b4dc29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582673, "uuid": "90065495-6560-4627-bb8f-5a6dfa57f6c1", "value": "12288:/u6NGJ+z+Qk8zdIuzygdbege7Y2LUKjWzhFN/HirXUgZAZ0OpfAqNfgDlRU:/dGJ+6Q7zdIaeRLUKj+N/HqZGroD3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582673, "uuid": "ebd06815-854f-40e2-bb13-b85c6b2c8383", "value": 889072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582673, "uuid": "5ce6f143-0d9b-4bf1-8f95-211d7ade6703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582673, "uuid": "2835c6aa-a504-4194-9ff4-de87f27ac073", "value": "SecuriteInfo.com.Adware.Softcnapp.124.24327.14533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519d4290-cac8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651572225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572225, "uuid": "d38f2be0-fbfb-4c27-95ad-211bb8f59905", "comment": "Malware payload", "value": "5e5c6e8591e22223754c0fac0435d8e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572225, "uuid": "f9f0364a-9aff-43f5-b7f0-42d261932ab7", "comment": "Malware payload", "value": "51d4145f2b12fad2c48d867ee7b72c498bf1a52b1272d5ce72205949966fb7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572225, "uuid": "c6492677-6e34-473a-9dfa-91c1ccd78464", "comment": "Malware payload", "value": "37e3c69020f882a2ec7d596fb1c2d545c5a836a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572225, "uuid": "394ab3ec-20bb-4782-9931-ece0a8ec915b", "comment": "Malware payload", "value": "d52e6b6060ac2b654b50f72200d62525ec0bba19f1b45cd16f57d3d590141dc181ec1b34f4ccf15809ddac425701083d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572225, "uuid": "1f1ca651-6e78-42ba-9c94-aee7edb0bcf4", "value": "T1C415F140F15EBCD6E52615B64AB954606276EB8B602ECA4578F2B35E88B33C33077D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572225, "uuid": "5210d7f1-612f-4ff3-aebd-d2837da103ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572225, "uuid": "ce21688d-6cf9-45f5-9b06-8ee85df13c3f", "value": "24576:q42SFVcJVpvTyir8B8LorM4srQSRtCRRvd0+GZcUcT:qNSFVo7Ty+wsbROi3ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651572225, "uuid": "82fc6cb8-1f3c-441c-99d6-bcd557d8617a", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651572225, "uuid": "543bba2f-db6c-455f-8b9a-39097dda66e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572225, "uuid": "9182752d-babe-460a-87aa-751b85ea78bb", "value": "PO#7100459206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da10a2da-cae8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651586198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586198, "uuid": "dfd3c913-453b-4ee9-87ea-84089583f892", "comment": "Malware payload (Quakbot)", "value": "c437087cad4cdb4b4f729ac59c260cb9", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586198, "uuid": "4e94e932-9bf4-4af4-8102-9dcdd71f6a2f", "comment": "Malware payload (Quakbot)", "value": "534f993e4231e697e3d36d098ea5a16aa8a2c84867058d43c93dba02234bb18c", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586198, "uuid": "a77ae710-3508-4240-8e78-75790effd866", "comment": "Malware payload (Quakbot)", "value": "415845b6249139ad4a504de4d3d11848de2a207f", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586198, "uuid": "699bfe59-56eb-4657-bb0a-af91e7743f6e", "comment": "Malware payload (Quakbot)", "value": "75df52efa9a0fc911e105aa24ce21f7c4d674a9c1b1211ca93649a28a3b1b4f64976dc4bb6c6d75c959d020966bf41cf", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586198, "uuid": "7b460e4a-c322-4123-b351-4d7058678cd7", "value": "T17D45121380447432C4E5557831485E62392B789EE039BAE88FDB17FE3B591F9EE399C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586198, "uuid": "052eabb0-0e37-4180-a198-d7ec0cfe1165", "value": "24576:IiG0mdDHrGZRjIo21FXm5Ob1mi0MriSo+fTA50MriSo+fTAw0MriSo+fTAA0MriE:IiGbbqRj2185ObMiS+f0S+ffS+fxS+fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651586198, "uuid": "498bc6bf-d875-4014-b5d7-666392d34c01", "value": 1260266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651586198, "uuid": "2a9fe673-7f5e-4550-8c23-d8beb76ef650", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586198, "uuid": "5d6579e1-b890-409e-afee-4ae85fc561ef", "value": "c_3245235532.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31649e2-cacd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651574509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574509, "uuid": "5e2415b9-ac97-465a-95bd-37d94a8ce379", "comment": "Malware payload", "value": "b84464a09e8d707d1d1d60be6158224d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574509, "uuid": "5c636b74-0a59-464c-b1a3-d81fdc3edf47", "comment": "Malware payload", "value": "5430394ea19a7c57dea6d2d07c389bb5fd12bb4e3e64f98911148ae0f870dfdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574509, "uuid": "31e35b2b-e561-48ac-be73-e1f95ed123a7", "comment": "Malware payload", "value": "514ca38e20826863eac766857f97c05f269df219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574509, "uuid": "7366af5f-36f5-4569-a7ee-d46af849896d", "comment": "Malware payload", "value": "cf427b1c2bcbc1fa6d208e138de47c695bdf05f97746c5f0ca72973610fea31605e5948ff4d0c8d0017cfe33c58ebe89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574509, "uuid": "61e6ca94-5e08-4831-a02b-44f59c0f117b", "value": "T123A53330A6C9E9CCC54EE971550F4B2DC6380D1D70E5AB14834D7AA3AA327C4A37DB7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574509, "uuid": "fb2803e8-55d6-4788-a4f0-8e1df01ca867", "value": "ec5bff8621035738ea190bd3a332b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574509, "uuid": "160edee4-b862-47d5-935f-47e951152cf7", "value": "49152:o+oUnUNekVtjJC0mz0tBS7mvmZu8qzP5LON1F/syyryiOfNxKrWAi:/ooUNnVtjJCL08mOuRzgN1hfiOfNAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651574509, "uuid": "a3a5b2cf-eb6d-4797-9b39-e5b503b91d29", "value": 2216448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651574509, "uuid": "ff0a8ea4-00ea-491e-8203-aed052d38577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574509, "uuid": "2545ef03-0d85-4851-b212-8d27f61aada2", "value": "Telegram\u4e2d\u65871\u7248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4f19b1-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554308, "uuid": "1cca1d93-1152-4f9b-a43a-93e097df48cd", "comment": "Malware payload (GoBrut)", "value": "bcb90a675debb8be750fac39c9ed9bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554308, "uuid": "fa00b235-83b8-453b-a204-81b95dd94674", "comment": "Malware payload (GoBrut)", "value": "54b7cf38f1227c20f79817206fabd49823ce83f9a749e93feb44a4ff51e1ce6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554308, "uuid": "f662201e-5b78-498e-a8d0-c445e4c34fc3", "comment": "Malware payload (GoBrut)", "value": "784878fa929858f14c250883620884fb86784270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554308, "uuid": "1ad6490e-8ccd-42a3-8791-2e857802d63a", "comment": "Malware payload (GoBrut)", "value": "2167fc04c8941126b644c5caa4299a783bfa47eed301fecf2537f1e3370f71e2e21126e8c572f3ec2334fb568623b57c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554308, "uuid": "742a7c78-8de2-4740-8534-384ba87ed327", "value": "T1D8A5338BDE46D424D355864945EB9BCCF2ACF3E0028D5E452FF18B562440AFED781AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554308, "uuid": "57f5e08d-478a-4247-8723-c1a7a16a9c8f", "value": "49152:8dfjEIRbloS+0dpxtVDNM7KXEs/I+u6EIo97LWBtaLgdCAaR6:8NjEIxiSbpxt47qLISEI0KBULC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554308, "uuid": "b9a76446-b3a4-4dde-85c1-45488fafb0a9", "value": 2228796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554308, "uuid": "c9a0dcea-747b-4043-b943-aa5cc5c83cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554308, "uuid": "9452093b-37b2-4078-94c4-9350340297b3", "value": "54b7cf38f1227c20f79817206fabd49823ce83f9a749e93feb44a4ff51e1ce6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0358c53c-cae1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582831, "uuid": "04b69026-12bc-46a3-acc2-e43422332ae9", "comment": "Malware payload", "value": "eb2742617b708680b7b3598211b765f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582831, "uuid": "8ce27201-a271-4dcb-867a-e28c624bc6c6", "comment": "Malware payload", "value": "54bd9b9af65457dc1eac5a2c310035d0e0e7f24b70d6428aad6f62cc598e1092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582831, "uuid": "b8cb3b52-7a85-4945-89f6-3b84b2090966", "comment": "Malware payload", "value": "c2007ce25f33e7b07cba6c4c9a4ecfde3a095e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582831, "uuid": "38493ce2-1b3b-430a-8c5b-6d6d4fe0bf78", "comment": "Malware payload", "value": "37576a763c0be9f28addfe67d03605e5f5d409c146de20cd92a434667fa0387adc9672c8040db14511d5a9c19faad0a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582831, "uuid": "4ee3a9e1-e1cb-4baf-87c6-9be15614f10e", "value": "T103052244A913C032D27417F786D8125523B3B74AF253E6AA7DDA35BC1A43BF70A94E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582831, "uuid": "5707fc4a-b3d5-437c-aca3-59d2bb1f3154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582831, "uuid": "4b9671d9-81db-431f-856a-c11fbf6844f8", "value": "24576:Q2U0V/jIJ86F5RlxGpzNhm/SvLQNcXMuyKt604z8z:lU0V/+DF3fGpzJvw8604z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582831, "uuid": "a806cb22-db39-4657-bbc0-affd29493015", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582831, "uuid": "ada41caf-3e9d-431d-844a-63e2d51864f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582831, "uuid": "abfacbab-d843-4825-b4b3-ba08f714fb48", "value": "Facturas Pagadas al Vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c7f37f-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651588655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588655, "uuid": "8e9f54eb-af05-4d95-93e9-4c96c0c66399", "comment": "Malware payload (Formbook)", "value": "bea68267e64a89bd987cd617d0a263c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588655, "uuid": "cb9bdce2-a0ae-4041-8872-4788ccb1a0be", "comment": "Malware payload (Formbook)", "value": "56d2044455e3029e58f168db4593928cff5953e47423a1ed452d9d967b8fd85e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588655, "uuid": "5702fbfe-0de9-4dcb-bfc0-360fc15e4869", "comment": "Malware payload (Formbook)", "value": "bbb7dab15686dd860a2fc21130c38f4bcf6889d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588655, "uuid": "91f4b8dd-8848-4ec8-8112-8b85c4585809", "comment": "Malware payload (Formbook)", "value": "7a9ae9ffd30ecc532acb78745618eb45508bb4bf81e908f74bcf624140e731f1389a9c41f224ab2f9d56f690a88c6173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588655, "uuid": "15ad0286-809c-4b80-a672-7556021d5383", "value": "T1AA732A0A3A896216C6E876F884F291855776ADF71122C14F9CF83E2C59337A3ECC574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588655, "uuid": "35d1fb19-0ea6-4917-8d14-9f40cffb7b14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588655, "uuid": "b8662271-6b5c-49d9-82ff-7d6069b7a0f5", "value": "1536:k0rtIShUCm0MFQv+G5ppaYtpGSp30VD0:kybmbG5SYtlEVD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588655, "uuid": "bef2ef7e-ec67-4934-8b1a-7ff21fc1c135", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588655, "uuid": "ce945639-c0ef-4abd-94e6-803c0dfb2ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588655, "uuid": "3c3530ae-b673-4383-b90f-2f3edb2ad250", "value": "AWB 80258723268766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66cce25-cabe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651568206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568206, "uuid": "cecbc441-42e2-490e-89b7-e6afc7327dfa", "comment": "Malware payload (Quakbot)", "value": "d09bf2eeb4bf503519d777b954d1f493", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568206, "uuid": "73c9f771-4458-4d72-a348-9c25dbb9ab4a", "comment": "Malware payload (Quakbot)", "value": "572292c2347f6a033742ba298463740a657999c98eb8928b5b37f1bc9fd773e4", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568206, "uuid": "d96d98fc-3021-4368-a88a-265c0ff27e3b", "comment": "Malware payload (Quakbot)", "value": "37aef686d7a24de5fb46521ab2da8b99b364ce21", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568206, "uuid": "0cf59cac-067a-41e1-bbe9-bef09a176be2", "comment": "Malware payload (Quakbot)", "value": "2be783a10cb40c8e71f5b871987b9ad06a20c61825d7d7c847a10ad1569afd10a3ee74ab35cbc3e6c9d471ffd42878b4", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568206, "uuid": "4f06d517-0e78-4aba-b329-dc3b6a22f5b5", "value": "T13D45121380447432C4E5557831485E62392B789EE039BAE88FDB17FE3B591F9EE399C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568206, "uuid": "0cfa90d4-6a91-4514-b674-90780529bb1c", "value": "24576:EiG0mdDHrGZRjIo21FXm5Ob1mi0MriSo+fTA50MriSo+fTAw0MriSo+fTAA0MriE:EiGbbqRj2185ObMiS+f0S+ffS+fxS+fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651568206, "uuid": "68c77a84-fab9-4902-b345-7a1451128c4f", "value": 1260266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651568206, "uuid": "89499fc5-4319-403c-8e53-cec0fb70060a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568206, "uuid": "4a07bfc4-6ff5-4e0c-b969-53d23e0800dc", "value": "NO_445295807.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9c2886-cada-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651580189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580189, "uuid": "be589036-48cb-4fea-b0e9-ffc8f5c47ad0", "comment": "Malware payload (Quakbot)", "value": "a4c0eb6589237b0627c261008ae8e34d", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580189, "uuid": "a666d3eb-8c4f-4c56-91fa-e6d3bd879a33", "comment": "Malware payload (Quakbot)", "value": "575ed61db0b944ac4571f190e37cf5ae5739d82fd8bcff1283024d054a046d4c", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580189, "uuid": "802487ee-9e1b-458f-a5ab-08e354ff197a", "comment": "Malware payload (Quakbot)", "value": "eeb9089930a03b780055cac0f193398ac5219e78", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580189, "uuid": "24f349f1-0b0f-406f-8c70-8840af007093", "comment": "Malware payload (Quakbot)", "value": "48a704691ebb1e128c40ac0f5687dc9f9cad70527cd538519f98365cc3022e3cfc1e768d93e1f09b37e07961f3a7f55d", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580189, "uuid": "8d2215e6-2bda-41e5-bf12-f44d0d13c7b8", "value": "T1B545121380447432C4E5557831485E62392B789EE039BAE88FDB17FE3B591F9EE399C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580189, "uuid": "8e73de55-da83-4cfa-9439-6da42ec1b080", "value": "24576:0iG0mdDHrGZRjIo21FXm5Ob1mi0MriSo+fTA50MriSo+fTAw0MriSo+fTAA0MriE:0iGbbqRj2185ObMiS+f0S+ffS+fxS+fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580189, "uuid": "74aa0801-a299-4153-ae15-e6e7689abfca", "value": 1260266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580189, "uuid": "bf5c3999-d759-459d-a325-c0d5a4b63790", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580189, "uuid": "27e0bf39-e21d-4386-b5cd-3134e077e079", "value": "A_2253998007.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc59c53-cb2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651614608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "c7a86ba5-2061-4e48-b4a0-983a00d48fb5", "comment": "Malware payload (Mirai)", "value": "5e1737a255197cc5f1b4ae8af58b7dd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "4415a4f6-4f56-452f-96dc-80c889ad1cb9", "comment": "Malware payload (Mirai)", "value": "583ab1b173942cf06deb48f82d4c88c9694d786aeb02941ecde87bf464cdda0f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "66cc2d29-d347-42b5-8933-0d5cdc88ee0e", "comment": "Malware payload (Mirai)", "value": "678582f1902151b96deef04f9b228ccf46c2bb34", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614608, "uuid": "dcfde64a-d20a-4664-affe-5ce5ca660761", "comment": "Malware payload (Mirai)", "value": "bf8050df8da9050995f41e36cfcb63995acae63fca0192796b52f57b935d9f18aa0e9f752d0f6b2f0ae58a1809e9af0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614608, "uuid": "fd14ff5c-ba1d-4582-8ca4-745a26a92ae7", "value": "T12D834B897C40A622C6C912B7FA1F028D332627D8D2E9330BDD255F71778B92B0DA7756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614608, "uuid": "139b71aa-7bb4-4e5f-ab23-7f5229aca81e", "value": "1536:K9bBV5n9UpIfKSTq9nxNzPcluP8uQDlOmRlEpvX2Bx:QbBDn9oIy1fPcluP8upukex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614608, "uuid": "8e948101-0d27-4121-8586-1b3b499c1498", "value": 88268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614608, "uuid": "b74c56ec-7a56-4d99-837f-fabed390af6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614608, "uuid": "8549907d-f81f-4d5a-b0c6-49738cffe620", "value": "garm-20220503-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfa06e9-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582684, "uuid": "4872fa1b-0fc2-4490-a4a7-cf279991cf0d", "comment": "Malware payload", "value": "bfa689875427aeefab862def47e22e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582684, "uuid": "6f424260-e054-4617-8a31-8dc1a009e2f9", "comment": "Malware payload", "value": "5947add4c30f0f7729d79457c96a2540bcf4a6a1556cd3d728c95dd3b010bc9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582684, "uuid": "e36ef1ed-5b23-4a37-848c-e11b9bc4147c", "comment": "Malware payload", "value": "d3a43578ae83e55060087a863176c4bbf25946cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582684, "uuid": "2d0789b0-5e99-459b-9914-c9d2106acb52", "comment": "Malware payload", "value": "a5694ad7aa8722d1b00646ea807cf9bace49bd321717ff4b7e40aa7095f7250c52a9d19cd788a297036c14ce7b2d1ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582684, "uuid": "50df339b-2b83-4fd1-9f33-47afe172760a", "value": "T102844A263AC24B7ED166273A407C57B9D56DDDA018F284AFF3B4B36A8F34D90683C146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582684, "uuid": "fa88fdac-175a-4a93-9a20-eb65334dd324", "value": "7d4f2d2784a92e4c0fcbaeff263bac27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582684, "uuid": "8e45deec-1ec3-442a-8262-17d3bc9554c9", "value": "6144:h4Fslx1VPhSef8PrAOdBIbRqLOp7LAqNfCnOJHN8:audP5fiXaREOpfAqNfCnOJHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582684, "uuid": "5b3e3336-6f7a-48b4-8525-066fe888d0f2", "value": 398056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582684, "uuid": "1a896d93-9698-4886-95f1-b464969b79a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582684, "uuid": "db578dda-d2ff-4ba6-ad28-dac8f9f47b76", "value": "SecuriteInfo.com.Adware.Softcnapp.124.31774.8079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20fe282-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582668, "uuid": "3c8aa369-5319-4fcb-8a0c-43c47d9ecc95", "comment": "Malware payload", "value": "0ff9c7fbde50e0cf17e8d0ae16c25930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582668, "uuid": "0ef466de-c9e5-4c84-a482-c9c32717d6c6", "comment": "Malware payload", "value": "5a6638b1edca711c107d707ee79dd3fd3065b4ba7a799c8cd85dae089a6dcff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582668, "uuid": "3fc56067-4d6b-47cd-aed6-9796abc12fb6", "comment": "Malware payload", "value": "951a3e0a444cafc96fc198535c98c9da3ea2e68d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582668, "uuid": "7d4013bd-5eb1-49e7-b741-843923656ead", "comment": "Malware payload", "value": "4a7ba4b4a0726bb6102126a7c177bda4d50f4b9c7d2846e8bd9707f8f2c9b13b93f7ae3b0a369b5b1183ae3e84330021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582668, "uuid": "97b8bd8e-452b-4c9a-b5ca-78e28b1bc376", "value": "T1CD263383EAA28672DFA60D74A209C2D259BF3E51607590A63C8CFDD73B3B710781D764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582668, "uuid": "d4ec9445-099d-4319-b7a1-91d6d439bd0e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582668, "uuid": "2fec4df5-a3a1-406c-b8bd-4125f6c963bc", "value": "98304:F3Wrcj4XrklHD+AuMvg/t0orDfV9inocf9Snj8p7i6qwkNc:1W4gOj+wvCt0oHVInNf9+8p7i6wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582668, "uuid": "43e7a9a4-44df-413d-a690-cee6f7725da5", "value": 4678440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582668, "uuid": "b0205745-67da-4794-b2eb-e82861758998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582668, "uuid": "bfd6a423-6ab3-477f-bc73-4691096db0be", "value": "SecuriteInfo.com.Adware.Toolbar.894.5397.5331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11be5bd-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554319, "uuid": "534b40fc-bc12-413c-8768-a4ce83f7a744", "comment": "Malware payload (GoBrut)", "value": "d0942bd2a774b194c94d7a5c6bee836a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554319, "uuid": "5b8285c7-ddf6-4f9c-a15c-a97079b214b7", "comment": "Malware payload (GoBrut)", "value": "5b0b9aed0b0ab715fde2c3c1e7845cf48cda5d458df7d63c9f41bd896b96de9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554319, "uuid": "846b8e8f-8466-4173-98aa-6e113e8270e8", "comment": "Malware payload (GoBrut)", "value": "931b4643e2d42bf12256652922f954d20c82e3dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554319, "uuid": "6de2aa53-90aa-4c6d-9372-ccd03fe446c4", "comment": "Malware payload (GoBrut)", "value": "5f9d8c039263c2574b37d36f751ea6d30542f5f37536acebeaf0f841c49333a1d1b642db0306bf2d510bc10b09dc6924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554319, "uuid": "e2ceef2e-0d20-4397-b8b7-4a8ccb9ecb98", "value": "T175B533FF4315C29A6ED00A6A57EEB7A66223101F920C1C1B0C65F4D456FCC6CA66FF49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554319, "uuid": "e676e632-91b4-4cef-bf0f-97c48ece8bda", "value": "49152:5k3aKkGa7HCrJd+Th/M1kputLSMKbYVApdWm41Y8FNclUmWrGtchl:5kDkGa7HCP+lTC8bY8dHUlFWGm5Il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554319, "uuid": "a1e49b7f-c83d-4a34-97be-aff94b2c1701", "value": 2377736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554319, "uuid": "25ae2be3-6fda-43b1-b918-8ac5563e4208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554319, "uuid": "8a948831-cebb-4073-af23-44d22e06a3ae", "value": "5b0b9aed0b0ab715fde2c3c1e7845cf48cda5d458df7d63c9f41bd896b96de9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb090bb-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651588670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588670, "uuid": "f96f4a6c-f201-46f9-a77d-1db33727e949", "comment": "Malware payload", "value": "898faf83ca0dd92c0dad081cf9cc77d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588670, "uuid": "155b7b97-5f2e-45b2-a4f0-9d134d2fd8b2", "comment": "Malware payload", "value": "5b4093ddc952ab92eb6d1b12d0bf512b14112eb82b8a4efd231e6b263cf8cba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588670, "uuid": "c07916d3-abac-47a7-8858-fce84e1850dc", "comment": "Malware payload", "value": "a1988466a15e8c27408e2e9b32d2f3a5c7edf725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588670, "uuid": "e6a9fda1-9e5f-46e6-82b0-432541ba0382", "comment": "Malware payload", "value": "4e188ceaea69bb94e9f2f109f87d8a148ced9d1393069657e76c66301ce291d689e78ba6d5136031ebdc20826db333fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588670, "uuid": "bd938d19-3b94-489c-820a-5a7126651bd9", "value": "T125C42216419B4332D17833BEE65513A363F3AAB5B063F2C82E44B2BDD9D77A91240F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588670, "uuid": "a043334e-eab9-42d2-8d59-cfc7476ee3ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588670, "uuid": "d22f25d3-b996-4c1b-aff9-b40a8ce50641", "value": "12288:lQ2L2IpprfPW7LddHxYljmw6T0LB8EWo73LAAv/ldr8vL:22JW7ntwo01mQtvn8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588670, "uuid": "eeb5e366-01bb-445a-a39c-4a9c7208ea52", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588670, "uuid": "4ead29f4-f886-47a1-9915-3cca582c7b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588670, "uuid": "60f3e4b2-a2af-4cfa-9db1-2bf11b8a8b08", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90900aad-caac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651560305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651560305, "uuid": "6715f379-7cb8-4145-96c0-9889c7684abc", "comment": "Malware payload", "value": "5763366b55fa0b99d0e235aceab95fbe", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651560305, "uuid": "15f77d3e-dd79-4c9a-956a-0c99764b9a6d", "comment": "Malware payload", "value": "5b5733e06d5f9664f2827ebeb11b8f9f78bbef92adc1de4200bfd4d36f00d3f3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651560305, "uuid": "98920043-9311-46ca-8df9-b45193a80fe9", "comment": "Malware payload", "value": "e775eea3f233d65cffc8aa5aadfd9d19f114556c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651560305, "uuid": "cd83c65a-d0e1-4315-8b8d-6f045e3b1dfd", "comment": "Malware payload", "value": "84ac9bb4f664df91f3fa25593ea2a59222777c3f7d2dd9318354b6b53d9d183ee916e6d2e9aa008e653cd76131617767", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651560305, "uuid": "b2a37497-540a-46f1-a936-0a6d14f33f30", "value": "T1F32402383A1E9398FA47C83072256DB0FD44BEBD19A5150BE79BBE4E7178C7210235E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651560305, "uuid": "af83ef7c-a5d8-4f22-b607-a186e3943144", "value": "6144:b3jrVoLSFKkaEIrJFxjGbMIcL+MIAq02y:bHVoLsoYMHIAqby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651560305, "uuid": "ab303812-d51c-4145-9eb3-47dae6744048", "value": 210920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651560305, "uuid": "1c476378-923d-4723-852a-a56115c04fae", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651560305, "uuid": "29a55d27-5b7b-4d4f-affb-1147a9c841a9", "value": "DHL_AWB_NO#907853880911.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4223f4cc-cae6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651585084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585084, "uuid": "398beb61-3521-468f-8543-685eb97808a1", "comment": "Malware payload", "value": "889426ca89436a5617783f3c7d20fb82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585084, "uuid": "d6b61918-9325-45be-999c-f4ff24cda891", "comment": "Malware payload", "value": "5bae4f449aae1a7d56a6c19912cabd200b0b423a1a274187cf0b4a85771cd393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585084, "uuid": "8aa31e3b-67e8-4328-83c2-627fe219d0db", "comment": "Malware payload", "value": "137eb14b632452a15ca74438a9e6b50620451a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585084, "uuid": "62aa2646-6116-4d1e-8a4e-bb5a7287d165", "comment": "Malware payload", "value": "d4b1060e4061cfcc65ccae75e660baee8cc8215bcaf8ad8e8b94a9a9285e425195f27c466ad1638407ec5491a79d81c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585084, "uuid": "dc9d8188-a772-465b-b881-788364fef79b", "value": "T16E052255BBEBC637D674223781C863A503B1AF06F123EB9F798C218D894377B4991B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585084, "uuid": "eac633c7-7657-42ac-9725-c377ad1dfea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585084, "uuid": "af892f4e-2c89-437a-a35b-92ba82593511", "value": "24576:jh72rF0Tl7gRFKF+brfIQCRgaLaeq98z:gOTlQ5rfuRgy28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585084, "uuid": "3a9fcced-ba8a-4cc7-b508-42f154645576", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585084, "uuid": "735ed4eb-84ce-485d-a557-415cfaaf188f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585084, "uuid": "3a6240e4-f273-457d-9dec-9efad8fa9a1d", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d78a81a-cab1-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651562286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562286, "uuid": "c8dcc4bc-8e58-447d-9f9b-1a99d5128698", "comment": "Malware payload (GoBrut)", "value": "84c8193befa1b7d0e6093c798a19d72d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562286, "uuid": "7a33755a-c387-492b-b35b-f9026810118d", "comment": "Malware payload (GoBrut)", "value": "5c099c44a634a36a49113de45ff434ecea74bbd96febc49559b87e1c56e2f6cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562286, "uuid": "dfc21659-9125-42f0-ac49-adcbd895d186", "comment": "Malware payload (GoBrut)", "value": "f5bf5b5f0631245bc792804886f03f6c02dd20fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562286, "uuid": "9f86a192-b72e-4479-92e4-7d94a27b8000", "comment": "Malware payload (GoBrut)", "value": "d869495d2f7a58ebd726c7f14f89f5355df17bfe22d9db225d76f7aafac693fc30ea71d5d16883b7cabc5d54c00cad5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562286, "uuid": "d3f01e34-7daf-45e7-902f-9036ae46ee7d", "value": "T1FA167267F8A614E5C5FFE0748756A226BDB134A6833477E36EE14A860329FE4B53D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562286, "uuid": "4520545e-abe1-44c7-aac3-816846aa89bf", "value": "49152:p9f6v7C+3sVU74tHva6hrQFnzIsGTPBuh5171HrdjGHSQedbqm+IQYIEx9158Xv:8bQUVZFz/Mg7nht3QFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651562286, "uuid": "7b1bd5d9-26fe-49a4-94d6-f38efdc9f8e9", "value": 4333568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651562286, "uuid": "10b9f94b-eb22-49a7-a02c-58576957060d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562286, "uuid": "dd86d8be-6e28-4d6c-aae9-9d98121a147f", "value": "5c099c44a634a36a49113de45ff434ecea74bbd96febc49559b87e1c56e2f6cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627bbff0-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651563663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563663, "uuid": "380e7eaa-66c5-45dc-aa93-79cfdd276009", "comment": "Malware payload (AgentTesla)", "value": "e9cc77b8f6334d764405193f788203e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563663, "uuid": "6a96a000-8b00-4672-94da-c46029284ad0", "comment": "Malware payload (AgentTesla)", "value": "5db110dfb57b23725b541beb1cf53e421e94ad03e87b33c8471c96f6a7e3dadc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563663, "uuid": "fefdde9e-bf54-4d6d-a728-ef2e1582ee81", "comment": "Malware payload (AgentTesla)", "value": "acae255b7a1b349d3906f65bf9e8e21e53eb5f5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563663, "uuid": "91fdcc9b-ad8d-4ffd-8f32-49a425d3fb3f", "comment": "Malware payload (AgentTesla)", "value": "8176de2800c4479b6c4bde562e8f8cda6718f05f6dfd20fca787609305db834d10ce1d9d1cca651d988c3a287b8bee89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563663, "uuid": "59e3a3db-e3af-405e-8491-ca1c285dfba7", "value": "T14573888261444232D9640DFF886873CD0E6EEE074B269595A53F3EF9BCB51808BF8347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563663, "uuid": "b8c19611-07bb-46c9-b7fa-083aca97a95e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563663, "uuid": "b5149561-2548-43a1-b702-24e72b82a77f", "value": "384:o6jJx/BOeI59DnmTf8fsUSI22rscNO8M9dLTceCjpIhppA:o6jJNwagSIHTe9dLTdpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563663, "uuid": "794373bd-bd4e-4f3b-aaaf-5b457cef96a2", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563663, "uuid": "20a78eb6-88f9-46b1-9954-1b6a60ec90bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563663, "uuid": "0a78254c-501f-4077-824b-2086b27d1f5e", "value": "STATEMENT OF ACCOUNT (SOA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00ddab7-cacf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nitol)", "timestamp": 1651575497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575497, "uuid": "3ad99847-3881-48f2-8496-476eb3629a85", "comment": "Malware payload (Nitol)", "value": "993eb8c031a18137355b7515a0ffbc3b", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575497, "uuid": "92591c7f-b960-402c-bf55-f9bed02acf35", "comment": "Malware payload (Nitol)", "value": "5eee28565df26ca44d7d27adb3c5f4256705d12ea57085ab7ceca57346296f9e", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575497, "uuid": "8c9f3fcf-e334-4d2d-a587-de6dbe9bb9a7", "comment": "Malware payload (Nitol)", "value": "c246934b7c95f423dfea23a11de8528f8b60408f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575497, "uuid": "d7c994a3-c8d2-445f-af2b-035fbc297d1f", "comment": "Malware payload (Nitol)", "value": "871c1fdd59527bed39fd2e1805e2cd261032375a99e3bbc2d31302fe1c12ee19a52ebdb1e0e68e389cf6c6f20350e888", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575497, "uuid": "7a2f120d-236b-49cd-97af-b393b80f5f44", "value": "T129946D05B6D1C8B3C34E00703996DF3B86BEBA741DDA1843AB5B47DA2D715D8E139A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575497, "uuid": "407f6f6c-b7f5-4ce2-85bc-b537bb57fae5", "value": "623dbe379540ae8d2cb2eccd12c4a33b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575497, "uuid": "3f60e6ca-709d-46b5-b259-499efc86eabf", "value": "1536:EhmStfVfTWgOWvuzSrlitxOtLiThtIrDNI5qQy2GbXDf1sFiqvywoD:EhpdD3vPrUtx50+kQyBf1Jqv/oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651575497, "uuid": "346111fd-7c12-4b3e-8e9e-15d590977c0e", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651575497, "uuid": "e530ce93-1e1e-46f3-b979-dfe99ead192e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575497, "uuid": "864962db-55a3-4bcd-8b1d-bdec15e1dee7", "value": "5EEE28565DF26CA44D7D27ADB3C5F4256705D12EA57085AB7CECA57346296F9E.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dfee0f-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585466, "uuid": "1df77a71-11bd-4c56-a294-1bb01dd58769", "comment": "Malware payload (YellowCockatoo)", "value": "2a70217fb2c2062972a83edad25f466e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585466, "uuid": "f8026191-7622-4dff-81f8-087027fcc00e", "comment": "Malware payload (YellowCockatoo)", "value": "5f39e07aa909ba23f38e94b42aa27e4918f233332e6389dba21892793f4d55ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585466, "uuid": "c319fa01-00e0-4405-aef1-d2139830b93c", "comment": "Malware payload (YellowCockatoo)", "value": "6a6159c3037761f05822696b625d9e437ec00602", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585466, "uuid": "94cfafc8-1a41-47b9-8067-a90ead0bb1ea", "comment": "Malware payload (YellowCockatoo)", "value": "7df4e85caf138dd03a9d87b52f414eed5da272fac987f04ef166d60cd3739d80ec67095f9c3d004e289fe73514d246ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585466, "uuid": "f31e0120-238b-4489-8978-a6d83b86fd84", "value": "T16E048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585466, "uuid": "04da1af0-524d-407e-a985-e830ee7ff76d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585466, "uuid": "93b110f3-846b-40e3-b904-21d66a03bcf2", "value": "3072:4NrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2M:kO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585466, "uuid": "0637b219-5884-4813-b893-3895c9b721cb", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585466, "uuid": "e5d2fbad-5eaa-4c7e-b20f-5b66fcb4781d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585466, "uuid": "92dffd00-b034-4679-b14b-f88755c5aa03", "value": "5f39e07aa909ba23f38e94b42aa27e4918f233332e6389dba21892793f4d55ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab8c771-cb11-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651603567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603567, "uuid": "57751868-ac29-4a29-bc27-fd392f585b83", "comment": "Malware payload", "value": "c9904224b3a6cfdb2fd428da7c5ce932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603567, "uuid": "c5c8ba31-0624-48e9-9c7b-ad299d379e0e", "comment": "Malware payload", "value": "5ff140eba5f339c29d84cb75f8a4749d2556d8b7dadb3513ddd1768e13014bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603567, "uuid": "4881777e-2e20-43a5-bbcf-336317588750", "comment": "Malware payload", "value": "a1ef5bb401752f2e2dd2126371ae034868f78b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603567, "uuid": "de0b34f0-86c6-49a6-957e-f2df52b0c0f5", "comment": "Malware payload", "value": "104ca0cfec8aea5230c2bc4497753042ad081f7b6a401aad3f1a07b6f775cfaeb4b9f4a16545c95e336734eb06ca0cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603567, "uuid": "fa4dc057-6de6-4ee0-8ccb-f57e3ca7476b", "value": "T1B385AEE38342510BF1532031C11EAE6D747717315B8FB8B367886AEDE72B2D19A29B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603567, "uuid": "d62a38ff-b175-4970-9ad3-a3875f4f013c", "value": "6db5fd36871bf7ca78879be44b315cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603567, "uuid": "8cc0d889-42e9-4994-b73f-eb68b2bd9062", "value": "49152:NXez6H2cda1yMo1+3qhYVAs0Vbx13zqrZ:Nez6H2cdawMogCfh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651603567, "uuid": "f2c1568d-2105-418b-aef6-219bee90c755", "value": 1786368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651603567, "uuid": "7ce93ade-b6f1-4fd7-b3cd-841a20e4277e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603567, "uuid": "b4372361-ea2b-452b-954c-f0fdc09712a4", "value": "KMSAuto Net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67069718-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651580851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580851, "uuid": "c5eacab2-2c51-4dc9-9253-f31e58783eac", "comment": "Malware payload", "value": "8d5f02df076cca3587fab28d0ddc40ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580851, "uuid": "ed8a6f57-7672-4b25-a45a-426a404caf71", "comment": "Malware payload", "value": "60a20d6e8f786f9540a292038bfae3ce606301087018a22d450c7ee1ef75c140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580851, "uuid": "c98b6be7-0133-41ed-8f44-8621385d8bfa", "comment": "Malware payload", "value": "34d814f874dbb3ee0080237b19a2cdd11a5244e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580851, "uuid": "6e3a84ee-b7a5-4c6a-8af9-95499421939b", "comment": "Malware payload", "value": "6e5dda7ee3d319487a45c88f3fc6c55ea6b7e22cddbb0f0375a6fa5f4b806330fe89f69a7736110fb75a4223d563dbc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580851, "uuid": "0cffcb44-ebca-4cd6-ae50-bb180bc786c0", "value": "T14684BF10BB90D035F5B726F05A76D3A8793E7DE19B2491CB62E426EE9A346E0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580851, "uuid": "7433ca30-11e2-4284-b8be-2c068c2dc407", "value": "a143483d4d0f129b0ed032a728de83df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580851, "uuid": "f9dbc04e-4451-4d62-8a50-ca955175a864", "value": "6144:qccm7bKxX/dCLFxw8Ss/DF34txqePb9WfDnG7S0kiX:qrm7bKBdIFxw8Ss/VOXb9WfD0S/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580851, "uuid": "39bf2d8e-5514-4eca-9831-09abc2fc82cf", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580851, "uuid": "3d4ace78-6bc7-4eb3-af5d-1ee063e330f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580851, "uuid": "99e3c2eb-00ab-4fce-9944-8c6f3b3ab36a", "value": "8d5f02df076cca3587fab28d0ddc40ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ff989f-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651563671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563671, "uuid": "8e8c0d63-6afb-4f63-b393-7ab04fa9661b", "comment": "Malware payload (AveMariaRAT)", "value": "fd15833c864e8d4644941cbf810f05dd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563671, "uuid": "b08027be-2602-4c74-b192-9484bfcd05e1", "comment": "Malware payload (AveMariaRAT)", "value": "633c0ac621ac43b678d04e0f6dbc30fba07e0baa5b5640b29aba8197af9ca2a2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563671, "uuid": "24a80e06-f56c-4153-9c31-77a983a84129", "comment": "Malware payload (AveMariaRAT)", "value": "b05e5a5d8921ecc8688b154f9f399b9f20f81de6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563671, "uuid": "f209924d-fdf3-4df1-b644-cc66e8831736", "comment": "Malware payload (AveMariaRAT)", "value": "2379be56f03cd888918aecd0d76a894fa9fee1259e91d0b9e3cc004052c461378bc74567bf175e1a6c0f2a363e98f97f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563671, "uuid": "5d1e9d84-b174-4505-860f-72f3e8ef5da9", "value": "T1C9C3FD8261444632DA640DFE886873C90E6BEE0747369595743F7EB9BFB21808BF9347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563671, "uuid": "2e4d2068-43c4-41e5-8212-7bdf93becc77", "value": "384:E8cJ3KcPO7I59znD6UYTx8fU0SI22rscNO8M9dLTceCjpIhppL:E8cJaL7lWSIHTe9dLTdpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563671, "uuid": "9905f5d9-400c-47df-91af-abc7d1878411", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563671, "uuid": "d77eb3fc-da08-4c28-a2f9-8f9c5d6af806", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563671, "uuid": "cb545d17-da2e-473f-a447-59fb9f1ae8bc", "value": "STATEMENT OF ACCOUNT (SOA).img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e7b470-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651563617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563617, "uuid": "88219cb4-acd9-476d-a37d-1b8a9ba8659f", "comment": "Malware payload (GoBrut)", "value": "60d6a04443e993d7bf8377daa81bf690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563617, "uuid": "49b5afa9-327d-4fb2-98ae-1b0b6807d968", "comment": "Malware payload (GoBrut)", "value": "64104cb674d2e0d423ae7bc68526ca4ade8765180ad57a57d5d51f6f4663881f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563617, "uuid": "66ccc10c-81e6-4678-8fca-3a246cbfd2cb", "comment": "Malware payload (GoBrut)", "value": "a2a82441bbf1b208b824a117cb9909fc0b0e3f8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563617, "uuid": "4adc3da7-b629-4552-9e1a-91fd26bd73bf", "comment": "Malware payload (GoBrut)", "value": "a9a68abfb5af85479a097b6448082456fe2e37cf554f053acf5ea9c5b64bae24c2cc8f7b41b17854277cf0687d5e3e17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563617, "uuid": "6f8790ee-204b-418b-b5f3-19bba374b569", "value": "T10D864B1BF8A614D6C2FEE1708A965222BF7134A5C33137D76F9086951B66FE4B93E300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563617, "uuid": "75c291e6-9814-44d9-87ae-86fd78ed368a", "value": "98304:jCLB/22SnyjeG50Kfr6C7KLgtT6I/dVAvZ/:2+2cySGaKfPlSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563617, "uuid": "4fc3072e-320e-4695-94a1-9990a3cbbe83", "value": 8570744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563617, "uuid": "142a0a5e-8204-46d9-851a-a8f53389c131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563617, "uuid": "08d0a76d-4caa-4db3-ac27-0e03313e0d57", "value": "64104cb674d2e0d423ae7bc68526ca4ade8765180ad57a57d5d51f6f4663881f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd67db8-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591220, "uuid": "b7da79be-4c03-45c2-ae7b-039584020f77", "comment": "Malware payload (Mirai)", "value": "2668de6c36c4168b32c8c937eb83016b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591220, "uuid": "7ceeeb23-490f-4a4e-a392-164cc39f99b8", "comment": "Malware payload (Mirai)", "value": "65bf6f278007a279baa02be75ba1932c2c85a77b85956ccce4abf248279052a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591220, "uuid": "4fa2a697-c1b9-4d69-a624-0c7271df0b28", "comment": "Malware payload (Mirai)", "value": "ad3f234e67c25a79d4d382b7a2e32ba66a51f2de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591220, "uuid": "3f2ab356-ddb3-4643-81ec-ddce91bc3b4f", "comment": "Malware payload (Mirai)", "value": "7fe852213372224ffbc55185aa2cf8ae0ecdb9c86db0d0531b773dbb96ff1357e24417edd8ebf361df6c4c63184eb10f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591220, "uuid": "e5d467a0-35dc-4792-8768-e81677fa3c92", "value": "T1FE332981BC919A02C9D423B7FA2E01CD372563A9E2DF7207DE212F1177CA92F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591220, "uuid": "356731e6-9367-466f-862c-35745b8579c1", "value": "768:aQ8hF5yjQQsLC3TfWvHbXKspnpeyKNSwrfqUoOiTXVcBNOS9iVbPR2MK:mhF5yjQ7LC3TWvHbXBGlSkfqvm9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591220, "uuid": "5b6bad63-e8e8-4dd9-8c00-5f9db69b263a", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591220, "uuid": "84c99705-ed94-4364-872e-8df4f8a0f1e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591220, "uuid": "f9e28f47-067e-49f0-8c81-9b3f8d4a579f", "value": "arm-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b63c4db-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585448, "uuid": "aabf58d2-175e-4691-b074-858d47c80d4a", "comment": "Malware payload (YellowCockatoo)", "value": "b1648c11f821a969c51974d89f748981", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585448, "uuid": "ae7a6378-850b-4b35-8163-e4d872479d8e", "comment": "Malware payload (YellowCockatoo)", "value": "6648caf71c178f49cc619f2f68af67e18706d00f5bd0b890705d8ab8e086abfc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585448, "uuid": "aa4fed2b-2899-4d11-8815-3a884724eb60", "comment": "Malware payload (YellowCockatoo)", "value": "4e63147535c1f56e40a64e4f1fb0809d4ea9d0af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585448, "uuid": "3957cfc4-84e7-4698-81fc-af2749a0db58", "comment": "Malware payload (YellowCockatoo)", "value": "091ac9d697eaf2f701b307e6b488bec136bf20e95e8e91d65ce22c10dda9b3219d4b4a2001b41338e7882c9730fe31f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585448, "uuid": "ef1c157f-ec9a-43eb-a831-7ca853d6e533", "value": "T106048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585448, "uuid": "6ab380c1-5e23-4aec-98b7-fbb71388e80f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585448, "uuid": "462e4f4e-408c-43f3-aec8-2c939337f5d6", "value": "3072:gNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2M:8O9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585448, "uuid": "dfed4af8-d3a0-4916-b987-75aa13d353dc", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585448, "uuid": "39dbe67b-33f3-4efb-8126-9bd98ad3d0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585448, "uuid": "5a17f7fb-84cd-4d27-b23c-5dc77f237be8", "value": "6648caf71c178f49cc619f2f68af67e18706d00f5bd0b890705d8ab8e086abfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634c6116-cacd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651574402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574402, "uuid": "bb29da43-abdc-440f-ba1e-c3b89005b592", "comment": "Malware payload", "value": "42ad478dd2cb3fb86aab7dc89ea2cf9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574402, "uuid": "65e4d546-05b9-4d64-9bf2-12793e3bc485", "comment": "Malware payload", "value": "67ef630ac44cbb608e400a577c3193001c22f8d6eefe433cb26ca0b7a2f5e848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574402, "uuid": "2f2e8477-6007-4a69-a4c1-3e56c7c12d44", "comment": "Malware payload", "value": "69effebca7dc6b138a47709a7e7d222335bdc7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574402, "uuid": "59359a6c-0b85-44a1-a0dd-d9656cc48bef", "comment": "Malware payload", "value": "255bbed8e04d33b4be27f86dc2351a924e8f27c65860c8741051087ae416f80af51d7da4a11e6c2db70e115a66c97b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574402, "uuid": "74e35467-af3a-4f8e-af29-95e5ce6086ab", "value": "T1C3A41225416B4333D5FC37BA91A6029233FAAE497023F7CC6D9A71DE978725C18A1B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574402, "uuid": "b7b052c9-9fb7-4a08-af19-21377baffb71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574402, "uuid": "6585faa5-b21b-4a46-a4c2-de315f59d309", "value": "12288:KN2L2IWEOAX8ZLWb4JbyI0m5CiXjSZB8vL:A2MXAsZLWb4JbyI75yZB8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651574402, "uuid": "ff48a11a-5547-47b1-a0d6-4f10a2408aba", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651574402, "uuid": "35f5492c-ea50-4e40-b9db-38318df53b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574402, "uuid": "73c85b46-b588-4fee-b903-e24fd353a3d6", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18077.26298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb85def-cb37-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651619862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619862, "uuid": "1ec91283-8a30-4b7d-9e45-4e31d117167e", "comment": "Malware payload", "value": "316dac54ea6da9d969ac5bc50735b724", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619862, "uuid": "1b2ee458-3cd5-4a9d-8cc7-0d8ccf5e6f7b", "comment": "Malware payload", "value": "6809b83004e2dd1f5a4e7e79cbbe5422580b33c7844bf860d403027a12e32b2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619862, "uuid": "83335058-1f36-46d9-9768-703d34314727", "comment": "Malware payload", "value": "4fa694e1623686d5cf58d01f897e1e2cdd0db4f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651619862, "uuid": "e117e04d-839e-46b7-93b6-fa061e3528d4", "comment": "Malware payload", "value": "6794552d21cfe132e434e11bfb25308f5a447464c9811f4aeb9ee0779d0da18a6c48b1d38e448c6c1cfecfe6577f2942", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651619862, "uuid": "ca9d2b9e-0672-4244-bb8a-608b50f1bf10", "value": "T152C47BF172409BD7DD7BAB3612990E5023F1553A9322F70B2FE123E50A53E2F1D62A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651619862, "uuid": "a8f7d3c7-3a84-4b9a-b2a4-c27c7d3a0c46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651619862, "uuid": "aaec9087-dbb3-457e-a984-2af23a7532c6", "value": "6144:5wEPfQMfpNyW3hwMhuShUZjajhrUsWknqVelv9f2FKGduOaVJKOX0GbY34uCF+zg:5wEPfrfh3hv+Zgdq+wIGQOM0/rCnG7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651619862, "uuid": "1aaea9b8-e852-445c-835f-5e312603b203", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651619862, "uuid": "78591ea9-7aa4-4205-a668-f1cad65a6c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651619862, "uuid": "f5a76eca-6403-467b-adeb-37ece96fa59b", "value": "PO#7A68D20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968bb65c-cab3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651563321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563321, "uuid": "12174155-584f-415f-b11b-3788fbe3dea7", "comment": "Malware payload", "value": "f081478be2867b7c8ac098660804a426", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563321, "uuid": "4a4ce8c7-71ed-4798-a61b-fa06ae379627", "comment": "Malware payload", "value": "6a8ebc0b2656ab81b238d306378bee9dd4cb6345feebd574f35c824108191ef5", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563321, "uuid": "c9c0722f-2eee-4811-b6ed-72a6adf63854", "comment": "Malware payload", "value": "f70d0345f02dc0170256ee774d59391a43696554", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563321, "uuid": "1c51e0f5-e640-46da-b1ae-ffc8b28bbfbd", "comment": "Malware payload", "value": "7ac8a10d3d5b8abe1531a49f90a5c8c2c8a78347ffa70bb194e413ecb0e03ec3c0ec678e40c037293be5dbb7281a9b05", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563321, "uuid": "1859e7b8-701e-4e08-85f3-1f7d2a84822c", "value": "T1ADA412A2B5C4CB02D5C776364E94C1E66739FD290B56D60F7584FF0EA831B2D622123B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563321, "uuid": "b46e75d3-9070-4781-9e75-7e48a85f7a53", "value": "12288:9DFDVlq6WLEGulpeKp0GnJO3aq8edvOI+RVOn3rzN9p7GO:9DFDVlq6WLEGCv0GEBdd21VOn9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563321, "uuid": "2f207f4e-2ecd-4975-b749-89b66c68d85e", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563321, "uuid": "a3b1b445-8d81-4389-89ca-4986abc8d6c7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563321, "uuid": "01866355-2045-485f-837b-491502bb846e", "value": "Weekly ACH Payment - 01.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e108402-cafc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651594660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594660, "uuid": "9b1d7775-0f05-4b4f-a1c0-80db529cddc2", "comment": "Malware payload (AgentTesla)", "value": "55a18aaecd30e82ae0c6e5c9f3575a81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594660, "uuid": "8845edce-20ce-4d8d-a702-f34977be7700", "comment": "Malware payload (AgentTesla)", "value": "6ab9b209fdd5fbd49f97a187be268836ba85ff7c4b070a288b44fcbc6e45f659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594660, "uuid": "1779b429-e025-4265-8eea-b91e0de3922b", "comment": "Malware payload (AgentTesla)", "value": "1191c2dbad53eedfd7a675b517d999186940d13f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594660, "uuid": "d543daae-683e-4244-b01b-1865a2d0357f", "comment": "Malware payload (AgentTesla)", "value": "dd3123d23feb66b7bfb8949a73762bc961fd73fac06cc7b4d93b869f6c365d14299600701a2f82a1b4c0fe4036868ded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594660, "uuid": "1f5f16dc-6a59-4347-b723-13a81087577d", "value": "T1E9F490A3651C8AB3DE3AA73E01490DC052F01C6D9299F3071BB86BBDC53D9261D1FA5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594660, "uuid": "6d8e6639-d2b9-4b13-8e05-0f42bcf39925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594660, "uuid": "ab355c4f-6bb3-43fb-a609-3f41d984f53f", "value": "12288:IwEPfyg3hj/uK1DoQ8plz80CUQ1QM9U3DvnD6yZ1LTG7tLIF:IZ3MK1D/8DtqQBzvnDbGaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651594660, "uuid": "1f55ac20-24ed-4c1d-b475-a93e90fbd4d8", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651594660, "uuid": "c7b7252e-3cc5-406c-a137-1bc19336c805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594660, "uuid": "ffa8a41b-faae-4cbb-a61f-e717246915ee", "value": "P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba6e324-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622197, "uuid": "bd1270cf-31a1-4d4d-a3ec-e129cdac149e", "comment": "Malware payload (Mirai)", "value": "526a67fb90bdaf0d34c20deac63b3222", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622197, "uuid": "4afce581-14d4-422b-ac27-4fb93ea1c4b9", "comment": "Malware payload (Mirai)", "value": "6b02d07e283c278add694816c2c0caac87c62c6bad12d6da3bed12e13c3cda04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622197, "uuid": "0c4fa79d-29ff-4a8b-a362-0c628d139178", "comment": "Malware payload (Mirai)", "value": "458568e3a58285c50bc9c41f5a23396f6d9ad2d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622197, "uuid": "016bc44d-ac06-4ab8-aeb6-59e998aade8d", "comment": "Malware payload (Mirai)", "value": "eab7e71a655b44d2fb62fe641b4dac530d276d13bd1931ce1614d1f708c36b628c617e06ab4aadd5e8344387d4cf7bef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622197, "uuid": "5eed6643-53aa-43aa-9aa7-b3d8309aa9b3", "value": "T10FA34C52B6140B87E4930DB42D3F1BD157BEEED021F0B689698FAB5A8635D332446ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622197, "uuid": "f13f6c52-3340-4c22-9b80-6a74c48173f0", "value": "1536:KuXnWprNof8y/ji9cVlWhgnCi37eZA8IeVqVHW+kO6EwIxJGXna10S:lWBMTjQcVlW+8VAWw6EwIvfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622197, "uuid": "656223d7-c40b-4d90-b107-4a9550214b6b", "value": 105208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622197, "uuid": "a3c0b2ef-a6c7-49ff-ac9b-ca0feafb67df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622197, "uuid": "8630befa-6867-462b-87e6-b2e88f205898", "value": "526a67fb90bdaf0d34c20deac63b3222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040e954f-ca80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651541171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541171, "uuid": "854577d5-1ada-4d3b-8b1e-68721f9b992d", "comment": "Malware payload (Gafgyt)", "value": "1fd243b2cbc8e04ac13b95c33c943aa4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541171, "uuid": "36b60ed3-7122-430d-80af-f60ffc65af87", "comment": "Malware payload (Gafgyt)", "value": "6bb88bdbef2d87b00827197fe4ade9c4b0813146727cb386253762b630bab01d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541171, "uuid": "32b05f3d-e4f5-40f9-a4e1-405f922ed53b", "comment": "Malware payload (Gafgyt)", "value": "403e50d0a218842b2b85d06fd2051440c3f91f06", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541171, "uuid": "46a92e6a-9d01-437a-ae1d-6c09e2137a61", "comment": "Malware payload (Gafgyt)", "value": "c1fffa4adb25a8cb0e61b7fd551e01caf41fc8b7ef473d62143c1a2de7c2ca8a6a8e0720853b576221004872331e8323", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541171, "uuid": "71f22379-f722-4964-841a-fa03dd26b820", "value": "T1C213F1C3278461F3C9D1ADF6E7CF4AC8B71392AE954B271C53942BC064A6203A5FD9B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541171, "uuid": "4634e74d-48f6-4ff4-8dbb-85f0401ef3e7", "value": "768:WZ5WLKP4UqJYyVGIgSUr2FunUT1yBlMCR263UPIqW9coG3MH:WHWeP4UqGUJyBl2IqWiJ3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541171, "uuid": "b3803897-aebf-4a30-bc41-d74c0a585e31", "value": 44508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541171, "uuid": "d7a38d4d-0c34-454c-9567-d88832274cb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541171, "uuid": "7d2943bc-8f91-4465-8409-605e61292e8d", "value": "gummy.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834509fe-caeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651587341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587341, "uuid": "e348b5e7-af98-4e51-a640-a1b179129cb2", "comment": "Malware payload", "value": "e8c32318c2c6804df582f3b62a539fcd", "object_relation": "md5", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587341, "uuid": "4e53dfe7-e7e6-4b6c-9b9c-210953b63f44", "comment": "Malware payload", "value": "6ca286d4e1460691a0e56dbc2b6f0df0b18a5d6db068bc875b5edc9256ed8487", "object_relation": "sha256", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587341, "uuid": "acb4d340-5eef-4f1f-a112-6283ce51acca", "comment": "Malware payload", "value": "2d94e0134782ef2401fa086af0f6dcb6a4733fd4", "object_relation": "sha1", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587341, "uuid": "9acc75dd-83b7-467c-a57d-c1329d49395f", "comment": "Malware payload", "value": "db251883cb8cd4b2d3bf0ec9c529731b663bb0c42910c8f6d2d5b8870d92da6302cda766cec02e6f26dd8ee577dece09", "object_relation": "sha3-384", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587341, "uuid": "48535cc9-d58d-4b8f-9b52-50cb8818f7d1", "value": "T171A5AFB8B6542CD2EA7E0777C9D77DE917B227228A8BB9C9406477C30963372EE11814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587341, "uuid": "c24004e4-dc5f-436a-bacc-7eace02eae6c", "value": "12288:OCrTQXkicwDt/PXMh9voih4yN10RgXlbG+NR9JnZApQ6j4:OCCoWt/PMhJ95N1VK6R+pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651587341, "uuid": "c0c2368b-ce09-4a24-8bf4-0042a857a9ca", "value": 2162688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651587341, "uuid": "c6cd5eea-aac6-446a-95e9-af174bd542a2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587341, "uuid": "999ce625-a0f7-42b2-93e8-5771fd732f00", "value": "6ca286d4e1460691a0e56dbc2b6f0df0b18a5d6db068bc875b5edc9256ed8487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a432d7f-cae5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651584722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584722, "uuid": "91119fda-edd7-4dd0-a42e-2769ffc3d955", "comment": "Malware payload (AgentTesla)", "value": "f4c0bc871d4fda60f269e65560677bce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584722, "uuid": "c1d45aa2-fd5e-4468-97fc-c2479016343c", "comment": "Malware payload (AgentTesla)", "value": "6de4569d9946cf92795964def925a371049e858558566d3e1c6305b214e3bfaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584722, "uuid": "bd88fdfe-c8f5-4716-9c6f-67d9b2a31f46", "comment": "Malware payload (AgentTesla)", "value": "80814c2c159d0d296d1739731828dc44afdf4ccd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584722, "uuid": "33a515cb-82f8-4320-a45c-88ca271d0ad4", "comment": "Malware payload (AgentTesla)", "value": "e1a6afa85ae2fab4de0cb383bc47e2ff7453f0ed14b60fbfdb0930517e9e1558e19ed131d0df990ff371768fcec649ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584722, "uuid": "0d79607f-a868-4eb2-8255-d9744d2ac6a0", "value": "T1D824124407F89A3BCB955B7C5A261CE60774AFAD7B23DB36BC4C40AA0E133982502FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584722, "uuid": "ce402f31-baea-4805-bcae-816c7a70e45d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584722, "uuid": "6f799e49-64ea-46d4-ad19-03814c071781", "value": "6144:bQ8faW4uDL3a0xbBt0RNDWu0+9EXGsJUc:hasL3Pxr0RNJ0++dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651584722, "uuid": "3da673a0-ac8b-468e-87da-ebe78b867d8c", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651584722, "uuid": "83dc7321-d262-4b45-90cb-f7ab658faad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584722, "uuid": "84272142-8e3d-4b1a-a8a3-86c81b1bfb51", "value": "f4c0bc871d4fda60f269e65560677bce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfc8193-ca8a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651545481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651545481, "uuid": "fb1c9fba-abd2-40aa-82ed-c1384b542cdb", "comment": "Malware payload (Gafgyt)", "value": "cf15ca26f17c0f60efc742a46563c9b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651545481, "uuid": "aa2c6395-87a0-4167-9476-55a5d19de60d", "comment": "Malware payload (Gafgyt)", "value": "6e4cb60c5ab7ba64ddc2492a92363a53407e9135d04cae202d3fd175555a9f57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651545481, "uuid": "bdbb4a3a-574c-4820-920a-bc98060cac3a", "comment": "Malware payload (Gafgyt)", "value": "353e50ebb5d1bdd3f887fdccbbc5c47ea5439d77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651545481, "uuid": "362f5bc3-812e-4166-a780-b7773267eb70", "comment": "Malware payload (Gafgyt)", "value": "a5ecdfd4e0f9a612807a373ef3b83a9f8fc47f522f50b45168b9cb7818889f08fa35ecd04722955dfb99d16f9de43f8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651545481, "uuid": "69c1d282-9878-40f8-a3c9-002f5b1b8c7e", "value": "T1A0C30A3B77130E63C0CA107111E30732AAB5DF9835B95797A9A07D6C6F3BA843816BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651545481, "uuid": "57b98dd0-cdd6-4099-9bd0-43a5e3ec5470", "value": "1536:tNI8EMn1RanJN95l45tWjStvsDV7v/Pmmi4l5bUCOCntyNO:tnrgJNPl4GO2DBPmm/l5bULCntyNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651545481, "uuid": "b2fdbcd8-1c37-493b-b2b5-3c3e6d40a975", "value": 123575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651545481, "uuid": "92d3aea5-2943-465d-9d95-3077596b559e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651545481, "uuid": "5f7d86b8-97df-4556-967b-4f0dbf2204ee", "value": "cf15ca26f17c0f60efc742a46563c9b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c89759-cac3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651570329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570329, "uuid": "5409d419-e395-4e2d-8a58-47b649add56f", "comment": "Malware payload (AgentTesla)", "value": "05ad18b89bacf967e09ef80acaa28fde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570329, "uuid": "aec3e0a2-87e5-4c38-a7af-9011e5a02654", "comment": "Malware payload (AgentTesla)", "value": "6f246950e4551705a3839ec78388104de1038307a399e7566c81851394734977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570329, "uuid": "3ac677df-352e-4c4d-b0a5-7741659b5f14", "comment": "Malware payload (AgentTesla)", "value": "ba2f6dd05b6646605adc4a7138f70b934697a710", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570329, "uuid": "0a3eb267-1949-4cff-94a2-40c3291675b4", "comment": "Malware payload (AgentTesla)", "value": "8f6e9109e218b8dfc93dcbc3cabdca11d64ba1fe3410665f180b37cec7c6355cc0226c6b496500959a625914c6aa5541", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570329, "uuid": "1cb26430-7d93-4c0a-b93f-4c4eb34d5dec", "value": "T15F254BEEF24031DFCC13D4B669794CB5AB02283A93267247634B33A90D9D7674E36897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570329, "uuid": "2c67831e-c45e-4efc-92f7-5cabcb457232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570329, "uuid": "af9e82ee-5d85-4a01-8b8d-e8bfab149de4", "value": "12288:sWlyuVYq00nzoa+eRbJU0I05oUBpzEEG7tT1rc27T30IdDbrFOSNkPp0W1+fkLkZ:s5uVYanvrF9Po85EEGMi+ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570329, "uuid": "572a6f25-1d19-4c80-a612-bc83c5f903bb", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570329, "uuid": "b90a35cd-9050-428c-9395-b1e7b5a9b542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570329, "uuid": "7c1b5e22-e4f8-4c86-a203-1ddcd6be91c6", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c3ca83-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651582567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582567, "uuid": "bb4e7827-d4a1-4f4a-a8e8-094ccb24e9b8", "comment": "Malware payload (YellowCockatoo)", "value": "8ea44de54bf7bafa547a17b31d15cb20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582567, "uuid": "29f7f1da-ecae-48df-ae13-bbcc06d6a9dc", "comment": "Malware payload (YellowCockatoo)", "value": "6f251a11fe0f3e58ef0036fef550d65c2b05f844f25ac873cfdc91fc13506232", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582567, "uuid": "bfff2021-dc8f-4743-8173-77b933581b79", "comment": "Malware payload (YellowCockatoo)", "value": "462d831c4baf08fdc086ad8c10ca28a562663e66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582567, "uuid": "09cf3fed-dd3b-4cb0-a391-f496ce2a31c9", "comment": "Malware payload (YellowCockatoo)", "value": "28911154b2e46bf8f6d11522e99869463240957ba7b871d171fec44e47d83e9dfd114c4512b949bc5d36d2b625940e43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582567, "uuid": "e07aaf77-01e2-4e6d-a8eb-5bf27598452e", "value": "T14EF412603B8CDAACDB6C46E871AB5328871525F7D082CF8E68D515F0CE6AA50CD543FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582567, "uuid": "c5ac7748-f237-4d5e-a8d8-028f4678e3db", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582567, "uuid": "0a72815f-528c-40b0-8a7d-3958ac9d3869", "value": "12288:Fmcse7GO25JYJX7kjXaztLXxLK4av2JAYgDim:0KgJYp7TzxDa+E5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582567, "uuid": "4b0e1ac2-e0d7-4023-8f41-2b6a93620788", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582567, "uuid": "5d26b209-1444-467a-a4b1-5dc4a224a9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582567, "uuid": "1777cdbe-ee50-4fb6-bf02-ebbcbbc3847a", "value": "output.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a894e6-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582672, "uuid": "8963030d-09ae-41c1-bd56-a978d799522a", "comment": "Malware payload", "value": "e975c524c8db5bca6bb9fc05a1ddb244", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582672, "uuid": "bf6498ab-0953-48e7-b111-2da60be3f8b8", "comment": "Malware payload", "value": "6fd0bdb297e96dddec4755c6329501888c7cc6369f852867354ff98e171601c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582672, "uuid": "ae9daf26-3b6d-4a7a-aa6c-20c174ba5740", "comment": "Malware payload", "value": "a57592964f38db7508a5945d575cd3e2039da678", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582672, "uuid": "d47b246e-d691-429c-90ed-fa89ae47c2bd", "comment": "Malware payload", "value": "4647d0e104a7cc30747290fb2fa8cec37f4371622c987b45563139d46e5a3ea35f35f27946b3319f1ef4f4f8858d8bc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582672, "uuid": "3c166080-021a-4990-b95d-44bc6a421d1b", "value": "T10D24AF017582D573D1BF05301A7AEBA25A7CBD600B68C9FB73D8AF2E4E702C05B35966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582672, "uuid": "9b24c587-9bab-4fcf-90de-8b9a97525d68", "value": "82f70d8806d1554ef7d00b90320f5117", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582672, "uuid": "43be4b95-716e-4fc6-a436-8e96a28652ec", "value": "3072:7350MZdo/wUrRvw+v3U4rFTXGN9KHaz4rqzwTbcrzFbIBAg0Fujnpe60ZpbMRhz/:90zw0vwvIGNkHa8ZAOlXkpbM3DJ3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582672, "uuid": "cebcf90b-678d-4086-804f-829c0c31f4e3", "value": 214760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582672, "uuid": "6f166580-4ee5-4a2a-a593-28a22ecdf498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582672, "uuid": "8c8c5641-539d-4e5b-9ab9-85c4f02a67e5", "value": "SecuriteInfo.com.Adware.Softcnapp.124.6210.22006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a2b85f-cb26-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651612735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612735, "uuid": "e9e052ea-ab78-48a8-84e9-7208666f1e7c", "comment": "Malware payload", "value": "cf7eb797b63e8322269eb8281975af53", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612735, "uuid": "8ff619ef-42af-45e5-b89a-f340689ae99b", "comment": "Malware payload", "value": "710faabf217a5cd3431670558603a45edb1e01970f2a8710514c2cc3dd8c2424", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612735, "uuid": "04e876b2-3dde-4993-8dc8-955aaeab48ea", "comment": "Malware payload", "value": "beff0874841fc49e458f9fbfb04664143535bf32", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651612735, "uuid": "8ae7f059-bd62-456e-904d-37a938b82c9b", "comment": "Malware payload", "value": "5d357c26bd00f0fada8cb1bca2b147e9c9c37762efe4104973844c439e72ab256d11c088fc49b3578404ef57cfe795fa", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651612735, "uuid": "c088623b-733d-4c0f-a8c3-0af656eb821c", "value": "T15446332857E61689FA721D782431A06149FA7B55EC22DB8CF3C1320ECB67D0ADB36D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651612735, "uuid": "9fe5f079-4a0a-4f12-87e5-fa50be72a967", "value": "98304:DtClVkoOSfJNp8FUcwti78OqJ7TPBLYVrsk9N8ivyhAdsPSQx3UGgdc:DlobhH8FUcwti7TQlgVN8iNIShc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651612735, "uuid": "795d52e8-f5b3-4616-96b0-f2c42cb43589", "value": 5434336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651612735, "uuid": "26e91558-9bb7-4156-8d73-ac8b8b3581f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651612735, "uuid": "42990faa-546d-4ddc-b6f7-763011fb7c9a", "value": "710faabf217a5cd3431670558603a45edb1e01970f2a8710514c2cc3dd8c2424.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0cfe72-cab3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651563302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563302, "uuid": "2e187956-0d93-447c-aced-e93c2e68237b", "comment": "Malware payload", "value": "5c17c869a5e946a548de5c149f075771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563302, "uuid": "945a9099-097c-4d45-b0f5-99b1311dbe30", "comment": "Malware payload", "value": "712bb51aaeab1db04eb1ce1f04e3680bf838e7100283bb109f06e4a0139bb1ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563302, "uuid": "85689196-4609-46f6-a7f2-038576eeb8c2", "comment": "Malware payload", "value": "2b2242c446b2821725b80cbeac2e47b33ab3fc2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563302, "uuid": "0fb8a7dd-9838-4c6d-91a6-18b565372b74", "comment": "Malware payload", "value": "51968e9d6bc9b86faef0b7a0a2b56a0e89717f1478984f85350046d221e80ff09db39c1e35a7c640d4f51ab7201a2057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563302, "uuid": "455ecb1f-3416-4f79-b115-7ba6ad711a9c", "value": "T13336AF02BB868175E5E34235456BB7FB867ABC104B2185CB739C3B0E9A313E1693B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563302, "uuid": "e885941f-ba77-4a30-aaa0-fb0b4811dc7d", "value": "2722e71420a4b3a701f5c64908fa997b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563302, "uuid": "3303dad1-e2c0-4472-a5aa-af8d45b79bb6", "value": "98304:BhRchPS0xpNqWt5EKHOPpCvoQGckG7gfDn5XTC4+wJsv6tWKFdu9CTvHUQxf:BI6RpKHzvoVckrDCnwJsv6tWKFdu9CTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563302, "uuid": "a3e77b93-a162-4bf6-9d90-867e9ed12d7e", "value": 5077256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563302, "uuid": "a6f49076-802d-4e8f-8bc1-fe93da8c724b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563302, "uuid": "aad02bac-e38f-44aa-adc1-e5e9eb48ee6d", "value": "5c17c869a5e946a548de5c149f075771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d51897-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554324, "uuid": "b52429ac-1f11-428b-aa20-3b4cb0e902d2", "comment": "Malware payload (GoBrut)", "value": "9e6feeeae07e4045bdf9a9791f9605d9", "object_relation": "md5", "Tag": [ { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554324, "uuid": "1c1c068b-39dd-400f-aa11-22e538fdc31b", "comment": "Malware payload (GoBrut)", "value": "73d5b6dbb715c2995889b8aa9639a51852fb2f93155ae8c52c4b4b483a55cc33", "object_relation": "sha256", "Tag": [ { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554324, "uuid": "6beaf735-234b-4232-aec8-5e8949e594fd", "comment": "Malware payload (GoBrut)", "value": "6c80634f9c9b4ee5b34c080f2fcbcead4d21c53e", "object_relation": "sha1", "Tag": [ { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554324, "uuid": "b7b828b1-cc70-479d-a109-e6a4c9b1f1c9", "comment": "Malware payload (GoBrut)", "value": "3729d79757f021352f9833cb8f305e7960c4e3c55c8f9afe413a1d71b41bd56e74768f792825a3d087d98ce71dd8bff0", "object_relation": "sha3-384", "Tag": [ { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554324, "uuid": "e2f4c394-9365-4350-b3ea-02b0bf7f3f68", "value": "T11BB533EF534CC0EDFDB15874236926F2621B282F52966D5F0C61EEC421F8D1EACAB845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554324, "uuid": "582d7010-a32c-4651-842a-6e691d20cec8", "value": "49152:Bk3aKkGa7HCrJd+Th/MGkputLSNarbhnRquxrvmv8g6UGtch:BkDkGa7HCP+lmCrXVxji8HbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554324, "uuid": "2975fcd3-12dc-435c-b0ee-c0bd15dc59c7", "value": 2385920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554324, "uuid": "20ba9adc-575d-473f-84c7-c7db4e72e137", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554324, "uuid": "0935b562-6937-4580-a3e9-b3cd432fc026", "value": "73d5b6dbb715c2995889b8aa9639a51852fb2f93155ae8c52c4b4b483a55cc33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e06ea14-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651580862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580862, "uuid": "484e6970-b267-4e2f-bc4b-7828a1b7ed40", "comment": "Malware payload", "value": "70a1ffa2bf06a3a1ed69cbb9f89ec419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580862, "uuid": "eb569531-af8b-4e67-948b-a91d292ed65b", "comment": "Malware payload", "value": "74e46f184f89113ba6461174338663c37914b4feaa9dedfce5f1e5c53a171da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580862, "uuid": "c53c30bd-9896-4871-aa47-a0b16aed1fd1", "comment": "Malware payload", "value": "dd3cd1ac9d45dca75fdcbba204c1b65f5136f670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580862, "uuid": "5bbd2392-68ce-4a1c-bfc8-54def11f4aeb", "comment": "Malware payload", "value": "73f3cfeb99d787ab17fe42e9732b0fa92ae06575c95e5505af3df03cd8ebe21c237be1b3f095d5984f9f01867f516454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580862, "uuid": "37a2f5cb-7d65-4e81-8963-26fc59c21229", "value": "T18BD4E110BB91D034F6B755F45A7A92A8753E7DF05B2490CF22C52AEE5A386E1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580862, "uuid": "7366a59c-38da-46b5-82fe-f779ba9fa10c", "value": "e4c1b729a6a6c26957f366f6e05b141c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580862, "uuid": "146aa3f5-68c8-4480-883d-47b5619070d4", "value": "12288:aScaONYcN7haMlR0bcqE9sbEyVDDtZiBysQ+jfeBhbj1x:anacN/lCbT6s4qMo0GBhtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580862, "uuid": "bb7f6d4b-311d-4d3f-94fc-468496fe1cbd", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580862, "uuid": "bd0931ea-1dc9-4a27-a2d1-e17f23dca79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580862, "uuid": "2a1a9e15-4c65-48f9-a529-e173a45c3919", "value": "70a1ffa2bf06a3a1ed69cbb9f89ec419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09151fac-ca74-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651536025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536025, "uuid": "a9e939e7-2767-4412-a371-105f4c7e044e", "comment": "Malware payload (Mirai)", "value": "9c97a16523bdfe14ab23c73665b50792", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536025, "uuid": "b030d810-6ef4-46e4-a860-3c02b03e44d5", "comment": "Malware payload (Mirai)", "value": "76d37e5378ac65e79afe9ece54c3777933afd5cece2b7cf43cb1e9c92297f027", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536025, "uuid": "16670e70-4cf6-4114-a73c-46c1e2ee8c4d", "comment": "Malware payload (Mirai)", "value": "e57df8f5d85b6cf701892121f43fc5403783afe3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536025, "uuid": "e7e75893-28c2-46a4-8e59-88f50b018dbd", "comment": "Malware payload (Mirai)", "value": "2015eca99c09fcd9709a00830132c1dcaa1a3baa49dd124e508674eef9a910594d0373759c864ca5d939b2c1b48bef36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536025, "uuid": "f8c9d50f-fe11-4f9e-807c-583a4d68d69f", "value": "T1623301D816202E7183A43F3AF8F7898F1E5B27B66AB833D12974FD48531345692AC271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536025, "uuid": "ad7b60dd-c6d2-4f2a-bb10-5ba011cda78f", "value": "1536:z3wKvUbEUjThiQXvpk+HxLBdwu5CczGFhvj:z3wO1UjlfpdRLvwFczGPvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651536025, "uuid": "f3de0654-ccbf-46f6-9ae3-666d7f04c10c", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651536025, "uuid": "4bae709f-992e-4e94-8c20-af0d1ab6bf0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536025, "uuid": "51bc2a3b-00d7-4e41-897a-9312d4911f6a", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebca311-caab-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651559738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651559738, "uuid": "495c64e1-a643-444e-8dcd-7af07eeb9789", "comment": "Malware payload (GuLoader)", "value": "b57f101d7a2ba2b26fd077c404cd5b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651559738, "uuid": "6377cca3-4c45-4d2b-9321-399d957b799c", "comment": "Malware payload (GuLoader)", "value": "76ff37e66c52f5b613920fff3dfd22e300fe8bdd228baf76b843f198195680f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651559738, "uuid": "bfb78120-44fd-4dd4-84b4-c69af67cd1b5", "comment": "Malware payload (GuLoader)", "value": "c1a1a23aa82ac26f8c3ec9e075d8fcfde72c3fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651559738, "uuid": "06c5f05e-0ae3-4058-b723-4d2c106eced6", "comment": "Malware payload (GuLoader)", "value": "62b0fc10204b2df3a9458193b7d3c1c7379f5ece04163c48a2341e9d250744af7ef2b2e7d5d25dbc6df55dc5837599bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651559738, "uuid": "9b4f4541-929e-4fe5-9df2-060ecd780225", "value": "T12664BDEAA7A0C517D79007708825E379576D9D632C629B0313E67ECF7C73BB25A092B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651559738, "uuid": "d97ac387-96d7-41af-9ec7-426593a36974", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651559738, "uuid": "a7312e98-e704-4c01-8d51-72f98137a10d", "value": "6144:WbE/HUCKfouuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuWuuuuuuuuuuuuuuuuuuuI:WbWKfouuuuuuuuuuuuuuuuuuuuuuuuuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651559738, "uuid": "fa0a41fd-ae54-4ce3-8a89-05dc01de3129", "value": 307872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651559738, "uuid": "b9dcc282-1328-4e3d-a2d4-c63e008779a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651559738, "uuid": "545edf01-a685-44c6-a0f3-81b47f6674ae", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.5174.4594.25338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c0dfb9-ca7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651539004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "3fbff7ee-3cb1-4206-b600-01645abcbd64", "comment": "Malware payload (Mirai)", "value": "5c0eb05879846a8338627f42963048ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "f2a3af9f-3691-4c93-9aaf-774508ba61ef", "comment": "Malware payload (Mirai)", "value": "77fa8b967526b2c00dd7a169d2e4a0022d153c13acc371cf2282d81ee8341a11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "1a4d7c29-a6ef-4a06-8da6-8c33f79858f8", "comment": "Malware payload (Mirai)", "value": "9b9703b10b11be2555f288975e7e1812c67c8da4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651539004, "uuid": "2fd99ca2-09aa-4246-b240-a3a5b63b9f65", "comment": "Malware payload (Mirai)", "value": "f71b43052cfa5f2d09faf01050dcf8fb4e39264c1d66011396412d604224581c9e707efbaab644184b83a3c7cc364fec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539004, "uuid": "9f6e76bb-926c-4d0b-aa5f-3298c18ed97a", "value": "T18EF2F232324528B3C8B22C3DA47E89494F0B5A7D297DA37D536C56FE7C92C5156EA00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539004, "uuid": "fccafb27-5d5d-45a4-a072-b3fe208932d4", "value": "768:E6EpcegUxW+tG83h4jLb1Jh3fR2EVFLffvVtk94rWIrnJ53ah3Uk:p8tU1Jhf7/kdYJ53av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651539004, "uuid": "fd39550d-d554-4cdf-bbf5-eece5e3b9702", "value": 36516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651539004, "uuid": "ca247d18-5e6e-4352-b054-1f70e4a0cd42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651539004, "uuid": "41a827c1-5e1d-4e24-bef1-c121d47158bb", "value": "arm-20220503-0050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a836da-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591215, "uuid": "80a1a1ea-76d8-4046-93f3-cec5c71cc1a9", "comment": "Malware payload (Mirai)", "value": "dd32db82068e0293d1698d8259b54b0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591215, "uuid": "e7ae3c3e-dee5-4dde-8143-10c26891382d", "comment": "Malware payload (Mirai)", "value": "78237c19ab1fe32305828679310cd3629ce9b9e32756686bd26a878644f4f2ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591215, "uuid": "a0e06003-29ab-4669-a9e3-d99cd5f2462c", "comment": "Malware payload (Mirai)", "value": "cd8eea04dd2229830ed454ec548215761888d369", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591215, "uuid": "4bff411f-91b2-481c-8afe-1af7aa60c16c", "comment": "Malware payload (Mirai)", "value": "63920322ab20b734092a8c38dbc7338f167f368d2c92c67f06a248bf849101e258b6fa97de107464cfa762e0b7599a97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591215, "uuid": "b226d086-c08d-4f56-b474-99c3677fc88c", "value": "T150637109BF650FF7ECAFDD374AE9174620CC641A21987B397A34D818B24B64B05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591215, "uuid": "ec163055-0428-4f27-8dd8-f97bdc0ec533", "value": "1536:UZbdZCypJdqINPVeLJUgVAAtcm7jdHbZ7ix8:Y5ZCypJdBVeTd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591215, "uuid": "e9fd2027-7e8c-4474-aa57-2606ca0c0ff3", "value": 69100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591215, "uuid": "a21e7f0b-69a9-4981-9eef-b4ed1aecac2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591215, "uuid": "a29bc4a1-9e39-468a-949a-ec7ad4dced47", "value": "mpsl-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e78d615-cb34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618686, "uuid": "f7cff890-5f23-460f-80bf-14d0b63d47e9", "comment": "Malware payload (Mirai)", "value": "ce3df0efab5832ede2eea0d2ba1ef728", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618686, "uuid": "99799c9a-ac3b-48ee-a1a9-3c7bf0fe2f74", "comment": "Malware payload (Mirai)", "value": "788c2d7e0de119138c0ee38df413aef69a21e01f238ca4a631be60cc253da7e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618686, "uuid": "73fc1c5d-2c57-4001-aa92-2f0b734c4379", "comment": "Malware payload (Mirai)", "value": "6b33ab7b6cbbaa22551f92469d03fd4f4e7e7e84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618686, "uuid": "8c38b9c9-e036-42ba-94ab-29de8f38f720", "comment": "Malware payload (Mirai)", "value": "d893bcbab1b1b93886ad2691a5222f0900909ad787e3e826fa53c7f036af744c386886d650a4ff89cc49517f9d6e10bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618686, "uuid": "edf34221-052f-46b5-a90d-da3108a6bb94", "value": "T1FAA33A52B6180B87E4D30DB42D3F1BD157BEEED020F0B6896A8FA65A4635D332546ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618686, "uuid": "c987580d-9e91-466d-870a-14a64aa6569a", "value": "1536:Au4lFYOCM+QzCey9jNJ0MEdaz+K0WNkl3JxwINTGXna108FFFFFFFFFFFFFFFEY:2CxrHegjNJ+azUWK5xwIZf+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618686, "uuid": "0d0951f4-f133-4f19-bf87-754822583d07", "value": 105208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618686, "uuid": "cf5226b7-2865-43b6-9623-48406ae4f069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618686, "uuid": "376bef81-bffa-4509-894f-b1d278fc0b87", "value": "ce3df0efab5832ede2eea0d2ba1ef728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bd19d3-cb2d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651615559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615559, "uuid": "bd6fe9f2-0ab4-4e28-b95a-ad9a14fe2d61", "comment": "Malware payload", "value": "b8d0c1c55b4849838050f4d7223c8525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615559, "uuid": "35566675-7c76-4664-8f01-cc652fa53744", "comment": "Malware payload", "value": "793117d17a376e5a5d098b461a2e6059a44fad5806f06d79efc9b85a98f49412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615559, "uuid": "cdf2fd5e-b76e-4e25-ae8a-bd6852e5398b", "comment": "Malware payload", "value": "342e37afcbba198185490c18dfb543fe8893c6ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651615559, "uuid": "b5aae6c8-17ef-4d28-960a-7ed32f43f02b", "comment": "Malware payload", "value": "ae62d4852a9c696f9b8bb83d13eb10d7c950765259a4e3d62af24f141dfa198da7fae5d1c50bc767cbaeb9bae8c20faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615559, "uuid": "74a8eddb-9372-4ee3-87f2-29e67ad6291a", "value": "T1AC925513F9A8A9B2E59E8BB10D73CBA941277C642550CE2B7C4C3F2D2C706417CF56A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615559, "uuid": "2b2e5a64-028f-41b1-9990-44c8519f4f95", "value": "8a84722cb70992f62f046a4a4d29e33d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615559, "uuid": "3ef6ab37-8a43-40d4-9071-8fa6dc33459b", "value": "96:/lx45XA3B1KynebhD3RFHZvSDEMpUBUaOdlDVLxX/TcF1lU7tWEg92:/TxwrxWEMaE3xX/TcF1lUsE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651615559, "uuid": "95e883b1-3555-4492-83b9-efc0119b231f", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651615559, "uuid": "c003a17a-c750-40cb-a254-7fad5aba816b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651615559, "uuid": "f4cb4827-0e63-417b-bcf1-b01cc74bc12f", "value": "Ransomcrypt0r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe621fa-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622151, "uuid": "4021c1c0-8529-4be0-9ed2-2284c3a32c71", "comment": "Malware payload (Mirai)", "value": "ea7b917b6d77f57e08e9e9cb0f25f6e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622151, "uuid": "bf014f7f-a115-4ce1-a8bd-1990719432bc", "comment": "Malware payload (Mirai)", "value": "799a5facd63b1aaa9faafdccaf13d41f1242454ee06164601af2c6265044fca8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622151, "uuid": "45c512fa-3725-435d-995f-a9eb8c057989", "comment": "Malware payload (Mirai)", "value": "76a6d3ef3f7d51515c9df54063533eb90bbc716a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622151, "uuid": "f50d85d9-e9b8-4692-b204-b27ec5c6c2ce", "comment": "Malware payload (Mirai)", "value": "d2b90f63f6a637f2084406323c2cfcb965c16539ed5eefc630e30f08f6369be41b389ca35809ec5f7c8e6a6df0c57081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622151, "uuid": "b74da667-5bce-4a55-a3f5-11590960c874", "value": "T18BB35CD6F8019F3DF84AA5B585270E0CB821935472930F1BA7B6FDEBAC321D57A0AC45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622151, "uuid": "c5ba77ed-782a-4ab8-bc36-88593524e9fb", "value": "1536:QJlCsNdLA6mGgTW3tflvrAwN3puHUg0rOToIT/wKh/e8k82UpMpy6hh4hjIXDLY0:PW3tflvrAwtiUg0rOTj/w6zjuZhhWjWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622151, "uuid": "f9439ac2-c960-49a6-87b8-278fe1c34999", "value": 109548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622151, "uuid": "f57b170c-b178-477c-a25c-483ab82b18fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622151, "uuid": "9dae0c7c-1eaf-4bc1-a286-e9b4c6f3f608", "value": "ea7b917b6d77f57e08e9e9cb0f25f6e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0803e9-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585426, "uuid": "c14d27fa-49c4-4ab6-8af7-1da8da7e04ac", "comment": "Malware payload (YellowCockatoo)", "value": "9814c51cdaa74e6ab7c20d92c4a2d7aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585426, "uuid": "1c0b67bb-82c8-487b-ad65-5f53839b3016", "comment": "Malware payload (YellowCockatoo)", "value": "7a5fca09a04661699fea280ad4db1355bbd42412d70d49203fa7a3ad2fd9ad02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585426, "uuid": "eb65ce02-35d5-4bd9-bf6b-d925db66b9c1", "comment": "Malware payload (YellowCockatoo)", "value": "18291417bb8734cb29e83c9e67f68431d0fc8bc1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585426, "uuid": "b3941df2-b905-4f88-8020-6e14e13a3a13", "comment": "Malware payload (YellowCockatoo)", "value": "0debda6c48e7ea7af01037bc551b9ddab89dc63ce10aea1ce78cf931e06cd6e3580ff855fb020558076fac2fbee8900a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585426, "uuid": "f5a83a83-0013-452b-ade7-32b69ab6c5ba", "value": "T11F048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585426, "uuid": "f4595d37-9633-498b-a1f2-13808bc75f9f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585426, "uuid": "ecbb0909-3117-48b8-b260-a330f15631eb", "value": "3072:ENrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2M:oO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585426, "uuid": "9d0aa7fb-7c74-421a-9c0e-dcaa729b0c64", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585426, "uuid": "4066f672-455c-49be-8fd6-36b76a657dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585426, "uuid": "957c16c7-b4ec-41c0-8991-4f922b0c9f40", "value": "7a5fca09a04661699fea280ad4db1355bbd42412d70d49203fa7a3ad2fd9ad02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bc8cb2-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582679, "uuid": "473f2f34-4a1e-424b-8c33-6fb04d47a1f9", "comment": "Malware payload", "value": "1a1ead2362036d81ee5fdf1136d64ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582679, "uuid": "70163959-6e2c-4fa9-a8a1-70ae22b8c5eb", "comment": "Malware payload", "value": "7b1ed111c6884066f240034b6c84e93aa1a47bcbe93fa41b9ca9440d5fa75a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582679, "uuid": "12f7cb42-1ae6-4f99-9fdb-12b674c8a832", "comment": "Malware payload", "value": "f6cb1d59a86405ee9e6e48c9ef690d409db71264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582679, "uuid": "f0d24861-63c2-4bad-991c-93158c19f7d6", "comment": "Malware payload", "value": "6f24cd6e2ae16f1054aaa324ab3eb203c42a6ecd1630fafae9584633644971237cceefc2398ebc2bc7609c7991aebe2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582679, "uuid": "fe15046b-7727-47fe-9db0-5800bb156486", "value": "T131445A0AB6940CB6ED73C13989535905E6727C110B30DAEF13A4936ADF7F7E0663AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582679, "uuid": "aa9b6723-6d2e-4b1d-b6d3-e8c54bbb94be", "value": "f63818fbf606254548177cb9d217ef1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582679, "uuid": "66046816-5193-4c6b-a48b-56ceecb97012", "value": "6144:OmplRrN2sf9VW6fWnt7ms5bhrm1Ut2ULkYohLdU5TpbMQT:OmDu+C6At7mFUVolWxpbMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582679, "uuid": "4aa74463-e3ae-4b8a-8121-ceef57908a21", "value": 257264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582679, "uuid": "be31b33d-2c0e-4044-99b6-fcad1311e9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582679, "uuid": "e09edfb6-344b-446c-a0ae-65cd797e3253", "value": "SecuriteInfo.com.Adware.Softcnapp.124.21985.24028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbcde8c-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585424, "uuid": "ed5cd9d6-cb1f-4b1c-b7fc-f81edef93f65", "comment": "Malware payload (YellowCockatoo)", "value": "61970cd16daaa5e67a9207f3f4283254", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585424, "uuid": "1dd9f719-f04d-4690-a76f-c36fbdbe8b40", "comment": "Malware payload (YellowCockatoo)", "value": "7bf3b949f6c3d2dc15ad94b1c17f043a7526066f8e6a8db8e37b10c135e9fc54", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585424, "uuid": "6ac180b8-7d0a-4022-bcb8-8399b53d4c3b", "comment": "Malware payload (YellowCockatoo)", "value": "fb6c0635604a57a7cd259be0dc4337edf131b7a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585424, "uuid": "a14915f0-b317-4017-a2d1-b65f38a3911c", "comment": "Malware payload (YellowCockatoo)", "value": "2c6cca2791aa2f28c0c70cf5263b64e4b98047f72918ef5130ce454f473dcfe4a1b30da5897c74f527c2b0af9e0c167f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585424, "uuid": "64796037-7359-4cbb-b30a-06039a13742b", "value": "T10C048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585424, "uuid": "57e3e6a4-493f-40ee-bc5f-f69e6fa4d89c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585424, "uuid": "5c0b5d90-1170-4294-91bb-2f78b343cec1", "value": "3072:0NrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2M:4O9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585424, "uuid": "1a3d5782-d472-4054-a053-e40834bbbab3", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585424, "uuid": "ea60d1da-6d50-454f-b963-0c33cbf79af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585424, "uuid": "cb1c1e75-da06-47c5-8fc1-0a01504b30b8", "value": "7bf3b949f6c3d2dc15ad94b1c17f043a7526066f8e6a8db8e37b10c135e9fc54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5d4820-cb2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651614605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "e0d6c152-931d-4124-8dad-005b7ee6662b", "comment": "Malware payload (Mirai)", "value": "5915d37f9639cdc3f9f66e1e5cbe104c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "36717090-4531-4034-8148-7161f75bce64", "comment": "Malware payload (Mirai)", "value": "7c0edf60b2a6b3cabfa52f61da29a337e9facfd0c3b828f059c2f53976598682", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "5199eac9-0986-47cd-9b47-a9a55fab6730", "comment": "Malware payload (Mirai)", "value": "43d07969c6a303b4a60010e0a83015653a4ddd1a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614605, "uuid": "6c7feed6-566c-4a69-b063-6417fd89e17e", "comment": "Malware payload (Mirai)", "value": "7465166da3ed5dde6e92ec55e9ead909b8aa032b5f39a58e47b6631ce79c501a08784d087ca4b23d24fb2046ef7287da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614605, "uuid": "7b883690-30e6-4e19-919c-e3507b2c63b6", "value": "T125735BC1E587E4FAEC114579302A9BB3DE73F13A5539EF87D398AA239811242E60734D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614605, "uuid": "8e9e5e75-6981-4cca-b32a-e9ac04ed2a19", "value": "1536:4QcSm0OwAPSA1JKxUo5yezyFxINSNQ7/ELz8q4qwHI9ceK43UEq5QJmhAS1YM80:ZcSm0OwAP31JKxZ5MO/E/X4qyIo43UHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614605, "uuid": "c8d14019-4861-490c-869f-ef41701a7972", "value": 75764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614605, "uuid": "a9517866-91a6-448f-a052-3d4ac0c6057a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614605, "uuid": "980fdf28-bf34-4219-8576-bc3b7e26b2c9", "value": "gx86-20220503-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623b7292-cb33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618209, "uuid": "553e98b6-b243-48b0-9281-a12377ff8ccf", "comment": "Malware payload (Mirai)", "value": "373e296cf0463948ffd0cff6711cb9ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618209, "uuid": "a6e3fc35-8210-4a91-9fe9-b7d5b298f6d0", "comment": "Malware payload (Mirai)", "value": "7c280581523d31f27bdceba3fd3f8f136d38635b55a8c887dfc6a80bde33ced2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618209, "uuid": "4888266f-f42f-40f9-80f8-f75d303a6cf7", "comment": "Malware payload (Mirai)", "value": "64c4aacf925601f5e3fdf2c6b26de7e3fffb85c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618209, "uuid": "79c2f2d3-39a5-42ed-9633-d01caf7946a7", "comment": "Malware payload (Mirai)", "value": "038f57de631c263d45b73e281ca2620df7f40e7b0339bb6435a2d64ea1ed75756566c43b789d64723256f7031eaec1b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618209, "uuid": "cb16610f-b9ae-4eb3-84aa-2b52103109e2", "value": "T147E31945F8519F23C6D212BBFB5E428C372A17E8D2EE720399255F24378B95B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618209, "uuid": "badc5e78-bd76-4b75-9fd2-0532e07e8d84", "value": "3072:jAXEQft+EOeH53F3d/OoFoT4LWcjER/t2uyNX4C:jAXlZFH51ooKT4LpER/tINIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618209, "uuid": "5323839b-78b6-473e-bb17-14e9a661e394", "value": 155744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618209, "uuid": "051c9ac0-3e72-4999-b78d-2047f11f115d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618209, "uuid": "11456c61-426e-4560-876b-4725ca89ed9b", "value": "arm-20220503-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ea7cd3-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554401, "uuid": "b7cf7f49-5b0b-4254-bfb6-6a54c3f7088e", "comment": "Malware payload (GoBrut)", "value": "a07d86413ccb255dc7623ada11f1be5a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554401, "uuid": "4cb69f5c-e7a4-4823-b86b-46a668da6972", "comment": "Malware payload (GoBrut)", "value": "7c3e9f908c18644c9068dae18705f6c99450bb7fbd36e94d1b1680207877eebe", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554401, "uuid": "ec028686-b2f8-4d88-aef2-bf6c1866eb10", "comment": "Malware payload (GoBrut)", "value": "b2a6a20e283226e5e9be5819266ca6f7983979ad", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554401, "uuid": "bea3b418-12b7-49f1-a2f3-9abec8f65969", "comment": "Malware payload (GoBrut)", "value": "490d957a823d02cf6dc3a405b92ad772490abf0d43e2e2b0f923ee2c08d67876f3c08c29a50603d770eb79c3b9d5cf87", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554401, "uuid": "741cb69e-ba59-4bc4-a0fa-92726da772c0", "value": "T147173384064BAFAEC302DF6DD3DDE463A0667D791BB9E427926262038EC17546F10B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554401, "uuid": "968eacc5-bee4-4f11-b22f-1f4f97fee3c4", "value": "393216:yht2Hu+CtofOMbAHQsMq2DzAKZKicr/xoxDWgzzlVTLSwnuuMWFU0glC:yf+u+8jUDzAKcipxhVTv9UXlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554401, "uuid": "92a870d5-2f64-4b72-8b74-f0a73db48cf0", "value": 20285199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554401, "uuid": "72cf4bdf-938d-407c-9239-745826e39a55", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554401, "uuid": "465376bf-bf08-4489-a2fb-cd98dfc218ac", "value": "c8af1372e913856da2c9a6ae9612d83ea9cf55179568b12062a7a3b3e5f1180e.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cfb39d-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585419, "uuid": "f07495b3-a725-400b-92b0-79b2808d4820", "comment": "Malware payload (YellowCockatoo)", "value": "2dda307ec1f222b8a00821c96537d860", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585419, "uuid": "3bd70720-6a99-4f38-8bbe-8d872ebc6ce3", "comment": "Malware payload (YellowCockatoo)", "value": "7cd77b460f3f433c3256658a37368bb363e5c5b6a02e048e0646163f04560d97", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585419, "uuid": "0fb418ce-beae-4a58-bec4-7ba79e373fcf", "comment": "Malware payload (YellowCockatoo)", "value": "4b1a9e9fbebfcf464ffb638c67f14787a18bae97", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585419, "uuid": "8638cfa9-1cc7-4b46-a7b2-b26b0812c54a", "comment": "Malware payload (YellowCockatoo)", "value": "9aef7128e859c3ada9fc11cb2d6fb8a063925f6af18d0bc8f646611a33fad4011df88cfcd930c4a066d528ada44c984d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585419, "uuid": "624fc108-6593-407b-8ee0-932cfb9cfebd", "value": "T176048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585419, "uuid": "ba336ea4-1d63-4442-927e-dfdfed62ee18", "value": "4b8dc8b124f6a7b247112a2f7ebd73bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585419, "uuid": "47fceff0-7459-49a4-9c15-3ff6535dc17e", "value": "3072:ZNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2q:DO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585419, "uuid": "3eb37796-128f-468b-b915-6add4cc8af25", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585419, "uuid": "98aa3a16-27e8-4ff2-b5a6-ba7111d194f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585419, "uuid": "d7e4acd6-a843-41ca-82d3-0e86914018a6", "value": "7cd77b460f3f433c3256658a37368bb363e5c5b6a02e048e0646163f04560d97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c124c71d-cb3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651621804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621804, "uuid": "87556912-d750-4204-b65f-fa9450765a2f", "comment": "Malware payload (Mirai)", "value": "6cfdd441334205e12a51b787f3819014", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621804, "uuid": "0cf6a666-d2e6-4af1-8006-bb53a2624f33", "comment": "Malware payload (Mirai)", "value": "7de34c2a9c3aaf96d0424ebef32c96a45a156547d6fd10af7d2566b848ed6bd1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621804, "uuid": "4e540ab8-56ee-46de-9f4e-7cac780fda61", "comment": "Malware payload (Mirai)", "value": "87520b8b393beda84e884266c32f7d80a630810f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621804, "uuid": "3f999e23-d267-48e5-b05e-ef2c56a0fe63", "comment": "Malware payload (Mirai)", "value": "2aa5fe9a4bac374037d0d9447d919753f2c7f00ac7a40290ebf7f1317b4bfe9f214db43971f730fea53a14164586f902", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621804, "uuid": "ebe5836e-7f0f-476d-a4b0-ef6ae7865c62", "value": "T197B2E194A35E4207C8C7403FD7098CC49EAA1E69DE0E9E410057C6F55AE3CADBB69CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621804, "uuid": "408397f4-083e-484d-a8a8-ab3d93b78d24", "value": "384:MLT44eyTGkYNDArcdzeo3HepFLhS5sroZ+5vu+bOo1M9ktq7m27rygI9+b0K5hL+:Ic4VTqTeg+pFk51Z+ZbxBtq7hvI925RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651621804, "uuid": "edc8807d-8c91-44c7-8dc8-459204517936", "value": 24756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651621804, "uuid": "77653279-6a94-47bd-85a1-4ae89962b1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621804, "uuid": "96133b31-3237-401a-8219-2c02912aeaf3", "value": "sora.x86-20220503-2350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0078ae6-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582664, "uuid": "25019864-c350-46db-b56b-d86896d43236", "comment": "Malware payload", "value": "57b9ea37d13397107344b62199e4d61a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582664, "uuid": "63d90929-639d-4f68-bf53-227376dfc10e", "comment": "Malware payload", "value": "7e0ff9f2034a124023cf89585a5408daac8830b2e38be15ab5c3c0dd96082d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582664, "uuid": "de9a4891-d589-4339-9dc1-5ac7b38ce770", "comment": "Malware payload", "value": "84ac0d76845d23d9b052d0b059175aa049c30608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582664, "uuid": "c06959e1-bb35-44f4-94ef-77140ee2696b", "comment": "Malware payload", "value": "2b21db3373e06d2913fe3fdf866b33bc51f83f8f9089b403c6c3224647fa366f256204fcaec8aa8f8eddf35a0dabb53a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582664, "uuid": "754da90e-64d6-45a5-bfe8-fdfa2a4cbf44", "value": "T128A44A293A460F6DD866A23D843A4679E56E7C401AF1C5AFF370B216CF3BF90653D206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582664, "uuid": "32f80a54-77fc-43d3-a51d-ab28d537cbc5", "value": "5d50edf08631a1d24142c07feb06d75d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582664, "uuid": "620cea82-4177-4c0c-8efb-5a6806eeb8f6", "value": "12288:+G/s6dEoFrnoez5X7S9o6dSHL2OpfAqNfGf:wfoFrnoez5X7S9atef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582664, "uuid": "f0e81985-397f-4038-a4aa-a7354a9fe0c9", "value": 465128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582664, "uuid": "594e846e-e8c2-4565-b433-7f0bd16dd425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582664, "uuid": "aca97b1f-efe9-4bb0-a4f3-083b80b5fd19", "value": "SecuriteInfo.com.Adware.Softcnapp.124.29109.5615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e3b3ae-caa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651557250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557250, "uuid": "73542383-7680-499e-8167-af76efbc95e4", "comment": "Malware payload (Loki)", "value": "7b6ef9f3b37eb76618c6062440a357fb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557250, "uuid": "bc937dbf-5a70-4f87-b3ff-40527e1ca667", "comment": "Malware payload (Loki)", "value": "7e91c24511bf78dd089c2b613882d5005009e653562876c3d40625cae95cfea9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557250, "uuid": "3e239bfe-b9ce-4cd1-a17a-7cd6b13feebe", "comment": "Malware payload (Loki)", "value": "756a5b7b2a8d0c2af8b178f366745b5f03536b56", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557250, "uuid": "29fa4a1b-682e-4ae4-8975-0adcc818ebed", "comment": "Malware payload (Loki)", "value": "7f713075465626d52c9849ed58940f6bf5024bea12ee0f53f32b0c8171723fb0949fdb801f55509e9864bb739f6c7ad4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557250, "uuid": "bdcd2c2c-2b93-43fd-92a9-d67c5aefd172", "value": "T141942342C0455CE3E3EB8EE7E715836516B24F1D66E8B52CF8346F82CAEE8543A11DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557250, "uuid": "d5991cbd-5309-4df1-8a06-271138de621f", "value": "6144:hKp0Ce/iKm/5HaAltzmWeSkwniLDcDZ5dvYL9VF+o8NtoX416E5xl3j:hugiKmxHJ7iSkwnqAZv8f+o8NWX4Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651557250, "uuid": "6b512ba5-ffed-45f5-8a20-1e1074631fdc", "value": 441481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651557250, "uuid": "6b714514-1dba-443a-9a47-07d07f0167c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557250, "uuid": "a6432665-dc2a-473c-aa86-158e04d83246", "value": "RFQ.info.bit.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62145c3-cae6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651585332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585332, "uuid": "73bb1c7a-febf-4633-9e22-32679a9120a0", "comment": "Malware payload (Quakbot)", "value": "facf84dc607a0bb06a44f0e25d9a4648", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585332, "uuid": "0630cbc7-bfde-4b34-afd3-687f90c52cb4", "comment": "Malware payload (Quakbot)", "value": "7eef3bee45306f5870e49270ba60291096d0ce6d71b17f16cf57c88caa8efcbd", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585332, "uuid": "201ca641-5464-4bf5-979f-3369a3f39bd7", "comment": "Malware payload (Quakbot)", "value": "174bb1e0eaac5076e5e7426c4ddd6fff1de929e6", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585332, "uuid": "73b88283-6a79-4794-b521-47709b0d5546", "comment": "Malware payload (Quakbot)", "value": "2feb99a6f5b7bab97b0211f411ca41f1e6a3c4aac25e94dae0df3dc0f7daf514f4c7cfdcde3a74c376a387e79c718079", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585332, "uuid": "dee1051c-a9b1-494e-a6ae-cdbda049e58e", "value": "T18815F165AA58C82EF8DF04BA50ACC507083CB9B2275545CBF3C08DE5A4E51D3BE36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585332, "uuid": "91528e2f-462e-407c-b9d6-1e26eb26121c", "value": "d0f05ca687f9f16f264a475768c38442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585332, "uuid": "f19498fd-79b4-48ef-8c95-e29f5c820f2d", "value": "12288:wwYWSVNT8mDwme7gAbq/LstY00MQxHsePTbzswVpeJo6b26OHeloyMzjEwP:G4mkLv2/CYX3dLPswXeJg6jotzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585332, "uuid": "704cadda-b6ec-4bd4-bfaa-1c45f68c1cb0", "value": 893404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585332, "uuid": "e8fed46c-9576-4ffb-aa5c-9b9f480149d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585332, "uuid": "ace677db-24b7-4e00-802f-09a8937ee927", "value": "7eef3bee45306f5870e49270ba60291096d0ce6d71b17f16cf57c88caa8efcbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c781ed54-cabc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651567269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567269, "uuid": "adf3c3ab-2d7a-4de1-8c66-5fbc4dd4993f", "comment": "Malware payload", "value": "3f024446b1c137bb852821457ed152e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567269, "uuid": "75764100-5545-4479-a4ee-fa58a99d86a3", "comment": "Malware payload", "value": "7f60c433e80ec16e8d09b7aead451964966832305d7df8ce400ce6a96115bb9a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567269, "uuid": "bffd29b6-817f-420d-b073-d8a2fe00340d", "comment": "Malware payload", "value": "17c456215df23cdcd8dc4cf03f75695dfc48ad03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567269, "uuid": "77d14ee8-fa1b-49d9-b821-e8736f8428e4", "comment": "Malware payload", "value": "0d2fdcef23d2df40d635edd906ba82f33a860f66bdd5ad0c436a6f9ef3e14726d315be4bbfff29c98f4ae7c775c9f871", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567269, "uuid": "4cb46d15-756f-4715-9136-7d5cd3a53239", "value": "T1C6342A0462684517D3FF9977639762528AA4E34BC693DACE0D47C4DF05D2F80AAA3BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567269, "uuid": "2227d1fc-5b65-4498-ad88-c37330bb0811", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567269, "uuid": "71814c13-830c-41ba-90af-c40349beeb8b", "value": "6144:HXeECtsRXyfy2B/miAZUL/yrj6DOUZ4oqGd/f3jdOIU:HLmsRX0y2DOooGhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651567269, "uuid": "ddee4961-b78d-45bb-a1a5-2c56baf54eac", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651567269, "uuid": "dc4bd43d-11b9-4285-8d99-bbee77d84a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567269, "uuid": "2031977a-3a40-45d6-9828-37a811d708cc", "value": "SecuriteInfo.com.Heur.Bodegun.1.12723.20889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15893824-ca90-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651548072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548072, "uuid": "5bfcfefd-96b9-41f1-b91a-a48861028367", "comment": "Malware payload", "value": "18ae6c0812dbf6a89eebc606be933d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548072, "uuid": "da0ef168-2d19-4fc5-a322-95ba8df878ef", "comment": "Malware payload", "value": "7fb3f7e138396a6e6d3a5daecbb506042628bca069d9d0e2cd97f4dd0b051e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548072, "uuid": "35664a4c-cc93-4a01-b33e-067fe568d0f8", "comment": "Malware payload", "value": "8dc6ba2506b1ac3ce8a31605ee4047b2e173960c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548072, "uuid": "c9e47f6e-6e7b-41b4-af87-d7d4b6986a99", "comment": "Malware payload", "value": "0a419ba860d1fc74888520ef738db74cb83a6204fd5631585156c1595b18b2ce4df05d1d5ef14efc00bb852594943f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548072, "uuid": "e0145003-55c9-48b7-ba34-0fedefd6a0be", "value": "T182A4228DFEA4EF49CE088A3DCC6157F10A570E7327D82636F212FD697DE10A2652D981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548072, "uuid": "94363b15-ffd2-4f69-9571-8b5a854abf11", "value": "dc73a9bd8de0fd640549c85ac4089b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548072, "uuid": "802e8e81-af9f-4911-9520-dab3f992a939", "value": "12288:/j8Bg5H/uh/t1EPlSv6rwLwuNXZMR5LdXEPTNVwaqL:/AG5HGhVuG6k/xZINOTNVpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651548072, "uuid": "a9908bb5-34fd-4a3c-aa66-5f9ba3f83819", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651548072, "uuid": "71c52263-8812-4043-9565-10f6c3c99148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548072, "uuid": "2ff92964-67c7-42dc-b07f-bf4b8e71ad27", "value": "Patch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7cc918-cb05-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651598499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598499, "uuid": "102f40de-c2d1-48e1-bfb3-3ac84f7155cd", "comment": "Malware payload", "value": "ecfafb74aa968013d1b0eb5abef922fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598499, "uuid": "29f2d20d-cade-4698-bcf6-25388e656cf7", "comment": "Malware payload", "value": "81ce0d60dd5728e08934e205fa3bfdfaa9e04256981c2bec1d4a18055651cb73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598499, "uuid": "fd7529a6-a873-4862-bc5c-84707af1b4e8", "comment": "Malware payload", "value": "515ffd12a76a392438788b40c93ef89a4cd18f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651598499, "uuid": "ef530530-ecf8-4764-a953-d6c20f77e7f9", "comment": "Malware payload", "value": "ff231c8e86f413f1aa1410ed0384061d51a5e6a91c155afaca393d4a5560ec2533dafb7a796ab30fc84bbdeb933c75db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598499, "uuid": "951433c9-53c6-4f43-bc34-402a2ca92860", "value": "T1D0043102257CA8C3F69C6C73A8DC975E1EE06C6C4676106DF247B6E9E53F143E6212E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598499, "uuid": "090701bb-fe01-4e0b-a37c-d19e328c7fa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598499, "uuid": "7c368bcf-deb0-4c01-b5bc-2b0e760538a9", "value": "384:6NY054MX4DGF85NlrRNIfJK3le/RhFVeGLdNETT4k4g6tGocA04sQm6eS2KWVAvH:q4BDrq/R/VeRaje3EJGq+xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651598499, "uuid": "ce53f044-d866-4aa2-a996-258e46c07330", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651598499, "uuid": "6c8aa16a-a695-43c2-9506-af9e5a07007e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651598499, "uuid": "1c237314-6724-451e-8107-59675203dbab", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d56e98-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591217, "uuid": "215e3c74-06de-4366-8a38-b24b40da27ea", "comment": "Malware payload (Mirai)", "value": "3acb6ffba5e8f60f8f70e21d2de08d74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591217, "uuid": "cae8e3df-ed27-4c25-afc9-51b5bc40276e", "comment": "Malware payload (Mirai)", "value": "82eabb26ff9ff68987ca337088886641fb931cdebee5d22594b4dd3fe98ebc33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591217, "uuid": "24c2b58d-7c4d-45a6-b9c3-6361576a7cd8", "comment": "Malware payload (Mirai)", "value": "3af39fd758c399bceb2d83294359c03e4ee3c8a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591217, "uuid": "10fc3dc3-72da-4a7a-954d-183d89205dd3", "comment": "Malware payload (Mirai)", "value": "729dd0988006e18da5aa48b801086a85821bf50cb48a2003e6523fde4071690329f77b4852a8b228b7d0f85c5905fc75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591217, "uuid": "eaf27b6f-ecab-41a8-8310-67eb4390df45", "value": "T193132986BC929966CAD01776BA2E108E3321B3E9C1CF3217CD145F0137C9A2F4E27A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591217, "uuid": "eab52e9d-a3b4-4b23-a6a7-9e5587d7f251", "value": "768:I62tNjBmP2XBDFlumI9NY++qnSRaja5r8ZwwWUSqgSSxoNQMTmPBNAJ:D2bFmP2XB3uVOp+SRajaKWwVSd9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591217, "uuid": "c4945692-3dee-45be-933d-5a9921f71c19", "value": 44112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591217, "uuid": "1dc6abba-ab83-4c4b-b069-2d44d5d6eeee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591217, "uuid": "fa3d77ca-ecad-4f92-bbde-1b57e32425ac", "value": "arm5-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdba1b71-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651591331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591331, "uuid": "fbb2c278-09d7-4a42-bbf9-4fe44a81b742", "comment": "Malware payload (AgentTesla)", "value": "637a166223288c8bfbd55c5daacbbcc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591331, "uuid": "e1e66f7c-be6a-459c-887a-bd182f13b8d8", "comment": "Malware payload (AgentTesla)", "value": "830ab27291a13c25dbf7faa79e8c0d9984b572a06547b13d63195751a82f006a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591331, "uuid": "f14ec5ee-f585-473a-9afd-d821a79d131f", "comment": "Malware payload (AgentTesla)", "value": "4be7816f17dc5ac6372093997f83869bc363c9d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591331, "uuid": "39ad69c5-bf95-43f7-a4b7-6251180942b3", "comment": "Malware payload (AgentTesla)", "value": "3c76d3148b7d93674cfa855438aa0908fdcaef4bab48ba631afa445c6fa4f7254b04f5221f15e2746b80c4c0a93257af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591331, "uuid": "3eaadb0a-5fef-46d4-808f-6f60d00b5b5e", "value": "T1A0F4F5F12130DF9BFD269BFCC1C945100BA31935D651E30B3B7067DD2DA3EAA295AA48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591331, "uuid": "7f708046-c10e-426d-b2d0-a4e19d372757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591331, "uuid": "7609a2a7-1624-44c7-9802-d9648364ffbc", "value": "12288:CwEPfw3hoMst5MInLyEN/hUnJs06MRgLJhG7t8MtntGGzGtGGGlGtGGGGFGGtGGl:Cg3eLVJpUnftahGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591331, "uuid": "2c5b9363-65ce-449c-b4a3-6b7349bda07e", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591331, "uuid": "0cd35ff9-f929-40f1-9850-9e72e5d91ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591331, "uuid": "1693b8d1-3244-4db0-a8dd-9fca335ec9ce", "value": "SOA (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f1dea3-cae5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1651584654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584654, "uuid": "196e7511-b858-4fb5-a619-bc0a4b907b55", "comment": "Malware payload (AsyncRAT)", "value": "ca98a6d9246b9f1879850e5afa383668", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584654, "uuid": "5a9de583-5365-4cec-ab47-520a9c6b2976", "comment": "Malware payload (AsyncRAT)", "value": "83dc26a2c75493b5b5bc8dad149d67cc6e1c9c91c2582fc46a0d64d3edfa9647", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584654, "uuid": "56dabe34-213e-4ddf-96c1-ad134b3ce681", "comment": "Malware payload (AsyncRAT)", "value": "7d4cec53c3673a1e6150fa73612b65eacfdfb73c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584654, "uuid": "6b4caefa-2144-4235-814a-5a318b42c3be", "comment": "Malware payload (AsyncRAT)", "value": "718bfd9926c05bac2490482261b5f3c85ae108366c653c640db416f07530573958275cec1c42e57b491b1ed847761a1f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584654, "uuid": "ea487568-697a-4cfb-8d48-1e5709c6b559", "value": "T1F73472A63DF64353D3B79A3302E1B99691373C333FE2B78E1481BB899A60753B502546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584654, "uuid": "f1e60065-1b98-42ff-8f8a-400253f69f9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584654, "uuid": "f22f1acd-3f9b-413e-9c59-6736a7bc60dd", "value": "6144:rh3iwrxQ39cpkV+mXXsFWmEmngP4555ZcoeTh8scBf6Fj0wi0UPbP0LQN+Jt0U3I:23tjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651584654, "uuid": "f819e8e0-b704-4cc2-87c3-78cde07b9231", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651584654, "uuid": "ccf28e5e-d81e-40da-9c1f-3f264bd3b008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584654, "uuid": "7687b9b6-3b8f-4661-8f74-9a29120f36ff", "value": "ca98a6d9246b9f1879850e5afa383668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8feb98d-cabc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651567325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567325, "uuid": "caff7f4b-0929-4ec1-98a1-999ef11f2ecc", "comment": "Malware payload (RedLineStealer)", "value": "39f002430561c1f286768c183b9b8642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567325, "uuid": "54eefac0-07e2-4bde-9ff4-ebee944a45d5", "comment": "Malware payload (RedLineStealer)", "value": "83dedc781457c9dd7b9db68494163d944000eccb1691c41e7de989a1ae761282", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567325, "uuid": "d4738929-c772-4831-a440-60a5a54057f6", "comment": "Malware payload (RedLineStealer)", "value": "f7cdb3c7b4760fd61cc16ef6cfa069e88323055d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567325, "uuid": "93533b05-0e47-435b-86af-5a4f8220036d", "comment": "Malware payload (RedLineStealer)", "value": "73e8b749635f50a3872465d8b74bb6bd0186b1074844f46706703d3ca83996060308e8d8e072958497edb336b9eaa4b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567325, "uuid": "f16fd101-a30d-427a-9acc-bf14a9635e4c", "value": "T11084BF10B790D035F2B716F18A7A93AC753A7EA19B2491CB63C42AEE56346E1EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567325, "uuid": "3b1e0239-1dcb-4851-9353-1f745cdf5c8f", "value": "e4c1b729a6a6c26957f366f6e05b141c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567325, "uuid": "4b394504-47d9-436a-9e51-92713536f1bc", "value": "6144:klZ1aMn3GjlzCbxYphjNez2B54suJ+NPa9eI0He0nneY02J+KzhQ20m:k/1aEGjxwxYphjNN5HK/9eTne6+20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651567325, "uuid": "0aca98da-4ec9-461a-b35a-38f292207cfc", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651567325, "uuid": "f9a358f7-ecf9-41ce-984f-7b80f182995e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567325, "uuid": "6ec7356e-2264-4b80-b89b-e383d03d7e61", "value": "39f002430561c1f286768c183b9b8642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f617ef-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570994, "uuid": "74c6fe59-4c20-42b3-94b2-088c937196bf", "comment": "Malware payload (Mirai)", "value": "6e96d652cbde68d6c67808011a293813", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570994, "uuid": "e14a7893-89cf-4812-ab52-636b9bb00a83", "comment": "Malware payload (Mirai)", "value": "855cd51f768e9b5dc2204fa23cfdd3183f2efe9f2bc26966c408d8d080c2f7d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570994, "uuid": "389354c8-40f3-4284-937b-1293f83d546e", "comment": "Malware payload (Mirai)", "value": "31a783c8cfc017f380a222f5a29daa6505272962", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570994, "uuid": "6e5f8193-8f83-4d75-a48f-b22f72621a35", "comment": "Malware payload (Mirai)", "value": "b67798a70adc4b7d95f7c1cfbd8240859ca12bbaafce334a13ad7486e7dda693fa66d4af2147a8c9e9698ed22b7e03c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570994, "uuid": "ead0b64a-da80-4aee-b9fb-47f3f1fc2d78", "value": "T1D1330A96F8814B22C5D5127AF91D158D372327E8E3DFB2129E206F603BC696B0E3BC45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570994, "uuid": "03bffce4-f6cb-4c55-889a-be8cfeb28b35", "value": "768:iInAvL4Z9AASlM9vp0ivlXbIIQXqkXwj4l16Kd5bUzf2moWTQMaXoinfQpF+MWpP:iInAP3M9p0MLky6rxWniMPinfAF+MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570994, "uuid": "6a629b5d-695c-4d41-a2bf-c7739a179a56", "value": 51156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570994, "uuid": "daf3eac2-a045-4a84-85e6-2fa98d30c874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570994, "uuid": "ef51c59b-10d2-4ae4-924f-90b3183c3dbf", "value": "6e96d652cbde68d6c67808011a293813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd4ae4e-ca75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651536835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536835, "uuid": "2c862fe2-8e60-4dc3-9a0d-68d17df5b52e", "comment": "Malware payload (Heodo)", "value": "7c16765b50a46ebbd2e986b1adfe50f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536835, "uuid": "91f148ec-4c4d-497c-934f-578cc5b0354f", "comment": "Malware payload (Heodo)", "value": "8699485115b8d16c77aeb31771a83ff277c2223016f2bdabd3896aa50a7ef476", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536835, "uuid": "be1b9460-ee14-4fa6-bda2-93e947e04b0f", "comment": "Malware payload (Heodo)", "value": "4a7072dd5d70217aac851c1b0497b47cf4358343", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536835, "uuid": "382ebf5f-d803-4047-9448-1e5991e6b641", "comment": "Malware payload (Heodo)", "value": "acbf4cc1f9b937d50da84f057968f5a3f9657ead142eb61d6d4d85722adc7422a1e5a10b8039f1f825785761e8618954", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536835, "uuid": "d8acb2f8-26a2-46ff-9f68-ed025e3d824e", "value": "T182053A207AF64012D28E0B38049DCF54C56B9D5BA7B1F1EF2B987B8E5AF17C16A70706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536835, "uuid": "16a2e6c0-8310-49f1-ba10-70edfc4e51f0", "value": "12288:zuZ0VaBZTXd0T5Do463OP4eesiSOZjb2woE+MhJTsjPbs:wdmDogPCddb2woEBJTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651536835, "uuid": "f25521fb-c460-4900-a84c-92178e54ba75", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651536835, "uuid": "b1f82d05-122c-4fa8-bb9b-3acf381a4287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536835, "uuid": "288bae6b-f86f-44ab-bc1d-69344f234296", "value": "emotet_exe_e5_65c07b344e545808e6d7db5784d051452cab60c6a21985d0c0a43a2d0856b003_2022-05-03__001349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c255927e-ca77-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651537625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537625, "uuid": "593aa6df-a32c-446a-a966-5981c6ad59fa", "comment": "Malware payload (Heodo)", "value": "2d47c81fb9ddcb28b1556fdf2482123f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537625, "uuid": "1e57c179-6397-4fb5-b758-d07642931b11", "comment": "Malware payload (Heodo)", "value": "86e4500f18e9482c7251c8ce49f6fab46e5fba91dbbf1f445538c8e1eb3c3055", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537625, "uuid": "ed0cb985-4563-40e6-a3ab-c2fc0b328d4d", "comment": "Malware payload (Heodo)", "value": "8810706307b10e841f626c00eae8b60edbf29083", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651537625, "uuid": "12057024-20f6-48ce-bb6b-74b83f485b38", "comment": "Malware payload (Heodo)", "value": "15f253ae1affc68bd08a75713bb8fdb3d516909c705d7dbbfd3499edb3820dbf17e980e6e7be02cf84e775ed4a2139de", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537625, "uuid": "f131dd2d-fbf0-4ef4-8bac-c8c5ac466d7b", "value": "T10594490BAABC80B6C0269179C5539B4AE7B17C448B64938B43A1E77E1F377E16D3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537625, "uuid": "3135f596-a30a-41f5-a038-17cd5bc7a6ca", "value": "197d9b9439eab515b09edee36544d57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537625, "uuid": "583c576e-af5a-4562-b62e-6d56c99f6610", "value": "6144:8Ej0nGAWfV9Osno2c1GvJureTz1qkMJICY7feVc6C8QWz2hVVxrjjrk:VMeQsno2LR+eTz4kMJFGH6C7Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651537625, "uuid": "272b3eec-ada0-475e-b790-85c81e2e0054", "value": 435316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651537625, "uuid": "b10f6a67-35d6-4a85-bb86-ea5786b996d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651537625, "uuid": "c3cd757f-5ab8-4428-b2a5-3da757b28c48", "value": "emotet_exe_e5_86e4500f18e9482c7251c8ce49f6fab46e5fba91dbbf1f445538c8e1eb3c3055_2022-05-03__002657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b67494-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651570881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570881, "uuid": "56e5088c-94a4-48a8-b90f-e1557465633e", "comment": "Malware payload", "value": "1cfff83d10d55dd424934dd851198590", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570881, "uuid": "b661d7ce-b22c-4764-9c41-cbf35f172cc2", "comment": "Malware payload", "value": "877cfc6361ad4773703bc1a89824f72ca0d9d56bb4db459e78d9419a258fc91a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570881, "uuid": "6d4569fe-b7b3-48cd-bc0c-2dbbfec19548", "comment": "Malware payload", "value": "de145a09f9cc984ba3215475bad3b972803a6353", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570881, "uuid": "7a1da96c-dbdf-4352-89be-d58db482e885", "comment": "Malware payload", "value": "d9854e671e20de9629fdf0ad2874044be12bb6e99c8cd461aaf4b6a10b1c66ceb64b6405a71b8c67789fcc56c03a5708", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570881, "uuid": "edb73b54-8ea9-42f3-8d1f-044231725014", "value": "T1FA23A53173F88A5AE2BE0974B470456823BDF1863516D7AD8F93E48E3D76B4084D07B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570881, "uuid": "57de2acd-6352-4e29-a2ff-85649cb37856", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570881, "uuid": "b56dfb0e-ebab-4aad-89da-067cf5949c78", "value": "768:y00C+Sg6zYhuNBdCj2xTEizVNwNmZEA66VLgJXBTRtdj1x82S8fy7b8a3/K4FdAV:y00/Sg6zYhuNBdC6xTEizVNwNmZEA6oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570881, "uuid": "2d6756ca-c72e-4b98-8cd1-ca9d97511833", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570881, "uuid": "279ce3f2-fcd4-41f9-af35-9f995d96fedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570881, "uuid": "703ce1b8-a909-4243-9244-ff46f0cfa2e6", "value": "tt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ada1727-caed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651588078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588078, "uuid": "ac3fcf0b-5607-43e4-a9cb-36983d29c2ed", "comment": "Malware payload (Formbook)", "value": "60cc9d6849ed4599ae01506dbabc87df", "object_relation": "md5", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588078, "uuid": "72ad76f5-ead8-4791-bb79-e64fbfe562c4", "comment": "Malware payload (Formbook)", "value": "87bc99f92dd1d5344195aed847c8ed3af8e0aea954133a97fb65834e81278645", "object_relation": "sha256", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588078, "uuid": "9d444ce2-cb05-427b-ae3f-a02b04a9379e", "comment": "Malware payload (Formbook)", "value": "f78ac4cff0841cd6d9f8767b302280e2a3e07df8", "object_relation": "sha1", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588078, "uuid": "e1b3c8c5-57fa-4beb-899e-5381ee0083e8", "comment": "Malware payload (Formbook)", "value": "a9195ac9b12b1bd26d86b00cc91ef4e3a5d6baca99405b4f99ac3cd9ceb6567ebd34727438aa4a255866fdd8229ac96e", "object_relation": "sha3-384", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588078, "uuid": "9d00dd72-f996-4c09-ab9a-8a7ea80db098", "value": "T110057BF532428B36C024A979BE7CFE921E2A7BC791EFBA5C835965015CF5B01CC19B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588078, "uuid": "391733d8-2eb3-41ed-8d65-ea0d78eeda51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588078, "uuid": "91ad0906-4cff-402f-bca4-3e8ebea99d91", "value": "24576:VF54NE43M3SiH6VnZEVdzbEgCy/Jdw5Huvc:z54NE43M3SiH6lZEVdfMy/JdHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588078, "uuid": "20bb8464-ca78-42bd-ba9b-879a214f57b5", "value": 854752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588078, "uuid": "9d48f2ae-e9db-47ed-95dd-c60b60a54868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588078, "uuid": "2ded2f03-d9f0-4251-8cdb-c72f652d4654", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6289643a-cacd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651574401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574401, "uuid": "96a5da69-1a1c-4bd8-9584-2527bb9fcf03", "comment": "Malware payload", "value": "9732c615c46e0f9fc83430938fc6d7fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574401, "uuid": "ded0bdd1-2c1f-4546-9a38-cdd6a5c90430", "comment": "Malware payload", "value": "8824006199b3df1f9e7723a87939be1a3de83820dcd75df778d2a84fd0512528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574401, "uuid": "3c36da45-1a06-4a9f-99f3-9e3be3cbde34", "comment": "Malware payload", "value": "50cd768bca9d858816b5154626c8fcb41e017290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651574401, "uuid": "11976eb0-5bea-495f-8b34-df164e036003", "comment": "Malware payload", "value": "b7ed4c6630c56f82bd3099f01a25616868ee0b4105fcda4e173b644b89b24f58d97ee3802776bb93a3d7251ef9170a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574401, "uuid": "860e1cc5-fe2c-41f2-8260-d7230ecb0d27", "value": "T1D9B3E010D6E4E0E7F9A24B316C38326B5FFA991118A05D0B1F842A9C7D333919B3E71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574401, "uuid": "9ce46dd3-18b6-4356-9a79-195b9d259d17", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574401, "uuid": "3a459008-0bef-44cf-abd2-aa147b32c57d", "value": "3072:ybG7N2kDTHUpou/ubrPWgpz/JQ8M2PhfSp:ybE/HU4rOGdPhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651574401, "uuid": "bcd39b5e-ac24-406e-85e1-e5d06bd78f74", "value": 110920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651574401, "uuid": "21d2f4bc-3ac3-4702-b570-88e4d3338858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651574401, "uuid": "64f98765-3a56-4b8a-b706-93339a21ed8a", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.GuLoader.gen.11000.24247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c55a5a-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651571004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571004, "uuid": "2354e61f-c9dc-4031-8b73-f808e7e416fb", "comment": "Malware payload (Mirai)", "value": "38adfcfadd6d82e5d38c6578fe1507f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571004, "uuid": "d1419852-4352-4b1e-8f59-c9dd9d297e74", "comment": "Malware payload (Mirai)", "value": "885cb8350d5a2a114d040f809e3f0b351051dea93fc59daca0cb5a749c2c9218", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571004, "uuid": "1e37eb9c-da68-491a-ad68-9fa779b07383", "comment": "Malware payload (Mirai)", "value": "17578decf4fd8f0f56ab37efc114aaf1ffa3428c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571004, "uuid": "47b9401f-20bb-4cfd-91cf-66134ef0fc64", "comment": "Malware payload (Mirai)", "value": "9ce42b75fb2c5a21cf1ad95c0754e8dbdbd2fad3ec545c5e6b91a9aedcf758cadc1454e5208dece1c28bb8c2d81f5fa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571004, "uuid": "60677517-a2ee-450c-a38f-3f3e1537c1ac", "value": "T1BBF24B52B21D0967C0971A70263F1FD04BBFA9C122E0F686356F9B968572E372486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571004, "uuid": "f654b8c9-e1e6-4aff-807b-467382fe5cb0", "value": "768:TpT1GEh/QIQx3Hj8gRsVulnei2UKNeO5Dfw+:TDYIQBRWuFuNeP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571004, "uuid": "5291e285-7fb0-46d7-9d8c-7bb71d3cf269", "value": 36620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571004, "uuid": "0dac3578-2bcb-4d34-b0d3-8540525612c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571004, "uuid": "bf48672a-95c5-4783-a0c0-dbd85c12fdbd", "value": "38adfcfadd6d82e5d38c6578fe1507f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3c139f-caed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651588111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588111, "uuid": "0fdd3536-d662-4e17-817a-4447828c1457", "comment": "Malware payload", "value": "877ae69096c5e7eb820b24189d9be540", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588111, "uuid": "49887455-a5d5-4e96-a95f-78efe994b03e", "comment": "Malware payload", "value": "890ac57814c261848eab397dd8d59496f2c40b17a9c39c596296c1f6ac6ed278", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588111, "uuid": "9ece4260-74f9-4670-914f-0c27c53a8a68", "comment": "Malware payload", "value": "7b9ef69c09f68919c788e3f346becab6c73f0149", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588111, "uuid": "bd9cac92-2ff5-4c14-a107-f6dde475d02f", "comment": "Malware payload", "value": "ac5b45104f4ad636e523079dc0221b8cf69ed8c83a18619b9ad708b56286daa1ed529b81d7325f950927ee1fb1ec3b4b", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588111, "uuid": "69135877-1fc7-4170-ac04-d46bf1f50160", "value": "T1DCC61932627C7DFAC05A3DF755F7A514B83F6E7125928C166BB02848CE35C80B92A74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588111, "uuid": "b89f2355-9cae-466b-8a76-dc5d8b7ba8bb", "value": "71a9553c9a0bea5c3ad5c60e2d970c2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588111, "uuid": "e1ed8fe1-e6b4-4a0b-94a3-1ea00e329b4d", "value": "98304:ArEWWyUwULI1VeylXtGSPB5zIsEBChPvPsS9qpL3SqYOts+FkRgY1IY:gUczl9HfzIEXPsS9qpL4wF8rIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588111, "uuid": "1ee4b296-0fc3-4e8e-a751-796cf873148f", "value": 12124160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588111, "uuid": "0f1f2bb9-7f51-4ad6-805c-51c41c8d6af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588111, "uuid": "51f56eb4-d364-44dc-8be6-ab595e6b824f", "value": "08414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8bb1f0-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591218, "uuid": "c4d9c2b3-7a76-4e53-8b62-f007707b69a8", "comment": "Malware payload (Mirai)", "value": "e7170d6e45da2f60f7868a553ddc56fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591218, "uuid": "e81b9b53-3111-413b-9fc8-d2abff0a9d18", "comment": "Malware payload (Mirai)", "value": "895b78240cdbe7b4aec2a0bb6166c820deddbd695587bb90076adce4f81b10ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591218, "uuid": "4d701763-f49d-4689-897d-e03adaafd97b", "comment": "Malware payload (Mirai)", "value": "9181146dc029dccfcf75a1094843c986a85af226", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591218, "uuid": "c2d093d6-0fb2-48b5-a14f-de7d57429355", "comment": "Malware payload (Mirai)", "value": "2e6ad991d36d5c3e2e836dddadf87d96d4299f00cf8e1eaa23e115e88ffb32391106eb8336e99df1bc42864c826ade6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591218, "uuid": "e9b007de-23f4-455f-97a5-2aed63899062", "value": "T15DC34C46EB408A13C4D51776BADF42493323E755E3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591218, "uuid": "677673d4-670c-4535-a006-ddc4bb3e4e38", "value": "3072:YSqfkbUZDzrraLe1cJw15lNHF+2mUxVQWz:YS1bMDX+Le1cJwrlj+2mUxVPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591218, "uuid": "ad07d39f-1cae-4f5f-8070-3c905ffee10f", "value": 125738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591218, "uuid": "d0bed454-f7c8-43e8-9586-4e8fc6f33474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591218, "uuid": "186857ec-6d33-41d5-9b41-73b94a405e90", "value": "arm6-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc30015-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585429, "uuid": "6dd4af05-5df3-47c9-90d3-116db636046b", "comment": "Malware payload (YellowCockatoo)", "value": "987b323180e264a9bc52e7d5039d793a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585429, "uuid": "53305832-6b0d-4420-985a-773405e34a64", "comment": "Malware payload (YellowCockatoo)", "value": "8c37f4b7cc589923e84c3b28403135b3e52c42d5fd0961e7a57ca8b53ea9cb45", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585429, "uuid": "b5f75846-0026-4797-a784-44d33ce3d841", "comment": "Malware payload (YellowCockatoo)", "value": "c7dbedd33fdc29d91ec94d8b89b6be08397c61a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585429, "uuid": "db5a6e7b-a1b5-4699-b789-65f4c3ae886d", "comment": "Malware payload (YellowCockatoo)", "value": "4f9a7e966ae51512241996db48547a9f71347c87c9f6eb848224e41cb82d0a6d56c757f23db7175fb6becd4d17d28079", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585429, "uuid": "b931b3b8-4c4c-4985-bee6-2ba773d37a39", "value": "T160048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585429, "uuid": "5bcc99c1-601b-4e3d-bb53-9b35c7295c8f", "value": "9f00868a9351d7a5857413af333de0ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585429, "uuid": "6db1662f-7648-495b-b6db-26e95a6584fa", "value": "3072:sNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2r:gO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585429, "uuid": "516b22ac-a59c-4332-9846-e5f34a54dc08", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585429, "uuid": "10487e6c-f12c-40f0-b64c-d598b8921bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585429, "uuid": "3e196ad8-1a10-426a-86a6-54c333499051", "value": "8c37f4b7cc589923e84c3b28403135b3e52c42d5fd0961e7a57ca8b53ea9cb45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e2e3d9-cac7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651571994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571994, "uuid": "85bbfd0f-4c47-40e6-aeea-1fa249b5259b", "comment": "Malware payload (Heodo)", "value": "2094f2216800bb274dcd023ddb28d7b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571994, "uuid": "7972a609-7273-4417-87c0-1e27a32b533f", "comment": "Malware payload (Heodo)", "value": "8c86ff24d95d479b568dbf80ba66f4e1cd07865e734c23f73b234a7110712b82", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571994, "uuid": "6d09698e-ae23-4d21-bf92-7be62ecd1cbc", "comment": "Malware payload (Heodo)", "value": "3326400cd286f341883389d65a928e045f2bdbab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571994, "uuid": "2b8fb1b0-9dbd-4736-a896-b734f684e1ae", "comment": "Malware payload (Heodo)", "value": "ba4ad1f6c9843f678db848b3d98a64a03522d91e64f88eddeaac0da04b351a2f1067b5561a3d7d6bde2991856b410037", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571994, "uuid": "dcc1e673-a62e-498c-9d3d-b0e7a4adb0e6", "value": "T12ED49E02E65D84B9E12FD13C88E387A2E2717C98877953DB2694FB3A1D739D45F3A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571994, "uuid": "32818360-c7ba-484a-a810-6918d034a4ba", "value": "6144:JhZ02GdOOgPYVNazgHH6mXZOs4z7N9nAfieHiL7iinzGCvCsP5Otq61CgTAEbik6:JhFfuTHzXO7N2fBHiyzskF1CubVnmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571994, "uuid": "140cf803-223e-4112-bce3-787217b6667b", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571994, "uuid": "21fb1e10-d7ad-4338-a543-81b08a033b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571994, "uuid": "187d173e-c105-43ae-af72-24bdf9668f5f", "value": "emotet_exe_e4_e0137732a8f7e88419f4d462918b3fd98c29f32f15a8f2967fa75b81a1b54902_2022-05-03__095949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078b6f67-ca74-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651536023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536023, "uuid": "c2c5ebe1-d4e4-49df-82b0-4a0dd204ca76", "comment": "Malware payload (Mirai)", "value": "6a89a8e1e8c7c41e1a65eaf734fe30bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536023, "uuid": "8942b3ab-ecd0-43c4-a01f-f5288f23e052", "comment": "Malware payload (Mirai)", "value": "8ca8aa4fbb24cce420769be553edb1e57e847231c8f8b7f1b22b7a0aee8abcbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536023, "uuid": "45afbb7b-b97c-4340-8368-ec74e49c5b92", "comment": "Malware payload (Mirai)", "value": "39a6c1407530f8f08dd60068c10331d99f938076", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536023, "uuid": "5e5108b3-dbc8-454a-aa80-2cd70fb9ecab", "comment": "Malware payload (Mirai)", "value": "26bbd6863f38d9451962cc2264b3dae8f60ec4e10066987bf0a3d22c5cc7941007471d05e350757278a70e6a013ff262", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536023, "uuid": "ac2ee0ee-26a8-4309-bfed-3fb4ea0a3a22", "value": "T1F4D2F191BE4ECAB4CF4D937F21CE4FFAD0122591534C6993A8829C5F0EF61BB5A52C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536023, "uuid": "cdaad56f-4581-4475-b930-ec439f8a7745", "value": "768:Z930DyeJXHXBJnm9/0HDaaAmtkRWmyXvebLr4WmjhHHKFglxQ5:Z93SyeZ3BJnc/0H5ASXmyE3ctKFglA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651536023, "uuid": "a5138946-a41f-44ea-aa30-c75af4acf43a", "value": 30860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651536023, "uuid": "b92f3289-3374-4d55-a34d-02ced2f280f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536023, "uuid": "b386b00c-7c12-49f9-b68f-21a80aba2340", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026140f5-cacb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651573380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573380, "uuid": "4bce3ab9-d71b-4cf9-9cbc-3b298aadab9b", "comment": "Malware payload (Quakbot)", "value": "487fd75dc8715a0b3ffeb88cc504f730", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573380, "uuid": "e5bf433d-9459-478f-9094-81e6c37801be", "comment": "Malware payload (Quakbot)", "value": "8cc8f32b2f44e84325e5153ec4fd60c31a35884220e7c36b753550356d6a25c8", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573380, "uuid": "8933817d-740a-4b85-be63-df6f51644e82", "comment": "Malware payload (Quakbot)", "value": "e0d8a3ae6c0b8c12850b0f0bad35b776da2d2805", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651573380, "uuid": "cf05be0b-2078-46fb-8de0-1c70fecbb19f", "comment": "Malware payload (Quakbot)", "value": "c1e4ab9baf5bcdfdadfba82e5b9694bc4fbaa6efb6faa17274d2e39aec821a255de4e6299e2934626bb4deaf5aa34b01", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "GAIN AI LTD", "colour": "#950C09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573380, "uuid": "6ca6e38c-333c-4d3a-9503-f8882a54a121", "value": "T1E1351219BE9B0B33D9034132409B97505F7A8C189B960B13E3A2734C3D76B7517EBADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573380, "uuid": "2a14a58b-59a6-44b3-97a6-9e9e71eb84d4", "value": "24576:DnArxiyIXH33af9cZ4RfvGM431sAGaqqeNDi1TNParL2zp:DnArxir33afeCR3GM4lX9qqeN2ar6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651573380, "uuid": "34f174d3-3375-4a1f-bc24-56adfb23e2d6", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651573380, "uuid": "953fdb71-1636-4a11-8ea7-d6cc81a8f050", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651573380, "uuid": "d0806add-6469-4bba-a726-276f99d8caec", "value": "X399.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84756d5a-ca95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651550406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550406, "uuid": "1575c8b3-c83e-4f67-ab80-e6b941b732dc", "comment": "Malware payload (Mirai)", "value": "7d584970f9ddda72cdbdf70a419edf66", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550406, "uuid": "3ca385a0-28ae-4a21-aadd-e50e9786f1e6", "comment": "Malware payload (Mirai)", "value": "8ce9cb9382519115e22014773ce7498d60a63d3eeebbd2502ebcefe6a48525e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550406, "uuid": "eb52b5f7-b395-4dd0-a473-048e48b2dab5", "comment": "Malware payload (Mirai)", "value": "5cbe430447993c52e31b7d533babdbd665b5b114", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651550406, "uuid": "6797805f-03ee-4469-935b-f49f9aa504de", "comment": "Malware payload (Mirai)", "value": "d937d7c57e0251774b85c0a4f49f0c61ffae86c3485b32ac9f2b3eb2be8d9983ac4ea858cb90727e9b40eb7279d87eda", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550406, "uuid": "53662177-39a4-4d8b-9511-0b4757a717a1", "value": "T1BF7349C6E683E8F6EC120578207B9B729E37F13A153AEE9BD78C6923D841641D71235C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550406, "uuid": "1d2d8f99-9fbb-4916-8f23-0503fd87939b", "value": "1536:KY9gGmsYRYaABS94zeVo4NG/EL+2uGRUcAhYKasJOjSqw4d:KY9gGmsYRYzBS9bG4g/E6rmUhhAUOiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651550406, "uuid": "5e2846dd-4bd0-4681-bbc7-5a51f950bd29", "value": 75732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651550406, "uuid": "c1d318ac-e18a-43a0-bf0d-23d7505bda9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651550406, "uuid": "aba8b054-718c-49e6-94e7-a92a71df0e7d", "value": "gx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae850048-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582689, "uuid": "bef1f6fa-6875-49eb-ac10-0f571b712ac0", "comment": "Malware payload", "value": "ed6f625a652da754398a2ad804098ad3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582689, "uuid": "33fa5868-e8fb-47f8-ab45-a27e9b824d44", "comment": "Malware payload", "value": "8f5240b6a3cf7cd6ce9e3f5481fb11a738864141f9de25a566a34e87d06961d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582689, "uuid": "ba43147c-ff48-4e7c-bcf2-94bd37f1053c", "comment": "Malware payload", "value": "fe68a87af535ec45c7215c715cc0a52c1afd76d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582689, "uuid": "72db3030-669e-477b-b7de-f46296398942", "comment": "Malware payload", "value": "9286719a61442a885cec11012919e9500270b3980437f824c7d48c59791ebbb843c303ea9c9f0ec5b923d1e1dca4b31f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582689, "uuid": "579fb861-838c-4a4a-92aa-879cac0adfcc", "value": "T1E0A43A193A860FEDD166623D84384679E56EAC501AF1C5AFF374B226CF37E906C3D206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582689, "uuid": "2ca1b376-0b45-4e3e-aea4-5110048b4186", "value": "eef8c661f226cc12112ed3d47e5c9c82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582689, "uuid": "3258a32e-fdf9-463b-8dd3-2a70d52c0f27", "value": "6144:F1t94dolxAithgDMg8oAE46UHohU8bJFAOp7LAqNfmit:F1tIW3hBn246UHo9JCOpfAqNfmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582689, "uuid": "7d80a79b-92e0-4fad-b40b-ceb6c8ff42ee", "value": 455912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582689, "uuid": "2d6f795f-4bda-41d9-bbd1-f6a3f7676696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582689, "uuid": "8568d912-a15b-42fc-8881-8434a10c36a9", "value": "SecuriteInfo.com.Adware.Softcnapp.124.15424.27552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c371c02f-cb3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651621808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621808, "uuid": "e0b77940-1dd7-4158-91b0-ec59291cd5b9", "comment": "Malware payload (Mirai)", "value": "3ff82460b5675b886833969b58431c58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621808, "uuid": "aef4602b-b6f7-4bb8-bd8c-37b227bc10ed", "comment": "Malware payload (Mirai)", "value": "8f571b3369e30cf423cfb791415991299312c5115633de2c3bff7ec4f24a746f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621808, "uuid": "e7c60371-b863-471b-8194-8f6dbd7a47d3", "comment": "Malware payload (Mirai)", "value": "f1a3334beda5ac1342c82cbc5dcc1f45ce6c94d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621808, "uuid": "6f69f7cd-8d54-4fec-9519-91bc798bfb53", "comment": "Malware payload (Mirai)", "value": "52ec3251fba00737c174261664395306c3f17712c1143047b62fc14f7ccd10c30f4447f599a6db8cac99b3e1d65fdb33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621808, "uuid": "fd56765a-6fc8-47ea-80ac-bc8d3e36601b", "value": "T1F7B2E162B2E4D931CB306C3ABAEF45CEB68F0028C09E72540A254DFD755D91A68F40E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621808, "uuid": "b87c6587-41c9-4d79-abed-8383f050ea70", "value": "768:xM3ulIZPNFLIwBHZpOpjBXNEE7ks3UozPD:xw1NlHZYpjBXNzBzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651621808, "uuid": "277c10f2-e4db-4937-8d56-2934422850a2", "value": 24664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651621808, "uuid": "b74dc5ea-bc8e-4128-ac6e-cca1fa13d777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621808, "uuid": "ec38c6f9-ce1e-4201-ae89-a5fb9293243a", "value": "sora.arm-20220503-2350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d761a1-cac3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570158, "uuid": "b4061a69-b1e9-42ec-a3ae-a29e44b171d1", "comment": "Malware payload (Mirai)", "value": "39c6657d1314c3b7088d5be92b8cf0d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570158, "uuid": "a3ed6991-ab20-4188-b266-674dc0f586d1", "comment": "Malware payload (Mirai)", "value": "90c4aa9fbf36c7c52e4fa2baf763fa4d4f1cfe22042cd13163884745fb8ba73c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570158, "uuid": "6c803625-8424-4341-9aa1-20bcfd68d990", "comment": "Malware payload (Mirai)", "value": "e2e2ff6ad4680b50b3c08529c9231213dafc0666", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570158, "uuid": "8879e3b7-93da-4ecf-872c-d52ef107071c", "comment": "Malware payload (Mirai)", "value": "b681e5f128dec6be13f65b9c9b6155053a1b8dac43be0e48c7719efe38566d2f179379d7486b271082cdbe4d011ffde8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570158, "uuid": "990ea4d1-2f63-4425-800d-8cf4738faf81", "value": "T14023D61ABE228FACFB99463557B78E119A1833D637D1D685E19CDA011E7024E340FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570158, "uuid": "a78307f2-addb-4a94-8b42-8f1996d490a9", "value": "768:KxRxHf1FtirmM5MUEjx6eQ1lL++ulLqbNyij4CgJQInmUMK5Vej7vNUxww0h:yEx5MUqQj++FI4InmUR6ziX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570158, "uuid": "a6e5d2d1-c0e2-43a5-9435-e4c7e58e53b0", "value": 48216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570158, "uuid": "b4360901-7b2e-4412-8c3a-569cb09a5807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570158, "uuid": "5f51e62a-6ff6-4d61-9f5a-72ee0a2d4aa3", "value": "39c6657d1314c3b7088d5be92b8cf0d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e597b67-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582661, "uuid": "707c4be9-11dc-40e9-b7b9-44fb966ef549", "comment": "Malware payload", "value": "f2439aab14777281296ba52e6a89bae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582661, "uuid": "c8f7a720-e3c8-4b84-aa41-ab4b9ead6cf3", "comment": "Malware payload", "value": "91007a8885ca5bcfc94768420de248c962e517c4ca7a8e5d19010d096204f628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582661, "uuid": "f2fc5aa4-8901-46da-b0d6-88bb2ec94f59", "comment": "Malware payload", "value": "ea90fb4e14e47925132ed52bd472c202d8ef9320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582661, "uuid": "007380ea-80c4-4532-87e0-4dd2d8a3ffd0", "comment": "Malware payload", "value": "4b0b14e8f9942571f84805f95af4a4d378cd7382c6303e6b4a3f31cd9e3edda8bf65692782dfc70dfc7e9dc3bcbecd8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582661, "uuid": "69afd0f8-5dc3-4d98-afd4-2876d148578b", "value": "T18BC5AF2276A2C435C27312318C2CB37F85BDAE701A75D19BB798361C5F748D2AA67363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582661, "uuid": "62360e1e-a913-4a46-9653-07a4fa88a301", "value": "29fa5883cfb84e7defd668451181c0aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582661, "uuid": "ca96b74c-f0e4-4592-afdb-9889f4bd0ea5", "value": "49152:oh2D7hsQTeED3Hz98vI/Y1LGdoa1pkoi5ciCJT01oaUZNUYt:okD7So3T9F/YBpoWU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582661, "uuid": "8e460a37-8b74-4ca6-ba2f-c27bb4ff5f4d", "value": 2706152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582661, "uuid": "a0a30030-82fd-4443-a64d-f98379ebd007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582661, "uuid": "8396530e-073b-4f67-ac21-d740ffc40007", "value": "SecuriteInfo.com.Adware.Softcnapp.124.7351.30040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d421a02-caf9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651593182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593182, "uuid": "8af5a799-eaf7-4270-8236-f5c4a65d64c0", "comment": "Malware payload (AgentTesla)", "value": "e92e62ffc51c780f467857345b9d7a92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593182, "uuid": "7934acc3-c8d9-41bf-917d-c95a691bad81", "comment": "Malware payload (AgentTesla)", "value": "912597630fd10244f16e1c07227a3d6c0cd707cbc1c78beceeaa2d4fe009fdd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593182, "uuid": "828e82be-036f-483f-8dc8-3e8639816c98", "comment": "Malware payload (AgentTesla)", "value": "3d1643751c4442cd326330c80a19da69c13d5991", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593182, "uuid": "f5823cc7-77d2-4e99-aed0-1a6b054ffb7d", "comment": "Malware payload (AgentTesla)", "value": "af64c017e2129853b74c63fb63348125bd69f0a648196a1609e030ee1cff95fffd8e7cb928b47d5ca2817dd62f11a2a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593182, "uuid": "c266c0a7-ef39-42d0-915d-f9632c19617c", "value": "T1E6254CE93150F5DFDC57C87196A89E35A5202E7B871BE303902333EE9A3E55BAE140B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593182, "uuid": "e84f3763-255c-4e62-8be1-95af176421b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593182, "uuid": "8f4704c3-b43c-47df-9812-3d868f68117a", "value": "12288:FKbJc7ylzOXspNboN8nwH7qWs6Oi3jFkeG7tMTr9BbIhhWJGOdvi9khikmfm+mgh:FKb270zvom+3rfjeeG5876j0KDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651593182, "uuid": "3e556eba-f4b8-4afe-93d8-458182cd9415", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651593182, "uuid": "930b8adc-05e5-4e85-8ebe-af98f3c10f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593182, "uuid": "78f7c3b2-be49-4dfc-bd30-709bf3a38c77", "value": "Bank Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a084bc3-ca82-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651542174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542174, "uuid": "beca810b-f35d-4283-914d-4c4a8fc3b0a6", "comment": "Malware payload (GoBrut)", "value": "e27f183578d17738b5fab27fa1f7b207", "object_relation": "md5", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_x86", "colour": "#D29058", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542174, "uuid": "1e79deff-225e-44ec-8903-30d68f9e6822", "comment": "Malware payload (GoBrut)", "value": "940ea36c95934bc5293f43894ff5af8cd4c35c15dcf2f4032a9bf87050678406", "object_relation": "sha256", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_x86", "colour": "#D29058", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542174, "uuid": "cb8b0e9c-9955-491b-af8c-91feb8b295d2", "comment": "Malware payload (GoBrut)", "value": "2da956bfa7db43218ba0b4469acf4a3f67a9da3a", "object_relation": "sha1", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_x86", "colour": "#D29058", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542174, "uuid": "28500993-dc9e-4e55-900b-49cfcb3d4171", "comment": "Malware payload (GoBrut)", "value": "f8f8afd1287d6e22418948ebdb5cfa1e9db042c3415e6ca1a0fb94c33f210625fab6c72c2f4a9a44803e2e31c5ccb346", "object_relation": "sha3-384", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_x86", "colour": "#D29058", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651542174, "uuid": "b1da546c-6ce0-4c3c-bcda-bd416af8e4bb", "value": "T108A533C6AE12E474D31709D500FE67CFFAADFB4A03849D5747AAEE1402447A6CAD03AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651542174, "uuid": "32431085-a421-4d6b-b13a-4398de997d4d", "value": "49152:rdfjEIRbloS+0dpxtdDNqJ4I5y4CIuuzz:rNjEIxiSbpxteJ4Q7LuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651542174, "uuid": "5fae6fdb-df58-4f4d-a0e5-5da6fe28bd09", "value": 2228748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651542174, "uuid": "d9ff25ae-6936-4a30-a9d5-a99ab2d614ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651542174, "uuid": "e52c2214-d06e-4677-853d-9fb2206e0d15", "value": "Linux_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7a1c38-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585422, "uuid": "b55cc63a-d202-4d70-a9b7-684d3d031864", "comment": "Malware payload (YellowCockatoo)", "value": "c6cdc4c215755fdf63ad59b7b110827b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585422, "uuid": "da11e489-5c33-44eb-a738-bb87723adc62", "comment": "Malware payload (YellowCockatoo)", "value": "9792adc49c428ca9a49172e35b84cb8250c58db2a5b36d2509c418adc8a843d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585422, "uuid": "9a908d70-2ff6-4b1b-a93d-c11690693573", "comment": "Malware payload (YellowCockatoo)", "value": "f7be2a6ff1919919e94a4d1b24e92d038369aed0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585422, "uuid": "f670ee70-ece3-47a8-9c8d-f13056756922", "comment": "Malware payload (YellowCockatoo)", "value": "bcecce6405021c059536add96fc9bb4d95a8cd3b55f55c1835e9980d934b962b898aea7e4f0fe14d187f6f41e5a69d3d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585422, "uuid": "75c16052-574f-4706-8823-9ec0620a4f22", "value": "T145048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585422, "uuid": "6cdde17f-4ee8-46c1-82a6-b58b4071d3a8", "value": "b3dcd85d0d6296b94127d37cccf50389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585422, "uuid": "342be9b3-e6a9-459f-910c-328d47cff4a9", "value": "3072:pNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2G:zO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585422, "uuid": "cdf8ab8a-98a2-4083-bee0-043f6db7175d", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585422, "uuid": "cb9131e8-055d-45dc-a38e-08bc54263473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585422, "uuid": "960fd1f7-5c02-4a39-abaf-276813cccd10", "value": "9792adc49c428ca9a49172e35b84cb8250c58db2a5b36d2509c418adc8a843d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ef72c5-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651580926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580926, "uuid": "80bddd24-6c1e-4fb4-961f-cca237efbdfe", "comment": "Malware payload (Loki)", "value": "c861392a6d25fbca987f21ed284e9710", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580926, "uuid": "83da1833-710b-4432-948f-96c406696236", "comment": "Malware payload (Loki)", "value": "979f64f01977c2ff75c7f498dcf89f436e316f9957935338af3f0feb7544969f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580926, "uuid": "a03b4374-3078-4fe4-966d-ba99943c7dd1", "comment": "Malware payload (Loki)", "value": "49fdcbce723701352d709379b3987a4097430717", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580926, "uuid": "52062038-e6e1-46c9-a694-99470e1ca227", "comment": "Malware payload (Loki)", "value": "7730003e85e6b302a4b36a308bbc7323b7a043c40e4d81725016953c23388ac720621d986600951ffaac433852ac59f1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580926, "uuid": "fa156b92-05fd-4942-9059-6fb94d4e01ab", "value": "T1021412403B24310BEC9D82749CC4EC823D65EFDE515823AA778EF7AC0A7ED2159D7A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580926, "uuid": "87568abb-9f26-4d76-8375-5cd639d32bc5", "value": "3072:K22CDOo/aCBsvuTVek/h669JuOxvoiXK5VRtBn/YT2A0LJBY7wuCFxvcy0Oaaa4B:6aOo/ns2xecV9JV6dtBnRbJBY7Rqvcyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580926, "uuid": "ac0f51c5-0b9d-4e91-a855-56ce66d46ecb", "value": 193992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580926, "uuid": "9cf613a4-3410-4136-b52d-43185c18a03f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580926, "uuid": "eade1bbe-cc48-41dd-923b-091651ab2837", "value": "project RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5523e7e-cae6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651585277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585277, "uuid": "8d66e0d4-9171-4574-9268-293750f0ea3d", "comment": "Malware payload (Quakbot)", "value": "bb573e3457139f2024679178b2d9ca94", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585277, "uuid": "35b3f4f1-e44a-4366-945d-a07b76c85164", "comment": "Malware payload (Quakbot)", "value": "97a5858f2bc9c4c99cfccaf907fc3d76e726b49bbc705b08fd5af3eff264b67a", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585277, "uuid": "b4e547af-8604-4c13-9a2b-8aaa3cddfb5f", "comment": "Malware payload (Quakbot)", "value": "91c302cff4d273ae5ab367866088efae63bb51b7", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585277, "uuid": "e118610e-53ba-4556-bb7b-d0267ed7ac0e", "comment": "Malware payload (Quakbot)", "value": "25da2fbdfe66081cf043f03b6d893bec10f544115b7fc4f0223888928bd4a3f2dfdeaf44d8141cbaaa6d028d97a029ac", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585277, "uuid": "b4d4666c-81e1-4e60-b723-58b43e55bbef", "value": "T14D15F165AA58C82EF8DF04BA50ACC507083CB9B2275545CBF3C08DE5A4E51D3BE36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585277, "uuid": "3cc3d6a7-be37-4503-b9d0-093e33efb060", "value": "d0f05ca687f9f16f264a475768c38442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585277, "uuid": "bcb7abba-f016-4ce3-ab61-3e97af8d5370", "value": "12288:wwYWSVNT8mDwme7gAbq/LstY00MQxHsePTbzswVpeJo6b26OHeloyMzjEwP:G4mkLv2/CYX3dLPswXeJg6jotzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585277, "uuid": "c94083c5-44fd-4be9-8b3a-ecec21ba06bf", "value": 893908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585277, "uuid": "aa75cd7f-07d9-4f8a-9812-1f91c1946836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585277, "uuid": "6a519b3a-370a-4902-ace4-d5ec4c08c1a8", "value": "Bmnby.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7da340c-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1651591321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591321, "uuid": "6548ccf5-0d07-4380-8773-0a70c35e4960", "comment": "Malware payload (BumbleBee)", "value": "332d1f555297d05bb4b3b2dd7e76041d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591321, "uuid": "021ea906-5ed4-4973-8ef7-69fb94a03372", "comment": "Malware payload (BumbleBee)", "value": "986dc96c4dbb6c953db7b68a30c9cdc93598d89ca3e9804bd92f53d26a48f5ba", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591321, "uuid": "3e721666-4ff2-4577-a29d-a0fa693262d7", "comment": "Malware payload (BumbleBee)", "value": "b39893d501d3f33edfc475cc7ccaa747022001b2", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591321, "uuid": "a5599aae-6d58-4df6-83a4-147160b1bf2f", "comment": "Malware payload (BumbleBee)", "value": "3b76fcf029532ec08979af8a18a42d45b94f199e1dc2b291c0501afd759424a1f6c7e1444d009ea65e1a301636cd1602", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591321, "uuid": "9d692193-8d6f-46bd-9029-867c357ff970", "value": "T18ED5F1090E150826DAB40EF42CDF3B8905147B17DCB89D5B4AB694AC27BDEEB346352F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591321, "uuid": "143e2a6d-45b3-4bcc-9340-21a972776f3d", "value": "0c85cc919aa73be02e9d5d942c58302e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591321, "uuid": "c47ce37d-27c9-4e4a-b294-4c9b80b0217c", "value": "49152:vwBPPokJKVdx1YWV3obuUvpHOxcSCoCH+JljOAEe+hArAJ2m/NxtZ:vwBPwkJKbx1YWV3oSypHOxcSOH+LOAEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591321, "uuid": "f6810dfa-188c-414c-8183-6404b37dfc65", "value": 2769408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591321, "uuid": "ec4c361a-39b4-48c9-be3e-7c691f0af590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591321, "uuid": "468cb876-9afa-4ce0-9e92-cc45e25aa9c3", "value": "tools.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742702dd-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651580873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580873, "uuid": "1f21d330-df7a-449c-a062-13c0d5223d23", "comment": "Malware payload", "value": "3514c137e36c957f7be125d23c213c46", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580873, "uuid": "4331f9a7-e53a-453a-9c83-69a9d67f8088", "comment": "Malware payload", "value": "9936c1a2ebdba89d19f9d733f552315cd5d7d5ddfa487bfab93b587cb8a393c4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580873, "uuid": "cd80e758-de4e-46ad-96ef-31c5ba90d947", "comment": "Malware payload", "value": "dceed939afa3d2079ac6867bea6722b88194aea0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580873, "uuid": "12a52ed0-6df9-4a94-bbfc-fa9a20ed1646", "comment": "Malware payload", "value": "80e6ec48fad7ce5331e0f2855f318456461becd204fcdd0e4e6e000c7b00d9cb9084e243653dde1935903559092ae705", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580873, "uuid": "0c449e2a-2144-47ed-a0c8-e1f81750759f", "value": "T12D266D23B284753EC46B2A3A5937A758993F7B7139268C5B57F4088C8F365403B3E64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580873, "uuid": "7dd30c6f-e1b7-455c-8d5c-590b0ac750b0", "value": "98304:2dvK/nSvr+0yRCtqihrroxtEAIumVnKgZVNdYAA:2kPST+GqKrroxtEFuAnKg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580873, "uuid": "2a2605c2-dfbd-46c2-8b8e-e796c4870d1e", "value": 4750848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580873, "uuid": "aa692973-9d20-4617-82c6-6f5a33b760f8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580873, "uuid": "da300979-7bbe-4550-bc27-a8f9f45e01f5", "value": "Archivo.Endesa.Fecha0305.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3cf5b5-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581938, "uuid": "37c92d25-adb9-4729-9b2e-cbea11afea02", "comment": "Malware payload (Mirai)", "value": "86a7d09d211312917db21f2d62770f7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581938, "uuid": "4d115861-f225-43f1-ace5-846bfdce17bd", "comment": "Malware payload (Mirai)", "value": "9a3790d9b5cb623333f1d6c6f785587868c08824ec1552e9af3fa4c308ffb78e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581938, "uuid": "02d447bb-39f8-49ce-b6ad-f8e94f3c3b00", "comment": "Malware payload (Mirai)", "value": "0ab14eea268a3393683f8d089ba97a03c99f38c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581938, "uuid": "61096d51-e653-48a8-af46-ec19af6ff06b", "comment": "Malware payload (Mirai)", "value": "3cb0d09489bacf3a275fd9015f57460d5a2eeeadcdab866756f11ed6e4ae09e73a105dc7510399d4f9b75b1f2b3963a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581938, "uuid": "ab7afc31-e91b-49f2-9ed6-5d159a0530d5", "value": "T128831946BC819F01D5C912B6FE2E118E33131768E3DEB2239D149B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581938, "uuid": "b022aabd-1497-413f-a92d-5ed13b39c161", "value": "1536:CxnTsKJgf2wC2ZTlbMT46sk5ba8wkbyMRiOcYc8QRQv5SYG:rKGs23isYaycYc8QRQvMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581938, "uuid": "3c886204-1675-410f-8e32-fde784bb31c0", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581938, "uuid": "913479de-1286-4fc2-8115-6c2ba212b62b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581938, "uuid": "67f1be4d-00ca-4b3a-896a-309243995d05", "value": "86a7d09d211312917db21f2d62770f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cd88d0-caf6-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1651591938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591938, "uuid": "256448b6-33cc-4b6c-8f7a-772eef826b3f", "comment": "Malware payload (BumbleBee)", "value": "cf01708a7f90125c9a40a5b69e5c7b1c", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591938, "uuid": "ffa83072-9507-4f8b-9d64-2b3b73b62797", "comment": "Malware payload (BumbleBee)", "value": "9a4ee49993a5a5b4f5e7f4ee34e86f35e94a3c7dd3580bf165fb5e4774c3c7ca", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591938, "uuid": "5f9dd88f-6618-437d-b707-c95d6e416de1", "comment": "Malware payload (BumbleBee)", "value": "7077253237f09e7106d81ddbf6a0b88baf539b02", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591938, "uuid": "4606f373-0308-48b6-8d39-4394dca0d635", "comment": "Malware payload (BumbleBee)", "value": "b5666b115a723864af7b1dbff2de117dce5647695f400f41956d991f6e401e1cf0d92e40b52f1e1eddba1c64c8888226", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591938, "uuid": "2bf9324d-6423-4a93-9ff9-a75d7eddeb87", "value": "T1A0E5C00A82988D667D9C5BC03C1D6FDF464DB7527A69249D2BBA18C5C3F2A7B103C13B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591938, "uuid": "cb31bed8-ddfd-4817-881f-aa0ec60728c0", "value": "76c7bbb3ef482197e9ed4286198fa18b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591938, "uuid": "2d8a91c7-82e0-4eca-9d72-202dec4a4615", "value": "49152:c/QSPeBPVlPYz6I1aNhsj0q8WoYboIsMG3NI1clAqbmTaQSF0g3:cYSPeBPDPYz6I1aNhsj0q8WoYboIsMGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591938, "uuid": "f7a7de82-5592-4ff7-8546-3c454f835a25", "value": 3118592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591938, "uuid": "6165fbbc-c519-4a00-a2bc-e822bd1b7d8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591938, "uuid": "8df7db55-89c6-4462-9204-2af5299857ae", "value": "mkl2n.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abaa73d2-cb23-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651611460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651611460, "uuid": "9215d4bc-91cc-461c-b235-bcb98ac99f88", "comment": "Malware payload", "value": "583b85b5e44a5811ac570f3925045938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651611460, "uuid": "0ef64c25-4b05-4b1f-9291-dd24a7f43238", "comment": "Malware payload", "value": "9c00d71b81182c896e3c8f63d6a877c6be8b1fbed3c9b6a510e2abc959b8cf5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651611460, "uuid": "d7408e56-036c-4b42-8974-474127450366", "comment": "Malware payload", "value": "849b119c92e454f218f45d5d9e3e5c148a9a36f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651611460, "uuid": "d964abc4-a582-4ae9-ad03-9de310c645e6", "comment": "Malware payload", "value": "874122d5f1c9e5871e8f11f10a1871a76b967b848d37ac8e7274891d32beb30f259077699f567219a01314e6aab533eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651611460, "uuid": "d775a1e3-ff2d-4ca1-aed3-b463f9db6f79", "value": "T13DD49CF172408BD7DD3BA73A12994E5023F1553AE326F70B2FE023E50653E6F1962A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651611460, "uuid": "f3e12738-5bf8-47a8-8eb1-306b9dca0e87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651611460, "uuid": "d59fe8e4-98c5-4e37-83d8-baddee05077f", "value": "12288:ZwEPfBn3hBIg0+Y5tjJOv2s/Uih52Y5c80TKZpZKgxYJI0G7t:Zx3cgpYdEHh5zJZpZKTJI0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651611460, "uuid": "fe134afb-6401-465d-8ef3-60002407324d", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651611460, "uuid": "d0709224-be56-49a8-b404-a961e7557381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651611460, "uuid": "3c73345b-9581-4866-b321-e9ba7eb9b825", "value": "BL-SHIPPING INVOICE DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32a915a-caf2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651590481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590481, "uuid": "393960ff-f6ae-474c-89e2-ca818b1af43d", "comment": "Malware payload (Quakbot)", "value": "ca90c12464dbef7bb2995f4d8612fffe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590481, "uuid": "69d3b085-cfb4-4fef-8dcd-703bff57af73", "comment": "Malware payload (Quakbot)", "value": "9c2b95ec0797ad6b52f1e2fdb3c0a7ed9fe45a73b47515cbba5529cdd3f43a09", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590481, "uuid": "a07219ce-0ec4-49e8-9d9f-06636bb75a80", "comment": "Malware payload (Quakbot)", "value": "97132cfd5c2b296449f252a9cf3f91a2fd04f0b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651590481, "uuid": "4bf8dfc1-a222-4370-a3f7-6b94893a5664", "comment": "Malware payload (Quakbot)", "value": "0895b29a6b3e727fd1eb20d6f9828aca447d4a4831888db40081b5c158c34b406080a0d88c01f8e17cdbbd972ed97d95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590481, "uuid": "b5a931b2-4b58-49c8-9da3-b3652df42227", "value": "T13715F165AA58C82EF8DF04BA50ACC507083CB9B2275545CBF3C08DE5A4E51D3BE36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590481, "uuid": "9478390f-1a97-427e-8776-6dce8012a698", "value": "d0f05ca687f9f16f264a475768c38442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590481, "uuid": "8db45483-05b4-4ae5-9873-27199ac43e68", "value": "12288:wwYWSVNT8mDwme7gAbq/LstY00MQxHsePTbzswVpeJo6b26OHeloyMzjEwP:G4mkLv2/CYX3dLPswXeJg6jotzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651590481, "uuid": "1919228a-b1a3-40b9-9357-424f86e678dd", "value": 895699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651590481, "uuid": "8c2456c0-737f-43c8-a370-8541de9cd564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651590481, "uuid": "ea2ca23d-075d-4503-b785-f189542c3cba", "value": "9c2b95ec0797ad6b52f1e2fdb3c0a7ed9fe45a73b47515cbba5529cdd3f43a09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569549da-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570945, "uuid": "cfedd71e-18c8-429d-b43a-f67e78cea28a", "comment": "Malware payload (Mirai)", "value": "09fb0cf2712dceca1ad507a64a78ebba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570945, "uuid": "d726caab-6faf-4900-8ddc-4520404b8bf9", "comment": "Malware payload (Mirai)", "value": "9ce2699fea603e6bb065f4c4d77f2655fac599499b16b8db1c50c2e09529e545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570945, "uuid": "c6ebc96e-d06e-4d2a-bce4-681c7ca5e382", "comment": "Malware payload (Mirai)", "value": "e535543a39d98ef4992cf63228b7ed1427dbfc98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570945, "uuid": "437bafdd-ac1e-4db7-85d5-532c31e3ff99", "comment": "Malware payload (Mirai)", "value": "d283cb602cd8fbbe8ecd2e139fb9135d23bce867184fda5166ab3d12cf04572a8d9f1e74cbe29adbbaf4c922842b2f78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570945, "uuid": "cf50b21e-234d-4474-a9ec-ef8dcc0ad42f", "value": "T12F33B715FB610FB7C8ABCC330AAD1B0129CC554B26B53B367934D568B64B60F69E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570945, "uuid": "c37c8f60-1b59-490a-be74-84d3f22831a9", "value": "768:KapARqQbTIbQw5OaepzSeCNeNeiQZPNpZXiBDH7hw6:KaeRqQQppzNRZZPNyD+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570945, "uuid": "0fc58699-ef01-4bbf-8b58-a18c3509cecc", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570945, "uuid": "ae388227-2d84-4b5f-b9d9-02ec870e9dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570945, "uuid": "2d1fb175-9a29-4ab9-83c7-78e8c481ea1a", "value": "09fb0cf2712dceca1ad507a64a78ebba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761c937d-cad6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651578299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578299, "uuid": "55db1e33-9eae-41ea-bf7c-53b4ac8c0324", "comment": "Malware payload", "value": "a7214fd895f3da70da799b50c2ce30c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578299, "uuid": "6ca8debd-17c7-4464-a0c2-c09d7d09292d", "comment": "Malware payload", "value": "9d0c57b7d0afa174c5a8f338151095e0a3ab6e4a5feedb23489997e121013974", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578299, "uuid": "df6164f4-f51f-481d-9e16-da8c2d15b000", "comment": "Malware payload", "value": "a6ac1cee95dc94506a5b41440943ff188031cf49", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578299, "uuid": "9eb28c8d-3bb9-4030-a8d6-82d05bdbe2ff", "comment": "Malware payload", "value": "8ac2593d5199d380b830cb511131ff49caea488dfd6322c7265676f17e37a832e6cca5a2b13649f8608414b49ad6ef65", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651578299, "uuid": "ecb1a966-76a0-4f35-ad85-a89b561d22f9", "value": "T1C5A2BF30BE0FD80DD1699572109F36B4EEA06086DB67DE0F586C614D8E62A6A4307E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651578299, "uuid": "3d119f67-a781-419b-a8d3-0b44e517535f", "value": "384:zXSKgETbqb0HHHHHBHlDYIBSjyJ0oX+N/K5w70wsKKWhaKSKiJgkuZVsqxfWXhXp:zbZ2b0HHHHHBHHSjy6oONy5iLOKe6Vsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651578299, "uuid": "d03d7c2e-11a7-4386-9216-e7827bcc57da", "value": 21864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651578299, "uuid": "6e7bd21c-f32a-49d8-95e2-a57108cc616c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651578299, "uuid": "3ceeade2-040e-4fea-8f70-93245ea7ade5", "value": "ANFRAGE - 0503.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8b062b-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622176, "uuid": "b95fd9ea-c37c-4904-bcdb-913424c5a1d2", "comment": "Malware payload (Mirai)", "value": "74ea57981ad019519ebdf0b2987cd960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622176, "uuid": "8fce89bd-8ea7-4097-8ddf-17e3ac835637", "comment": "Malware payload (Mirai)", "value": "9dc7ab90be3af9c1a1b018162435ce3e85000719b5c2f18cd96e4fb09d6cf7be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622176, "uuid": "ff6a1f35-1a4e-465a-a8e2-500fb2f5b927", "comment": "Malware payload (Mirai)", "value": "875a1ba5b17d696118477eb6646d8712caed6424", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622176, "uuid": "cb0ee35a-ffa2-4d35-b346-7735eb5c507a", "comment": "Malware payload (Mirai)", "value": "d799c9f2911fdb74b75331ec780425a245bf7b48bb56e1911593f5aa0cf10f001c51e4b1de17e2bac7d8034badaa114e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622176, "uuid": "8a39e6e8-9cc5-4f12-a431-2058250fd518", "value": "T117D3E80E7E219F7CF3A9877807B78E20965833D616E1D545D17CE6210EA028E641FFAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622176, "uuid": "3196d9e3-6083-4ef7-aef6-43ca3b8728cd", "value": "3072:CFjHE4C1HN8q+dAX6yRXcMCMRWpFCVoOQRMgg:CFLE4CHaGDxcMSko6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622176, "uuid": "6cd78415-7358-42a9-8d98-159f20533c96", "value": 133328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622176, "uuid": "6e112b58-38aa-4b38-a1f0-22969c9342e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622176, "uuid": "77b5ecb5-4e1c-4f1f-81f4-c134f5a6d0de", "value": "74ea57981ad019519ebdf0b2987cd960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42b831b-cad9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651579692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579692, "uuid": "ae6ebf28-9966-49a5-a3c7-585a77b96b00", "comment": "Malware payload", "value": "8e78ca8c85fcfe1c72d11a499bdf0042", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579692, "uuid": "2c543f08-4663-4978-8523-b585f1f5e31d", "comment": "Malware payload", "value": "9e075d6929883ec5ae55948f32534e5c7a8294069a9b4decc8252c9693cfe067", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579692, "uuid": "95dd93fd-c537-4024-85a6-877145b9930e", "comment": "Malware payload", "value": "fdd1b58127535c4c41d353472df1ffd520604953", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579692, "uuid": "7c3d2afc-48ab-4fc5-bff6-2efc2185b54d", "comment": "Malware payload", "value": "e6177c82845c04addf0d2b1d8c4fef00e28af61a4946c50dade060c238a2d6009dc1e409c0b1b5d4edac1c4a53cf10c2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579692, "uuid": "9918b9f2-3e76-4c90-997d-0e76ec1b112d", "value": "T125953352FCDBDA62E403CC3280275843B96F4B14DC5EB962BB17C2694D76E21E66388D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579692, "uuid": "29d1bd92-f8c6-473b-a6a2-20f06295b616", "value": "49152:/q2JSXvusQcoAdlmoJzm2CXi4a7UeZlkjcbLOThwRCG:tSXvuIXY+IXE4Olkjcwhwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651579692, "uuid": "07b61fa9-bd66-4160-9018-4ac5a5a785b3", "value": 2015037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651579692, "uuid": "fd492787-5872-4e9d-bf72-07f3ad7a180a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579692, "uuid": "5ea7f52e-09be-47b7-b30f-ca67557e561b", "value": "\u0639\u062f\u0627\u0644\u062a \u0647\u0645\u0631\u0627\u0647.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2061e78d-cb10-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651603066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603066, "uuid": "59af41fe-2325-4f01-95f3-54a62ff56448", "comment": "Malware payload (Heodo)", "value": "c5551b03ea57d3383653edc435428891", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603066, "uuid": "34e7184f-0a9e-4340-85f8-8813250504ca", "comment": "Malware payload (Heodo)", "value": "9f0ac4577fb097e6c410989a74f9d81fac45eba6a2bf8262fc18788aef606007", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603066, "uuid": "be924e15-710a-49a0-b3ad-6e40efb70d95", "comment": "Malware payload (Heodo)", "value": "eb42371106811bdcccf1caca273312fd1079af4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651603066, "uuid": "dd2bff04-e787-4371-a4d6-6c60bac47cae", "comment": "Malware payload (Heodo)", "value": "1125c5beee3703ca094abba7014960ff390f784785bd3c76fc65c3b510b526fa21c7296e0364a470f432a1c7f3d74992", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603066, "uuid": "6a551aa3-4651-40d0-bc7f-7f6df93c7167", "value": "T1D815E74279838E34F11F03B0DD43121AB61F9E50FA51553EABB872AAAF307A17DD921D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603066, "uuid": "a7c0504b-abe9-4a57-a5a4-b3bb8bc00525", "value": "39f0c91492ecdee129a7efdc73aac29f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603066, "uuid": "57dc24fa-d1e8-41eb-a15b-d065a83497ec", "value": "12288:1HINAbFJ0qIOft0qsDCTOtbq/XhkUqKJzlB/ooM5M7VesLZkl:qNyJTIOfADYOFgoUuoM5M7VesLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651603066, "uuid": "e012ef91-29f8-4588-bdfe-54b1f7159d0a", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651603066, "uuid": "902223ed-5360-4021-b847-049fa2c0ef4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651603066, "uuid": "a53390bb-9889-4e1f-b503-ff276fb073a3", "value": "emotet_exe_e4_9f0ac4577fb097e6c410989a74f9d81fac45eba6a2bf8262fc18788aef606007_2022-05-03__183740.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753dc69e-cae5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651584740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584740, "uuid": "c8521496-ceab-4d7e-aa67-83f0d2508cd3", "comment": "Malware payload (Loki)", "value": "523ec0262addeeb0d2479f4698a9e244", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584740, "uuid": "c9dc098f-95ed-49f0-a9ef-fd638037eae7", "comment": "Malware payload (Loki)", "value": "a244c9f48051a0de3e4baaf1f6e09e6027d73bd8c4988311b3697d9800178989", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584740, "uuid": "aa80e08c-2995-4b8d-8b82-0f16f6d86380", "comment": "Malware payload (Loki)", "value": "668bff0b3f3aebc5858ffac524d35f5043a03296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584740, "uuid": "f85a316a-8c73-4bea-b0aa-b44418898f73", "comment": "Malware payload (Loki)", "value": "4fe656aaac53d76a307602a3f38cf41214fcb9476c38c8a513d402578dc10cdec764c32108e009a765e3bd10678af30c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584740, "uuid": "fe5515a6-4a90-430f-a2a0-b2ea1a67d0a0", "value": "T1B0C30244B7A0C837D16B8B311AB7D7B39AE5742365E4A59B1340AF48BD32782DE0E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584740, "uuid": "9d807f64-4af0-4df8-98de-2461897f7345", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584740, "uuid": "39bfa652-8e95-4272-80b9-53fb370ab255", "value": "3072:l1NjcVVnLpPunbZgAAJGLIX6hsLc17oAkuKzBElMbsJ:HNeZmZ/AJGIisLmeuIGKba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651584740, "uuid": "1e4d3ab8-3fcf-4744-a66e-dd3a9937146d", "value": 126430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651584740, "uuid": "abfe847c-03be-4224-b4ad-60553f5a0a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584740, "uuid": "1645de9f-e85c-4295-948a-b936d2f4cb6b", "value": "523ec0262addeeb0d2479f4698a9e244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b243cb1-cad1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651576106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651576106, "uuid": "c92b63c3-4e6c-4739-ad8f-24aff9bffdd5", "comment": "Malware payload (RedLineStealer)", "value": "c64a73ba2dc7a801a01a7561f1b6dae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651576106, "uuid": "9a8a3415-dce4-4138-9356-ca95cc7baf8d", "comment": "Malware payload (RedLineStealer)", "value": "a2bed9be9e8d978ac01029bb1edc5949cb9ec9a455c36d561026ef7954cf99db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651576106, "uuid": "52a78d1b-f591-4163-90dc-76ea50232fc8", "comment": "Malware payload (RedLineStealer)", "value": "47ac03c654d37c9400635ea9b7ec9375c49043d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651576106, "uuid": "5c272660-72f9-4896-bc19-34b3d514581e", "comment": "Malware payload (RedLineStealer)", "value": "c416a4ae8d16f9b657bce76a2aecca912750a950200e0681b8b303759c8f4099ab8191ab53e5cbd780ea2ed12d6d3130", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651576106, "uuid": "50f51329-fd68-4cf5-8476-4ccc2f3e34a1", "value": "T18684BF10B7A0D034E1B726F559B993A8793EBDE19B3491CB32D42AEE5A356D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651576106, "uuid": "bc5dc120-08f8-448a-a9b2-1207df03d940", "value": "a143483d4d0f129b0ed032a728de83df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651576106, "uuid": "3f66622f-c274-4e6c-9005-fe01f32f429d", "value": "6144:SU8y6wqvHICHZAsOZT1qy76U/3qpW722pcyGXD4eQdrbx1u3dmS4:Sjy63HIYZAsOZT1RH3eWt1pro8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651576106, "uuid": "14b0bb95-6922-40ec-86f7-e0ce31924ce3", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651576106, "uuid": "131c7345-3f2f-4606-972c-5a2bc689631e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651576106, "uuid": "357132ee-4e27-47e7-a54d-fdadf6933b5a", "value": "c64a73ba2dc7a801a01a7561f1b6dae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf84e4a-cab8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651565343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651565343, "uuid": "c958ee98-07c6-4cbb-8037-18f7606686a0", "comment": "Malware payload (Heodo)", "value": "6ac90623e07f9557672f64dcfb05f62a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651565343, "uuid": "21deac83-d8fd-4d84-b8c9-4e415cdfaa6d", "comment": "Malware payload (Heodo)", "value": "a3b1994e74fccd304cdcf8b3a4e45d5dc1d5dae3d3918252eb680a810b0a391a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651565343, "uuid": "21ed0685-cbf2-4c17-9658-e29848c93473", "comment": "Malware payload (Heodo)", "value": "3633ce1c2364226a1bad722c6b33f2f7b9e83f1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651565343, "uuid": "094c82d3-fdb0-4221-8b98-6e91a4e11152", "comment": "Malware payload (Heodo)", "value": "56f9b0205a049f2c269b30657b1c44f533f9989c4e49655bdb396175415fff8de8de2d7186819bbbb5bb254992a7e515", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651565343, "uuid": "d588e5ca-5476-4bad-923d-41c352af87a1", "value": "T12EF43A50735AE1B7D0539CB44D1982B4AA0F6CA14A3461F7BB9E371DEB789B01B207CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651565343, "uuid": "85aeb02a-d612-47e6-bb8e-2bc61efe72fd", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651565343, "uuid": "3f1077c4-8b74-4dbb-aa6e-3dd8e8c2b352", "value": "12288:DjN/Z2wkRrA9CRDCWElAjHDsndSyHOrNjEP0OuZfMAofD:dEHR+CR2yfsMyHOpVLZkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651565343, "uuid": "119877ac-fe04-4baa-b58d-73265aed50c5", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651565343, "uuid": "4387f886-c12a-463b-8fe5-0b3a99164e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651565343, "uuid": "6ee640e9-849e-4f72-ad61-0ee6d5932768", "value": "emotet_exe_e4_213517f8fdb8823c61a004bf4157d207b335be50f178906dbeddf5455a34b8a8_2022-05-03__080859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4b1f72-cb2b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651614761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614761, "uuid": "c45fc930-3133-49c9-8d8f-6b563ccba853", "comment": "Malware payload", "value": "f112bbd9b20d8d3500419a0d41de2a9c", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614761, "uuid": "67e40d19-cb6d-4b9d-b30f-255cd0999b89", "comment": "Malware payload", "value": "a4165ae334a45cd8cf05b1659650d61380854fe3e8369df4cfd47cdb71596303", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614761, "uuid": "351a5569-0461-45be-b227-c34670dcb1b2", "comment": "Malware payload", "value": "cf5c692e877f8f83be9708f8bbd27763ebdf9fb7", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614761, "uuid": "e2330cf0-ee75-40b6-9ba1-82036b15ee66", "comment": "Malware payload", "value": "2b17204ee4df0a798a7255e7ef9127c221b4c534d0621d6cb866dd2bd3af9836311d8e46f8a97ad648598e55bcc2c02a", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614761, "uuid": "8fb40cf2-8d6c-40fb-ac3b-9757ec3bec17", "value": "T10F663302B6C58A33C5FB4D312975C725DA7EBC201E68E37BF3A5292CDD314912729B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614761, "uuid": "c70b78b5-f89b-47e3-8d0d-36a94406d912", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614761, "uuid": "f962b18f-9558-4ddc-acfb-11dab3e06f07", "value": "98304:Hwq4C1EWIbRueuIBc+JQnZospUnZiV8Fv2Jywvonmc1poXeXgAu:CWIbRueuIGZosmscTYX5Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614761, "uuid": "e7447fa0-5692-4872-b1bc-5c95dead8b54", "value": 6653353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614761, "uuid": "7e14eed2-26ff-4d15-acc0-1c64a627f04f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614761, "uuid": "4e9fb60e-e236-41f3-957c-b348dad639d2", "value": "a4165ae334a45cd8cf05b1659650d61380854fe3e8369df4cfd47cdb71596303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370a6f1c-cab1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651562302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562302, "uuid": "18f1b7b8-3b79-4c9b-bccb-ec21d1984a52", "comment": "Malware payload", "value": "9036834a2823d3bf0a4a7685783c7e20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562302, "uuid": "87990b38-6a3c-427b-a5fb-c116e576546a", "comment": "Malware payload", "value": "a6a8bf62b131ea276eb1a56e689a2fc4f3e72c6f557c40e3bf673d7ced1b89e5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562302, "uuid": "6529c950-bae9-4a73-832d-964878d094bb", "comment": "Malware payload", "value": "52ed5cebfce22bb96cd7127be06ec30cf4ac37ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562302, "uuid": "f563a8f7-b035-4abd-af72-132ef5de4cb0", "comment": "Malware payload", "value": "7c651b655e3b0e03c8cd3f4c6a5408e010e24674308847c0053a1b1e449f9f33fa5617211626212d3745c1d9c2765148", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562302, "uuid": "a2cf39f6-bc19-45d6-85f9-3ddfc5e34225", "value": "T1FFC14B74DB94DC92E78E95D0091E78AC203578A1C3C6D8C439BD73F80F966AD0B668B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562302, "uuid": "485ebe33-8992-4d97-a695-474a6a44b956", "value": "96:vb6WXWebe5ly4Vf5+Cs8j9kWYd2SBIN0WnarTo81ZPBBgFt23TyEqlV+75sr/FhV:TdBIl1+Cs8j9kWYdHBCnqTvPBBgF9EMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651562302, "uuid": "108e007c-d66f-4113-a738-ccd1db69aa5b", "value": 5671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651562302, "uuid": "0ce11e06-cf3a-488f-8be6-9398bc590e1e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562302, "uuid": "43ba9667-a4ae-4725-b1c1-c559607baf34", "value": "NN swift copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f830947b-cadb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651580665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580665, "uuid": "aa61e900-a127-4cdd-b6dc-ad8169540106", "comment": "Malware payload (SnakeKeylogger)", "value": "3624a643c86690f954d880c6b7ca9efe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580665, "uuid": "44be5fba-32d5-46ce-a053-3c0935ff0d4f", "comment": "Malware payload (SnakeKeylogger)", "value": "a750c87300b171417adbf5ae69054d2b70073004238216f6e09df4666488f28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580665, "uuid": "38cc6b1c-30e9-42c6-adbc-ca5522f0ca7a", "comment": "Malware payload (SnakeKeylogger)", "value": "d2c8208cef8d215ce5126d89df5420fdea3b8bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580665, "uuid": "aa7baaf7-654c-4441-a2e4-57c7c6759f47", "comment": "Malware payload (SnakeKeylogger)", "value": "bc8925252352d733bdd66ba0c0e1d10e9e435b6a2cf58c039ee12d9bcee595fea1c5b5bb9793aebef8361cb3e50fe6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580665, "uuid": "636d50e9-469b-4d48-87e1-f77d2f74ad99", "value": "T18A555B8C57D54A12CCA47573EDBD2B833727D7FAA9839EA702C1B23E852B3AD1E40145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580665, "uuid": "c5da075a-b375-4040-bee2-3d6a78e7c2a8", "value": "12288:+Clc5jjUH0H8LAfhdISWTImAJk9g3lLtCWVkVwXP/8ncQJYU7CEEm2eDVc7Y9:m5jjYp2hdI8mEk94LhKwXPpoYY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580665, "uuid": "96e2c4c6-8149-4a35-bbb1-87f084f74dec", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580665, "uuid": "7a84c898-a6a0-4337-a48a-c36916297611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580665, "uuid": "081e6e20-1521-4219-afa6-213f64191608", "value": "PO_TN22635.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836dfc6b-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651580898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580898, "uuid": "12be092b-67de-4e14-afae-7253aa03a82a", "comment": "Malware payload (Formbook)", "value": "d5dd1f8fe85f18888fec2190bb585248", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580898, "uuid": "757371a1-ab01-4da0-b295-27de5c22552f", "comment": "Malware payload (Formbook)", "value": "a7a5bc44079d6627f2875cf361c70541b74f713653201fecec7ac90028059915", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580898, "uuid": "41663558-626f-47c4-88ed-21ecaa56b1c2", "comment": "Malware payload (Formbook)", "value": "51bcbc1c17ca08921b7c13b10f7dc9930bbe9544", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580898, "uuid": "891e8152-6921-4506-ad89-2f0951db21bf", "comment": "Malware payload (Formbook)", "value": "a2e298cbf3dcf056bc84417d7d344e90bb6fa3b6fc2b62c7f7ab455559f21805036a22f74e6293e7221b941fa64ad4a4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580898, "uuid": "64d0ab63-b217-4834-9764-2c83653ee718", "value": "T107F30294337C782BD9F425FC9669D823966AAE3D44D0807EA0E9B0EF45F13D0A3487B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580898, "uuid": "422cdb0d-98ec-4648-986b-fbc0cff979d5", "value": "3072:0get+wMynVgwNVh9RmI61vjZa4GcqHUe67cjqBZLEcGFyDCBGfwErHU3pq:QZMyny6Vh2I6pZa1HUe67G+gcGF0Cqwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580898, "uuid": "f8958754-3485-4b3a-867c-10586975fdf3", "value": 160888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580898, "uuid": "e3b78af5-c20e-43a9-b2d7-6e1b9d5e0590", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580898, "uuid": "a9431e12-4237-4dc7-8798-06c25be7c269", "value": "QUOTATION REQUEST - SUPPLY OF PRODUCTS - DTD APRIL 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a494b7-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651588680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588680, "uuid": "0402f956-b4a1-445b-9245-9450fcae8f7c", "comment": "Malware payload", "value": "1aac7415f2924b7cd8b5fccd0a46c0f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588680, "uuid": "17853465-10c9-4302-9bf0-1f39026cbb78", "comment": "Malware payload", "value": "a83a5b46bc9c973e73c4204d8bef2e3bfc2ba7cabdaf6bf49f912c5919e96f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588680, "uuid": "e5a844dd-96d5-470a-90cc-b174e31aa001", "comment": "Malware payload", "value": "51b9ce5a786a05cc842b037bfe4b0b00f63f4d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588680, "uuid": "1cf47a81-f004-49d7-94f1-2a994348925f", "comment": "Malware payload", "value": "f12b21ea9bc438e4a08581f06a7fc1353d2f4f5e5091017f61bff66c1599c921077f215aa25b648e6b265524eee19d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588680, "uuid": "a0d5c259-db65-4f3a-b338-e9067cb720d3", "value": "T18AF22A73E644CC75F86C8636441EDA821237BF55A833E51E2889F5070FB278247A1BFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588680, "uuid": "86b19795-71e7-4f9b-9782-f5e34b189dfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588680, "uuid": "75802138-5ad7-4f98-b5dc-f8097408d50d", "value": "384:96AmffOWkpaVkHTeHlTg+nwgUdXGkY2Hib0nBCkO2Xt6FpmWn9byORp8D/yV:967JUZGkYgibiBXt6FJ9bb8OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588680, "uuid": "c89b61fd-ce90-424d-829e-03d218d5b097", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588680, "uuid": "5e63ebbf-0f50-4409-9b8d-aaa00427ff18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588680, "uuid": "185a3726-ce7d-4c17-9feb-df391fb9de49", "value": "RFQ__635672453436544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2b5bf2-ca82-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651542210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542210, "uuid": "fc0e3e8c-ff12-4138-94b8-ab7139a45cdc", "comment": "Malware payload (GoBrut)", "value": "1a5edcf40f9d95c0c8fddc501ebd9f8c", "object_relation": "md5", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_amd64", "colour": "#A59EEE", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542210, "uuid": "87a88b1c-7886-40c5-9b68-d1a2694173c4", "comment": "Malware payload (GoBrut)", "value": "a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf", "object_relation": "sha256", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_amd64", "colour": "#A59EEE", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542210, "uuid": "7088325f-f3e4-4434-bef2-bff338483334", "comment": "Malware payload (GoBrut)", "value": "8d4869df5df1a9a88e0d0a9d838c71f5e7aba939", "object_relation": "sha1", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_amd64", "colour": "#A59EEE", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651542210, "uuid": "f536336f-2b9a-4d06-a6dd-d4c95f636674", "comment": "Malware payload (GoBrut)", "value": "1f0eed7a96c79194ff8ba10fb3d296de02611667b0fd94f5ab749592028df3c79fca1615ef674659e82740ddfd030626", "object_relation": "sha3-384", "Tag": [ { "name": "82.165.106.79", "colour": "#7878AD", "exportable": true, "hide_tag": false }, { "name": "92.255.85.17", "colour": "#8DBD4A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "Linux_amd64", "colour": "#A59EEE", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651542210, "uuid": "dcc76157-a2f1-41e5-acb6-9ba90677769c", "value": "T1A3B533EF134CC1ED3DB15874236926F2621B282F92966D5F0C61EEC421F8D1EACEB845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651542210, "uuid": "eb0a3ca0-71e6-4edf-af75-3c402121b9e9", "value": "49152:5k3aKkGa7HCrJd+Th/MGkputLSNarbhnRquxrvmv8g6UGtchp:5kDkGa7HCP+lmCrXVxji8HbIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651542210, "uuid": "e9689558-0b71-4e82-9e9b-f29d63371e17", "value": 2377240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651542210, "uuid": "c190b90c-bcdd-47c6-a071-3aa96609ace6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651542210, "uuid": "5ec88cfa-748a-4ecd-9399-b86c05ef0e0f", "value": "Linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab459f00-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582683, "uuid": "213a9838-00bf-4ea0-97bd-bc392150e864", "comment": "Malware payload", "value": "a4c39cd90ffc5ceda61d3fd496360dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582683, "uuid": "0f00b168-e548-4289-8fe6-dc2d8d6cced3", "comment": "Malware payload", "value": "a894133671b96675c314b628c11f38eff4f537cf2532b354b082e5fab102d6eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582683, "uuid": "6de15657-565a-4a30-8a8f-90ad33bc0d17", "comment": "Malware payload", "value": "60f500cf6b797a52fa4c4898923bd6c80e88f816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582683, "uuid": "faa92961-1552-4ff3-a528-c6e631d543e9", "comment": "Malware payload", "value": "41fd0ce132efc8ddaff3f0cb1315a3142090af49b14b397e1e22d8a66bcbcbec57d624d6d40521f05a03eeeda27acc19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582683, "uuid": "0ebca47b-927e-46a6-bee1-fc1380c41325", "value": "T1CF7633195200C5A6F4C99B71AABA21D9BF36E7BB387B1C8475F4B906EF31184D8C5323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582683, "uuid": "c7bbac2f-bdd2-4f6b-b253-d71545d5e17a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582683, "uuid": "a8cec414-e896-4ab0-b895-f3f905fa6095", "value": "196608:73wTUA+kLEhf8pNnBIQNFa2V2SWwNLzwWXg:73wwl+7hFa5SDzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582683, "uuid": "0dd4c430-a77d-475b-91cd-3490b048b69c", "value": 7129196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582683, "uuid": "e44db2db-2f0d-4f77-9269-25c597d814e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582683, "uuid": "bffe80d1-09be-4903-be7c-577d5d32e376", "value": "SecuriteInfo.com.Adware.DoubleD.163.16661.20661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0755b316-ca90-11ec-8e58-42010a9c0032", "comment": "Malware payload (Worm.Fesber)", "timestamp": 1651548048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548048, "uuid": "bdbe01ab-9a3e-4c84-aa82-c1e884164d42", "comment": "Malware payload (Worm.Fesber)", "value": "b4370865115a6684335fa944da264f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Fesber", "colour": "#EED84D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548048, "uuid": "e292ddbe-8773-4f9a-a22f-63103e6f4408", "comment": "Malware payload (Worm.Fesber)", "value": "a905521e788bdd8627b2bbdf1ec33f8952fd0924f07180e8b8be6f319aa5e0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Fesber", "colour": "#EED84D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548048, "uuid": "1c1ccb55-f377-4bd0-b577-cc072f8b2915", "comment": "Malware payload (Worm.Fesber)", "value": "4c46276b553cc3f2a354318723070b08e1daf51e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Fesber", "colour": "#EED84D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651548048, "uuid": "74602779-19e9-48e6-92f8-9580df0ef5b8", "comment": "Malware payload (Worm.Fesber)", "value": "649470f7c5c1c2ffa147897c861ae9ed3daa19ad4b08e416c262a91d3150958b1caa88ae51ac874417f5389eab152be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Fesber", "colour": "#EED84D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548048, "uuid": "22e76664-2670-4dc4-a211-ea472bce81c8", "value": "T16036AE12F6809073C55202319A5FB366B67DAF351A26918BE7987F1D7EB02C2EB1D313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548048, "uuid": "dc421ba4-a6f5-44f6-a955-56966beec593", "value": "7bbe5d518e2c84069c99198902ad5b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548048, "uuid": "864d9daf-5aea-4058-beb9-e79baec904a8", "value": "98304:WbNpKHKplQCEcLjGCur9FM5rHbdt8XbHYPG4Dtjh:WRpKHKplRnLjGuVt8rUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651548048, "uuid": "6c1bb260-cc5f-4aab-b13e-254605fa2765", "value": 4904512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651548048, "uuid": "bec9d244-a52c-4e43-bac5-e5dcbe5a555c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651548048, "uuid": "f0d906a0-b460-479e-85d4-783791df9722", "value": "a905521e788bdd8627b2bbdf1ec33f8952fd0924f07180e8b8be6f319aa5e0e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92791338-cac7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651571904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571904, "uuid": "0b016835-82e7-4d15-bf91-c79f324f969c", "comment": "Malware payload", "value": "c66a35a9c1778ab162e3718afbd8c3ac", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571904, "uuid": "b09d36b3-5c9d-4845-9c0e-78566105983a", "comment": "Malware payload", "value": "a979c76afd0e9d2e135ca64a215e1af270222d059d806e7028022060e8cbe72c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571904, "uuid": "98283c7e-3b90-4754-aef1-785205fb955d", "comment": "Malware payload", "value": "a32e7a0a0ec97ba0e42d8bb19462a678374731f1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571904, "uuid": "35245831-9632-4650-985f-1ef6cce74adc", "comment": "Malware payload", "value": "4512984a9a78865f3d0f0c28247f8df3d1373c29acec04a7044eaa98a8516788b20e935b19558227f9533335b714664e", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571904, "uuid": "b468c8d5-61b9-4001-9691-e1aef854455d", "value": "T19BF25C04E36D4A23CBBD0AF8E8F1522203B6C19B3633E7955DC4A1E91C677D941A0BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571904, "uuid": "b35a6232-1763-49a1-a110-8a36d83c468e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571904, "uuid": "1b3ac34c-aa33-48f2-b54f-8e2109e22a6f", "value": "768:BxJxDjEqodnwpfJi8yKcQPWEN5ysp1By+T9LGxXhYZ1jbKjk:BxJxDjEqYVK75ysJy+TVGxXhYZ1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571904, "uuid": "4eff9ddb-1e2c-4d32-b3f6-dec9d903b2c8", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571904, "uuid": "85d066fa-2b88-4397-8e8a-2a52ffa40a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571904, "uuid": "3957df95-c2d5-445a-a003-d6fbbbafe0aa", "value": "a979c76afd0e9d2e135ca64a215e1af270222d059d806e7028022060e8cbe72c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc3c013-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651588673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588673, "uuid": "54daf251-cb2b-4ab1-b1e9-c65b554239bf", "comment": "Malware payload (AgentTesla)", "value": "97232d12bc7211cf8c2abed68ae3f38c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588673, "uuid": "f3a22acc-8015-4e5a-9d24-b3f2180dcc3e", "comment": "Malware payload (AgentTesla)", "value": "aa76f7d319a312997f967b20e23bf0f789ee3bcb822605936c10ed7b134ae061", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588673, "uuid": "0aff7fad-1123-4c6c-b6f2-d54096c44b1a", "comment": "Malware payload (AgentTesla)", "value": "200f870a8f3fcb16a7d4976d9427766245343c83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588673, "uuid": "a404021c-6d7d-4120-8954-15a0fad00c96", "comment": "Malware payload (AgentTesla)", "value": "3750c0820c726250e90040ec0bae5b88620d3f6dd7c8e72f54484e1171942d62bf424169861481381ef2a50d0877fee8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588673, "uuid": "887ab37a-aed6-40ee-a0e6-9377ca704102", "value": "T124D4ADF1364C9AD3CE369976068B8F7103A34A621122F7376BD377F6364261BEA13185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588673, "uuid": "30900623-1791-48f3-be59-91bc518aa002", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588673, "uuid": "af7215b3-5b47-4f89-ad80-592b23b52e9e", "value": "12288:WIXODqbqXWC9clX5B13KweXupWLnamazfm9fjlP3qTQ9+uHgG7t8Eht:FODq7/lJr3ta+mGuJ53fvgGOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588673, "uuid": "b9190087-3961-4da1-be05-4b98a61c6344", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588673, "uuid": "ecb3bfba-55d3-496b-a466-01288eee1041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588673, "uuid": "9ccbb3ec-4ab1-47eb-99e1-fc244a6b30fe", "value": "Proporma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f53c219-cab1-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651562289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562289, "uuid": "8aedbc9a-cf3a-41a4-b92b-339aafdd463a", "comment": "Malware payload (GoBrut)", "value": "7010dcf58594d8624826876189855223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562289, "uuid": "fb43a00e-cd9b-4599-912b-6e9addfe9e2f", "comment": "Malware payload (GoBrut)", "value": "ac15997a93c198642c9c9a9e53ef3a0ccc841fc7c66d156d050d06c52b977763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562289, "uuid": "1f041369-3e8a-4c07-9523-535bb2260c86", "comment": "Malware payload (GoBrut)", "value": "52f24581e93ea800a5b1ee0c506d8a38f4eba6a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562289, "uuid": "4e5e6b4f-7e75-4cce-b867-fccd21c5f63d", "comment": "Malware payload (GoBrut)", "value": "939275cfcfca3ddc79e882dfcdd09742d0a1b10fb467f1e9b039a4a800fa51ab7ae5dcd5b705b6d8b25a92465c2451c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562289, "uuid": "1da5c715-f2e2-449c-9d5c-9cdf1c39b064", "value": "T1CE36F860EECF14F6E9031D7151AFB22F673116064B29EEC7DA481F46E93B6E2193211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562289, "uuid": "a3ea9d88-1ee5-43dd-815f-fd151d918506", "value": "49152:qsf+rT1lMu38Uo3nqxbVwSm83vUpSRFjrwaL/D3jcnJnGm7LzuRtXAyoJclbsUab:DE1b8UT19vcSzjr5/YJ09sUa2mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651562289, "uuid": "7bbbf351-5024-4cd5-9558-df5fbd517ef0", "value": 4956160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651562289, "uuid": "6a3b2407-d7d1-43e9-b3d9-877ccdd634a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562289, "uuid": "cc622594-926a-44d7-adfb-611030a34038", "value": "ac15997a93c198642c9c9a9e53ef3a0ccc841fc7c66d156d050d06c52b977763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033155f6-ca80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651541169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541169, "uuid": "24e36c6e-3e87-44f0-8579-84039f21046d", "comment": "Malware payload (Gafgyt)", "value": "a2f29260380aa358ee89eceeb6593619", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541169, "uuid": "08bb4263-5743-41c2-ad49-863ad0ccd486", "comment": "Malware payload (Gafgyt)", "value": "ac2a9f84fe603d5f216922e5b5075cf7808a33f7cdf2251d5ea922efe5f33bf3", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541169, "uuid": "396792b2-33f3-448f-b5b9-506863f2382b", "comment": "Malware payload (Gafgyt)", "value": "5ec5e8af605539100b39ddb62c410e461cd4c55c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541169, "uuid": "cd384e8d-8020-483c-ad31-3e619b3dd46b", "comment": "Malware payload (Gafgyt)", "value": "46a8e9aaeb2e6014a74b51d60b61231c55b4ddf9114116e04f9895e562624549dc2dd9b404073f61b35fbc77fc07b6ad", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541169, "uuid": "e7349fd6-3b84-4f52-beac-8f5a07e6afe4", "value": "T15323F11A92968084C59F1FB9F755176289322642B6ECEBCD83C04C0ED7B5E43B6BDDE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541169, "uuid": "080177e2-ed47-4427-82fe-56d442a609bd", "value": "768:izuUj5Y9QpBYzpsrMY/cfagZ+pz5h8T82zBqe6kW4D86aNJeRpmMY5cBbuo02WRy:AY9gBY19pUL8TfzBx/K6kUjx5uRoXhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541169, "uuid": "2fdfddc1-8424-4a89-8e25-6ba1f9f4da55", "value": 45580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541169, "uuid": "9b3b0d28-1150-4702-82db-51b9e2fecd87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541169, "uuid": "ce457d5e-589c-4b29-bb04-db85adbaa94a", "value": "gummy.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85ffde2-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554358, "uuid": "47a914bb-f636-45ee-8315-8534da2e0935", "comment": "Malware payload (GoBrut)", "value": "708c4f04b3196869fa15137b13671fe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554358, "uuid": "8fc8b54f-62de-4f1f-821d-64615d745079", "comment": "Malware payload (GoBrut)", "value": "ac4196970c6a3e3ea3e2794dc3a7db6775430d660fdd2bc1fec7aef190832bc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554358, "uuid": "7b3d8643-2538-46e0-8491-19558af1784a", "comment": "Malware payload (GoBrut)", "value": "eada740658258f19508116e03eb926d6f72cfd4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554358, "uuid": "277a861e-efa9-4688-93db-3935f402bd52", "comment": "Malware payload (GoBrut)", "value": "ec30509e1750f59f376b38f94065d3aa860e7153bd9b870fbc5e10480173765707ae11a4efcec9c0c7d51bd6bc89c077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554358, "uuid": "83cdc407-2e5b-4f1a-ac89-8388e670f85e", "value": "T111763A91E9CB10FAEA032D3191AFB23F573111068764EEC7DB485F52E87B5E2593324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554358, "uuid": "2faef806-b960-4204-aa7b-d0d302068269", "value": "98304:DE1b8UT19vcSzjr5/YJ09YUa2megmG5OFZj8KIX:I98UJ+SzB6Ua2ac8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554358, "uuid": "b1bb0b95-8547-4b1c-9551-ff06c4013c19", "value": 7314230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554358, "uuid": "e3c01ddc-8c2c-436f-bea8-d71b17c7eea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554358, "uuid": "258e3e26-da08-45ac-a85b-27886d80b401", "value": "ac4196970c6a3e3ea3e2794dc3a7db6775430d660fdd2bc1fec7aef190832bc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d42ff1-cac0-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651569044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651569044, "uuid": "3ff57906-0ec6-4d72-a037-a60a2bee5179", "comment": "Malware payload (NanoCore)", "value": "c5048f43317f0b20b71d58b9c7c52eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651569044, "uuid": "49a3ff5a-2cb5-4a76-99eb-7203cec0ef8b", "comment": "Malware payload (NanoCore)", "value": "acbb54d09d81c20d0ef864557805cefcd80ad43559066dc2f3ebf010589887aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651569044, "uuid": "4728c8f2-d8b5-471e-bd31-2001fdd7d794", "comment": "Malware payload (NanoCore)", "value": "730e28c0a2e03bc4d4f36eed5d92ca78d71db681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651569044, "uuid": "74775eb4-c5a8-4054-84d5-1973f36196a6", "comment": "Malware payload (NanoCore)", "value": "81460d94a1f5ecd487b88d31702d6861da5b402298c210ba88095246c74d8a631b9bd971c6774b847b9066b7d0b501fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651569044, "uuid": "eaf207b3-d562-4775-aff2-e7bfe496b67a", "value": "T137C4BEE4368596E3CE26D97A17FD9F9011F012329535F7436F8423E00B92AFF6A21AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651569044, "uuid": "7f6fbfd6-084d-4cd4-815b-df64d4156cdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651569044, "uuid": "7114947b-f9d7-437e-be77-e7eccc650480", "value": "12288:3jJPdtBNDa5uHI+9vc+AJN3k/pkC1foyQhG7tVx:1drNm5uap3AZ+yyGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651569044, "uuid": "c10da041-be5d-46ef-8d49-e2dcec1c8e10", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651569044, "uuid": "bfde4407-aac6-47f4-8154-8a7c85837602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651569044, "uuid": "698a79fd-4c29-4981-a81d-244c31808c08", "value": "c5048f43317f0b20b71d58b9c7c52eee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ae48fa-caa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651557421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557421, "uuid": "a498873c-fd4f-434d-b46d-5a0347e6a2d6", "comment": "Malware payload (AgentTesla)", "value": "0d943564a593dc94ae71c087ebdfcc37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557421, "uuid": "d607b99d-00a7-4d5d-afc1-db3d0a7c035b", "comment": "Malware payload (AgentTesla)", "value": "ae0da6b32722786b40f1ea460b9bc2842be29066702a8cad545383ffb3860b8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557421, "uuid": "3defe01b-b52d-4876-83a6-580002dd763c", "comment": "Malware payload (AgentTesla)", "value": "31e0b8b7219fb44688400759617c97edd715e6d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557421, "uuid": "a90481ca-8e2b-4c88-ac65-e80a9ca2abc4", "comment": "Malware payload (AgentTesla)", "value": "0a23e35ce883dd9095d839ffe78ffb7abc59ae78b54d069ec1781316e46f25864db04e51e7f3f18a7a2c297e82fbec81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557421, "uuid": "01c7d0c3-0c03-4bb6-89ca-f9c2380040d0", "value": "T1259423B97B8EB1B38EF00F4C696BDD8C9E1463954B635063F6F366C13786B500A38952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557421, "uuid": "2306fcd2-095e-411c-b9d9-3016847e8369", "value": "12288:Z+E6mMp2xWmntYKDbtEdHpI6SQvKxTJcWIz/o5:ZxRMp2xWmtlb6dJqQvKROWn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651557421, "uuid": "1163dd78-aa1e-46b6-a555-ee3101c5589f", "value": 432275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651557421, "uuid": "786c594b-905b-42aa-b9d6-ed545e6e3240", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557421, "uuid": "9eb21a18-bf84-401d-a286-08028bebd0ce", "value": "Invoice 16-36-55.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6147126-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582674, "uuid": "f1acef2a-7af9-4e84-a966-70eff6e6cf45", "comment": "Malware payload", "value": "1787a2a8428c3ed2856846b9624eacb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582674, "uuid": "c4e142f4-a856-4efb-a5ec-d171f30d18e5", "comment": "Malware payload", "value": "ae60b6c7e7e3980323d9dfda187f3bcc7ae21fae666a71297eaeeb0d1ead095b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582674, "uuid": "8c252783-002c-4e13-9660-4619a88efe7a", "comment": "Malware payload", "value": "917b840995265a1b0c8c0b3dab9f8f820c81e134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582674, "uuid": "8d109b58-074b-49d7-9aa5-9f4d2cb7a339", "comment": "Malware payload", "value": "40e39ffcaff49feed69185eeaa09bb8872a99f50df90d26b2cf988936c86f25bee88f4dfa046b53f00b16824761a10cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582674, "uuid": "96d9332a-7cc7-4511-a053-29e525ec27a4", "value": "T17BF49D22BA81C033E5B1013196BCAB76187DB930072984EBF3D54B792EB46D17E36767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582674, "uuid": "d3eb2dd7-cf98-40c0-8440-ce05f7803335", "value": "883054685c885d2350f85d2b43acd2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582674, "uuid": "b0ed952e-0337-4803-93bf-0a561bf7b6e2", "value": "12288:xZem46oXRUeo93uQ6whxOKpM66ucV5ZGXKYDMUmDxdJzjOWgI1mDuEtFBGB5rs5u:xZe16OFwHgyMUwxdJvOdIEDZ5lwkkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582674, "uuid": "dc643f92-bbb3-4351-9fcf-21627ed8b415", "value": 765160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582674, "uuid": "eca8ee6a-2f18-4bc8-abe3-69bb5a69fb6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582674, "uuid": "27a28c0f-58f3-4a0f-8071-10d4ce31a869", "value": "SecuriteInfo.com.Adware.Softcnapp.124.28323.12102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a1d795-caeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackBasta)", "timestamp": 1651587512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587512, "uuid": "ffaf527c-b12d-4703-a5ce-a8d88ff9eb87", "comment": "Malware payload (BlackBasta)", "value": "53fdeb923b1890d29b8f29da77995938", "object_relation": "md5", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587512, "uuid": "e1d78663-44bf-4117-9d4a-5248b75860b7", "comment": "Malware payload (BlackBasta)", "value": "ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e", "object_relation": "sha256", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587512, "uuid": "1e8580fe-9f79-401e-89c4-c74e1a158fbe", "comment": "Malware payload (BlackBasta)", "value": "a996ccd0d58125bf299e89f4c03ff37afdab33fc", "object_relation": "sha1", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587512, "uuid": "1540efd2-60ab-461c-a233-d85ffbe4631c", "comment": "Malware payload (BlackBasta)", "value": "0c91babe2b03c77ef2ec8023dfba070c96f8773ff124348b9bf8696751fff8050b2379d99fcc9308b9f2ca330c995f43", "object_relation": "sha3-384", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587512, "uuid": "8d2d2baa-fe06-40c6-92b1-0a8be9ca7f5a", "value": "T1D9C47C213581C43BD6A243B04DACDA95727DBC300F6206CBE3D45A6E5A7C5F27B329B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587512, "uuid": "d83c38a5-5ce7-4cb4-adc9-ae619d153ad0", "value": "b3794746554a5701b2de3e5ea435c59b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587512, "uuid": "154f1645-4f8b-4e2d-b81f-16e4446ecd0b", "value": "12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlAU:AzmoQqUiXw2s6yiVxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651587512, "uuid": "66b4ae47-a7cd-4d9a-a6f2-bb7d3f0bc986", "value": 556576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651587512, "uuid": "143b5a12-4922-4ecb-a03a-5e3c88a08dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587512, "uuid": "aa329911-0bd4-464c-a836-0c0296aa2219", "value": "ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ad0617-caf8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651593037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593037, "uuid": "27393b6f-c963-438e-bc75-9496537e0300", "comment": "Malware payload", "value": "c903ee5f79dad75851ad7c9b9dcde0e3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593037, "uuid": "ca59d34c-c009-4a4f-a113-79783c3c8cd3", "comment": "Malware payload", "value": "af1697f8a93c7c0724e64a7e618447af57af12f52c30411d67ed472b6d06c9d2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593037, "uuid": "adf078b1-9588-464f-ac8b-5e5cd6c9b8b8", "comment": "Malware payload", "value": "874068b8ac2fee5b09e207ae030ef95ab598803a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593037, "uuid": "c69bfc5c-155a-451c-9850-bf2393a9f01e", "comment": "Malware payload", "value": "474d50ac004a727eb35fdf80a7edb2ed117370a4e7dcc9225e6f125460c64de21dca463aae54c545701ee0ac99aba091", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593037, "uuid": "333d2b58-07ed-4029-ba68-76883a8eb1d4", "value": "T178E2B7871D9E7F5693AC18FE1252A0FBED8534C67569FA80E38D692330F1837AD1168C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593037, "uuid": "ff878f5d-7c94-4d4f-8027-0ae5ee4be7e5", "value": "96:bajzjuuFlhh23g7WT6rQVsV/1HEBY7fRnFazcR7HNgIlFF8j27yCdEPL:bafBFlG3ge6ryytkabqmNYAyC2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651593037, "uuid": "c14f4dad-ef01-435e-82f7-2e1fdeba9e2a", "value": 32462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651593037, "uuid": "684af704-4b02-4792-940a-d09c2bca5eb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593037, "uuid": "6addaa39-cff1-434d-bf34-d92b7353c20a", "value": "Info_Releve_ID21002502.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a8bb75-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582680, "uuid": "fe79aae5-1e1b-44e1-82d3-7f0332a1fa1e", "comment": "Malware payload", "value": "d4029b7468c610b25c1e77dc0e68d499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582680, "uuid": "32adcc93-f2ba-4975-b458-34055f1a2c51", "comment": "Malware payload", "value": "afeadef78a76166d65c0d86078fec3aab65597c7aa4bba8ea6f0f525ac008409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582680, "uuid": "1311b36c-52b6-427d-8d5a-e653c3a705cd", "comment": "Malware payload", "value": "831dec63d358642f5be8548b953b738dd0e8bea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582680, "uuid": "f992ce6a-3a65-4166-942f-97e6f89f8079", "comment": "Malware payload", "value": "b0e8c42fa0e547a0b8925ff6c5f42d324ba7275e74c9425aa5d8a94ebf64f322bc023a09c8788886a43764a10e13ac85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582680, "uuid": "94e09dc4-3c89-444a-b464-70550a469534", "value": "T1E2E5AE217691C035C57312304D68B6BA9ABDBDB01B7181CBF7A8361D9F708D1AA7B2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582680, "uuid": "1401f2b2-87f2-4c57-8d0d-6246740ee554", "value": "902f3beb26b2b271975041b33cc1104a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582680, "uuid": "12fb7025-24e2-4d04-aa03-e284eaa0a23f", "value": "49152:8sOnKiY2otiCA49gjMycgiSX223yZvOlZTQNJTuA7xzrIAkHWdbdN2y:85nrCAATyUStDlZzAtzrk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582680, "uuid": "9e19a983-ae9d-4fc9-a43f-6fde7d13c430", "value": 3100400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582680, "uuid": "87889061-f1e6-485a-940f-7fe0e2ae82b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582680, "uuid": "9c4e4b8e-454a-4492-9c9f-1c3ca5a8880c", "value": "SecuriteInfo.com.Adware.Softcnapp.124.31397.14166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d0af9b-ca8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651546809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651546809, "uuid": "7d2fcff4-cbc6-44e3-931d-3e041f5c043e", "comment": "Malware payload (Heodo)", "value": "d3e61b1423dc97fbe0a573abece06983", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651546809, "uuid": "22f6b988-cf39-41fe-80fc-4521d7a01ca8", "comment": "Malware payload (Heodo)", "value": "b08a5d80c38fe7840a90f0de7906d6e9618f8d99842200869f30e919896378c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651546809, "uuid": "92726fc8-8f72-4229-8171-462fab6bf232", "comment": "Malware payload (Heodo)", "value": "797b1d62b3feff1082bf699b45ec82f2b53533cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651546809, "uuid": "ae0f4241-19d2-4fc0-826f-cbccec69f5e0", "comment": "Malware payload (Heodo)", "value": "fc65d5994284fc1f06e7f806be50d27f422f399cf0544255d522ee930a38462831f8198ae0d64873cb4fbc0bb7a6be9a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651546809, "uuid": "cfafd804-06c1-439c-bf46-42f131aadc80", "value": "T10934A30233C351F0CA53B564840FD525BCA7B43C7B15897DA247A5AF87EB8D09A34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651546809, "uuid": "ad4adc7c-20f9-46d2-832c-9982ceb771e2", "value": "3072:4TdrXJjOjQyNo6BUv1gr8qcKRXyMjO8rSXVKfp8GSaztT2GTrw9dH0riC:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651546809, "uuid": "1303c8ef-3e2c-4c99-81fe-e2fe57b36e1c", "value": 251792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651546809, "uuid": "33772e60-40d1-4c24-94d2-0dd0e6a3d8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651546809, "uuid": "1cabe5e4-1503-4919-ae1f-db71a9838d8a", "value": "emotet_exe_e5_b08a5d80c38fe7840a90f0de7906d6e9618f8d99842200869f30e919896378c9_2022-05-03__030003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ebf5c4-caa4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651557010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557010, "uuid": "98f2522c-e2fd-4f72-9a24-ddeb869a052e", "comment": "Malware payload (Mirai)", "value": "437ed23c6e3050da0182b7ace0dae19b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557010, "uuid": "b1f03c5c-3fae-44e4-9aa5-f43e7cb2cc21", "comment": "Malware payload (Mirai)", "value": "b0b93d299e0f22073c16c5129a22064f612ee5f6e8f17a22baab70e793666bbb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557010, "uuid": "dd00d341-e93e-46f8-a96a-ca2e0b6f9105", "comment": "Malware payload (Mirai)", "value": "689eac021861ce3355d054a3e5dd824a605330a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557010, "uuid": "619a2f51-28f3-443d-8ebc-fbdf6b055ce4", "comment": "Malware payload (Mirai)", "value": "948e90ce036363e342ef359c6d5a32fe7079ea81b0ea9c0ff7bfff9f7fc5a184db21b689d4bd6fbe41e95830855833da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557010, "uuid": "e5b368ed-8a3d-4f23-9a35-cb3dc9817505", "value": "T1C2D30A06F8004753C1925BB6729B534D7B3253BA47DB3352EA396DB02F81B9A2E39DD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557010, "uuid": "fe18a08d-46c3-4e30-9a5f-3355420395a3", "value": "3072:wOdiamletJ8add9QzhsWjP5RZ/HmChrQAGzKXDwp:wOvmletJ8addQ3jPFfmChrQAGzKXDwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651557010, "uuid": "626dbdd7-7487-4917-9bf5-8dc2e6f7bc3f", "value": 133545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651557010, "uuid": "3ee8c035-695f-45b1-a318-7c95d0765552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557010, "uuid": "1c361e21-451e-4903-8b5b-51daadb587b4", "value": "arm4.Zodiac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4c9266-caeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651587461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587461, "uuid": "d6b093df-65c3-47d3-9e1f-923242a536c4", "comment": "Malware payload", "value": "2fcf888a6b452371f5209a065e3e530c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587461, "uuid": "d4f549fb-4755-413a-aafe-b46ae0a22e45", "comment": "Malware payload", "value": "b19e499a5bde33148475743cd34f8b30fa9a915f34c571e57707d4989e12882e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587461, "uuid": "d86a1a7f-a7c6-4cf8-9f7d-587ff668f483", "comment": "Malware payload", "value": "207d17ef2d432ed50a0ac0a8d2d0285884f9c239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651587461, "uuid": "230d1cde-480b-4922-ab09-8fd9cb25d8a8", "comment": "Malware payload", "value": "52e6f24141f44ed13c037f8c7bc114910855bf29347647032821d6dba00592b3a235ffbb51748bf1cdbb2a5fccfafaae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587461, "uuid": "3c006f53-c7a9-4c68-966b-ef53f5e49ba7", "value": "T161042002657CA8C3F69C6C73A8DC975E1EE06C6C4676106DF247B6E9E53F103E6212E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587461, "uuid": "8310ac57-7ea6-4452-8c50-6a0f6b104b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587461, "uuid": "831d2520-c1d1-48b1-a5ff-ef328b8d4cff", "value": "384:7BA3C0wI59IH2yvfMy3le/RhFVeGLdNETT4k4g6tGocA04sQm6eS2KWVAvne3Mef:7BA3LmE/R/VeRaje3EJGq+xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651587461, "uuid": "16753135-93ac-40a6-a036-e3f6f5f160e7", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651587461, "uuid": "5803a226-85f1-42c2-b0e0-82bc94910c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651587461, "uuid": "b0c7b9db-fa98-4397-b3bb-dd9048ff21c0", "value": "New Order inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb914f4-cb20-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651610204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "c3d317ea-2f2a-448d-9b71-6e1e38d5831a", "comment": "Malware payload (Heodo)", "value": "0b083525db3767b015413ce640c4fb7b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "c06811cd-1179-4a88-ab56-1982f8f724ec", "comment": "Malware payload (Heodo)", "value": "b24b1e7cec6d5739f4738e94d36039af070a1d0e515e83e9a49faf355f26fb8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "6b1ef1aa-fb5d-4b0b-9f56-aa4b453c510f", "comment": "Malware payload (Heodo)", "value": "65924f73bd9a71f4a46cac5cc162c288c293c5c1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "e651255c-391e-496a-966c-1ed253b09e3f", "comment": "Malware payload (Heodo)", "value": "63d270c8ccfe1171b8b25c6440a462918310cbc4b694ddeab1ac72ed2af67e66eadee2dedf4ad455cc68978bc77a4534", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "e4bce393-cfc8-4965-872a-0a18498627b6", "value": "T13FD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "a98a8214-0e28-46e7-9004-8bdfcf928d2b", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "fbe15ebf-5a1c-43c1-a0b8-6d1d6e7ce629", "value": "12288:C1FIcocJwMTHzXO7N2GBHiyzskF1CubVnmn:tco9MTHzXO7ND/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651610204, "uuid": "2df93d56-a5a8-4da8-bb39-1a9c9af3b77e", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651610204, "uuid": "bdffe868-c906-46c1-a994-ccee49486f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "3ad4e457-de34-451a-85c8-5d518c851eac", "value": "emotet_exe_e4_b24b1e7cec6d5739f4738e94d36039af070a1d0e515e83e9a49faf355f26fb8c_2022-05-03__203635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a1f0b4-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581902, "uuid": "322f772d-3fc3-448c-9213-1448a90da177", "comment": "Malware payload (Mirai)", "value": "d07f59c50e872eb3e6eaf9dcbc6825a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581902, "uuid": "5327b16f-fd7f-427f-ad7e-c87f36479f73", "comment": "Malware payload (Mirai)", "value": "b3579661dcdd6e1fb2baa94d2532606d6e65738f8066014858df217ab668c746", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581902, "uuid": "231d38c6-bbb9-4f13-bf7d-cd3a4513a02a", "comment": "Malware payload (Mirai)", "value": "d1a2d709168d90b29cd15a642fad5176735e8c34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581902, "uuid": "fea9a9f1-0f2c-434f-9cb4-dd251130043b", "comment": "Malware payload (Mirai)", "value": "800cd852b1d98e13d549ae772f2e76bab736c80dcf94e9772a9bbeabbbd41f0ed1bf08c8517871ba43f0fc734a4843a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581902, "uuid": "8dd50ade-18ac-409d-a758-492107a01c0f", "value": "T1F8632A92BC819A02CAD412B6FE5F519E331623D9D2EA7207AD156F2037CBD1F0E77241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581902, "uuid": "dc33c6c1-4121-4de8-940d-9b7bde53f617", "value": "1536:sWPKw0DX+CaF8wl82EFyHLJwq0E4nFDTFUI070R3tvH:sWzGX+n+2SMinpBUxIvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581902, "uuid": "53100a56-b5cb-4d3e-8f2a-74a6c0d3ee66", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581902, "uuid": "eda46893-8b50-4494-962c-cee4197fbd75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581902, "uuid": "24a804f3-c6c0-4e73-82cb-6e0470641745", "value": "d07f59c50e872eb3e6eaf9dcbc6825a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2468e59-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554348, "uuid": "859f3a87-3e67-4ce9-82b6-be3d63fb0a89", "comment": "Malware payload (GoBrut)", "value": "0ed58468974629e33b5c94e6df64a520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554348, "uuid": "d65a2bca-f02b-408d-af63-4e68ea36c6da", "comment": "Malware payload (GoBrut)", "value": "b358b30e38d9aad71f28c95d0e50e727d41871f9df7f8e54c9299e4291fea952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554348, "uuid": "c76e57d3-453e-4c4c-8235-aabb44e00c79", "comment": "Malware payload (GoBrut)", "value": "94994b5f13367652f40ab7d37716d6fa4f334dbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554348, "uuid": "44e592a5-a8d0-42c8-bf20-88774c21ff41", "comment": "Malware payload (GoBrut)", "value": "2563e126755c775ef828caf59326525dfbf45ef2144a4fb7699efa564f63244f6da718b35c04dfd7bac5711727cdd149", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554348, "uuid": "e4e0f453-5de9-4958-8a73-087e390eee13", "value": "T1B6D5336997C201389BC6603D756E5DA580E2CBDE5F65101049AE1C230BFADFAFE70A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554348, "uuid": "4de8010b-76e9-454b-a984-fe04c08c0759", "value": "49152:Itm70wqFk+DowagvMTdxi14Ny+39+2aYPpG1h2MemmEeNyhVd:Itm7VQkMZ7OVyw9+7oVp9yhVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554348, "uuid": "9cdd87f6-d05f-4cbb-b551-d03fe88ce5de", "value": 2809880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554348, "uuid": "a6ef897e-2cc9-4916-bf7e-ed7c04041735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554348, "uuid": "6d4282ce-ea01-445d-9a9c-e9dd5b974241", "value": "b358b30e38d9aad71f28c95d0e50e727d41871f9df7f8e54c9299e4291fea952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac836de-cadd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651581260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581260, "uuid": "985bd865-323b-48f5-af26-13a8e98efe52", "comment": "Malware payload (Loki)", "value": "2ee5f065dc9bfa25647a96f93e27e014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581260, "uuid": "fdbfe105-b8e0-4314-9847-10978cdeccde", "comment": "Malware payload (Loki)", "value": "b3d17b959be07e41497ebe48d403db574b5e5c2e94b9783bf7301ae17c48f71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581260, "uuid": "04ac53b5-c667-438a-8b6d-c5fcb2dbe15b", "comment": "Malware payload (Loki)", "value": "fbc039883bd6d00873a606b9f3d56fd10a64556d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581260, "uuid": "e6577cba-eb05-469f-8afd-1434cceec600", "comment": "Malware payload (Loki)", "value": "016f2c5deacfb7f4f116188f619ac5004d93143a7aa66e2280dba7cee0431ed16c348dea42bc800d222df166d3f69588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581260, "uuid": "d2854fe4-8469-4fa7-8288-2ed219b1c48a", "value": "T142C3F1143EE4C8F3D8A206712A36A7739EF8D62B14615B0F43505E5C3D627C2DA0EBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581260, "uuid": "8d77352d-9247-493a-8fdc-c91de2824d8e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581260, "uuid": "5021f8d5-30a5-477d-a26d-630b9b58d19e", "value": "3072:l1NjcVVnLpPunbncMo3unUSZiD5vEflCb7b8:HNeZmE+pu9sW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581260, "uuid": "86042c32-21e5-4cae-93af-ddb26970884f", "value": 125537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581260, "uuid": "1689dc70-40c4-4fc0-8b55-3ac54a9a5f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581260, "uuid": "7d79e708-305b-401d-8e6d-d775ad95c27d", "value": "2ee5f065dc9bfa25647a96f93e27e014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b817e74-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622170, "uuid": "3b1c734c-1e28-48cd-adcb-bf63a72bf7ba", "comment": "Malware payload (Mirai)", "value": "8b6b5efd88c6bfcebfdf059a9a2dac12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622170, "uuid": "6723b2e9-3d8b-4e32-bb65-950c2f244be6", "comment": "Malware payload (Mirai)", "value": "b434c3749cdf2d80bc71d451186d89701221512e69ff9fb62b9badcc37aea58b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622170, "uuid": "94385eff-5bab-4100-8646-ca54f3cc354a", "comment": "Malware payload (Mirai)", "value": "f38aef8f9d2dde09c637a7f6a92f3437950dcfb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622170, "uuid": "8f051251-7476-486c-9adc-208c85fd7676", "comment": "Malware payload (Mirai)", "value": "a1001d3cf1da24ce6a473827273a3db9d1cc925f302eae1fdea73daa11d0ce116f2fee1bebba5da46648123039a918b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622170, "uuid": "4904dc80-cb95-4cd2-9d0b-53bdfba79390", "value": "T13B932A45BC91862AC6D023BAF77E628D332263E8C2DF7107ED2417656ACA11F1E37E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622170, "uuid": "e1d83395-de4a-44f6-9257-2ccf1d183866", "value": "1536:KlaQoIjqrpEtF+gCnFI32Kwht5+N5+MEu4U+tcyLZs5WV/ZKxGFX9Cp7WoL5MRhO:KlaQo+FR3WcKsi/a+NCpVLGRVMYj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622170, "uuid": "b711fed7-2768-4df6-ba5e-c5746d54912e", "value": 96868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622170, "uuid": "d3e245ba-56c4-426a-8c38-4676dfeb539b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622170, "uuid": "3eecaa6e-3857-418b-9ca7-e5fd91dd5bde", "value": "8b6b5efd88c6bfcebfdf059a9a2dac12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f430c69-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582663, "uuid": "2b6dfc22-1eab-4f0d-b552-c31277026d15", "comment": "Malware payload", "value": "e411d67f17920f17e5911c3f3a3f8e71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582663, "uuid": "2258ca1f-a99c-47ca-bc1c-aafc29f5705b", "comment": "Malware payload", "value": "b45322c78470475027b469b1ae8c5b6709173f7c36a0416f6ff59a40d07d8f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582663, "uuid": "805d5d9f-cf49-437d-944c-8b0eb4308e51", "comment": "Malware payload", "value": "7f35b66fcae789413185ca203a7eb7fc1d2722de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582663, "uuid": "7ff2d19a-5cca-4a25-9145-1fa034d07662", "comment": "Malware payload", "value": "f3f6d1e4cbed704510ba14d13e73762b52edc94fbc520547410d8234b4b08af8a7adf694b860e42be9307e4fcf5ef45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582663, "uuid": "59195d42-ecc2-4830-bd95-0f84763f12be", "value": "T158F49D227A42853ED0A22139827C57B6D82D9D3027A180DFF3A476669F74CE17B3D35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582663, "uuid": "52165c75-642a-4bc7-9ebe-a7f63bdd0881", "value": "e88ae612be6d27a72bb84a36f2fd7d7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582663, "uuid": "bb163dc6-9e47-4c42-bf24-5ed3a993d848", "value": "12288:lOoP08KpWVrTLelP3iRthFUKEIDE7ZsAo0oIiAzQWiOpfAqNfgjvhR:lOoPdelctnUqDSZsAosjlojvhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582663, "uuid": "9cbe5cca-dcc8-4d25-9061-c43a6d71c353", "value": 789744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582663, "uuid": "d63f40f2-c4bc-442a-8e4c-950193ebdf75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582663, "uuid": "550174c8-220d-4ffd-a4e3-3faa98758f78", "value": "SecuriteInfo.com.Adware.Softcnapp.124.9540.6857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79adf9df-cb34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618678, "uuid": "2f23f093-c62c-47c8-8223-73b3ac7673e1", "comment": "Malware payload (Mirai)", "value": "d8adcf8593de16b97cb89a3f63688609", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618678, "uuid": "46edbe69-8423-4ff9-8fb5-1f8f9bd32e7a", "comment": "Malware payload (Mirai)", "value": "b54143081e20d80e722a89c8e2aa12b66d74f441b38368f97cd02add127f501f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618678, "uuid": "c41c8fd7-5b1c-43e3-b7e3-155030c528d3", "comment": "Malware payload (Mirai)", "value": "939ef445f66e0d12076f69aed1ed62a0ecac80d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618678, "uuid": "82c18806-8dbb-4bb7-958a-dd38ab05ba2e", "comment": "Malware payload (Mirai)", "value": "01b54928529e4d25d9756e06ccd59cb9aeb56155619b650c904a49b6b49eb2bc30de6d87ebc53ad8c14bf9a025518c3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618678, "uuid": "efb5b714-881c-40e8-9a9e-a19d1d0adf3f", "value": "T15CD3F80E7E259F7CF7AA873947B78E20964833D612E1D145D1BCE6214EA028D241FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618678, "uuid": "ef79d5d9-1425-499c-ab48-c549b2aac9c0", "value": "3072:jdNZxRjyNPk1wtBDqTc3tk8bBCIdK4be0zsOggJB:jdnxR+N8QS4tk86Eeg3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618678, "uuid": "cb617204-e6e5-4727-87bb-1293c67f10df", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618678, "uuid": "c8323732-af3d-4b4d-adbd-ea46f4cc0360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618678, "uuid": "be9a2c7b-bf4e-4cf2-a745-3c72d3a24b2e", "value": "d8adcf8593de16b97cb89a3f63688609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61673305-cb33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618207, "uuid": "5de3e6de-11a8-4896-86e0-aa7b46cdb795", "comment": "Malware payload (Mirai)", "value": "296a483714d88ba871d5db716696af8f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618207, "uuid": "af96f05c-027a-4a95-a80a-21d5948bdf23", "comment": "Malware payload (Mirai)", "value": "b59d90b6c5a58655690f0f1b53e9ed5439300a56393ca0c4307528a112bdf045", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618207, "uuid": "05bdf3b9-6405-4a85-bfca-74be3833c9e3", "comment": "Malware payload (Mirai)", "value": "b700dea6d1156e653157f90219be76b5462ca06d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618207, "uuid": "4eeb3837-f525-459b-9d9e-df5aa7f6592f", "comment": "Malware payload (Mirai)", "value": "e91ccf75e8b0d4470d297549d3d5d86a7f839cc4922510c5aa517514adc19b5c61effa5c0b0727d2e8d43f3e78b7e201", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618207, "uuid": "5d1324d6-18ce-4635-bba1-c5f953b6230a", "value": "T1C7B33A56FC91C622C9D023BBFA6D528D372553E8D2DF3103AE245B642BCA42F1E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618207, "uuid": "dae4fdef-8708-4a81-9b1e-4c5d0d62168d", "value": "1536:IukVqrDSFs244NukEM1Xvxh5ciS5+FXqNHUGJiYFV5wY1dbU8Hlq3NAP5iorvRZi:IukVPjWUMhVF1NpF9PrfdCdji0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618207, "uuid": "f80c5ebd-4882-41a5-93a4-7c01c7552dfc", "value": 109208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618207, "uuid": "c16f2ef8-a33f-4a7d-82bb-27671df02140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618207, "uuid": "e79040e4-ad52-468b-bb62-f564b3c24d3d", "value": "uYtea.arm-20220503-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cbaa67-cae1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582837, "uuid": "68caea53-7328-4ff8-884b-6fd54cceddc9", "comment": "Malware payload", "value": "2e5ffda2ea027df525d2e84dfad7305e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582837, "uuid": "1ad547e3-ed23-4ca5-a394-968bd9e2dc65", "comment": "Malware payload", "value": "b70b3981a44a8d84c69d6e9dcd801d94ef44754fe033950a54f723b462bac23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582837, "uuid": "4a5c7776-efbb-4f79-8e84-c46a10a9b89d", "comment": "Malware payload", "value": "0b711366a33f22b148d1000a239334b048ac5d56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582837, "uuid": "398e41ee-d4f7-42de-ad8c-2c1cb5b04400", "comment": "Malware payload", "value": "e0f7a2c399b9fe87479f4b81dc35324e45b4252ee9bf2bbb49e95d7ef218fe0638ba55feb5191088fb422ec79dc4666c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582837, "uuid": "6f759064-527f-4593-88e1-c1cb2382efbb", "value": "T12A052310B6A7C135D3342AB398C2125113A19749B037F76BBDBC37FADA163AB06E5742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582837, "uuid": "82c4e4ec-8a77-4a07-bd72-644a28bc78a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582837, "uuid": "fb064bc3-38ba-4478-875e-2fa0e109ae36", "value": "24576:o2/XQ4lJyVLGR+3UV2prGpXEHP3k3+U2q0a8z:9XJ2G8Q2prGpX63kuWb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582837, "uuid": "bfd4c0df-824c-48fe-a287-c68062a1ab5f", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582837, "uuid": "f4613813-92da-4ecc-b2b3-bec30d37b895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582837, "uuid": "93364767-418d-4767-a24f-1a18bf218e5d", "value": "0000002067.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e428b1cf-cac3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651570323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570323, "uuid": "3a0f0070-dd6c-4aaa-85a8-74d01d19ebcc", "comment": "Malware payload (AgentTesla)", "value": "4f274fc18bb2d64f31021e819adb78ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570323, "uuid": "0309e048-0f2b-426e-8c74-539936b6e442", "comment": "Malware payload (AgentTesla)", "value": "b8b97eb10485ce0ba18ae456023efc3a431f37694f497bbc334662cf36b5656b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570323, "uuid": "d15e061e-84b8-435e-8f59-fad08538000d", "comment": "Malware payload (AgentTesla)", "value": "35603c0fdb0214d8482b7d077f5ed083fa91ae46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570323, "uuid": "7c9308f3-17d9-45b9-8bdd-b9f121f3e7d7", "comment": "Malware payload (AgentTesla)", "value": "75c54fded74865e04a682f16ce2b37a4a8201cd6303860c351cda7aeac8a39b4495c8d20fea9093ff43f6fa2e3d0fbd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570323, "uuid": "c9a406f9-213e-4e76-ba08-0913098b1120", "value": "T1C9A42372FC72E4A928639C8117504C3826CCFE7B66BCD5A024D999E499EC81FFD943E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570323, "uuid": "b8c2e008-3a31-46ab-bede-2de2ad54df9a", "value": "12288:2rYGld2/4MjcBJdautum6ks8FTggcfeQPrUuBcz:qbl5M/ucDv8FNcGQcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570323, "uuid": "882853f6-c84c-4e5a-9deb-5447b3cb9d9b", "value": 473569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570323, "uuid": "95d0e868-f9df-49cf-b2f8-65571ea0ed76", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570323, "uuid": "f38be3a6-9d7d-400d-889a-bfd0aae8f7cd", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58cadb3-cae6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651585358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585358, "uuid": "18871e85-2727-4003-bc2b-ff7942255f81", "comment": "Malware payload (RemcosRAT)", "value": "5f5552248193a7dde6896cc8482733ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585358, "uuid": "82e829fc-f404-4c21-bc62-2208a31a1ceb", "comment": "Malware payload (RemcosRAT)", "value": "b8df890fac057175f86dc5f301f1e1f6d45b2a1b36598934c3fc0144cf433137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585358, "uuid": "dc3d2af0-e38d-4e3b-b6b6-ffc059b9bdd5", "comment": "Malware payload (RemcosRAT)", "value": "7e923179fdf835e128a6da8de1fac9b91fd164e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585358, "uuid": "62f59481-c73f-4dd7-8761-df876792e57f", "comment": "Malware payload (RemcosRAT)", "value": "8380b9ee693a97ffac05a06b4fc9d3b4dfcf43ec0204e07dcd4f3947fbc1e4423960478553117ea86b847dd69e6f1b4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585358, "uuid": "e8614404-ebd9-4387-a0f1-6f2d972f132c", "value": "T12C658E21B3408576C7220E35CC0BD3BD6826BE717E16658777E93E8E5E3B390B5252A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585358, "uuid": "02313040-163f-4ad3-99e9-bdb68999a539", "value": "a3587ebbd639674c0c7b8eeb6ae6abda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585358, "uuid": "90d4e869-5766-471f-a68d-17afed74ab76", "value": "24576:9i0Ehe4IlwPaq58042u2HjhPUnC9cNV4A:9wIhqKvQjhsQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585358, "uuid": "092f1350-515a-413f-91c6-8ac6c7aa27f5", "value": 1413120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585358, "uuid": "f5971a98-fc17-4a76-8515-bf8142e93dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585358, "uuid": "a84073d2-442e-42db-afbd-da74557b23a9", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbe7622-caa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Pony)", "timestamp": 1651558233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558233, "uuid": "723a1d3c-9cb6-45ce-9f54-5c3e3f609b92", "comment": "Malware payload (Pony)", "value": "a11909f5602b75c7fe94050d9ec48c17", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558233, "uuid": "0219b01d-cc8e-44b3-b1fc-d3f54941e1ba", "comment": "Malware payload (Pony)", "value": "b8fd094335044d71cfb4587e5289b826a827ba7d2e4dcaada8c3ad774c9b6d26", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558233, "uuid": "8b5adc66-9acc-427b-9aa6-e0e114c9d803", "comment": "Malware payload (Pony)", "value": "c6c4e5b96225d2e90b443b12a4f239dacb20274d", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558233, "uuid": "410fc977-da19-46a7-b103-3d4171dfaf29", "comment": "Malware payload (Pony)", "value": "e465ad140446d8d7e2df56a6aa20c1a537b7c249487a751044bad6027fc1ea9d3fabceddb779bb40f0afcd706c5d3064", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558233, "uuid": "ee3f42fe-4e85-4d20-8da0-484282688990", "value": "T1719423E2FCFF4B8ACDA6196A47EEDDE25B411AB8AC47A0834610E6C741BE4DD0975130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558233, "uuid": "c1dd1dcd-aede-42da-a025-887e86327fc8", "value": "12288:z8XlkvDf3QK7l+eYasLTLKuwB/dagLI8EAD8SSyV:IIjQK7l+Za2Teuwhd/I9AoSSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651558233, "uuid": "fdb7e756-3550-4741-ba23-455a639c15ae", "value": 415779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651558233, "uuid": "16eb32c4-aa24-4702-9f5a-63f57f9829e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558233, "uuid": "21c69729-4900-4ed4-b24f-fa51f4e50377", "value": "payment advice.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8015842a-cac6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1651571444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571444, "uuid": "cc5f6a77-7b76-45a4-8288-a65e60d4ce30", "comment": "Malware payload (AZORult)", "value": "bd5b6e545af0865e51eef97adb5adf4d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571444, "uuid": "1ede6fb9-a4f1-4fd7-8840-ac25ff0df946", "comment": "Malware payload (AZORult)", "value": "ba9272dd1b9b899305d65116430b7929ca1d4fa7b16f414297fa5f367a21e798", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571444, "uuid": "1030d702-5da9-46cc-9700-e91b7c8ada55", "comment": "Malware payload (AZORult)", "value": "8140653b9d7b9b4c257012905c6fe05cca206f0f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571444, "uuid": "75863290-2cd3-48ff-adb2-544be034f8be", "comment": "Malware payload (AZORult)", "value": "64b70c4747c5d2311b7d7be2fa4f94f913faa2eb6696ce7ea9113e3eaf8b784b9ed8c94d880f00f0ed6860fa7e3c9479", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571444, "uuid": "662de03f-bbb5-478f-b3d3-64a6ea7c9341", "value": "T13EC4F7EC325072DFCD57C8729BAC1D64A6602477432BF307952723E99A0E89BDF245E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571444, "uuid": "03bc0ff1-22b1-41ca-8fbe-706760f7413f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571444, "uuid": "d75a8036-416b-40af-a45b-3b4570aeef34", "value": "12288:BJjkW1bwOOFR3gvJEBzMfPvucX895KGG7t2dpHAdIqC9UEPzTqmXQgWX2NByW:B91bevgvJEgPDYBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571444, "uuid": "d1e2e4e0-a5f2-484f-ba45-de82a532fe5e", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571444, "uuid": "e3afe9de-0d93-4365-9efb-2699a08075a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571444, "uuid": "53fa6e07-b52f-4c0e-b0c6-249b25c2b34b", "value": "Altay Order 38578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566221f8-cafc-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651594567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594567, "uuid": "0fc0ccdd-5481-41d6-883d-5cb501789d94", "comment": "Malware payload (DCRat)", "value": "d3c732ae7f040fc12b0c168a6695763c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594567, "uuid": "1196900e-9504-4b4c-8845-60e232f2bddb", "comment": "Malware payload (DCRat)", "value": "bae6ae420a0d8d70a34a72dc282b747d4c955c6a8563e0ce27068e420cc1cc6a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594567, "uuid": "24300775-4c21-4570-9cd8-d0338aff164a", "comment": "Malware payload (DCRat)", "value": "8e4d9065912dfbe0c9ca3fd4f1dd1f62918689f5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651594567, "uuid": "8caac3ec-efaa-44be-848e-1f59e239022f", "comment": "Malware payload (DCRat)", "value": "050714ecbc3abbaf11239111f4175c15c2a69f3800a1011f6a9c26145fefe94778d4b867a8794474646d0d0aea5a412b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594567, "uuid": "dee88040-62e1-4ce8-aa77-58dfa90c637f", "value": "T12CB5BE127A84CE01D0AA2737C5EF841443E8ED417662EB5A7EAF33AD65213A71D0E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594567, "uuid": "4ae716dd-031c-4399-aba7-a3f9c51fce25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594567, "uuid": "bc09a3af-f9b8-47df-8460-69c42288684b", "value": "49152:S4HwATCSEMZgSFB9Ijs3BLf8o62XwuT3nvcqCRhfOB6+or9:S4HwATCNqnX3ZBjwgHB6+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651594567, "uuid": "230ce337-8089-4e91-8120-02b49238816a", "value": 2273792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651594567, "uuid": "e317c051-cec1-48d6-b1a2-c69aa5b04036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651594567, "uuid": "6498c93c-45ca-4c00-b8ca-1d7672e7c575", "value": "BAE6AE420A0D8D70A34A72DC282B747D4C955C6A8563E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ff5bda-cb04-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651597869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597869, "uuid": "5bd8d765-7af1-4de1-9ea5-4f19376c5e5f", "comment": "Malware payload", "value": "8976468036b76ab9dcdf8ff55ace0d70", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597869, "uuid": "989391ce-bb70-4a84-94ee-c451c3605aa1", "comment": "Malware payload", "value": "bba01af580df4e0193a2a31b9bfd655cb9fc8e74bfb20a0151b94f260587c43d", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597869, "uuid": "b7f9e1b2-ed60-485b-8894-71679146cf2f", "comment": "Malware payload", "value": "9916d45b2572be2b47a3f77050f0028aff4d6892", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597869, "uuid": "517c4f2d-7bf0-415b-8d9f-c7ac21ada01f", "comment": "Malware payload", "value": "253e0e4217a5f02aa62e10e1baf6dc9965999cb1324cb0e6461cafaf6af284271a1e1fb1349da1f23a1c1d03894cdabd", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597869, "uuid": "cb640e9c-95c2-4da0-a108-3d9c011832cd", "value": "T16666334218D6231B376A946E5DE2092B4933A0EDD015FEE520FF71E929F26EC476C48F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597869, "uuid": "596655f8-6ff4-45df-b742-e178eba05065", "value": "196608:aGMMh8YZ/hpWtfRgUr/U4NMgltvm7Ce4b:bfCav4fGULMqtu7ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651597869, "uuid": "0af4900d-c484-4c5b-9e91-8fc4b6c181a5", "value": 6785497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651597869, "uuid": "849d7cff-ac8e-4ded-a9d5-e1e03db4543c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597869, "uuid": "33019220-7baf-4966-a77f-0f6479d35c3d", "value": "Rent-Agreement-Filled-Format.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd29152-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582686, "uuid": "79eb0af0-e762-4841-962e-4914b5206a16", "comment": "Malware payload", "value": "a230a26635492fbda9d8c0b28f254851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582686, "uuid": "d8b9031e-0f4d-49ca-a05f-8dde852a506e", "comment": "Malware payload", "value": "bc58b53760555aa55c4b8a335b90719932cc8bef81952e50949ce4e53b1fe5f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582686, "uuid": "4e07b97a-f3c1-4fb6-b36a-afa9fdc8e9b7", "comment": "Malware payload", "value": "b5fe4f9498aaab32793ffc394025cbedc9e0f953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582686, "uuid": "953735f4-5558-43cc-a6e2-d22e6dd749e2", "comment": "Malware payload", "value": "73dc8ade6bc64b7e7a7a8a4c4a9dd2a8506a6f14ac39ec6c7a4318e74f0c78ff9635fdbf797833dfec4ab8c1eb388029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582686, "uuid": "28da24b6-c5d2-4e54-8640-1fff0dee7b6c", "value": "T1AC059E257A42823DD1B21239453C5BB6D82D9C201BA284EFF3A4767A9F34CD17A3D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582686, "uuid": "6868f406-7cb2-4849-856c-28abf6475bb0", "value": "47275f1bf1f4fefcfea0f3870bc3ce9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582686, "uuid": "710e0a19-5671-467b-8ba2-7e2c9af90bad", "value": "12288:3o9AeNnwxLb4qWCxpz9YQDdlFqjZSQDAY69+G4XyxUJDZaOpfAqNfsOrdB:3oraz9YUDFSSQDH69+qUJDZNUOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582686, "uuid": "83ee5d36-ea32-4029-abe2-f819a1757d07", "value": 845040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582686, "uuid": "aab358cc-4af1-4f46-a47a-879d0729a95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582686, "uuid": "57be9f0d-9453-457a-8609-9e116daf63a0", "value": "SecuriteInfo.com.Adware.Softcnapp.124.26382.15666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e4951c-cad0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651575579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575579, "uuid": "684baaae-ad3d-440c-9386-11a54f17b41e", "comment": "Malware payload", "value": "0a07cece553e1e8a62c70cf5ae3dbf6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575579, "uuid": "97f7d8ba-e9fd-42f5-af9c-ead5a7fa8010", "comment": "Malware payload", "value": "bc8195f103d1c59165073d3e31e805fc09ab147f5d11a2718d8fe5d74a30a873", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575579, "uuid": "cb71b96a-99c1-4629-885e-90d158109a67", "comment": "Malware payload", "value": "8d34705851317087411b074cb7ad7e26275e2aec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575579, "uuid": "2dac2dc7-2f82-497d-906f-389fc5822625", "comment": "Malware payload", "value": "0c4d66cc8e2b6277d64288cdc2135ed8ad94e7b320c43f16a7bd1a4475850b187a7f4e01d6767fd701d61129625b8e46", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575579, "uuid": "e2238f3a-0542-4755-92d9-a4dce0c14f2f", "value": "T1A5552354FE3444BFD093C87524650A7B5A3D790C853E7F831364EBAD28729A8E73278A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575579, "uuid": "d0973b77-920c-45d8-b3bb-15b66211fa0d", "value": "aac530b54c48794b9ebee293dcf2bb46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575579, "uuid": "9e1e28fb-7bd6-43bc-b70b-60fcefc7f646", "value": "24576:kZSMOlG4nETYLSMKmPy1NPOyDIDILDQdZKEYicDBHyhH4eLcH9h33YCB++l2:JlG4nEtMKmK1lOhDIIQ23LcH3IQ++l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651575579, "uuid": "d8568a8e-249a-4dd8-a591-f15ecab9c864", "value": 1290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651575579, "uuid": "fb35c7c3-fa5a-4c3b-a00c-3494e643a49f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575579, "uuid": "780ba22f-8837-4548-924f-1756ce2d42b3", "value": "BC8195F103D1C59165073D3E31E805FC09AB147F5D11A2718D8FE5D74A30A873.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25c300b-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651580950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580950, "uuid": "45eb4611-b5b0-403e-8156-c03f7b9d38d5", "comment": "Malware payload (Formbook)", "value": "de5d130bd65ee0c31093ec406b06b43c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580950, "uuid": "8e57d42c-227c-4043-bc9e-52d828b14ca1", "comment": "Malware payload (Formbook)", "value": "bcc8b30673702588455c69a2a8279accd47e30a8af95ea9bc0d91f2347e86d60", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580950, "uuid": "8287b68b-7edd-4c20-ba7a-76a4b4b14813", "comment": "Malware payload (Formbook)", "value": "e68e06f83ede3c09223a7aa98ffdc45b2e29ff07", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580950, "uuid": "633160c4-cc3b-41f0-9435-2788785a2352", "comment": "Malware payload (Formbook)", "value": "e1fce3562fd4d7f711a6626b7688a7246e7a8d7e7b45a07976956d0c061fa853b29fef8f98c4146d4465def50e08fc87", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580950, "uuid": "86838102-1c1e-46bb-804e-447034aa9595", "value": "T12804128F10950EA1ED3013F109F286935B78EFBCCB1B80A39375FD6926305642A5B9E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580950, "uuid": "94990d60-9ebb-4286-b344-659ab4964017", "value": "3072:bAOIvIss24yi6DGAXN9aQwW/iT38VCOcd2YdI+DrlHDxH/+HSIeV8W+tLCD2Ana/:Mfh4debWQwWe389qdZZYSIeVP+dEKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580950, "uuid": "a134941a-fef8-4ed3-a48e-0a8e1b1c0522", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580950, "uuid": "7f7ed13c-7ef9-4006-bb76-a4cd2ab9c02a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580950, "uuid": "5ba11d0f-3739-405c-9db7-4bda12ae9c4d", "value": "IPSCO_Purchase_Order7891559.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70aa406-caae-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651561309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651561309, "uuid": "7e84c8d2-491c-446b-90b0-c16bc1607749", "comment": "Malware payload (RedLineStealer)", "value": "3e6d9c959fffbcc2edd43126118f6996", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651561309, "uuid": "6e321657-4da6-4085-87f9-908620595b0f", "comment": "Malware payload (RedLineStealer)", "value": "bcfbcafb6a9a4c9b927c314911d6fb2df0124f3e84c5bde424f17f0024e650e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651561309, "uuid": "7ef13225-c68f-448b-ace4-ffcc463043b6", "comment": "Malware payload (RedLineStealer)", "value": "e64f91a7cf5f9b611d5fba225e58982cd5206db4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651561309, "uuid": "9f27d1a4-8e18-4414-9b41-f73d9e8b3c45", "comment": "Malware payload (RedLineStealer)", "value": "47ef4b9e8bdafd8b2e5eb166d7ae6c5eb4e8843e24ec20c84d0eded3677d6d8306e58b179d7ee8dd08153274ce96285e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651561309, "uuid": "26ed10d6-2ad6-4998-a81c-dbc77e59e089", "value": "T1E484CF00B790D034F1F726F559B992A8793EBDE15B2491CB23D42AEE5A346E4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651561309, "uuid": "bf6bdf0d-5e02-4241-b4e7-c192b8615d11", "value": "e4c1b729a6a6c26957f366f6e05b141c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651561309, "uuid": "00329b75-0f61-4ac5-83fd-e909074ca952", "value": "12288:fffa5uzRXxTxc6UqbQqqGUUQ0Ib8/M5Vo3:fnagZxTU2ZqGa0u8/Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651561309, "uuid": "1ffa2c57-74d2-45fb-8a06-e723908a5983", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651561309, "uuid": "10c6fa99-2320-4fcf-b04a-724a0ab3a1ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651561309, "uuid": "eaf130c0-41ad-4ce6-8204-14e71de543eb", "value": "3e6d9c959fffbcc2edd43126118f6996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbce7e2-ca9d-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554049, "uuid": "ef3294c7-6612-4b30-8912-838bfe4a5413", "comment": "Malware payload (GoBrut)", "value": "dd8ac7ca3edbd3f5a4633f3360eaee53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554049, "uuid": "c42b9653-eb32-402f-b4b7-48b75211a5de", "comment": "Malware payload (GoBrut)", "value": "bd9ce6bca4d8a4df594da58ea8b542ea7b3889ad4c784a1b8729c40d7a643e84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554049, "uuid": "89ee222c-d56e-4e14-abd3-800c49f1b237", "comment": "Malware payload (GoBrut)", "value": "28e92ddf4fd5ef152084ffba31526d0078dcd057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554049, "uuid": "c730095e-7e46-4928-a93e-897a559caa09", "comment": "Malware payload (GoBrut)", "value": "d612748084c46029dd828c3098fb8956e404373e4601d64ab79d821c6010bb86f0142bdc7809de191767771ed3413876", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554049, "uuid": "15f17c7b-00a8-473b-9a75-64bbc05fc6d0", "value": "T1ED763A91E9CB10FAEA032D3191AFB23F573111068764EEC7DB485F52E87B5E2593324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554049, "uuid": "643fdd07-2472-46bf-bd77-f5b1f71d699c", "value": "98304:DE1b8UT19vcSzjr5/YJ09xUa2megmG5OFZj8KIX:I98UJ+SzBXUa2ac8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554049, "uuid": "e0d31c0c-06ef-4a29-9c65-9f6ce243e885", "value": 7314432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554049, "uuid": "5970c2f6-4d83-4f02-8ace-51b98524573f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554049, "uuid": "2e5e4c72-d8c4-4328-8895-264993ed3633", "value": "bd9ce6bca4d8a4df594da58ea8b542ea7b3889ad4c784a1b8729c40d7a643e84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb49c0a4-cb39-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651621016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621016, "uuid": "e43c0ad8-7115-41d4-ab51-c3c0bbca7e5c", "comment": "Malware payload (Heodo)", "value": "1a2fc5301aaf29cc32c797fed33065bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621016, "uuid": "df19096d-f9a9-4ec2-ae41-6be66ea06d8e", "comment": "Malware payload (Heodo)", "value": "bdd4eb208003367c691cae3f9b86d284107566be561cb0206fb4dace42b76d39", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621016, "uuid": "7b4be442-31e0-4075-9a26-cb93bee6a891", "comment": "Malware payload (Heodo)", "value": "bb6fa509f5ba0a5daaec3aee52c3d2fe923c4e7c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621016, "uuid": "4bc4cb77-45da-493b-ad9a-2185bce31499", "comment": "Malware payload (Heodo)", "value": "69c90d6a1e63038b4144849b9c0d40af39e6136d42e03369ac68c6282e88e032221711ba5421bbd693afb7f8ede21b51", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621016, "uuid": "fa756745-2fc3-4cc0-9fe7-41ba83b08315", "value": "T1EFD46C117691C832FC995F34359396BD1FF97F64AAA8822BEF803A4D6BB35008D142D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621016, "uuid": "5c125795-8050-49dd-88fa-be243fd04e9f", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621016, "uuid": "99149799-b8de-431f-86a8-2da61ad12226", "value": "12288:bGptged525pthqnht+RUKyTpoOvHuf27x+x:Ch525Dhqnh+mpvOf27g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651621016, "uuid": "71e216b3-0b63-4071-9187-24b33ca8e26f", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651621016, "uuid": "9c274534-6e0f-4498-a689-88824c16909c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621016, "uuid": "064244d1-a00f-4d10-bc0c-06ff32a32057", "value": "emotet_exe_e5_ab2c1cbd5be4db52378e44cabb42589de8dd6a3126006b53e966c59264f830a7_2022-05-03__233645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf0d0d4-cad0-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1651575759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575759, "uuid": "668c6494-f5f7-4221-86c1-efc2cb1bcba5", "comment": "Malware payload (OskiStealer)", "value": "5784bbf760286a8a213a38e00c97d274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575759, "uuid": "2f61f26d-7f61-42b9-915a-7418749c07f9", "comment": "Malware payload (OskiStealer)", "value": "bed8bccee5865cfa5e6bb504ba19f983b954e9c9fe072f7186d4362d7fda0701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575759, "uuid": "2ffba29f-ff5d-4d49-903b-24fde1d580ee", "comment": "Malware payload (OskiStealer)", "value": "cb008b307ff92b68c3f74522a005174552d12674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575759, "uuid": "318c8185-85f0-4c4d-bc64-87f5add92ce2", "comment": "Malware payload (OskiStealer)", "value": "e667c83982fda54d7e4ca471999cdb6776cfc2d879e34b5571235eb808eaf8f703101811d4259eef06cde5a8c3b4cb7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575759, "uuid": "b88e4e0b-8a49-49cf-8184-815ba4f16272", "value": "T152D4ADE1354C9AE3CE76997306CF9E7113A346250122F7335B937BF2364261BEA27285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575759, "uuid": "54b325b9-8db8-4aa8-9152-d922bd188177", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575759, "uuid": "8294e485-019d-4b74-ae9c-24b19ea757a0", "value": "12288:Ufk4zXW91M3mVyiKyrjppqKgDE+tOWCG7t:KRB4ph+tBCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651575759, "uuid": "ee5fd302-1576-4fed-a545-68e621132621", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651575759, "uuid": "8df709af-951f-4140-a1db-10c6c70c7928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575759, "uuid": "6f074d4b-3985-4a2c-9eeb-daf9eb3ddb23", "value": "INV39765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4e4094-cabf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651568404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568404, "uuid": "d16bd562-ff7d-4255-b6d6-8bc3d0ac2746", "comment": "Malware payload", "value": "bd06825cb0365869672dfac3b0a1d6d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568404, "uuid": "84f2b556-3dbe-41f0-be47-5ea53bd69201", "comment": "Malware payload", "value": "c19a70a91897b60ca56d7bf20f7113ebe83165087fd918789020b17cb4e09a13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568404, "uuid": "278d4ad6-34b1-4ec2-aec3-adf253e1f73d", "comment": "Malware payload", "value": "3eda723ddab4085dcb6922127a54a5f3ca5b150b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568404, "uuid": "c1326e72-7896-49ed-a66e-6c6f302831aa", "comment": "Malware payload", "value": "e0d3f835eb8f99a2b2837ff7ff77e56e875cc7a31ddf07353143b006fe3c73d3c1b486facd5fdf2e1b5f2053d75dd47e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568404, "uuid": "b33042c0-6d19-4e35-8478-370927562ed9", "value": "T122430114C315BFA5FA7B9074B43690C2336A0AE0F66B63C4EB3D1F3259D940B21EE592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568404, "uuid": "52e3106c-0b2e-450e-96db-610871ec0bae", "value": "1536:Cin4/vjvlGhKHhbLf1WN8WyIY9vZErRJVS:v4zloKBeNyI8vy9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651568404, "uuid": "2c07cb6f-3538-4cd0-8468-02a92990a459", "value": 58720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651568404, "uuid": "202ae04c-83b6-46b6-877b-87eb2fff9d3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568404, "uuid": "d18fd343-d2b3-4de8-add7-9eb48a2101d8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7360a5-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651588675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588675, "uuid": "8941b333-e349-451b-93cb-b6cfbb297c43", "comment": "Malware payload (Formbook)", "value": "b4e4989e91c06b80c46a6c05a6098f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588675, "uuid": "8993782a-f371-422a-9b00-de33382ad686", "comment": "Malware payload (Formbook)", "value": "c1dfe91a238e3b79887653dc716fa1fe5d4799b8ab78d6b91c0568830b795a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588675, "uuid": "20a0087b-935d-444c-ad2b-d9d934be06d6", "comment": "Malware payload (Formbook)", "value": "597eba336f4593f9f8a53e7b4704990ab24f193f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588675, "uuid": "36722565-0236-45dc-bd57-a5a5e69ad8ae", "comment": "Malware payload (Formbook)", "value": "2322eae2b2caabc50e87264b313617c8856dad553493ab5b86a3d2545771054fcc551866f6b8213aef632d37b99b6386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588675, "uuid": "7d10a796-d4ea-45d1-a365-88418fb610f4", "value": "T17124125896A4C433D5A393315D359B6F8FFEFB1230AA830B17A08F5EF922181E61DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588675, "uuid": "88aa6a05-cedb-47ce-9133-402a9c413b36", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588675, "uuid": "e1a55e86-3133-44c5-a01e-b189baeb372b", "value": "6144:HNeZmM5aXu1NS4iTnoy8vS/QaKe7yYS8g3emE70xvGHs:HNlkaXu69cvS/QCuSYU0xvGHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588675, "uuid": "ae147904-2817-49f2-b613-3e087d7f17ae", "value": 218893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588675, "uuid": "f26c34e4-0617-4912-aae4-90aead305b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588675, "uuid": "eba8e755-115d-420f-9186-fd0ce21094d0", "value": "Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c079307-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651580913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580913, "uuid": "cc79e697-2b2d-4a30-b46e-8fb8d2714988", "comment": "Malware payload (AgentTesla)", "value": "21a9206d7014acf86ac3db0e28665a66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580913, "uuid": "d68e80fd-7971-4dbd-a954-8942d0f1dc74", "comment": "Malware payload (AgentTesla)", "value": "c1fd55813a87aa413366f0d2ae3776be9f2a5d3ddb8ab93aece3d56ea72ada43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580913, "uuid": "7374a49d-3e53-40fc-a9bf-00ef81b0ebf4", "comment": "Malware payload (AgentTesla)", "value": "c686c25af6a6d0a037cbb81fe0202f407530f8be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580913, "uuid": "ffbea87f-5303-4016-a8d6-638a1a4aa346", "comment": "Malware payload (AgentTesla)", "value": "0abcd603c3faa91dc128d7b41fd9477ab275dab3f4a4d1b1b49268e941a702644058339f7a2d182c01fb30067bb547cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580913, "uuid": "e192e5f9-8b67-4ebe-b39f-a2e30d0b9b20", "value": "T12424128EB1748528F5C6D3333C6888AF9F3DFF73D6698541CA853699D6706822C3A321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580913, "uuid": "c593d73f-cbe5-4d71-9579-f3c05f7eb1ca", "value": "3072:1hd0z2usrnNpfJ+rLOAPX8dZA/SH/4S8B3Gd30t+QJlwB3OVbp:6zwHf0rKEX8/A/GdktxbSIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580913, "uuid": "28673ddf-26ca-4e19-a5fc-21f46dd790da", "value": 210648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580913, "uuid": "bdc401fa-47ae-4751-a326-52a4ed31645c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580913, "uuid": "14f3608f-fa5e-41ba-9cd9-b3a16b6141cd", "value": "PR 00120181213.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7959682-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651581040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581040, "uuid": "8642b9ca-615b-4d6a-a7e8-06122d3e920c", "comment": "Malware payload (AgentTesla)", "value": "754d48ff0be8b4e6fd5111cc64f87c43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581040, "uuid": "07d7b38e-c8ac-4f4e-b228-bbb8de023acc", "comment": "Malware payload (AgentTesla)", "value": "c2d65ea1c6fa3c75597c5a27931c94ffbf4bea5baa3b4447b5a0f7aefea52665", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581040, "uuid": "8128e71c-afeb-4024-9831-e6f988e88116", "comment": "Malware payload (AgentTesla)", "value": "39501a5ee5846d7d40791ec9a205f5c025f3b42c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581040, "uuid": "20e57ee3-19bd-4ff4-a012-07c7031f981d", "comment": "Malware payload (AgentTesla)", "value": "72b4268916067741302066baf5bc71d8325633975473396d6b8c5a658e11b9f4c5e9daa571eb5f408bcd403d6c58f227", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581040, "uuid": "1cb73d52-ce47-4ab0-b297-59b24ebeeeb3", "value": "T149050151A238A50AEDE00A7E4FAAC9B523346C9E044AFEC5E9C53FCB7978503D701677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581040, "uuid": "8ea4b4ca-9700-45ff-a7dc-a912e7badd98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581040, "uuid": "d56317ff-782a-4ab1-9927-64c2d9425a64", "value": "12288:e3bbJHYdbjTiBgbBHauMrv4U4QMblnC4EHdaU6:e3tYdms9a9LzunCj9aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581040, "uuid": "1a58b0e8-ade1-4df4-9112-32370def6a4a", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581040, "uuid": "5186ac55-9cc8-4125-a1d9-70183bbd90cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581040, "uuid": "bd952e56-9d55-4d82-88ea-692ef4a8a323", "value": "TNT - AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e564eb-cabc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651567268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567268, "uuid": "c60004c7-3dd8-4a70-a90b-54c462c6343a", "comment": "Malware payload", "value": "88d0aedf6f6a8700ecb4cbfeb4d13c78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567268, "uuid": "f383dcf3-168b-49bc-a7ef-f865f72c9b0a", "comment": "Malware payload", "value": "c39abd839dc0d644942e247af53687acf90f2d47fe4e70c68c6baeb88781fe16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567268, "uuid": "937d76cb-6463-42cb-aae4-914a97d94102", "comment": "Malware payload", "value": "5cb8c487ab91d36d7854a48f07ab017f5c6ea730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651567268, "uuid": "9fdb31b2-315d-4bf3-86eb-88fa5a4e49fb", "comment": "Malware payload", "value": "adb2f06a1bb491e16ecc04f328f02665e4aafcac65c7beded7983dd5d8ace1e66bf77243dd37bbd739652aa7a20a326f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567268, "uuid": "0e4b2733-e2a5-4ff5-846e-11dff4eae8a1", "value": "T123548E227791C876DB634032CED25BFA96B6BD90CE52858353E4BE0CEF31C91CA67614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567268, "uuid": "e87b9dc7-ac6c-4059-9946-194541a1ac45", "value": "74b3953ad2c264faad6fd32bb2a0978f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567268, "uuid": "3409db3f-e4cc-4dc3-bbfb-6516450c3aae", "value": "6144:eHKu15PB+hxV2xQcIiG5XDmMg41tMGYOhSgz7tadVQH8:ehyC6cIiG5XDmMgmtKOnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651567268, "uuid": "f00f67f8-659e-49d2-a5ac-9bae0497f6f3", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651567268, "uuid": "c3c24ed4-666b-438d-8db4-ec72a58459af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651567268, "uuid": "e4fdbb16-2a1d-4fc4-92e9-8041066bd487", "value": "SecuriteInfo.com.Trojan.DownLoader29.7226.11313.12182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d9a05b-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651588664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588664, "uuid": "9f93d5e3-bdc5-4e0a-86f8-fbaa3526170b", "comment": "Malware payload (AgentTesla)", "value": "df62c8cb10507c0a8eaa5c38381ac905", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588664, "uuid": "1f6f091d-a976-402f-bca1-9256f3ffdd0e", "comment": "Malware payload (AgentTesla)", "value": "c41cb27d711753a2b7eae138ffcce95634c036c6206c91c80d51a7e31c7659b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588664, "uuid": "7c2de573-dcbd-48b1-ad33-9ff9b7e8f8d0", "comment": "Malware payload (AgentTesla)", "value": "472c2f1cbc4aa441388422b800ce2508740a8df1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588664, "uuid": "a67c083b-b926-43b0-8cb9-629f3cf03e1e", "comment": "Malware payload (AgentTesla)", "value": "a36f7668d3164d04620b4a4e7bc8534e105c61306216d498ec188279cba1e7902d959175f11c8b41d33ac5981235d324", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588664, "uuid": "f6c12049-ae78-4bf9-9d61-e4dc8e689f9a", "value": "T10DF4FEECAB122D66ECBFAAB34C2F591CE6B24E1311B45646D6F732C58B3B0D66C14C44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588664, "uuid": "38ba86fa-0c8b-4242-9c88-3124f3ba40ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588664, "uuid": "55bd9725-287b-4838-b78c-91caba525015", "value": "12288:DS4cNRdpRpVDlvzyfisYMw299j1TL/hlL:2hpVDRyDwa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588664, "uuid": "a90bbf00-00b6-49eb-af50-97d4531ab301", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588664, "uuid": "462fd3c8-88fc-495b-a9d4-bdc3c73773c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588664, "uuid": "69f92c4b-f138-4fdb-966b-977dad9ff4e8", "value": "MV.JUNE XIN_SHIP PARTICULARS.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635d7bc5-caf9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651593300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593300, "uuid": "eb54d356-826f-4af4-a425-c504b12b45fa", "comment": "Malware payload (Quakbot)", "value": "f082367a1be4aa72c07c598a00c87b20", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593300, "uuid": "47681f28-94f5-4063-9804-dcb59f6f9606", "comment": "Malware payload (Quakbot)", "value": "c5cfc6fe448b32b9e3d7001b9ca693e9aec9930c645849e7735e3eaed2de342c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593300, "uuid": "5abedd12-9544-4acb-aabd-f8af666b806f", "comment": "Malware payload (Quakbot)", "value": "8555bbd699d6eed4e2deb5b98e0f52eaa0d9ad57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651593300, "uuid": "e2a654f6-b569-475b-a199-215fad853aed", "comment": "Malware payload (Quakbot)", "value": "413a3f9b4f6a8053b2dbcea8fdb84a179213576610f9ad056c8b3bdc0508fb0c976b6e1481ec4d7fdb3e52937f55dd66", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593300, "uuid": "c6059bad-2736-4dd9-abed-f21e31d04aa5", "value": "T1A045121380447432C4E5557831485E62392B789EE039BAE88FDB17FE3B591F9EE399C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593300, "uuid": "b39de0d1-823a-428f-9684-c18fe7fdd668", "value": "24576:0iG0mdDHrGZRjIo21FXm5Ob1mi0MriSo+fTA50MriSo+fTAw0MriSo+fTAA0MriE:0iGbbqRj2185ObMiS+f0S+ffS+fxS+fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651593300, "uuid": "55c7d6db-7858-48b2-8605-78ddf0851174", "value": 1260266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651593300, "uuid": "24503865-6b5a-406b-9afd-5e1caf4ff106", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651593300, "uuid": "d87966e1-1f58-414c-895c-317e7685198a", "value": "f082367a1be4aa72c07c598a00c87b20.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866ec05d-cac7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651571884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571884, "uuid": "94da057b-62f1-4718-a364-662f47ffaf7a", "comment": "Malware payload", "value": "2f665e4c068d2f09fef3ddf10caaef6f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Machete", "colour": "#C3475D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571884, "uuid": "785340b1-4bcd-4c4b-9b87-08480d4b409f", "comment": "Malware payload", "value": "c6512363fc61912fad462d7d5ca5092e6afa0643e77d6fb3a2b726c37b60ee61", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Machete", "colour": "#C3475D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571884, "uuid": "ca1411df-5cf8-4a2f-ae96-6002929cee40", "comment": "Malware payload", "value": "7d16e97cf9c876275c16420d065f297b4069746f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Machete", "colour": "#C3475D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571884, "uuid": "4c4ea0d0-6cb8-4de4-96b0-79b41c4f55ed", "comment": "Malware payload", "value": "d0881bc340ed5ae930046c5eb4996cb5222a86462cd14bc97f5bd1a5729050a0d1268f576619a277910b2715de683a57", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Machete", "colour": "#C3475D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571884, "uuid": "b8e4d6cd-b734-4cb8-96a8-a76243118852", "value": "T165762362BF919126F6F310F0167EA3646A1EBC70A768A0D773C173CE86706D5B937242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571884, "uuid": "396d9096-107b-4882-8a92-f5aaa6060e9a", "value": "98304:bID+1FynVH+Lhka0yPFmeWTYabNd25vHTkXkUtCYavxLtn5HhKtfpGLf+IIli+o:b/1FdpNmeWTYaupkUUsvxLt26CII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571884, "uuid": "3248ae68-bb87-4873-a92a-818204328162", "value": 7667712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571884, "uuid": "d9d7e354-6ea1-4e26-b938-0ff3253898cd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571884, "uuid": "73c9a95f-481b-4be8-a11e-a7c7b2f9b1db", "value": "GooglePlay.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dbe2ed-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651580929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580929, "uuid": "90219100-edeb-49af-b902-0a90820f3c4a", "comment": "Malware payload", "value": "1da7813477631ca63e359093f4554b14", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580929, "uuid": "b1698fbe-e34c-4054-95d3-386b5a8b1a77", "comment": "Malware payload", "value": "c7698a84e43a6b469f721ac83e0f4bbc766aa816a0ef19df0f54c23fd3dcc184", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580929, "uuid": "2fe5dc0c-c495-4665-8737-40130f973989", "comment": "Malware payload", "value": "06e7343b0a241368e754bc7d3be8836a40226572", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580929, "uuid": "0b335f49-c70a-4958-8fb0-c85c278c2ddd", "comment": "Malware payload", "value": "fc79435a615e0de4057fb41806abdbf12d576df1c17661a9f8fa5e14d610107b187c9092fc2c874d986acda62ea59613", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580929, "uuid": "3d406ef5-0777-4a7e-81a6-51e2892c7bae", "value": "T1A2E302887F169E03CCCF2B3A0D19E9E49235DE881C679F4F798DB61AF9B4861105E507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580929, "uuid": "09de7358-eb75-4e36-85d3-fdfccccaa113", "value": "3072:R1sOeobhc7pa1k5Omrcz2Oo08XOTmY7UgwfOJ2+rWwWt:TsubaY1kDQyOr1bIXWJ2+rfWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580929, "uuid": "94420543-7364-4218-8d5a-0a94fba89c6c", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580929, "uuid": "139a9ee0-1d59-4b85-bb7d-51ee956ae3a1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580929, "uuid": "fe888753-43d8-4989-a0a5-f45489219f09", "value": "PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8a4d73-cac7-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1651572082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572082, "uuid": "38423e84-06f7-4309-b1f9-8a8da0dfe1e9", "comment": "Malware payload (SilentBuilder)", "value": "df076d0f45a4e3e23be2b69d624ccf02", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572082, "uuid": "2f4d95f1-4922-4e59-8f91-2f382e7675a9", "comment": "Malware payload (SilentBuilder)", "value": "c857d848632519091caa6d0ea22c4a725f2ee28029f2f087ebf6cb05b074f805", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572082, "uuid": "51061476-e89d-4eeb-8e17-a8da357c0e5a", "comment": "Malware payload (SilentBuilder)", "value": "80bc67c8e985b562b4972862d69132885936945b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572082, "uuid": "932a106d-a20c-4141-a24e-8a4328e5966c", "comment": "Malware payload (SilentBuilder)", "value": "64e2cf9d1ebb0c672521c82738aa0e59e21fcb948b76325a3483475fecf4acd5346280ea42a9a5d36ebb30e061005061", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572082, "uuid": "559ed863-71e8-4933-92fb-4ff611dab387", "value": "T1FF633B477549B86AE916CB3D4C974F95B613EC104B960B83BB09B3597FBE9B04E0310B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572082, "uuid": "f56ffe3d-1d3f-44d9-8e74-2ad56dd34537", "value": "1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgAYW/ESKQHS1yXJFadK0pB:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651572082, "uuid": "c968ac1f-7c11-452e-98c3-bbf7f3299c23", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651572082, "uuid": "cfde680f-9f37-4498-a6cf-978d1d69cf20", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572082, "uuid": "0b25c567-7494-4470-b4ac-cb51c17680d3", "value": "75744364019255557019031792.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a84397-cac8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651572441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572441, "uuid": "3dac0e62-c54d-46e7-95f9-6c5a925c33ba", "comment": "Malware payload", "value": "a7910ec0e6898c7bd9a0994caa6e70e7", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572441, "uuid": "070857c2-3f24-4284-9256-67f93c2c7edb", "comment": "Malware payload", "value": "c902ed13403c55e1c2dfb99ba7d8a878ac18e77712d68230e2b4cb4e15d85741", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572441, "uuid": "05969e74-0648-48e2-a414-1b94ec3e14de", "comment": "Malware payload", "value": "2006aae850098d009045e120fb8ecbbdf1e53ee4", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651572441, "uuid": "500cd729-cf4c-4002-b5c6-dc37996ce07b", "comment": "Malware payload", "value": "402f1229b0c63526acd11e9267208ce377d281f14d2d2e8d96969963b96ec29c1f7ce36d23dc734e4235c9cb6da60cbb", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572441, "uuid": "6cd5c277-a081-49d4-b454-27c8fa1e434b", "value": "T1F4A3F5792C7F4216ECEA11BCE0EABE26B5BCEF2A21104101AC6DB31557F98B35771D12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572441, "uuid": "ac2145b8-1d7f-49a6-abcd-0aa7ca2023bb", "value": "1536:hhcxd0gyL3zVRPfsXP2BJ1d3pF3hpJN5vnNhJhJfJZNJPBxi0D80Dm7fxV:mURP0OBJ1d3pF3hpJN1nNhJhJfJZNJPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651572441, "uuid": "9423f728-ecef-42b8-befa-ae0cce6049d7", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651572441, "uuid": "ed2f20b5-0cfb-43c8-91ed-7b2639b5a01d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651572441, "uuid": "e7303e08-7909-43a8-a687-537783600062", "value": "Win10.0_System_Upgrade_Software.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461e7daf-cb34-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651618591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618591, "uuid": "80f3fc4b-c1b0-4edc-a20c-43133d9357f8", "comment": "Malware payload", "value": "a36869986ce1f84390cc6226c888189d", "object_relation": "md5", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618591, "uuid": "fece062d-5617-4ec8-8994-64205cea559d", "comment": "Malware payload", "value": "c92fdf2a620493c81ebc7074479eab7b1181ca636e302f1bdf31bbc3988bb173", "object_relation": "sha256", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618591, "uuid": "a0a0e5d2-ad31-44fa-b367-7286e8dce970", "comment": "Malware payload", "value": "dc3812c63569fc79daae71122a2c05e7eac02aa1", "object_relation": "sha1", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618591, "uuid": "2be87d31-6172-4a0f-9adb-c7f2909a2c30", "comment": "Malware payload", "value": "2f98a82e09f115424b1131611edeb6c7233cef85ebcd735e655888c4d3756c87725c7a16de8dfc2ed0c70514807e1ed1", "object_relation": "sha3-384", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618591, "uuid": "fadbd939-0523-4df8-a67c-34071bb66d1d", "value": "T16626C00682988D66FD5C5BF03C1D6FDF464DB7427A69249D2BBA1881C3F2A7B103913B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618591, "uuid": "2c7b558f-d9f8-45e8-8460-b495867e24e0", "value": "98304:GYSPeBPDPYz6I1aNhsj0q8WoYboIsMG3QclPdF04:GYV5QznQhcomPqQclPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618591, "uuid": "adce37de-7f21-499a-bf36-7fbfd2357bce", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618591, "uuid": "a5bb2390-6b64-4b43-90ad-55739e1c2f0a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618591, "uuid": "175c04d0-1923-462d-81ba-67eed0e43dd3", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542e78e8-cadd-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1651581249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581249, "uuid": "31de26f1-3787-415b-902c-ccd1194f2b5c", "comment": "Malware payload (ArkeiStealer)", "value": "ba5461bef761e4e723c2567cfe710fe3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581249, "uuid": "5804cdcd-180c-4cb9-bdf4-e1575ebf4860", "comment": "Malware payload (ArkeiStealer)", "value": "c9c82de52be77596153f54b192da4e91e671cc5ad01d6bfe0011fd8e9d5723fa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581249, "uuid": "b5ec9179-c4a8-44ec-8e57-0858a4683041", "comment": "Malware payload (ArkeiStealer)", "value": "92f94d48482ca2006caf4c50ac387d1b532e837b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581249, "uuid": "46b7b92b-a2b9-4e8a-ba7c-3ab3fabc68ad", "comment": "Malware payload (ArkeiStealer)", "value": "53ae650f6e12e6def0ab674e350ef583d1f38a411bb1b930cc67305c306e4763d14c65fad748c0cd38da07334dc8d521", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581249, "uuid": "3e2aa038-3bc5-4eb8-9f3f-0221341260ee", "value": "T1D684BF10BB90D435F6B726F04979D3A8793E7EA19B2491CB32D82AEE5A346D4DC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581249, "uuid": "16f0fb28-e9e6-410b-97a0-cce3395777d5", "value": "a143483d4d0f129b0ed032a728de83df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581249, "uuid": "9d5a34d7-1f36-445b-9eba-84e4a24d42e0", "value": "6144:wEFpKQg948Ca1dEiGn9w7tq/lQICi8n1Nkq2swg/5woWglvXmz6P1Blr8:wypKH48p1dEiGn9U8lQNiU1NknS/l+S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581249, "uuid": "c6be1feb-5f26-41c3-8d5b-df314896147c", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581249, "uuid": "f88c4566-0368-455b-bff3-2bc90e08aa83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581249, "uuid": "585e5a99-e795-43e3-98b6-838084184714", "value": "ba5461bef761e4e723c2567cfe710fe3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80c3815-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582678, "uuid": "ceed8740-cab4-466c-b489-b9e8df08799e", "comment": "Malware payload", "value": "2db4920fb76be1da38ac0891b016deb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582678, "uuid": "b0b2157d-d2ae-4345-8790-28ac4c9a5fff", "comment": "Malware payload", "value": "cb1440e6daba037b6c388f80687489a75f9e1e22f72798316cd522925a6a7433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582678, "uuid": "0f52cb5c-cafa-4922-b90b-7dc66ad8c9fc", "comment": "Malware payload", "value": "e8bd8d2d0eb948b205f4255ca2e0d7a289852c2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582678, "uuid": "43fe96ed-9af5-4c81-bdb7-9df418b085f5", "comment": "Malware payload", "value": "92b04e20077fe991e9cae04ad3bd84b65187b312d49ff4d6dd8d9f11afef64f76041cd68f483b5910a3295df7c01b98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582678, "uuid": "65375d3e-0f9f-44d8-900e-c32cccff54e5", "value": "T1A9D59E2176918439C1231331483CB6BAD9BEAD742B71C1DBF7A8361D9F74CE1763A292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582678, "uuid": "18623de0-6f36-4e96-9b4d-8c463f27e6a4", "value": "047674a249b817e47c2647e59600b436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582678, "uuid": "6b813902-1cb0-479f-a11b-a101f28febf4", "value": "49152:+9QoWjBfXj3OFFpNUlBv3F+0ZonAXqTxYiR:AUfXjCpYBv3U3nii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582678, "uuid": "39e47611-1100-4a5d-ad55-281370ffa1c1", "value": 2947824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582678, "uuid": "46e53f6c-9a04-4755-8e4f-2f62d575716e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582678, "uuid": "f513aa75-b8a7-48e9-b69e-97dd41a4afe0", "value": "SecuriteInfo.com.Adware.Softcnapp.124.19282.18427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713dade4-cae5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651584733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584733, "uuid": "aefbc451-eb2f-400c-a168-8671ad4ff6e4", "comment": "Malware payload (Formbook)", "value": "c1adf8769886ceb184e58d3d807a0d8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584733, "uuid": "9d61889d-78c7-4702-bbc5-ec386d92b736", "comment": "Malware payload (Formbook)", "value": "cb211078773205b00dfbb29da746dde5cd2a3c25f8e141da84fa8d07379ed778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584733, "uuid": "9e4ae22f-f25f-4495-9342-0c419d02ee49", "comment": "Malware payload (Formbook)", "value": "44212c77502e6af1c02c9f009973e1d6f5e5bfcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651584733, "uuid": "80912307-81fc-4331-b684-9eddf4e66d9b", "comment": "Malware payload (Formbook)", "value": "c9e52ae40033e837f52cce6c47ffbeeb9e46327f855ecfb8784fa8aa3434cb856f4cd144e7b99ffc007b9273da8bdcbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584733, "uuid": "65fb2d47-7e99-4b0d-a3fd-a00e5a9d6d74", "value": "T1A3F402A0B2396509EDA0957F4ABBCA7123346C5E0055FED9D8C43ECB39BD623D701366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584733, "uuid": "eb67e8c3-4c9a-4ec2-878d-bbcf0c311547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584733, "uuid": "488171e0-5408-44de-9e29-64039eb83b8e", "value": "12288:P3bbJbAVxOz1PsyeRhgnY2u4PkwKMweVkGQ9R:P3lAEPJeReYx4k/Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651584733, "uuid": "1b8e451c-605f-4a6f-8ac6-405218fac1a2", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651584733, "uuid": "2c2725d6-a70e-452b-b044-c2ebb80617bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651584733, "uuid": "eb394427-2d25-4f79-81e2-e0b5b34e6f29", "value": "c1adf8769886ceb184e58d3d807a0d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91f27be-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581955, "uuid": "3865d9b6-61e8-44c1-9a08-404bb5b845ea", "comment": "Malware payload (Mirai)", "value": "f4763b64e6677a1fb9955b9a1b9993aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581955, "uuid": "53569ae4-a105-40c5-9344-7a6a445296ff", "comment": "Malware payload (Mirai)", "value": "ce8b1f0467073df21e6d09087f9e0bdb798d1df9611779543828551592aa2eef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581955, "uuid": "f7414c65-0d4e-4d14-8533-368ba9c49738", "comment": "Malware payload (Mirai)", "value": "503e957ef3e9e733641706ef59189efb40356e00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581955, "uuid": "a72a0a87-88bd-4b50-87a6-33297d9cc23c", "comment": "Malware payload (Mirai)", "value": "2d0531c5db57d1f4108a1ca2a0028589f962582f7dbec940f988bb452a5c3854cf43f461566119d17e24ca4831030909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581955, "uuid": "99615f3f-1b06-4553-9dbe-8bf16f910477", "value": "T157732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581955, "uuid": "a521266b-b18f-468e-8514-018b88e41ca8", "value": "1536:awW0PKt9cwxjQ/sIXIdZzN3uD8Utia84GLf84Eo5WOK+7c4R6yN:awsg+dZzNiFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581955, "uuid": "364c2df3-a878-42d2-8a13-4d6bc77a03c0", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581955, "uuid": "2874eb9b-d4b1-47c6-8321-45458845394a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581955, "uuid": "4ed431c0-7378-42f1-8eb0-76696e16b551", "value": "f4763b64e6677a1fb9955b9a1b9993aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e17e346-caea-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651586795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586795, "uuid": "881af82a-6ce2-43a6-bc59-f52327b1a175", "comment": "Malware payload (AgentTesla)", "value": "26a183d70ef9c1f7f9440cdb07d35d59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586795, "uuid": "eb80a017-804f-459b-a001-1406324587d5", "comment": "Malware payload (AgentTesla)", "value": "cfe8be1e8c9102bb38319ae52e3ec3f51ed7330f447da51a7a7e791f8a1cf966", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586795, "uuid": "75eca558-36d9-4b3c-b9b9-5a76c17752ea", "comment": "Malware payload (AgentTesla)", "value": "4d4afb37cdb68a5345dc24d39ecfd07ba80995d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586795, "uuid": "702028ef-36b6-4790-9719-79bb1df6f1cd", "comment": "Malware payload (AgentTesla)", "value": "783ecd7a206c2a9f954d86d4e8e2fc31ddc24e982c77b2dd96a462042c2447ddbaf53dc4863ec67e35fab9ef42e5d289", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586795, "uuid": "020327bc-32e0-4a06-b9e4-04be160c8e44", "value": "T156D49CF171408BD7DD3BAB3A229A4E5013F1556AD326F70B2FE023E50653E2F1D66A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586795, "uuid": "a4b3b4c9-fe47-4e8b-a695-17719ebea2a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586795, "uuid": "3264c022-3908-4f3b-b77c-359f15b1fd98", "value": "12288:jwEPfP3hoDdhvL+uAWMWob61RxicbikG7t:jf3mxh0WSijekG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651586795, "uuid": "f34710e3-22db-48a7-b2f6-f18f92edb505", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651586795, "uuid": "01a3f611-ad69-470d-8b83-d7340379b12f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586795, "uuid": "b8404dff-15d5-40b2-ab3d-f37fc28d6358", "value": "ATTACHED FILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c854333-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582658, "uuid": "9d4e8f2e-e733-466e-9b1f-8d2e847403e1", "comment": "Malware payload", "value": "40e5210ba4fcb7a8e282f0c86083e63d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582658, "uuid": "5a35cdb0-eccf-4131-9649-9d9106a75ce7", "comment": "Malware payload", "value": "d08dc7e38a7724e2367e10c2df7ad57969494c7ca3d936b4095bc48b8e655ee6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582658, "uuid": "c8b90314-6523-4d33-a6b2-d4e080b8ad9a", "comment": "Malware payload", "value": "c02f981186bc7d3f773f1599b159ff6697391921", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582658, "uuid": "da327fd0-7a3f-4880-94f8-69adebaddd00", "comment": "Malware payload", "value": "1f16cf0fb162c4aad7524c91ad6b601b4913716133accec5e7827f882276708bb2a3d68e9b0e4e074198a11323dce029", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582658, "uuid": "efe98fb1-cf9a-4a4a-aa45-bbc8fd20fd31", "value": "T1D1D4AF23BA41C032E1EE0131A67DABBA9D3C7930173890DBA7D809B95E705D2B739757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582658, "uuid": "ace92d7f-608a-424d-a122-91060808082b", "value": "055cbc82d112cae538ac82be5478ce3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582658, "uuid": "0557f822-4ea6-45df-b868-b2f8d0586914", "value": "12288:ic9q7ixbj2zPQGu2+lTW7IychRi7fgokdwHlhpHTR8oSq:ic9j8+FW7IxhU7fgXdkBT2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582658, "uuid": "d01e4b2c-57e3-40f0-a935-c6837ef47c97", "value": 607984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582658, "uuid": "637a882c-0a86-41aa-9ff3-0da33798fd6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582658, "uuid": "b56630b2-d9b8-4f70-ba64-e224c3f52332", "value": "SecuriteInfo.com.Adware.Softcnapp.124.3067.26373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9364b1bd-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622157, "uuid": "080cbdf2-c52c-4f5a-b2c7-ec01a7277e3b", "comment": "Malware payload (Mirai)", "value": "862749cd989f7c2f986ea8674740ceea", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622157, "uuid": "e25987d8-81e0-4971-9ac5-1175948eda4d", "comment": "Malware payload (Mirai)", "value": "d21cae739228135f1fc8b08591c45d57205f15b6087bd066329156c8923627dd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622157, "uuid": "3711daa4-e18a-4fed-aa96-3549de8fffbb", "comment": "Malware payload (Mirai)", "value": "4111ee79168272b9cc7fd3cf2413a699cc917d65", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622157, "uuid": "056da660-c2d5-4627-ac8b-daf7c749bccf", "comment": "Malware payload (Mirai)", "value": "577209d128a5c765e881e6f79196c95fb323e415c373d6f1a1537c64f26decf65db6a760f5c481e42eef68e7a66619bb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622157, "uuid": "4fd20a95-0873-48c3-9d93-5e0dbf75d60f", "value": "T1F4A32A46B6C248FDC11AD17426AF7D36CC21F5AD0236B2A767C0FE163C4DE211A2BE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622157, "uuid": "bac62bf1-8309-4134-a07f-35c5bc9f1265", "value": "1536:2GHjYF63OWKaTVKrCgtUsQVSgN6AY/RXY79lvs0ll5i+bqXDL1nk++68q:2GDYFnlakrCgXQvgY79l15i+q1nN+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622157, "uuid": "9a7bb4b5-9e06-438b-9c47-335681916c57", "value": 102864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622157, "uuid": "48fdfe25-2bf9-4b37-b861-1ed7d4c33213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622157, "uuid": "4ffa807e-00a9-42bf-b432-873dad1cb977", "value": "862749cd989f7c2f986ea8674740ceea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf4a2e7-cac7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651571977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571977, "uuid": "2991e9f7-ddfb-4d05-97f6-e5961032ccc6", "comment": "Malware payload", "value": "6c9ecb608afd7be5d76343532807049e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571977, "uuid": "ac502fb4-55ef-43aa-bd9d-799b59bfedbf", "comment": "Malware payload", "value": "d458684537bcec9af46be1f3995c40d9566edc16af3f8fe46a7cc53dbb084ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571977, "uuid": "e6893bb2-24ca-4087-bdb4-f8c25a8e02f5", "comment": "Malware payload", "value": "89fb4fae503e8dfdbb313d99d1c1941030d51719", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571977, "uuid": "eb0ce3b9-e81d-4505-96cf-e969348ad0ba", "comment": "Malware payload", "value": "898b936453efa8331801b55ca7c6273f14ace7fcb418bf8be2bc2b90ef7430adea1424f2ffdfe6887db14e79d50a8ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571977, "uuid": "3d9b21ee-8ad0-4175-b27e-4763c3891218", "value": "T19A5633E4A3901CF9FC77463AAC42952BE532396B4345C98F039C57269F33AC27879B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571977, "uuid": "1a52f10b-683f-4444-87a4-b5655e67f201", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571977, "uuid": "a6066de0-a65c-4148-b869-ba007287ec58", "value": "196608:Z/TWDyAAYG9xzHkkUo80YBRSEmmv6QkZ4MqJ:RcxPG9xAkJ80YBII6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571977, "uuid": "2b9d17f1-6df4-406c-8419-255c53cf2798", "value": 6440074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571977, "uuid": "eba6c684-7665-4514-b70c-343eb3a46019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571977, "uuid": "af7f55bc-a05a-4abe-b063-fde1f321fbdc", "value": "eb436d4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01801a5b-ca80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651541167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541167, "uuid": "7c048f5e-13ac-45ec-aa45-6529d83c8cea", "comment": "Malware payload (Mirai)", "value": "e30664143bb45c5b66e9889057428618", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541167, "uuid": "ea02bcf7-61c7-4533-bdae-9b40aef3aac5", "comment": "Malware payload (Mirai)", "value": "d64364996d8e8f4d2c8368e22aee8569351d36df70b6854670dc219db20815f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541167, "uuid": "4ed9577d-cd68-4524-a76f-aecd5fe2a0cc", "comment": "Malware payload (Mirai)", "value": "f2d0b07a040e6b1d70d7a76b9b0384b6eae21469", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541167, "uuid": "00442b64-0d7e-450a-8a98-10d29d1bdf57", "comment": "Malware payload (Mirai)", "value": "3ec7cfa9bb89f255d1ef3aad64d23a0993510d389aa47e705d3e1eea557dd022d70c548d12758a2b664a4469f02d540c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541167, "uuid": "64547f8c-f0e8-49e9-81cb-8c6e403a3132", "value": "T188330219880281341E219CA3C9B2418DF69473EEF6FBA7A7150ACF24FE445C3A5F6E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541167, "uuid": "4cef562e-18dc-4bf5-ac9b-e60c05423bd2", "value": "1536:9wWV78t1MSnwg009xBrymHeeZ6KmzFZ7H:vV78TMSw1gryeTpSFZ7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541167, "uuid": "cb28316a-a107-49bf-91c4-3176e579d536", "value": 50156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541167, "uuid": "d20da7ad-d6fb-40f6-8075-ff5f1b922c09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541167, "uuid": "bc410541-6fba-4422-bdb6-bb63b4d5f5bf", "value": "gummy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483e1f52-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651563619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563619, "uuid": "eaf11b93-5a97-4378-bddf-15562e05ad69", "comment": "Malware payload (GoBrut)", "value": "a17a90134bfdbf68e52bf9704110d145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563619, "uuid": "1bd9723b-a9f4-4404-be1e-3baf6b8b1d76", "comment": "Malware payload (GoBrut)", "value": "d70511f773f0b825b3e3217276fc4c05b55d1f5dc10ac5b5078fc26f82ffed50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563619, "uuid": "d42e1f1f-ac01-415b-80af-a80e629c2950", "comment": "Malware payload (GoBrut)", "value": "620995b67a91363b3c0e2e016d85579a79a9966c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563619, "uuid": "e249c799-86f7-4183-9e95-cb1d52c75ece", "comment": "Malware payload (GoBrut)", "value": "56d4238250a5be140b80dcac9cb1135c1649791f476978b9a146ebea1f3f790c45e627a28b6f0a85cc35b0c3ce19c4e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "jumanji-at", "colour": "#DB1591", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563619, "uuid": "d01af98b-4def-4d72-a671-cc8e1528d31d", "value": "T15E763A91E9CB10FAEA032D3191AFB23F573111068764EEC7DB485F52E87B5E2593324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563619, "uuid": "ebf58d84-42fe-4987-8bfa-dbbf6aa6ec1d", "value": "98304:DE1b8UT19vcSzjr5/YJ09sUa2megmG5OFZj8KIX:I98UJ+SzBSUa2ac8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563619, "uuid": "7813229b-8b23-46e8-beb4-44f1a873ef2f", "value": 7314432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563619, "uuid": "e662fb1e-bd54-4a64-bab4-2e1b8b9a1076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563619, "uuid": "f12546ef-e3c7-4b33-835f-da221e4200bb", "value": "d70511f773f0b825b3e3217276fc4c05b55d1f5dc10ac5b5078fc26f82ffed50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09af51fa-ca74-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651536026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536026, "uuid": "a87f2674-3b9b-43e7-923a-62e4211d3b45", "comment": "Malware payload (Mirai)", "value": "29ffdd8c00c473a30421f3e7eb0f5eaa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536026, "uuid": "6a6f1e14-ac5a-4f46-b2a7-08e0ea0f4ad2", "comment": "Malware payload (Mirai)", "value": "d80f721acc017229934e77d18af0cc902d246049b6681d5a942f34696134be8e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536026, "uuid": "45b9a786-3f7a-434c-84d8-59311297c832", "comment": "Malware payload (Mirai)", "value": "b653b98625a1049c9d2e844990aaff4c84fb79ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651536026, "uuid": "d616e7ff-2cc0-4a5b-a12c-9b04444360c4", "comment": "Malware payload (Mirai)", "value": "704c9c4e514e094d1094447040291e0ddef13ed15dfe5f43b3ade1ddc5f6499ac8af525c5e5532a889ac974588e52292", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536026, "uuid": "c9ec23fd-2bb5-40ff-a0e5-eb88cad265cb", "value": "T169D2F17A921EF1B4DA30C8B9FB9C9A09DB6423BA51B07B39156282BE574CC4C65F104E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536026, "uuid": "7e06958a-6446-4715-8cf0-5b0fb924dc8a", "value": "768:nk8QjKtpEIX71QYQMOavJ5MSdGkLNTs3Uoza:k8Qx0RQYv2M+za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651536026, "uuid": "ac3eec60-0041-4a32-840d-93b8451339cd", "value": 30448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651536026, "uuid": "f7cb8f73-1a6c-44e9-a1e1-f769a5123c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651536026, "uuid": "ee774cfc-9ebc-49dc-890d-c323463597ce", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57590da3-cb22-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651610889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610889, "uuid": "7f235597-cdb9-45af-8430-1326dbd6873b", "comment": "Malware payload (Heodo)", "value": "d45e0edafe48823f56fc7128e01725ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610889, "uuid": "aa91282e-12e4-41a7-a865-1cf297b2b086", "comment": "Malware payload (Heodo)", "value": "d8552f26d1544de6643765853eb16c4aa9f5e26f6f39cd8a8d6238ab7ca69bb9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610889, "uuid": "231d8840-23fa-4f05-b2e0-e3f8a11a5329", "comment": "Malware payload (Heodo)", "value": "82ba7d39cbcda99c7edb0ddd261dc6895488349e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610889, "uuid": "857e5e85-64e1-458b-a9e7-75bddb3e89e3", "comment": "Malware payload (Heodo)", "value": "d4d7fb356c6c444189757da30e314e8076a21b4bf28e2a83bc192c0a3686f70dbe7f396014d3204c5f84e61461e15f68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610889, "uuid": "25d242c6-6102-4704-8039-04ee8c765fa9", "value": "T157256C1072C1927CE1EE45754CBADABA412CBA230734F8E79388EAFD1B70AE16D31557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610889, "uuid": "592b5c83-6cb3-4f7f-abbb-99218a2225c1", "value": "2a986943d8440d2f00f13ad10b553808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610889, "uuid": "7adb2a8d-25fa-48f4-a519-a32ebb76d17f", "value": "24576:k8dlVJKB+nLkT3G1u6UkgKkhwLBeUNKsuG31Pt8H:3dlV0EnITPwgeKsh56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651610889, "uuid": "03454d8b-5511-4709-b80e-59e5427cf550", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651610889, "uuid": "30f2e817-79cf-4cd4-ac58-96b72afb4360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610889, "uuid": "d033db2f-fca6-460b-b23c-866699da754d", "value": "emotet_exe_e4_d8552f26d1544de6643765853eb16c4aa9f5e26f6f39cd8a8d6238ab7ca69bb9_2022-05-03__204759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7877c6ed-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651580880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580880, "uuid": "db3bdbf6-c4ab-4412-b2a9-c0f77e38c654", "comment": "Malware payload", "value": "b486c82527547271c9c3d7cc731efb81", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580880, "uuid": "874e0a58-3084-44a3-a94c-c624358466b6", "comment": "Malware payload", "value": "d894a5a25b8b59be98d10c1bd50bb5b076242bf5aa0e84addaa7f5b25ede3e08", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580880, "uuid": "9f551be8-7dec-4da1-8b55-2c535c8af81b", "comment": "Malware payload", "value": "ec511ed2d64b8dca7845fe042d1ceeff10369854", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580880, "uuid": "eee41b81-abcc-48bc-822f-428942f0f6c8", "comment": "Malware payload", "value": "87ee5c8f4b2576a356735f227231f2380ba6815ccf95132ffa0f07a54114a0ff2210b98fb4cc72ac73a9ffe773f47ffd", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580880, "uuid": "46c499f1-5cec-41e6-becf-dce57ade0a81", "value": "T1BF2412C1F2977483D572D03C692EAE38C431ED449B5AB286680C7D4F7B34583EA6627C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580880, "uuid": "e948b7ce-83c7-493f-870b-6ce9efcb888e", "value": "3072:wRosFivIoKMl9YMbpzqFLl1ONvkqht8P1wm6cDKt/uxXkAe4Ue8oI/ssbIESYL:+oNQoJlO1sbmpE/uhkCI/smIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580880, "uuid": "f05a430a-ebb9-4c04-926a-99f0b2a0cb7b", "value": 210632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580880, "uuid": "8923e699-10ac-4eda-a14a-f2d73415468f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580880, "uuid": "020cd2e8-9417-4933-8f80-e8df427affe3", "value": "order Confirmation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431bf8cd-caed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651588092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588092, "uuid": "2ef90cd6-8fc5-4f81-bcb7-1d413c014ca8", "comment": "Malware payload (Formbook)", "value": "8640d5837c0fdbdc8a4b6966da2848ca", "object_relation": "md5", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588092, "uuid": "c1e66f42-5637-46e3-8c29-4cbc4878f1ef", "comment": "Malware payload (Formbook)", "value": "d91d04a052c74e24823eeeeec79d14cf3a5bcdd50ca4867d0cffd5a6188085d7", "object_relation": "sha256", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588092, "uuid": "bff75687-860e-4dc6-afc5-fc543b94399c", "comment": "Malware payload (Formbook)", "value": "0d619c30d819564ec1f32cac2dfabd3c772f4802", "object_relation": "sha1", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588092, "uuid": "39c3d6b8-902b-48f7-bb8e-6753523a4b79", "comment": "Malware payload (Formbook)", "value": "ea3810fbc34c69f971f1089f597bd42f458353732657e0fd004842002bf8172eaddbcc3f01a750fd89ef9a25c42b847b", "object_relation": "sha3-384", "Tag": [ { "name": "103-141-137-109", "colour": "#807E00", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588092, "uuid": "9d9b13ca-9471-45af-8bfd-46bd282d4a45", "value": "T1B6256BF1E24504E9D45EBEFAFA81C984077DC1B21DF1C64A6E38AAD55883CD20E1E778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588092, "uuid": "f82d1f01-e40e-4338-bb9f-95915fd7675b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588092, "uuid": "7a22d112-57e2-4c4f-be2a-23c274da82cc", "value": "24576:h4qzgXHlCKbWafMySBuUxObP+qvx3QR9/FsNGFoyrsvEgzs6h3FT1xvBMRI6:eb3lHyQP+qvx3QR9/FsNGFoyrsvEgzsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588092, "uuid": "3bd27174-9ad8-4c46-93a8-0fb1a1a9942a", "value": 1015528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588092, "uuid": "4139fd6c-ef78-43ff-8fb4-8477fe6108f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588092, "uuid": "07e7d2bf-4fe6-457b-abd8-877050c0bffc", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88067817-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591214, "uuid": "c37ebfbd-e36c-42aa-af32-a9234bf8ba7f", "comment": "Malware payload (Mirai)", "value": "81f66de6d271a08236524e4c210b9383", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591214, "uuid": "cb8ffb86-7a07-4572-8ecf-e5698411bae5", "comment": "Malware payload (Mirai)", "value": "dbe042d35ab869a68666919c8bb41e882dd9745560fe070e5e062102579e4ee2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591214, "uuid": "ef483c80-d027-44c2-a3c1-26bdc72a460d", "comment": "Malware payload (Mirai)", "value": "9831094109339de5892bfec68cca02374f3f0931", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591214, "uuid": "0bf62cbb-59b7-4221-802b-1665601f17ff", "comment": "Malware payload (Mirai)", "value": "4f150c845936a651a39d4f92a296f895990abff6e23dd1dcaf1a0290c9f740ea583adbed629efe7c11112f10aab30e1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591214, "uuid": "86eb4dfe-ddbe-4073-964d-92c47de55458", "value": "T1BC235BC9A587D9F8FC060A342172EF326B76F93F1018EE87C7959933D942742E10A5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591214, "uuid": "c0ae5a22-7d28-4550-8d19-925a42f7a2f8", "value": "768:53sPWVrWy7PBIedilokjF3dMh80otXzNlxKUDWE1AaIKpZYim6Qls:/D9I8ilokjF3dMu0iNLKqWESDKrrm6Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591214, "uuid": "d8b32c70-350c-45a4-92d9-c1ed31f38ed6", "value": 47024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591214, "uuid": "fa2406a7-1ab2-45db-9ab6-5d6de04dc5f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591214, "uuid": "358ad859-4ec7-4ed6-812e-85cefba3e0aa", "value": "i586-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ee8053-cac3-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651570170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570170, "uuid": "5e6842d4-0e86-465e-90ae-63fd628e9cce", "comment": "Malware payload (RedLineStealer)", "value": "7154874cdadac80e2f22bd658f5df700", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570170, "uuid": "1bbe8d06-33e5-4602-b8a5-2ac82fe5a8da", "comment": "Malware payload (RedLineStealer)", "value": "dc96d93ad1c83dce26dc847e4a842485642533f0dc6151f564425dba0b1bf753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570170, "uuid": "41cb4105-1278-4c9f-babe-d806d9efd697", "comment": "Malware payload (RedLineStealer)", "value": "55ecff495c9b725e9d592820a65b3a153cce49be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570170, "uuid": "8502dd11-baff-465d-9b47-bf85cb091283", "comment": "Malware payload (RedLineStealer)", "value": "20844f0a718c09f4537742de67d7f454e60cd44e8f456f54800bfdc4a365b9aee3243ca40ce96edcbf4732c65e9cdae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570170, "uuid": "44c52bf1-a448-47d0-9627-f2dab578fe9c", "value": "T18384BE10B790D035F1B716F04AB997A8B93ABEE1AB2095CB23D42BDE56346D0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570170, "uuid": "bc48af2d-33d6-4c4f-b3a8-6aca45b8b64f", "value": "e4c1b729a6a6c26957f366f6e05b141c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570170, "uuid": "d1205b7c-0bfe-461a-8aa6-c84fa54774cf", "value": "12288:iADaNmrCXxY7RzNXIKUTWn6w7bOhVwgiVErBY:iqaUmx0NYLomG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570170, "uuid": "8594e1b4-106e-4a6f-ae3f-1709102bfa75", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570170, "uuid": "c3491639-1b7d-403b-995c-902ef52f3c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570170, "uuid": "6ea42dfb-20be-4d9b-8eeb-e96740be310a", "value": "7154874cdadac80e2f22bd658f5df700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfc8be0-caa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651558740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558740, "uuid": "5a924281-7b3c-4bea-84c9-c15defe95ed6", "comment": "Malware payload (AgentTesla)", "value": "2f7271a9482dc8666a750fd9129db595", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558740, "uuid": "d0ab7946-3aa5-4d86-8835-e9e58bc141cb", "comment": "Malware payload (AgentTesla)", "value": "dce51e23d92e0f708963d7bbc90f239b65756c45cde242260bff78e1d07b416c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558740, "uuid": "f0078d91-d916-41b3-860d-4a85e58170a3", "comment": "Malware payload (AgentTesla)", "value": "64ffd13275ca53bd074a66e71653cd1195838636", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651558740, "uuid": "2bbb11c8-fdfd-466e-b674-55db97328be8", "comment": "Malware payload (AgentTesla)", "value": "546a9eef5d9a2090aa671a503714eacd44f7fdd9e6929d6ab645ea4617c859b4270f2cfec47149a25ee07ff905bd53e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558740, "uuid": "730ffa05-f1f2-4891-b53d-ec94c0f1d316", "value": "T14AA4339F959AF9FCB5F3103BDAE4B0825AA24E78DC5E432CB1DC19D09108B1AF04C567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558740, "uuid": "904a861e-6af3-4dfa-bc54-0baf501665aa", "value": "12288:LZaha3on8GBJ3pbpscMElUm7n3SnsLM0azn2k2td0:LZBQ8aJ3pb6EV3BM0a69td0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651558740, "uuid": "e0c3bfe3-177c-46ab-b7d9-d1a377554e33", "value": 456962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651558740, "uuid": "bc28b4b4-2de6-4333-bc47-eae4e7d3666a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651558740, "uuid": "0d31d602-cec5-4592-b963-eaee20912d8c", "value": "PO#7A68D20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3575079d-cae9-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1651586351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586351, "uuid": "f12150ef-cdf1-4172-9130-8e01193a291a", "comment": "Malware payload (BitRAT)", "value": "616bf27a5cde0344f00aa8270cee2626", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586351, "uuid": "a1666b99-6e5e-43a4-853f-e3ba57fbb638", "comment": "Malware payload (BitRAT)", "value": "dd86ae0bf74b12812b8ad6c465a28b7e8a114de0be1cc7889ae959a02f7af208", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586351, "uuid": "270c9c48-94ca-4182-a12d-a675bd6f62b0", "comment": "Malware payload (BitRAT)", "value": "8d36d70a038261e6f64f595f0238f42a350e019a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651586351, "uuid": "50246436-22aa-4fcb-bd60-5bfe44fe6543", "comment": "Malware payload (BitRAT)", "value": "18514fa876c3e59dfd7acd47d6279b204e5c3d4b1fe48faf48ab138be6790ccf01406fada2c5861440ebb7012b2092ef", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586351, "uuid": "129affaf-502d-43b5-bcfe-873494f83408", "value": "T1D805C022E3D08437C37329385C4BA7AAA9267E303D1A64472BFC5F4C5F356C67A251A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586351, "uuid": "f07c104b-ef21-4f3c-b6f8-0fa9af9bc414", "value": "e96f0f2282c9506da8169ca64b3d06c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586351, "uuid": "704761c4-f598-4a3f-81dd-242b27a39570", "value": "24576:2eU6JECFkvVovtL14UUKC8WLVtVSn52XcNVCo:fUAkchWNSn52Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651586351, "uuid": "937537ba-46a4-4fc8-9bce-65c3753e4762", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651586351, "uuid": "b167000c-a5e9-476f-b5b1-92bc5e558435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651586351, "uuid": "2bad690d-d342-4df2-a8c2-fa9c169e0c75", "value": "SecuriteInfo.com.Variant.Zusy.422856.6594.25160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb18bca-cb20-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651610204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "356b2a93-0d85-438a-9457-bf3b22891d14", "comment": "Malware payload (Heodo)", "value": "bc1a0b3f8acd9ab1cdbe3145af776c85", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "0d6c2a5b-209f-491d-938b-924d7dcc7fe2", "comment": "Malware payload (Heodo)", "value": "dda1635f6e6e33dd3a6db7760691ddc4b80fa689f9db7ea38e5f342080fe321d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "c9a6a4ca-6df4-4f89-8415-c35ebd3ce9f1", "comment": "Malware payload (Heodo)", "value": "89fa05058c729be58cc9db179cddeee1ecd1f8c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610204, "uuid": "f1618c0f-bfb4-4a5c-bd17-1bbbbec7d336", "comment": "Malware payload (Heodo)", "value": "e29c7ec5e352c0f0dca267d43729207603a8fdd30ca504518cbcb6450b3c5d85a539504011e99616a7867a8f01febc7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "67f80c3c-71bc-49a9-872f-826c6b06c59d", "value": "T100D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "b40df5cc-0dff-4825-b70d-8693cf17678b", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "8b87d1fc-bd45-4c2a-8336-2eb18b6cb809", "value": "12288:UWBpwupxl0OeL/grx/GzO+r9AjCb/XKh:Psupxa/gC2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651610204, "uuid": "e0bd3fb5-6475-4ee7-89d4-262d8f057e62", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651610204, "uuid": "31ba2120-a70a-47d8-b90e-97cb2f1c5f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610204, "uuid": "315499de-0bb0-4d4b-9367-a6b220560a7f", "value": "emotet_exe_e4_dda1635f6e6e33dd3a6db7760691ddc4b80fa689f9db7ea38e5f342080fe321d_2022-05-03__203635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575ba5e9-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1651580824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580824, "uuid": "21a47f23-7012-4d09-939b-c2b1f1c49fb4", "comment": "Malware payload (Socelars)", "value": "54a7e55a79e9ed5626307bdc126f557b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580824, "uuid": "2603d03d-9318-4d58-877b-cade26ae80fc", "comment": "Malware payload (Socelars)", "value": "de6be8d70a1d6739edc1bb788925b5f3c98771e444c72c248fd7ffdf3282fcd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580824, "uuid": "e9b6f574-0391-4423-a214-29425e506881", "comment": "Malware payload (Socelars)", "value": "d0106a1d36f553a2736aa11a6334c29efdf50eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580824, "uuid": "e6b06b13-35f9-4f82-9c50-ece95b1ac087", "comment": "Malware payload (Socelars)", "value": "c5cb147728c88286ef12ef0b4ab7a5dbea66bed2ee5001e98598c76b60d77ffb88768b3d7bc5b4d338e1ee69078793ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580824, "uuid": "9a60995d-7e82-46e1-9d1e-daa8e529f3bf", "value": "T1A5659E11F6429036ECE300B282FF4AFE8D68BA21431854D7E3C46D695E715E37A37A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580824, "uuid": "c6ba3bb5-e4db-4873-af2f-edc3031d7d58", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580824, "uuid": "f390373a-428e-4f42-90a6-54d95dd97c31", "value": "24576:JQAgpBGV2HpWHuREjDnI2AuADZ8KvqC7dH2dtDPc/o/KFcz5g:HgpG57R8cnDPcQ/KKdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580824, "uuid": "e58b3ff2-e577-42c1-b1e9-58891bea5833", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580824, "uuid": "c1eee380-dff1-4073-849c-94c391129ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580824, "uuid": "e5a887a1-eb9d-4a77-a189-2096fc8a849b", "value": "54a7e55a79e9ed5626307bdc126f557b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0efc3d-cb20-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651610202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "2173b146-f539-43f7-8ba1-dbdc6f4c1d8b", "comment": "Malware payload (Heodo)", "value": "927cf4864ae9640e091d5c5cc7a450de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "c68a99ea-118c-4d18-a729-b373f67933cb", "comment": "Malware payload (Heodo)", "value": "de8c56fb4a283f07708361adab2e68837d203f1168812d876edb890291e1804a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "e231d03f-454b-4351-9563-211a08e62395", "comment": "Malware payload (Heodo)", "value": "a069ce81a561dc5d3fa71803585071fa497d7cdd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651610202, "uuid": "32f6bc91-7f1b-41af-a0f3-6353b727f06f", "comment": "Malware payload (Heodo)", "value": "b1f0c279e39dc99e655888b467be0cc38b701cfab50e8b8027e6ebe6402679701ed2bc7970167ad047972edd20631fd8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "2fba9a05-e3fe-4126-b375-38b498ed6e5d", "value": "T103C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "14dd846e-2b82-4e3a-afcc-0ec997d6de5d", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "a6c08161-7f90-4a25-81b3-57298e2a6d29", "value": "6144:JhZ02GdOOgPYbKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfcKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651610202, "uuid": "37c6931d-dc41-4344-ac23-78e55560d2d4", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651610202, "uuid": "a17f3728-9cc4-4cdc-83e6-3a049242992e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651610202, "uuid": "301ca0e4-ab15-4fa9-9906-35895e4e878d", "value": "emotet_exe_e4_de8c56fb4a283f07708361adab2e68837d203f1168812d876edb890291e1804a_2022-05-03__203634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30c6d2a-cade-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651581891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581891, "uuid": "09b503c9-46e1-4d03-ac98-3b33a721d861", "comment": "Malware payload (Mirai)", "value": "d2a8bce38cb6c03d2f3dc600e83686c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581891, "uuid": "25c62f78-856c-4835-a6f3-215cf2f29aca", "comment": "Malware payload (Mirai)", "value": "deaed977808a422cd6530ff209738f9307e9b466054d3ce5f012a2c1cd02c108", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581891, "uuid": "e4fa3d61-94f8-43a2-b029-899ca61f9db3", "comment": "Malware payload (Mirai)", "value": "c6d35fdac8493cbb13ebb4ba7be8ff719f7500d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581891, "uuid": "4c878c6c-6225-4b5c-b604-c6b0d851c311", "comment": "Malware payload (Mirai)", "value": "a68214b1c0c9aa023d84ef08155bceaa626675da7f04d68442e15ef47198d9eb4d0e76d7d338862951ace6a7a282dfc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581891, "uuid": "bfd53f5c-13bf-416d-9859-419de880def3", "value": "T159E34C46EA808E03C4D61776BAAF424A33239754D3DB73068D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581891, "uuid": "db3bfc33-287e-4244-b4b1-0fc2af468bb2", "value": "3072:NRR6WEjnOKwaVDV2uiGUD/vzdMvEi3cxgM/9yD+Sf:/MdznwaVDV2uZUDhQEi3ceM/9ySSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581891, "uuid": "773d4501-6d15-491d-b51a-3e03221f83f3", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581891, "uuid": "21cdcdd6-7993-4b2e-99ca-d5ab1a8a23d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581891, "uuid": "70dd4842-db0b-43d8-87d8-5c0f2dba2c23", "value": "d2a8bce38cb6c03d2f3dc600e83686c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5f4d1d-caa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651555060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651555060, "uuid": "eef53517-249e-4340-a50e-30f12dd37ec6", "comment": "Malware payload (AgentTesla)", "value": "6eb52f23b5fcfb6ecf19784576de6a76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651555060, "uuid": "d5b078de-ab41-43ed-9e11-f4031aca3591", "comment": "Malware payload (AgentTesla)", "value": "dfeea21b02ac4ae062e090cb4d22e921b572db69aef76bb26b7fc9477628f3ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651555060, "uuid": "08e12837-364d-4833-8618-8c012540e068", "comment": "Malware payload (AgentTesla)", "value": "41c7ec0568ea2f2b658ebb58c35a808e356af5b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651555060, "uuid": "686e41f1-4668-4f30-8f3e-9896c3b5c1b6", "comment": "Malware payload (AgentTesla)", "value": "d8fa06ed9aa0fbdac50a6927f9a4e1d8c54efdab6e5a2e0307f68b6182f671109e37d1d72aac1b91746525a12562df26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651555060, "uuid": "41dd56aa-6f11-4d3b-8c60-3fc2e3473e2f", "value": "T155F45F9B351CA1FFCE36973E45580CD491B02C6A429AB20347772BBCC93D4578E1F9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651555060, "uuid": "d4d071d6-595e-421d-99fe-6228eb552652", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651555060, "uuid": "40123d60-352a-4512-8db0-f2d8f273648a", "value": "12288:Mh5RkSdPMGhii4KjDMkmH5x5G7tXLlayoEm+Z8C448qA8h7YpyAgf7TEttF:MTH4JfHtGlc/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651555060, "uuid": "f2a475b9-0eff-4db7-8200-4908c0ff2ead", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651555060, "uuid": "70d9efad-4235-44d1-8bcb-eb1635dbe4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651555060, "uuid": "d41d1f3a-9839-485d-9de5-d96ffb0236c5", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b30c09a-caf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651591219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591219, "uuid": "c2308e4a-9687-44f8-8018-80024e00565e", "comment": "Malware payload (Mirai)", "value": "fb3b4179b05b9cf50d954f561d3a3a68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591219, "uuid": "99d82845-f1d5-467d-a26e-b6f687354d96", "comment": "Malware payload (Mirai)", "value": "dff226f38139bf491140c11e96b0cef543693da5b16078d0154e92b862f4cc0b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591219, "uuid": "7e7fe0a5-da45-4390-8ac5-291f98980b10", "comment": "Malware payload (Mirai)", "value": "5c479c92709b24878919e9b32d0afc113a807a89", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651591219, "uuid": "3173dad3-560c-4231-a29a-19cdf9e44770", "comment": "Malware payload (Mirai)", "value": "dc184deecbf78470251e20314eeefb8e3fc7430a880b14a9420ed827f4d197c1d0ea5832969969fdfacc9c560ebc5e37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591219, "uuid": "8e35db71-6ec3-48db-a78d-2716a5198c44", "value": "T161C34C46EB408A13C4D51775BADF424A3323E755E3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591219, "uuid": "ae1571e7-c814-4953-b6cd-ad0cb8d02ef2", "value": "3072:YSqfkbUZDzrraLe1cJw15lNHF+iL8M/9QWz:YS1bMDX+Le1cJwrlj+i4M/9Pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651591219, "uuid": "3fdae1ce-cadc-4d44-9721-54d4a2d6dc37", "value": 125738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651591219, "uuid": "1fc64df3-fab8-4d4d-8b1c-248f850f4ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651591219, "uuid": "cb4a1d83-39c9-48b5-9872-7062ee8b734b", "value": "arm7-20220503-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf7c2e0-cadd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651581129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581129, "uuid": "e710722c-68e6-4c04-877f-f224495a23ba", "comment": "Malware payload (Formbook)", "value": "fb67faae4d6130eb562c38fc510dfeae", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581129, "uuid": "a67b1a90-9df5-4203-988b-daa8a4e1624d", "comment": "Malware payload (Formbook)", "value": "e0586f6e028448a0dafda2bf958fd9d1d9b63636b29c8a8847e481a3122e71a2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581129, "uuid": "616c6576-2688-4a8a-b1ff-2feb67db9bea", "comment": "Malware payload (Formbook)", "value": "1dde4f5576327e33d629a7ef382c149613f188b2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651581129, "uuid": "5e4950cb-b027-4ec6-a8a2-cdeace4d13fe", "comment": "Malware payload (Formbook)", "value": "a50c3651728a1387ab61f397080f88bfbdbc0557fc8a2ee275925f2354d562e745e74b8abfd5628a518173dd7620980f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581129, "uuid": "cabb4d10-7bed-4f8c-a1c9-77adcab436fa", "value": "T145241208B924D0D7D1919B334A3A6363A7EA7A121178971F13BA5E6E7F33EE1C605703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581129, "uuid": "0eb450bd-32f9-439d-8292-657a1a8cc53e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581129, "uuid": "96b37be6-3af2-464b-add0-b8d5488c08fc", "value": "3072:l1NjcVVnLpPunbYTJCwz0u6yxjjeBMej5xzS02p8KEPc0B3MdvYnSuqZfAvV8Ue5:HNeZmYTJmufjelbzS0fKEZcdvYofAWU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651581129, "uuid": "7841ad93-c28c-4314-ac8b-73ef9ebf98f1", "value": 218263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651581129, "uuid": "a372dc6a-4d77-455c-9c5a-096e20188c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651581129, "uuid": "9aac181d-2abd-4d22-920d-58be4530ecd8", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cac28b-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651563753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563753, "uuid": "517353f7-4bac-4bed-9590-ee870fe248d5", "comment": "Malware payload (RemcosRAT)", "value": "8152f54597bdb3d0c4c859068a5db933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563753, "uuid": "e11eff61-c01e-458c-9979-062c2f9a2566", "comment": "Malware payload (RemcosRAT)", "value": "e2957cb5fb3bc6646533495ea0e907b852d768839e39cd49f362b2cb1ab53df9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563753, "uuid": "7e0562be-e488-4c05-9773-67acb91189f2", "comment": "Malware payload (RemcosRAT)", "value": "68950c73d9690910b0de5423106bb6863b8722e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563753, "uuid": "f8e97521-ff4c-4060-b322-a3acd19abdd0", "comment": "Malware payload (RemcosRAT)", "value": "fa0742eb3542f887a678a8e892c097938a7d67285c40dc1f2b6b63e6ac99aac1f1c649b6e1403fce067070bb433efdbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563753, "uuid": "1bdda736-9fc8-4ffc-be8d-cb3d2e7698b4", "value": "T13394231A506CC28BCAE72635BEFDD92B69FD99310580F87F33509F84B917349840ABB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563753, "uuid": "7c64036c-c08c-453c-b4a4-9616769288e1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563753, "uuid": "37bec91e-9eba-4025-9787-03aa5335a0aa", "value": "12288:lNuUSpnlZLO8eAEmE+3KMwStICpAxn6CwXUhWuq:lNPSZjmtmE+aMwTTnTwXUhRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563753, "uuid": "d0a39afa-7328-463d-ac1f-aaae8d17dea1", "value": 448747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563753, "uuid": "215c52b1-1f1b-44e7-bed1-412bd13761fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563753, "uuid": "0b0e5c4d-1a74-4667-828c-ae19a4cc68e1", "value": "INV#1191189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13deedcc-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585436, "uuid": "8da0478e-a6f7-4c8a-9982-b4ff5a4b645b", "comment": "Malware payload (YellowCockatoo)", "value": "b6e62bce3b8dc79b7bd805ed3c70662a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585436, "uuid": "76be1199-6902-4d32-ab2a-e99739d68b07", "comment": "Malware payload (YellowCockatoo)", "value": "e2a620e76352fa7ac58407a711821da52093d97d12293ae93d813163c58eb84b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585436, "uuid": "db2872b7-8764-4bc2-887f-29596fa534f5", "comment": "Malware payload (YellowCockatoo)", "value": "2f72d663faa836438e88931fb938c7c16f0c6402", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585436, "uuid": "fcb90071-1948-44cb-9027-47ad0b65032c", "comment": "Malware payload (YellowCockatoo)", "value": "e9e8e33819e7341ca211560f3516b70b48a37e0fa9dbb31dac052da7713793b893c84d2bdbb1a7662ff2ae1d594b4034", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585436, "uuid": "e2e73a98-4055-465b-9926-61f86502fc99", "value": "T16F048F11338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585436, "uuid": "eef8b474-698a-4d28-99e7-0fa28e4eca10", "value": "5afec3ec125869702d37f544a28880ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585436, "uuid": "f43ba158-a7c2-4912-afe2-462f26771d6c", "value": "3072:nNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2M:hO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585436, "uuid": "53360ee9-1c30-449d-9cc8-50f59c3ba565", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585436, "uuid": "b370715f-a6a8-499f-a9f9-2464c7390025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585436, "uuid": "60beae33-d82c-4bb3-ab66-47a0d33486cd", "value": "e2a620e76352fa7ac58407a711821da52093d97d12293ae93d813163c58eb84b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c265ef0f-cb3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651621806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621806, "uuid": "3fb1a73d-6603-4b87-b5de-d57e7db74331", "comment": "Malware payload (Mirai)", "value": "31a660884e84ef21e0c1d93c5a385c57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621806, "uuid": "9943ff1b-2876-4df7-994e-75a6b4bd78d9", "comment": "Malware payload (Mirai)", "value": "e4fd3a28134be93d07e2e9337095f330be6aa7dd7f21a3bc23b2fd9c2239074a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621806, "uuid": "e2da75ca-2b3e-46f6-9e8b-82b4aa268dee", "comment": "Malware payload (Mirai)", "value": "d0a1b0c81b17ea167db0cbe3a957d2036c561d67", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651621806, "uuid": "2eb4dd0e-6907-41c9-b85a-84649c9d9f29", "comment": "Malware payload (Mirai)", "value": "5fde59d52381b0ea476c369f74a95100fd07b945877e70d22597bd19c2658924d61eda30f4f2e1d4c788932779317187", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621806, "uuid": "8c21262e-6b87-423a-9a49-70c2078fdbac", "value": "T1FF23F124A4650B72EE5028F5B5AC4647EE512EFCF66E215337F00C3434F9246AAF1ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621806, "uuid": "e17026b3-b052-43f4-a450-cb159df1d544", "value": "768:G9Vq6T00vOWjrhJXyI2LYkQWzDRSlOT9Km8atcdj9q3UELGrHeMM5DFoAhQbis:oq6T0024rhdL2DjCOZKhaEiLGrgoAhQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651621806, "uuid": "f3ddd1de-395c-4381-aa04-6cdc530ea954", "value": 49076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651621806, "uuid": "f0ebb663-a92d-48d2-a941-d2296beadf57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651621806, "uuid": "a25a300a-f117-4ac3-9ba9-1fd74130dd6a", "value": "sora.arm7-20220503-2350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5036a5-cb2a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651614310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614310, "uuid": "faa03d65-82cd-4553-ad16-86a050d9232e", "comment": "Malware payload", "value": "a36d41f2e8210c0da3814b8e9a15500d", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614310, "uuid": "ff19091e-5621-4675-b010-8cce4b722f53", "comment": "Malware payload", "value": "e5c85df9a9b6f84f76c64b41c07a4f52f16a373eae80c713765a5cf43ced3e8d", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614310, "uuid": "491f1981-7822-47d9-8ca7-0ab9c502d26a", "comment": "Malware payload", "value": "e3fba49fd246e3580bca587982a0f9ee820a582d", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614310, "uuid": "0300f6ae-fdb3-4f8e-a9ae-a7b3cd64edc7", "comment": "Malware payload", "value": "83dc292926826e134acf703b079f0b8f119ffc2cbdd84b816f8ae543e752486303c645d6f846cdf3db68ba258f823fe8", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614310, "uuid": "df7422ed-3e72-4d88-96e0-142e2656baae", "value": "T166663302B6D5DDB3C0BB19312D2DD712AE35BC140FB4E67B73E5262EBE7056013226A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614310, "uuid": "10c29ec7-3684-4a0b-83d7-8d1cb120fc07", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614310, "uuid": "c9e13ee8-3486-425c-833b-8a8943451973", "value": "98304:HyBEvyd0JkMzAo/Tsl03kxD7EhHwwsrfYbQa8vCMTXeXgAg:S0JkMzAo/Th0xD7Kts0t8vLX5Ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614310, "uuid": "31ed10b9-5197-4543-9887-49a5576bf55d", "value": 6653298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614310, "uuid": "2c9c6e70-9c34-4b16-af4b-53e06e7db1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614310, "uuid": "74b09823-64cf-43c1-b324-aa83242076de", "value": "e5c85df9a9b6f84f76c64b41c07a4f52f16a373eae80c713765a5cf43ced3e8d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de67a81-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651571011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571011, "uuid": "fd65afbf-80ce-432e-b751-8074d9c40a1d", "comment": "Malware payload (Mirai)", "value": "3edec00a855741b4f11a1a898de4214c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571011, "uuid": "f397bd04-ad68-4d1e-b51e-f5d58ba7136f", "comment": "Malware payload (Mirai)", "value": "e6ed35c2154ef6dca9c4efa17e1498fe85ea7c9e3e425c92f9618e68b2348e28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571011, "uuid": "efcc5a51-3113-4bb5-ba7e-1a4f008ae714", "comment": "Malware payload (Mirai)", "value": "efe9f74a42981299010c1daf2b5370e7ae93f5cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571011, "uuid": "c7fff17b-6e06-4350-b55a-6598b0169d9c", "comment": "Malware payload (Mirai)", "value": "9fc94b1d6a345cb6c60a25ea828e365499dc191b6555baab9130addefc1253ae7e70e1a3f8cbbac8491e77cccafe3aa9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571011, "uuid": "4440242d-056d-4714-9970-be0c3edca96e", "value": "T157B33956F7814B13C0D61779BAEF42453323AB94A3DB730699286FF43F8679A0E13906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571011, "uuid": "d7f06e37-b8b7-41ee-a56b-979dd5f74d9b", "value": "1536:zInU/Lj68zQoroHqohCsxY25rllKpiyRoGYFGiuU4e/B0zw/9Znd4yh://EbqohCsxY5FRonFZuve50M/9hKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571011, "uuid": "2f74854a-44ff-414e-8d5c-4aa1ff267942", "value": 113439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571011, "uuid": "5380c337-ce03-451a-be1d-9d77bd98e431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571011, "uuid": "28c5fa47-b88f-4c76-9f63-0b6fecb1aff1", "value": "3edec00a855741b4f11a1a898de4214c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1528c2a7-cae7-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651585438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585438, "uuid": "3b02670e-281f-4830-99a3-a705f084328e", "comment": "Malware payload (YellowCockatoo)", "value": "6e38fb9f0ca4a4bb2a8dc2b8c5bffebd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585438, "uuid": "5d38dea3-5392-461d-9fdb-a2757eff46a3", "comment": "Malware payload (YellowCockatoo)", "value": "e700bfc17b21ee66339867abfe88625947f8f5b43dd0a174452354677adc270e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585438, "uuid": "59ec392a-8ab2-4135-ae35-51eeca369072", "comment": "Malware payload (YellowCockatoo)", "value": "26f84d7ebefec4dd1b0beeb360aecbc87b1744b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585438, "uuid": "8d3c2171-edd3-4ee3-9543-2eaf92315a5e", "comment": "Malware payload (YellowCockatoo)", "value": "1142865e45ceb21c1d2caed466eac714d6dc3718aa6b81bfe36106f02186859a7d7c271e86fd272f57768b6f60b9df95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585438, "uuid": "44015d68-c6e3-4102-b866-1f8eadc7bd21", "value": "T16C048011338ED792DFAC9AF8B8921330D31450E7C712B35768B17AF89E655A87B042ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585438, "uuid": "5c97acb2-6cc0-46d6-bba2-f09de5f437b2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585438, "uuid": "f24f5cda-56af-4923-8260-95a61e84d733", "value": "3072:QNrTDqVThmYQ5xOxoyaxiC867Z7jxdmcddlM+ywHp51RHnR7Dw55tTpkvJ+R5D2J:MO9wYxsks7Br7RdE3tTpkvJ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585438, "uuid": "4ed4db40-b8bd-4e13-b672-fab29726f6c9", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585438, "uuid": "5c037eb0-fa74-46a1-bb24-9a8cadc6dd5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585438, "uuid": "931507c7-2d23-4fd0-b9b3-7b7dd7fb1cd5", "value": "e700bfc17b21ee66339867abfe88625947f8f5b43dd0a174452354677adc270e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed54cc4-caa4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651556866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556866, "uuid": "8f2edcd4-31cc-45d8-88fd-ced4ede76bb2", "comment": "Malware payload (AgentTesla)", "value": "553b59646fa06acf3c372080d1680833", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556866, "uuid": "0c66f84c-e2c8-4829-afc0-d09cd181bdbd", "comment": "Malware payload (AgentTesla)", "value": "e786a27d69c81b6775a0084dcb47304bfcb15d7677c34672cd4faf9b8e7ecc4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556866, "uuid": "191e8d38-ea1a-4936-bcd9-7a28dba231c2", "comment": "Malware payload (AgentTesla)", "value": "c82fa97faf908b271edfd32767cd7c45166ae46f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556866, "uuid": "521711f0-409c-43ca-9868-f6cfbbfb36e4", "comment": "Malware payload (AgentTesla)", "value": "686614cdf552dc48b4351de476506ec066741abfc715cd2e822b3b381256bb1b89608f369716329c774c7dec6b8fee32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556866, "uuid": "b6025239-7b1e-4fd2-af8e-0aa22bc01a59", "value": "T1AA553369434AE84E34B6C7D6B63CE0FC343E4A56CEB46B30E916231775AC43D859A8F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556866, "uuid": "dbaa34d6-6fd2-45fb-9bec-17e7f37e4400", "value": "24576:np/pQmaihUCCZh9gR59oJEOCVJsy7WZ4cjsKom1YHK3VXeBv:np/W0hUCo9gX9oyOQU4r613uBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651556866, "uuid": "75abbc25-cf2c-4306-9e32-6c42a5184d2a", "value": 1342293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651556866, "uuid": "f9ab3ea5-1f96-41fa-acaf-e6070b048890", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556866, "uuid": "dd6af781-c73e-4d7c-96c3-4a8dc552f12d", "value": "ORDER SPECIFICATIONS OUR DETAILS # 76645524332MCD 267786365.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e5c7f4-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651580867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580867, "uuid": "0fec1881-1ec9-4cd9-b331-8233913b4727", "comment": "Malware payload (Formbook)", "value": "375da39b3b3dc136d7d915b975ebba9b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580867, "uuid": "0d224353-1e18-4df2-8bbd-b46f780d9027", "comment": "Malware payload (Formbook)", "value": "e7dceea9f2d8680dabc0ebac9649188d4b1ecf0191705758eeb949cf7342b6df", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580867, "uuid": "1bf9fa5b-caca-430d-b6f9-0f31131417fa", "comment": "Malware payload (Formbook)", "value": "b630fd528392290a397709ef39c89371b61bcad6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580867, "uuid": "6b8d5ec6-768b-455e-9218-4aa934e1ccdc", "comment": "Malware payload (Formbook)", "value": "f3128c04cc28560cb5daffdb1453e521ae315f4fe20f93b9c6e3a29982af16ae5c237cf9c6376bfbd756230f3f50cc42", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580867, "uuid": "a2cd1b71-f06f-4f8a-a16c-4f3d93a85e4f", "value": "T14985EC31B132BA87C3160561565FBE86531CBE43B2C55F8CA04DFBF82CE6CA69342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580867, "uuid": "57b68f99-5075-4de3-bc8e-7834bb2bea7c", "value": "1536:Mch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bB:cV06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580867, "uuid": "1b785d63-d315-4799-8f51-b4869d644948", "value": 1723123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580867, "uuid": "17cb656e-6a7e-4f35-808f-8a61101936aa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580867, "uuid": "0590d849-3cb1-48c7-b8d6-40817ed1f2d2", "value": "Order 347585-159044-S dated 05.03.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06852358-cae8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651585843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585843, "uuid": "bf8fa409-999e-4623-a0cf-06d382d623e9", "comment": "Malware payload", "value": "c9606e68f6bc314e268b8645e57c9716", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phl-app-hcloudai-com", "colour": "#928A58", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585843, "uuid": "0d31fbd4-7e84-40e7-b03a-505a6cb71e06", "comment": "Malware payload", "value": "e82eb8de42795c84b1c48b6f2d763135bef3aa82e500f035d1f47f079821b237", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phl-app-hcloudai-com", "colour": "#928A58", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585843, "uuid": "394ec118-b768-4e35-8873-da78d32f2041", "comment": "Malware payload", "value": "04603cf8c663b6be65ba9fc4fadba42d910e760e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phl-app-hcloudai-com", "colour": "#928A58", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651585843, "uuid": "29809c02-fab9-49b9-8e44-f8df767f6b9d", "comment": "Malware payload", "value": "0215b1cff3f07d3af8e6e1e78e26956de4307c23d67d66ced1414d8706e491cf1656d9b5cbd212423160ebdbed29b70a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phl-app-hcloudai-com", "colour": "#928A58", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585843, "uuid": "fb0a7ce4-c090-474d-a78e-4dd9b5a95f87", "value": "T1D8B61287F794992FC4B741B3886F1232261B4E05CA839B472D94372D78776E81F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585843, "uuid": "b9b7eb83-d169-44fa-a61d-2925aa46737b", "value": "196608:YqGl8NBSxNtHgzfXLQRPRudeAlS9yGbgEMEfulMaYYye5xG:Ml88NVgzkJodqn838uGalySxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651585843, "uuid": "ee3f2527-3e06-4fe0-9dc0-c79de607f2d6", "value": 10491095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651585843, "uuid": "3f577082-54bb-41c2-a75b-c59d3a1ad93a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651585843, "uuid": "d539bbfa-7090-43c1-afd2-f4c297ac62d7", "value": "CashGo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7a8358-cac7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651571845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571845, "uuid": "4a168740-d101-4b56-ac7f-8638db0850ec", "comment": "Malware payload (Quakbot)", "value": "0809f8136b39b711f8d8abe773600be0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571845, "uuid": "5448e8f6-3775-4066-a370-2c455c66f0a0", "comment": "Malware payload (Quakbot)", "value": "e85c3d74bd674383230c752ba6cdfbd49ce03e324c59ee72813211bfd8cd90d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571845, "uuid": "a743b107-6ba2-4f41-bb0d-1dfbb9859aea", "comment": "Malware payload (Quakbot)", "value": "de27b4d48a1e49126defb438e0e20b7f2b4a090b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571845, "uuid": "0c76953d-d1d6-4271-ba9d-d5d430635ba6", "comment": "Malware payload (Quakbot)", "value": "585fba0de87de416f1885b8247f6855aa92c95130c8d2bbe2d9d3990c54e7f39cdcbf31cfded73cfc7d0e5ab987c91f5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571845, "uuid": "1e26a38d-c9be-447d-94d0-ec305b429f9a", "value": "T19045121380447432C4E5557831485E62392B78EED039BAE88FDB16FE3B591F9EE399C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571845, "uuid": "4fd765dd-2e81-4a87-81d8-00daafd39d8a", "value": "24576:UhniG0mdDHrGZRjIo21FXm5Ob1mZ0MriSo+fTA50MriSo+fTAx0MriSo+fTAA0M3:UhniGbbqRj2185ObMhS+f0S+fqS+fxSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571845, "uuid": "dce18242-401a-479a-9e1d-5eced3d20904", "value": 1260112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571845, "uuid": "69e7ac99-f3ef-4e3b-b21b-a94c7dc91034", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571845, "uuid": "63971640-3a6c-4c2f-a668-2a834e331ef5", "value": "e85c3d74bd674383230c752ba6cdfbd49ce03e324c59ee72813211bfd8cd90d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664ff3ab-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570971, "uuid": "c070d932-51ed-4799-a8e4-342e202a738c", "comment": "Malware payload (Mirai)", "value": "c8ebaf191ee3c4a611a9c3b6ba6686c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570971, "uuid": "6608b403-b617-4997-bdb4-1aba01d68e14", "comment": "Malware payload (Mirai)", "value": "e897fea399fc2d83a4ddffb09d6e2a30a85c5b446af0aba7a489f9867ee1dbd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570971, "uuid": "02c542a3-6aac-46c4-a183-b1589db81c71", "comment": "Malware payload (Mirai)", "value": "6b814324158f56873b6f7d2bc51dace3f34c22be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570971, "uuid": "1c786abf-aebc-46a8-9fb6-717a7b4b4730", "comment": "Malware payload (Mirai)", "value": "9c3d5a639639842d28198d9e00f2b65759a75b9a22ee2e4dc361fc9f1186a30fce8eb7230497de582023cc621da7def2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570971, "uuid": "f8ada1ea-285b-4538-87d2-5c1e5f4dc563", "value": "T149E28E75E4266E88C18A42306C689F741F23D0C5D3632EF727A446B65447EADFA09FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570971, "uuid": "7f66aa6e-d329-4dc8-b13c-3d7cf762b6b5", "value": "384:9asDbKDbfrvZn2I1gEiOMkKkLs++n91GxB7Hk6C0Jq5TatG7hODo6bT8/G4qBmPa:9apLrv8oiO1Lo1zGxRFCio6bTkrHxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570971, "uuid": "337c0f3d-3e84-4b01-b7fc-11f0e7e6b53d", "value": 34088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570971, "uuid": "0b4be5cc-b702-44a0-839b-f615820f370e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570971, "uuid": "f02f5061-7c12-4f5a-882e-90746e2cb146", "value": "c8ebaf191ee3c4a611a9c3b6ba6686c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda07179-cb2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651614604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "e15747ce-dca8-4d14-9d1d-cdcba7278fc2", "comment": "Malware payload (Mirai)", "value": "aa3bd08fc310eb7f4c3df703ad2ccbdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "85294256-4761-4736-a9fe-43d6128f803c", "comment": "Malware payload (Mirai)", "value": "e9f2a27a154d7d154ffa57e31f4ebfbe9d85cb25286e16783307edb112cdcfed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "4f3eb739-5299-4de1-9492-6ca2fbf3055b", "comment": "Malware payload (Mirai)", "value": "07d24ab3e7c4d609e899e922fe3611b09f550779", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651614604, "uuid": "a40663b9-4fc8-449f-ae8a-ab3e2d49fa57", "comment": "Malware payload (Mirai)", "value": "4cab5888df362751f17bf692686bf155bac817a5a2d04b8549d6cc7fee23eb382a54aa4e1f739b64932dd12e375ae461", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614604, "uuid": "310422bb-3a4b-42a0-af2e-2bb43f069840", "value": "T1C2435BC4D9CFD8BDE952097321675B728733F52E2199EB86D39CA523BE03611D11B28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614604, "uuid": "b2784e59-331f-44cb-ab82-d95e665139dd", "value": "1536:3RnGtio4elAv3AAwtURHwq1NWMU0uHT6UYS1:BnGtioHcPwMHhNO0CeU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651614604, "uuid": "c6423560-c12f-4fa1-b461-b04300f1d1c1", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651614604, "uuid": "45a87a80-a552-4af6-b521-a71c5c5e908b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651614604, "uuid": "25844224-bda0-4721-9c62-d9509dc28051", "value": "Cronx86-20220503-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d69aba-ca80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651541174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541174, "uuid": "a7cb9f53-c282-4e94-89bc-68adb8dac1b0", "comment": "Malware payload (Gafgyt)", "value": "be41fe4f7aaddba090e397ea9b8c5a38", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541174, "uuid": "0686a66c-734d-4651-ae9b-1b44620dd449", "comment": "Malware payload (Gafgyt)", "value": "ebd8df0b4c343126c09ffbd032cb9173b2924561ad5dcdf8d841de987cab0ee5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541174, "uuid": "bfdf42a3-5b92-4c8c-8426-d9055c9a4f5d", "comment": "Malware payload (Gafgyt)", "value": "d3549e38fd1cf0dad48a2686c34e36e856c86d14", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651541174, "uuid": "6305f7ce-69bd-4425-bb9b-3dd03e4a2e8f", "comment": "Malware payload (Gafgyt)", "value": "770342ca53ca4438d483934568d8027449ee18decfaf73a1c4b8142c22e72609cb8837c0da750f9c282777ce5a8cc3a7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541174, "uuid": "343e01bf-feeb-4d2a-86e8-afcbc30415cf", "value": "T1AD13029281CB4D2FF8DE00390D47250D5CA4F29D83FD65DDAB99B53AE0B0B245CB5BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541174, "uuid": "0c86ca02-5be7-41b1-9edd-82ed49df97cb", "value": "768:BRegVWQhtKH5WAVUIUDVw4QFKh658inbcuyD7UWyqELEG6w9wj:LeMh4X1MVkc658inouy8NqRGvwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651541174, "uuid": "d6068512-4760-4bd7-9511-bf1fb51b1fce", "value": 41700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651541174, "uuid": "ad39c45d-4f9c-4033-9819-e080142d406b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651541174, "uuid": "4c939354-d513-466c-97b8-9f89316506e8", "value": "gummy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b07119-caee-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651588665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588665, "uuid": "06edfe2d-56f1-45b0-a4fa-41c6c409091c", "comment": "Malware payload (AgentTesla)", "value": "79e69e74a2343dbbbfe1d7508d414c52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588665, "uuid": "922134b2-b530-4bc1-a7d3-6e5820b69b7f", "comment": "Malware payload (AgentTesla)", "value": "ec02b1eae63869af607bb857c14bfdb7d0acd823e203be20aa9e6e5874b6ecf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588665, "uuid": "55bc9685-a603-4f4d-adc6-53e6a8b0be68", "comment": "Malware payload (AgentTesla)", "value": "7c50ced940fad303490902efe6f19417497d5193", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651588665, "uuid": "88869b62-57e2-4efc-ad54-e4b4fd4f5491", "comment": "Malware payload (AgentTesla)", "value": "a9c2a438daffb1336919a8710237599ab5c124f38bf88db7aee63c63580e56d7e075225b7185f98c29e90b2724449516", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588665, "uuid": "86ee89a3-bb03-4275-8f15-5fe80409abcc", "value": "T149E4F090BBEACF91D39A0A33C0D75A044B71EA23E103DB5F6BD561D50D0376B8942B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588665, "uuid": "1d2f12c6-6e80-4f6b-ab92-e1baa30c3128", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588665, "uuid": "07440232-ef08-44c9-bf9e-1159012079af", "value": "12288:st6LWJe9A7qUl4xT+LqsD35+fjjqTPJCZZcOYd8ajVU:8+Q9qUl49+2ZZcr8au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651588665, "uuid": "6c01e8b2-5f88-4e40-bd1c-cc6125bd6dac", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651588665, "uuid": "f948a08b-0711-44cc-a4a1-86d40239a17c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651588665, "uuid": "7984bf90-c1b0-4d44-82e7-2d632c80234a", "value": "MV SUNNY FAITHPORT & PDA INQUIRY_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa989f5c-cadf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651582253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582253, "uuid": "ec41deef-4390-4406-ab7b-607909893084", "comment": "Malware payload (Loki)", "value": "d7b9556c731bb9e9a234c074777026f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582253, "uuid": "600be08d-ae7d-45a8-b142-74c0130935bf", "comment": "Malware payload (Loki)", "value": "ec68e4a53a49acd215d52b8b85b809c5fd1acb318e1cf9673806ff3d6b57f478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582253, "uuid": "fb5ae07d-595b-4415-ba65-68e3e6b6991f", "comment": "Malware payload (Loki)", "value": "0d9bfa790298755bf06b13227a9d771483ce2ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582253, "uuid": "cd20b25f-ccaf-4260-b2b7-6824f06ecde0", "comment": "Malware payload (Loki)", "value": "bae50bfc1d77348198ba7473b5c967d40925ca877cb724b002062ac7a10f4ca4ad3c32753a00d8e19f4b9b8aeeb2c826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582253, "uuid": "a1f32d23-c1f2-4452-b838-d2936e89bacc", "value": "T1B9C3012463B1D4ABD8F30B31197A6B62BFE596311070471F5790DE8EBC61282A90F7A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582253, "uuid": "7a259edb-673c-40f7-b891-89533a7e05fd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582253, "uuid": "e1bd3662-25cf-4454-aee2-0ef9af6407ca", "value": "3072:l1NjcVVnLpPunbqCnItDJ5eDQzosscodsO/tx:HNeZmzItl5e8zpscoztx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582253, "uuid": "6c7e2f73-1763-4e30-bdd8-cf9c06cf3217", "value": 125845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582253, "uuid": "2f673929-d543-4bc4-be25-7e6c6f6de840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582253, "uuid": "503dd875-0936-4ca7-a4c7-638f6c812377", "value": "d7b9556c731bb9e9a234c074777026f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c92beb0-cad6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651578337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578337, "uuid": "3dd54c5a-cb88-45b4-885e-9a3a270ae8af", "comment": "Malware payload", "value": "fbb0cbfcb4088b3afd1a838610d8db24", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578337, "uuid": "f1c80a8b-93e7-4c46-bb11-321c1c48e3bd", "comment": "Malware payload", "value": "ece08f894b1afd947cbfc57c75da1d6b41a9fab8837b41f5cd7ed18e70adf2d8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578337, "uuid": "89211201-db84-4e3e-aa70-086d8cfc58ef", "comment": "Malware payload", "value": "5f92deda3834cbdf03f889ee361a97672cc87bf3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651578337, "uuid": "0eaf73cd-d881-4bb2-ade2-9aeaa5270307", "comment": "Malware payload", "value": "a94d441d86f448f66236a8acb1efd2b60b6f39ec2cd6133d5a967f0dd22032418fb64ebf77ae35d9fefcba9dacd4af86", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651578337, "uuid": "1029d056-5116-4168-86ac-5aafab44359a", "value": "T1AB2412853BB7A986C0F2C73D2854673ECB6FCD4959CEAB77E905321E00727114DA21EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651578337, "uuid": "1eff70d5-0d2d-437d-a156-38debf67df54", "value": "6144:/sIrQWsK7umEtzETTMBpBwCwLq8lFwfSpgZi+BjUwlSnpR7:/5rfsK7u1tzE6pBvCnwf/Zi5sSpR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651578337, "uuid": "97b2211c-e51f-480a-b955-1cbc3030b0cd", "value": 210808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651578337, "uuid": "ebb53a7f-6772-4540-87fd-7f591e50a8fb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651578337, "uuid": "054338a1-e3ac-40f3-839a-916af843d45d", "value": "Nuovo ordine _WJO-002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d282070-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582659, "uuid": "b0234fe7-8d15-4e07-8bb0-e2aa48a09354", "comment": "Malware payload", "value": "fc7d032fe56e88fcc416a7fcd36813e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582659, "uuid": "376fa256-37a5-4a61-9414-15a6b156fd76", "comment": "Malware payload", "value": "ed1ad245841b2a5330409880070109b3028600bd9552670b2276b58d635fccc7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582659, "uuid": "694d301a-4ea0-490b-8436-d9039a291ffa", "comment": "Malware payload", "value": "4863866a7ab6866de14d376cc3041ea0ea1e7172", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582659, "uuid": "8020ccf1-1c1b-47c9-ba78-643da2534d01", "comment": "Malware payload", "value": "4838fd229f6fa6f2023974eaa6204f9ec0d7b5e4ce0333f0f1c8020f9d622b40a4d0c06e2ffff2c7022151cfda59173f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582659, "uuid": "89e4289d-a4c2-4d74-b0ac-11905e116829", "value": "T10F348D017591C433D5BF05305879EB6219BCBD301B65C8EBB3D8AF7E1E706C22A36A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582659, "uuid": "72a2c94c-0cec-421e-94f7-e8d0f482aeeb", "value": "64e76c82ccc68a4a09c16bc706d5fa09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582659, "uuid": "165ef8b8-ecdf-4fbd-8978-7d9d5d5b06f0", "value": "3072:W6PqZo0vx9/0cZQGRvGxPx+8KmbdekRLsLPWRiAg0FujDW3qD7Oq96lNeof:BPEzvvZQGUmmbdeeUAOfIqXolAof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582659, "uuid": "c7076dfb-1c27-465e-8acf-43292f04f75e", "value": 237296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582659, "uuid": "45c1ad12-4fb2-44d5-bee8-d7a9e8706456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582659, "uuid": "8125257f-1f98-4601-8fd1-b24c453cf925", "value": "SecuriteInfo.com.Adware.Softcnapp.124.14109.658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abc3bbd-cab5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651564053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564053, "uuid": "c789ee9b-72ae-482d-9461-2b9dd114bf62", "comment": "Malware payload", "value": "482d774a4d650f6211c584212c61c1c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564053, "uuid": "8e5b3151-382b-4a13-bb15-6a8bb6dee967", "comment": "Malware payload", "value": "ed90c624a45eb34504e1e21f9f9818b298e48ac257ef7e91d4522448537da4ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564053, "uuid": "fc118a04-36ba-41bb-ac22-d33b44b6bcfa", "comment": "Malware payload", "value": "650c225d4b37c51864e61381b4bad17890929bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651564053, "uuid": "c721b56f-657d-4c24-9e2c-903880d0db57", "comment": "Malware payload", "value": "e147faead751496e25c5ddc4ec68e91e9d0d43d3d76feb12132c553068042a9f3d08d98ce9b55a03d4ff61d8d00b056c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651564053, "uuid": "4a117ea2-3243-444c-818f-47841cb6d6e6", "value": "T115C4230443E7C731D7BA32FA91E62292A3F677043112E3C47D6EB5FC16A379A4456E82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651564053, "uuid": "e2dad0ef-9b7d-4f5e-823b-cc44e207a93c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651564053, "uuid": "1b6112df-cbe4-48c9-b5a8-2c2610cb371c", "value": "12288:oye2L2I8qbGyAxqfC40yYEWDQqFV3bXJenbNDUPxCWEwilyRl8vL:o32QCC9yvWBbXJenRD0C1QRl8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651564053, "uuid": "55b3603b-1c7a-42a2-8678-ddd554b35eee", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651564053, "uuid": "3d7a19c2-e009-477c-9364-cd9ba93cf20c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651564053, "uuid": "07b2f8fd-26c1-46bf-8328-8584bd1d0c0d", "value": "wire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12cf4f5-ca9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (GoBrut)", "timestamp": 1651554373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554373, "uuid": "17111981-99bc-4c24-8e83-a31d864d874d", "comment": "Malware payload (GoBrut)", "value": "04d1febec264e401eb186eff8354bf64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554373, "uuid": "f1a49907-1a16-4a72-ac74-7b2ed309ceb3", "comment": "Malware payload (GoBrut)", "value": "ee0995e24d78b36a9d6795318f8d28f9a558a8a39d72d28c2948b85213ed0d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554373, "uuid": "23e9b9a9-7955-464d-9098-18bcf9c45f43", "comment": "Malware payload (GoBrut)", "value": "84ea3f759a2d67dd1bfe46f0c2bf448930a06726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651554373, "uuid": "3aad1c15-ed5a-486a-88e5-d02f3fbfe4d3", "comment": "Malware payload (GoBrut)", "value": "7a83e5e9f6658969d86197609ffc27792063c851b896bb867d0de12f325c82a950b310c7d88ea91c47285162b744120e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoBrut", "colour": "#2A5140", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554373, "uuid": "7e83d1b8-cab9-4ac5-ac58-403dab6c9b89", "value": "T1E6864B1BF8A614D6C2FEE1708A965222BF7134A5C33137D76F9086951B66FE4B93E300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554373, "uuid": "04b1e7ba-b824-4f35-8d01-6efa85e44c83", "value": "98304:8bQUVZFz/Mg7nht3QFL9eKyBi1y8eiUlOX:InFTMyn/3QzWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651554373, "uuid": "c2edd28c-d583-4b5e-8f87-b37cbf2ebe72", "value": 8607584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651554373, "uuid": "0f29d10b-239f-4d92-9db7-abf8f081c4d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651554373, "uuid": "538c6289-b66d-49e5-8d53-9341d08fc649", "value": "ee0995e24d78b36a9d6795318f8d28f9a558a8a39d72d28c2948b85213ed0d36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2792d3d-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651571072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571072, "uuid": "6593557b-5aaf-44e1-a091-f33dd4471319", "comment": "Malware payload", "value": "a216752a201bb2fdc03a448eafa19506", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "telegrambot", "colour": "#CE7291", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571072, "uuid": "eab31bbc-a333-4b58-882d-8b4af30a311e", "comment": "Malware payload", "value": "efb64aa7b017d739f6f626d6cb2e85c6f226cc4b87e6a513186a25804e6ae46f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "telegrambot", "colour": "#CE7291", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571072, "uuid": "cd56ad90-1b44-4e53-b33e-76d51759b38a", "comment": "Malware payload", "value": "8568f08745b7a8881366890d37ee73a050986bc4", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "telegrambot", "colour": "#CE7291", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651571072, "uuid": "56a35cdd-b531-438c-a262-9ef0be8845ea", "comment": "Malware payload", "value": "7084d6da8aed44b558079cab28e5e514fc5aaa124823566a530e52c2133cda01a71ed8afecdea4704ca582c32ca29107", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CockyGrabber", "colour": "#F512D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "telegrambot", "colour": "#CE7291", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571072, "uuid": "8169bb7c-bdb5-47c0-bdd7-172c370810f9", "value": "T1E2E1831167E81A32EABB0B76E8B752509239FA119953DF5E2485260F2C2B7014E23F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571072, "uuid": "5363bc98-3665-41bd-9135-92c02195681b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571072, "uuid": "d9a1e412-cdf2-46f6-bd5b-b15005da8acc", "value": "96:RTODAL0UyWIaYv8Q+5mX/E7lOSQlbKngNrlTa7sB4epEzNt:Ry8gUmaCd+p7kSQMkha7sjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651571072, "uuid": "608a4da0-cd8a-4c1e-ae87-dd028fba5d6a", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651571072, "uuid": "eedc064f-8527-48df-b3dd-5d617d7949c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651571072, "uuid": "4421b038-19c5-41fa-8eb8-038b70809049", "value": "ConsoleApp2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8530c36-caa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651556559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556559, "uuid": "7ad3114c-fb7f-4916-a59b-0f88ee07e8c9", "comment": "Malware payload (AgentTesla)", "value": "7d539ba77021478fbb719cdb246ca94a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556559, "uuid": "8caafb18-b43c-4b39-a297-6b0a519a0348", "comment": "Malware payload (AgentTesla)", "value": "effb48e03ebe8d882e4410c2aca3c1a315bd1bd5210ef85b834a30ddc8b6f1f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556559, "uuid": "24039e07-b69b-4430-ac80-b640b6379f15", "comment": "Malware payload (AgentTesla)", "value": "89647b2167a34d6f2a878bdcc9195b48df7e004f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556559, "uuid": "4fdca698-1d82-4162-846a-2bbb968afd18", "comment": "Malware payload (AgentTesla)", "value": "2c0963754e1482d261b2b6c2f74a4a7565cbfcb514015cb215b83316eba27c9a6cdd2a6637e21c4ab3fc1e7dcc89903b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556559, "uuid": "a554549e-f9a8-49c1-b23c-c936a209feed", "value": "T1DA45D0C2B655A40ADC9495BE7B66C5B5336C6C5A6409AF9CF5C03F8B3A3E016D2303EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556559, "uuid": "72701a82-e1e3-4591-9ce9-d17465a5fa67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556559, "uuid": "ffb5524e-aa73-4e59-ab52-42ba8b73ea94", "value": "12288:J3bbJEMayC9f4yH3pjovP/W1+Urz/V5v+toHJobVlR:J3Nay8f4y5joHO1+Un/rJHYlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651556559, "uuid": "5637c57c-1b4c-49c8-9b32-05e4caaac429", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651556559, "uuid": "a2f791b4-498e-4ab9-bb67-bb16d5076172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556559, "uuid": "a586e8ab-e797-463e-8ef7-bc3a3b590410", "value": "Y1040-2+Y1048-2+(NZ) INV-PL (JAN-19-2022) - Revised 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9140f87e-cad9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651579633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579633, "uuid": "0a71e6eb-6221-4c90-9eb6-4a844f7143b9", "comment": "Malware payload (AgentTesla)", "value": "21b4db426ecc89c5f16e49c9709ad5bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579633, "uuid": "7d7df0a7-91a4-4a8a-a421-2110731b8d8b", "comment": "Malware payload (AgentTesla)", "value": "f2516501441770d9e14ea31a2d86473cfd58d6a1282bdfc92b067229f620db4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579633, "uuid": "d4dc8f24-7506-4246-b0a6-dee4c81781c0", "comment": "Malware payload (AgentTesla)", "value": "fe13fe39cd568d9d1432206f6d9fc7928924f811", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651579633, "uuid": "0b4899fa-c697-4618-a7aa-584a344af805", "comment": "Malware payload (AgentTesla)", "value": "9bacb09a46542595fb8154340074b2161936b7af3fc7d52365a01ca65b21f3923c98a245ab8d5b1a2191ee3284189f79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579633, "uuid": "7b94b70b-5b6b-4c1e-9ffd-15a5d67915b8", "value": "T19C63F11A7B4A9F34CBBA4BB3CD97884B457CEF9A4723972C34A4053E2F135058A12B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579633, "uuid": "30b9d46a-b056-4644-9748-c5834049a958", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579633, "uuid": "1e7d6ae1-de82-4d09-b797-6eb78dd6c32c", "value": "768:bk4L7WSqqNMub61I9LKSVddB1wCwxCcHsPnkT97/U83rn/+ubqghqadH2zBhdbwz:ga1YWLK2wXAP4d/xnugHWDdbyT1dYAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651579633, "uuid": "42e14cff-5a58-4e69-8fe9-12106c999f85", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651579633, "uuid": "90d5bf7b-1b4e-4953-9475-1727185573b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651579633, "uuid": "554df2ef-fcc1-4e4d-ac54-e95356b56243", "value": "( StmItaly S.R.L. Citazione ).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255b11e9-cab1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651562272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562272, "uuid": "f7e2de15-f1c8-466e-85ec-40dce116f99b", "comment": "Malware payload (AgentTesla)", "value": "32c88c5ba0949420aacbd09738bb5807", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562272, "uuid": "e3428344-9b34-4234-9462-e4b02aa6cfc0", "comment": "Malware payload (AgentTesla)", "value": "f2606f4a05bcb3e8c8aac6eeb3a8a1a3104b5e7897dc7cce06aef009100ffe44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562272, "uuid": "ad98e755-3943-407b-b4e5-e581781d06a3", "comment": "Malware payload (AgentTesla)", "value": "3c38c484139261db5970a2f7b8ced658830dba7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651562272, "uuid": "4a41052d-6ec5-4148-8080-a928e5c90256", "comment": "Malware payload (AgentTesla)", "value": "d8192db46debd702ec4ff2786e6f2d5ff9be223bc67bcee0c0f282188d880c60ee333113a7292c6dad71905bac40897f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562272, "uuid": "a26e3bec-a9d9-4e93-ba9c-c76424f91259", "value": "T10322081667948B39DDBA0F364CA366901339EB42B466CE1EA890102F6D73340CF73B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562272, "uuid": "92a884cf-773a-4c83-9f81-137fa8d9a291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562272, "uuid": "d27d278a-e312-472d-be47-65b61b5a42c9", "value": "192:hX27hg6spGYIPRGzfQ7hHeCCI5ibZypJYhepfBppqpp2WWz83RW1:hX27hvsqqY7RPsZypJYhqfxWWz83RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651562272, "uuid": "df020259-9f26-44a5-b673-d1491f384331", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651562272, "uuid": "4f0ebbbf-c9e1-4544-ba32-72c71f13cdf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651562272, "uuid": "8bc34002-332e-43ed-87fc-6758680e4ae3", "value": "\u65b0\u547d\u4ee4___xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7158ee78-cb34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618664, "uuid": "5f750ed6-9fa4-4ccc-bdad-71fc520f3f23", "comment": "Malware payload (Mirai)", "value": "a1d172ab6bbf0c1e6f48418a69ac655d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618664, "uuid": "d9a8282e-ea51-4a4e-ab58-0e5a641939cd", "comment": "Malware payload (Mirai)", "value": "f35737439f7712f37ffd2184ab1d4585f9d6cb0a8e384c9fdd7e5dd04773043b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618664, "uuid": "425ce860-363b-43dc-8427-8e2927260264", "comment": "Malware payload (Mirai)", "value": "63ded31825cfcfbff07bd24b9761911e924a9a7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618664, "uuid": "10b6d6f2-d035-42c7-b215-6bcfc6a93eed", "comment": "Malware payload (Mirai)", "value": "f4246cce8ddfa82ff30b9f56a5b1e32cf7cfe0f466a3c313d43e751c1c8844e94450a569141aa7f518d1fd4db3677eeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618664, "uuid": "bc97a859-9992-410f-a411-df53dfae7260", "value": "T13CB32C56B8918B11C5D622BAFA2E058E331667ECE3DF71139E241F643BCA42F0E37945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618664, "uuid": "2def2168-0546-478b-9538-a6ab431d650b", "value": "3072:naN8Lm9nAhiJJsHff4K9u+Gpj0/KRGCKvj:aN8Lm9BG/tARGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618664, "uuid": "3f667806-d398-4c0a-823a-b05fd0c910a8", "value": 112484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618664, "uuid": "b17c93b7-f1ea-42b5-9823-dffaf5a75ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618664, "uuid": "1a4164d9-4c1c-4c25-87de-b825b9fab5cd", "value": "a1d172ab6bbf0c1e6f48418a69ac655d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae7ca67-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651563677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563677, "uuid": "c351bd96-a69d-4aee-af9a-fe67e5fb0b0b", "comment": "Malware payload (AveMariaRAT)", "value": "cbecc4ad3e929172705f4407ceece1a3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563677, "uuid": "486376aa-93f9-4e80-a5b0-5340b37e9753", "comment": "Malware payload (AveMariaRAT)", "value": "f366cb892570b264ce73bd7c818ee214f0e5f00dc008a4dac5fa5cdc095ddab7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563677, "uuid": "ce41c5f3-5bdf-4ddc-a95f-4e9e9c89654a", "comment": "Malware payload (AveMariaRAT)", "value": "c6e44e98e1686ebe421b1fbf3c0cec9a1d14b510", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563677, "uuid": "d3882374-ba70-418d-9846-2145ec619562", "comment": "Malware payload (AveMariaRAT)", "value": "5ed03238008d3b441c62c283fe1537742e49ce973fcf93bfb7bb088557ec22e82c49dfd4f6502c81f7693ea04265bafe", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563677, "uuid": "0099928c-9862-4e18-bc24-9f0cf35f65c6", "value": "T13773658261444632D9640DFF896873CD0E6EEE074B269595A43F7EF9BCB21808BF9347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563677, "uuid": "6708afdd-511d-4390-876b-054821c96c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563677, "uuid": "54ff24a0-24df-4d90-850f-1863dc889f46", "value": "384:K8cJ3KcPO7I59znD6UYTx8fU0SI22rscNO8M9dLTceCjpIhppL:K8cJaL7lWSIHTe9dLTdpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563677, "uuid": "e1c31fca-f6e7-42fa-b807-60638265547d", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563677, "uuid": "018d4179-8b13-4c68-8a9e-dfe1c7640b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563677, "uuid": "f145b5f9-9871-484a-b379-e1ff2d9d0d31", "value": "STATEMENT_OF_ACCOUNT__SOA_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984db5e3-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622165, "uuid": "6a549151-0d01-47be-a747-5d72fcf3b46c", "comment": "Malware payload (Mirai)", "value": "65ef08409e17c98f520723636fd12a80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622165, "uuid": "03f27de7-96ec-4676-b456-73c0a6dc2f25", "comment": "Malware payload (Mirai)", "value": "f3c876f38b7f58894440238f15859fad5852653e2c1f473f0935fd4c24e618c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622165, "uuid": "fef07f13-15a5-418c-9902-600d8b251c27", "comment": "Malware payload (Mirai)", "value": "0a91c502b63f25b02e0ada936df3a68d152b5bd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622165, "uuid": "fa659637-4b1c-4415-9190-8e0d9023d5c0", "comment": "Malware payload (Mirai)", "value": "26ba5ec5e6e5427ced2140a5f65dc7ca3f461767aab8020078372630d3073f24f6eb6ef212cce973e5ba35a3c8e85e59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622165, "uuid": "13f97075-18a8-4809-9311-2c6544c6684c", "value": "T15B934CC0B683D4F6DC02467430ABEF329E7BE9FA111AEAD3D3E89E736855411840799D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622165, "uuid": "86ebb679-2e50-4326-b2c8-8597227ba8a9", "value": "1536:iXa/rr9OvWh90v858JhT1m3bNAatbsL80iAkzpftfRCKFKEQaXDLRK7:4ir5OvWh9h58JO3bia9sL803gpVfRbUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622165, "uuid": "de75e17c-f8ef-4dfb-b4a4-c10b3b01a157", "value": 94292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622165, "uuid": "3ffb514b-b9c0-42ce-a115-2a80ed730784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622165, "uuid": "da86e1be-d96c-47a5-92c5-f82bcb197aa5", "value": "65ef08409e17c98f520723636fd12a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e305d5a-cabf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651568407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568407, "uuid": "b14516b8-1d10-4e0e-83af-fcdb11b79e2b", "comment": "Malware payload", "value": "4e95a0c83ff39959a808c17023787acb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568407, "uuid": "3eb993cd-ad8e-4675-ad37-52be278b560a", "comment": "Malware payload", "value": "f4176f8a0510484447b585cfd803df0b7b2e25f22dcf797011a985d66b33d60f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568407, "uuid": "8f45e847-80b5-4f9a-973a-e485f52a4bf8", "comment": "Malware payload", "value": "26dcdc363a4b6e6a6cd6f05650099374cff9db68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651568407, "uuid": "53ea31b9-d952-459f-829b-33d64d286049", "comment": "Malware payload", "value": "e6f69de5e219adff1db0b22865bd8fc004ff1a36e0acabecefe6cd5f050b43bfa430a9c92ba382016e11fcd52f133080", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568407, "uuid": "665393bb-73ec-4ca3-ba3f-ced0f4f457c1", "value": "T12CE2E121D70669F3F7F10CF33AAAC20453E675BCFE0376BA981A5378E493006567594A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568407, "uuid": "9f1afe53-de10-4017-b2b0-1a7737210940", "value": "768:bQCEJ3Eda5gR/GVbBxkIsWdR9tZ8q1IvmRewPdJHd3UR:bQCGEE5EsbD9LfInoLHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651568407, "uuid": "54badf8b-0366-42b8-9dcc-7bc52a2a1512", "value": 31760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651568407, "uuid": "0efb7e9e-eb73-4c88-82a2-1eaf34bf0e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651568407, "uuid": "37e5dae5-e8f4-46fb-948f-909184ffbcec", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a50406-cb02-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651597030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597030, "uuid": "8ff1bf4b-6ee8-4f47-9961-e0d525f63997", "comment": "Malware payload (AgentTesla)", "value": "0b2a8d0d3a44a2b6c34a074a44725bf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597030, "uuid": "6a8bd083-13d7-42e1-ab35-96cb953d6b61", "comment": "Malware payload (AgentTesla)", "value": "f6b19c787e94375c804947ba13ba32aef40f24432c9cb1a4fe9bb2c1086c6a98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597030, "uuid": "bd98065d-8c7e-4514-bd86-f996c72fc94f", "comment": "Malware payload (AgentTesla)", "value": "95c05695c63177f4e39422686805c19f1240b839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597030, "uuid": "a4008c27-7baf-4d08-a6ba-138da216fe1e", "comment": "Malware payload (AgentTesla)", "value": "a1a16e3b391fede3c7285a596281f14eb1d61934d25c95c81ca0cf4fd7dabf95a18428095ff71e750c697f617a0a1ef3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597030, "uuid": "c287bd83-7890-4bfe-a1c7-84d35bad5f6c", "value": "T17FC48CF171419BD7DD3BAB3A129E0E5023F1562AE321F7072FE023E50653E2F1966A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597030, "uuid": "be49161b-ea99-4c8c-a071-89e358b2e393", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597030, "uuid": "fcdb2d22-3f3a-4942-a375-6ed1c087295e", "value": "12288:bwEPf/f3h+ErJhcD2sYnG8E5iJd3d1TxgtSAoL0jG7t:bH3FeD2sABpfg0AjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651597030, "uuid": "5ac5f52f-88e3-4691-a8e6-1f468297279c", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651597030, "uuid": "be8de3f3-95d6-44b9-8241-55998a433464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597030, "uuid": "5ee547c5-4b33-47a7-a080-97c0ceddefec", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce16d6bd-cb03-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651597774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597774, "uuid": "86afd088-c2f7-4297-8742-454665da8cd1", "comment": "Malware payload", "value": "1573b52c2d0b3d410e73a3a1495565d0", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xenarmor", "colour": "#AE48FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597774, "uuid": "1580ebe2-1c30-44f4-9785-3396544dabfa", "comment": "Malware payload", "value": "f7548d3107c311afddf7827c19a4154bf0e9359cc294e9169042ccd3cc290227", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xenarmor", "colour": "#AE48FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597774, "uuid": "fe15fbcb-b18c-42c7-a42a-ec436c1c0f30", "comment": "Malware payload", "value": "c7f09d25eeda29012127e0511a361b73254d4170", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xenarmor", "colour": "#AE48FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651597774, "uuid": "89bef578-8e0c-4829-94ef-c01f1e866d4d", "comment": "Malware payload", "value": "35612abf1cb7edee7500919a9e07882a8645a667f965a3485d6951bd14f165381bb0201437c2e38085134e3308aa35d0", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xenarmor", "colour": "#AE48FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597774, "uuid": "7c83dd6b-bf79-4a4d-93a7-b729f380639f", "value": "T1D705BF72E3905037D37719389C5BD2A8AA35BE313D26A98727F82E488F367C17D29153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597774, "uuid": "328e3a50-3841-4575-aeb7-64d0c177d2bf", "value": "e96f0f2282c9506da8169ca64b3d06c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597774, "uuid": "98bd2217-aa11-479a-ad22-93cc7e03f9f0", "value": "24576:2eU6JECFkvVovtL14UUKC8WLVtVSn52XcNVto:fUAkchWNSn52Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651597774, "uuid": "1fdabbca-1d20-40b6-b8a8-6eaa76718a7d", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651597774, "uuid": "590a4ea3-3cef-477d-be67-301fe692f36b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651597774, "uuid": "8044bf88-6e96-404f-b3c0-31e4791bd02c", "value": "KPSFEGLI.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1e873c-caa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651556408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556408, "uuid": "cdb35c37-d1c6-4b77-9acd-1f919738f48d", "comment": "Malware payload (AgentTesla)", "value": "439e91f1c698871abf4510225ae0248d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556408, "uuid": "9a950280-852b-4974-955b-e29c8f1c7afa", "comment": "Malware payload (AgentTesla)", "value": "f7e01d86f671a928311d600b8bb91ae72b72b88b01b1b6bf22727dd1bc3bb832", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556408, "uuid": "e4593644-3ea6-4b4d-bfad-a569ab94133f", "comment": "Malware payload (AgentTesla)", "value": "cab81d05d56fd22f9827dfcc18f8c17800827476", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556408, "uuid": "34232579-133f-40f5-88ca-46f213df50f0", "comment": "Malware payload (AgentTesla)", "value": "f3162dc3e49591c80f698ef9c7e474764cb1395121d9f7aab6c9bc5ef715eb16966557aa48fc078d4de379883d480a2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556408, "uuid": "84479b7f-718f-4a2d-9778-19bd85d4ccac", "value": "T1459423B97B8EB1B38EF00F4C696BDD8C9E1463954B635063F6F366C13786B500A38952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556408, "uuid": "7368ad79-08f3-4457-9892-9697d48d7696", "value": "12288:s+E6mMp2xWmntYKDbtEdHpI6SQvKxTJcWIz/oe:sxRMp2xWmtlb6dJqQvKROWne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651556408, "uuid": "48b755b2-5912-4e42-ae3e-24e3f61118df", "value": 432249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651556408, "uuid": "19cb2a85-4d62-4387-a030-31ec54ec041b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556408, "uuid": "f7fa7e83-01d0-43a0-b996-b23842da8f01", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239f9aa4-caa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651557974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557974, "uuid": "b8797b78-96e5-49a5-b762-2d5d6bda89c7", "comment": "Malware payload (AgentTesla)", "value": "8baa080712fc47cb08493f3122714f49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557974, "uuid": "1c8c5068-710a-4a51-8d10-5db913bf02f6", "comment": "Malware payload (AgentTesla)", "value": "f8330880d18dcad3cf2d00fd196c6d8d2387bfe702e5edd9da47f3715e28e7d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557974, "uuid": "ddb6a6ba-9cd8-4de3-9e4c-5eb475403465", "comment": "Malware payload (AgentTesla)", "value": "33d19e7aff078c0c18f5c12806ce3e7f0e6b0034", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651557974, "uuid": "2f042b03-ea7d-41c2-a2d2-601b6554f57d", "comment": "Malware payload (AgentTesla)", "value": "8a378f5619befb5dd45bc40b3a42ba2843130760c8b3a6ab62e7f6e7f3300c9dcf5fc48773cada946200ae263524b12c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557974, "uuid": "70c79d74-45ac-42a9-b1b9-f8f664b68ab1", "value": "T186A4339F9599F9FCB5F3103BDAE4B4825AA24E78DC5E432CB1DC19D09108B2AB04C567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557974, "uuid": "94f18448-e65f-4a72-b900-6c81abebd322", "value": "12288:GZaha3on8GBJ3pbpscMElUm7n3SnsLM0azn2k2tdl:GZBQ8aJ3pb6EV3BM0a69tdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651557974, "uuid": "01a8870d-027e-459e-af7a-eee83ea0b63f", "value": 456966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651557974, "uuid": "50b8a9e3-e8f0-49c9-a76e-7b9e1a690f42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651557974, "uuid": "9e66de4e-c26b-45cb-89fe-955bb7be2901", "value": "bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c39900-cae0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651582669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582669, "uuid": "d05146e4-3a62-49b0-b2f0-54cb429cd706", "comment": "Malware payload", "value": "70228cfe9ece2c92fc292574cd6e8ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582669, "uuid": "b9f8544f-0173-4743-a88f-a4d1a16a49fe", "comment": "Malware payload", "value": "f9594084519fb78e015eb5d8c4452bf5f660cffa79abc528fe97ba76d8ffd5b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582669, "uuid": "bcd39205-294d-4f0f-9349-d5ff20513977", "comment": "Malware payload", "value": "92062c8c59e0ed3ffc76fb666f4f3fb8595479e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651582669, "uuid": "6dc425e4-98dc-46d5-ab70-c7f69c73144c", "comment": "Malware payload", "value": "50f6f6087fb7f275f027f77cf2817edfe4dc93f659264942a4b9eb09f224f178ec558d4f6ae1fb9e64faea49f82e2812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582669, "uuid": "b5bdb698-2cfa-4d94-b2f3-dc35fa7fa3f2", "value": "T13D545A09B7950CB5EDB3D13989938A05E6B27C110B20DAEF0364936ADF7F7D0663A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582669, "uuid": "96fae2fb-104e-4ec8-992f-053750a3d6bf", "value": "d8bad1e6df81319722320794be09df4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582669, "uuid": "93a1587d-d739-47cf-9cd9-0649b4c3dd92", "value": "6144:Y2i7RvEkTT2wfvoFrnrZjRy4hk1XEijrFWlMvmLbKcohVqYf+9BSs:Y2+ukTymvoFrnlRdS1XEb1oeYm9B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651582669, "uuid": "cdbeeb4d-7e1f-48df-80a7-01902164690a", "value": 282856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651582669, "uuid": "93780271-69da-41b5-8336-1c9aa0d40fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651582669, "uuid": "d51dcb4b-c322-4ca6-9d0f-f0dcc83b5eca", "value": "SecuriteInfo.com.Adware.Softcnapp.124.6243.5692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb8dda1-caa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651556433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556433, "uuid": "de7c41d8-edf1-4003-8e85-3b67f44e3283", "comment": "Malware payload (AgentTesla)", "value": "a010e43e4bad157467981dc8c6d4f171", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556433, "uuid": "fd8b35c7-43e8-4050-bfa2-cec9253e6ce5", "comment": "Malware payload (AgentTesla)", "value": "f9799957642a2f3cc65a0d875ee6aaf60ad1f94065f0289e4383cbf5f6ad43a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556433, "uuid": "e45086a4-9e9e-4b8d-b35e-8c2315244a7d", "comment": "Malware payload (AgentTesla)", "value": "0db6e334ba2d1b5904dc68c0e4aefb83a46c8254", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651556433, "uuid": "039ff548-485a-4501-b12e-29661a38fbc1", "comment": "Malware payload (AgentTesla)", "value": "0dceb011624dddb4f96ff4661f1cff367af90a99c9ab221f92c6b4d0dbbb936cbe93897d8ac861fb9fe477d64de86812", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556433, "uuid": "1701c5f9-50d9-4ea6-bc67-01436e76e4a9", "value": "T1EA9423B97B8EB1B38EF00F4C696BDD8C9E1463954B635063F6F356C13786B500A38952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556433, "uuid": "4810a21b-2366-4062-918f-5ea08671371d", "value": "12288:u+E6mMp2xWmntYKDbtEdHpI6SQvKxTJcWIz/oI:uxRMp2xWmtlb6dJqQvKROWnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651556433, "uuid": "eeb626f9-4b08-4cb1-95ae-b124ff6f53fd", "value": 432275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651556433, "uuid": "de5de2c0-ac91-4598-ab57-231ae519dd27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651556433, "uuid": "4bc8fd77-a781-4660-97ae-6462be4d9e4e", "value": "new bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfde207-cadc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651580941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580941, "uuid": "81bdf576-c31e-43d2-8a90-0fe23cb58b3d", "comment": "Malware payload (Loki)", "value": "7563124d5aa1ca72227547f6491cd2e4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580941, "uuid": "e35944de-56e7-465c-a05b-6f22d3fb0943", "comment": "Malware payload (Loki)", "value": "fb2d4baa4d34659d56a3561abda8dad9dbe3a9fe25420b816705f73f38c89197", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580941, "uuid": "90321b82-b779-4121-bc95-49efb2a628d8", "comment": "Malware payload (Loki)", "value": "539ec1c47212e650f85d3b04745636a244a8663d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651580941, "uuid": "95d17a35-0bc9-40e7-8ff9-e3a018169750", "comment": "Malware payload (Loki)", "value": "20a2acf8bb00c42b1a20fc55fee3e63a42dce12ff72b2e2c87de17f3be1a6663990bfe8e0de26804a7c3521e9add06f2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580941, "uuid": "2743beb5-e663-4546-a043-551c33258f2d", "value": "T12F241202B627D36BE5927DB6473A497E190EDD847FC2E23D31E3BD6C1076A0A8271427", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580941, "uuid": "99fc1f0b-1ace-4421-954c-1cb3c2bd11ce", "value": "6144:DVNcu7RBjN4ybSPitGtBE9bHJ3vO2qdRzh:LbSPlE9bNbYRzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651580941, "uuid": "16d475f4-5b0d-46d9-b7f6-6dde4edadde4", "value": 210600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651580941, "uuid": "c08a0c34-b284-47ca-9e4b-479a11af870a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651580941, "uuid": "caaef846-4eed-4aa2-a071-dfc5894fec6d", "value": "MV SEAFREIGHT Docs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6f9caa-cb3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651622118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622118, "uuid": "e871bdef-80e9-499f-964d-097273951a6a", "comment": "Malware payload (Mirai)", "value": "821038cd7ea190b1142ca5a2d933c907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622118, "uuid": "4dd51bdd-8bc3-4112-b917-c588f36f7f86", "comment": "Malware payload (Mirai)", "value": "fbfc05cf97f15074c51f03e51b8b2ace141ba72319ca107ea9189ba5709b739b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622118, "uuid": "dac134ad-a3c6-44a6-a15e-a3070877a70b", "comment": "Malware payload (Mirai)", "value": "7589afcba57e1787d59255c7fba7c45c18474596", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651622118, "uuid": "965d0f61-4454-4c80-a6f9-f19a92f1013c", "comment": "Malware payload (Mirai)", "value": "2507a456b0d546334fe622a49277573d1e4a7a96aa99e9a92c82265c799182e9f10452c138dd05331c9ad16a5977f833", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622118, "uuid": "2d08cf9a-2516-49e9-a813-e9c46b19cf38", "value": "T16AD3F9067B310FFBE8DFDD3B49A91B06198C581622E96F327630D458F64B18B2AD3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622118, "uuid": "3a8ab1a7-fde9-409b-b242-3df3f27f27d6", "value": "1536:A+p+8cBWcD+TBCaNN957y8lrr3VXlV37VAHJbXfcBZjSpWFkWmWna10UpM:d48cBWk+lCCN957Zrl1VrGEBCkua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651622118, "uuid": "bf465e0f-1910-4be3-a0c7-3ff6e0a26448", "value": 136736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651622118, "uuid": "0260c532-144a-4077-8cad-367cf91ac836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651622118, "uuid": "7d495e07-b279-4ea6-91be-a29d3738ea71", "value": "821038cd7ea190b1142ca5a2d933c907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5220b1c5-cad0-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651575662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575662, "uuid": "f9fd3e3b-8d1d-44d3-98d3-05ce4f80e016", "comment": "Malware payload (njrat)", "value": "c7bf7457e2e527d82a25c302184d84a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575662, "uuid": "79c9cbc4-4499-44c1-b349-d0351b56f59b", "comment": "Malware payload (njrat)", "value": "fc18b6b158e942c1d9621b51b90268941888e8945aa564edafc45b739c9d088c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575662, "uuid": "2e9b6a82-b264-4678-90ae-15b9652a18f7", "comment": "Malware payload (njrat)", "value": "9012887a966e5cbfd4c6adbd6369bbb8edf41a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651575662, "uuid": "b4f9f7b2-e861-40f8-8ee8-f2b9da964777", "comment": "Malware payload (njrat)", "value": "50afec297e2a60dde4a748d08927314bccf1a05cb3675764402b5b6648411cc2bca0c58c111f5ff586efeefea256565c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575662, "uuid": "9a58cfd5-a761-4765-a28c-d22a47e4844c", "value": "T10BD4CF3EF3E98ED1CB842F35D5AF461407B2E0663672EB8F1E445596AC132B64E423C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575662, "uuid": "8e537770-515a-4ce7-a901-5390d57d4a34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575662, "uuid": "7cecab03-bb81-4708-92a8-6588dda89e3a", "value": "12288:abYVGU6rgRJA0l9EtVIjJfwhjLABnf8dBUjHJ8AdXhEi4:sqvXJAO2qChP+kdBRAdxR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651575662, "uuid": "2fd6a343-8889-4993-b8d6-242e08ec178f", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651575662, "uuid": "78433cba-1420-4b94-bac3-e3fcc6bf3fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651575662, "uuid": "2e2e9f96-8bb1-48b0-bed9-31df9c25af21", "value": "c7bf7457e2e527d82a25c302184d84a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1c0817-cac5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651570932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570932, "uuid": "aca15cf9-a39f-4e74-95dc-0c74a6da5e69", "comment": "Malware payload (Mirai)", "value": "dc853e00586d2b07182d21b5e2c7bd9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570932, "uuid": "b621de17-13ca-4181-aa14-bbd6b06f3815", "comment": "Malware payload (Mirai)", "value": "fcd51368b280c875b1158bba276d66c5e50016db610ee3b75b8b9a706f270cd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570932, "uuid": "2cda83fb-305c-44f5-bbc6-0619427d7d1f", "comment": "Malware payload (Mirai)", "value": "64728839aac1985060ee85616d5a77e602aba311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651570932, "uuid": "209e5396-eefb-4a40-8e0c-26eff88c6c27", "comment": "Malware payload (Mirai)", "value": "334e1347eb7b3bb2ab70bedf53353580c12a570a5635b02ce2a896b598449419c9aa8428c97c1105c56244104e8482ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570932, "uuid": "b48222c3-49b2-4386-8cde-cad228bc567f", "value": "T176134A35FA361E17C0D1987560FB4B19BAB156CE22A4C61B3D730E9AFF61A406903EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570932, "uuid": "e58cb6e1-bbfe-4ae9-9c4a-d100eb7917dd", "value": "768:fWoyfkq+L/eQzt9CrLhYK0LL7IiMO+2qw3:fW5fkqc/eQzt9CrGXI/g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651570932, "uuid": "71061ed1-d80e-4491-a84d-3407ce2316b4", "value": 41992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651570932, "uuid": "929a4fa4-fa4f-4ef0-800b-395410d1adff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651570932, "uuid": "fe07227a-0dde-4787-9c18-792900b1947b", "value": "dc853e00586d2b07182d21b5e2c7bd9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608fdbdf-cb33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651618206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "783edaa4-ae8e-49d6-8a82-f9ea52eb2bcf", "comment": "Malware payload (Mirai)", "value": "d9a103245da1fef0c71abe67681a3c2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "f8b0b611-4925-4a88-9fe9-0286632a566d", "comment": "Malware payload (Mirai)", "value": "fd4c57f9003b2e1f4e6f755de98b6da7fff541fdeb7015ca1c190b99e1e8ec90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "d155d9ff-7395-45a7-9254-59f4ba968da0", "comment": "Malware payload (Mirai)", "value": "492e8de84aa1615d0d3b10cfbbb8b19eadcccc7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651618206, "uuid": "b188ceaf-9b13-46dc-a243-112787431b1c", "comment": "Malware payload (Mirai)", "value": "a9742cb08a8de89ce412ffc3fa5586d1c78ba9e35e698512345a293b1d281414469004413c7c888d04e49961cf81b2de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618206, "uuid": "fa4f5517-6362-4a6a-b977-c7f9a12eae56", "value": "T1F1044B46AA808F13C4D3277AB6AF41463322A794D3DB73069D286FB43FC665F1E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618206, "uuid": "4b0213f4-c58c-4576-b775-d7b4d1c257e5", "value": "3072:FOyu6OInKwRMt6EIDesHYC48itDJLp81LW5ykj69QuhlkM/9I0mywEWR9z:Eyu6OIHt2tDJLp8xWh29QuhiM/9lmywF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651618206, "uuid": "a24bc3c3-00ac-4e5f-ad69-60d27ea752ca", "value": 186320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651618206, "uuid": "3095ddea-bee8-4839-a573-0780289b1ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651618206, "uuid": "bc8e51cf-6d07-4ce5-8a93-5972cde52ca9", "value": "uYtea.arm7-20220503-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16fdf64-cab4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651563769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563769, "uuid": "62bd8583-79c5-4b17-95ef-afc2f2aa3b7a", "comment": "Malware payload (AgentTesla)", "value": "6a40378d331f01a401315c1dca94a18e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563769, "uuid": "4d7be240-134e-424c-96d3-615acf192b94", "comment": "Malware payload (AgentTesla)", "value": "fea47428b9bec3ecfb9b9d1550dd69a5d16abe2bf485aa37e7aa8edbe754a276", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563769, "uuid": "1fb8119e-63b3-4c41-90df-aad24eaaa8cb", "comment": "Malware payload (AgentTesla)", "value": "85cf34d7dcf328e3db90740b1b07cf3d7da1a191", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651563769, "uuid": "3e603e0a-3049-43a3-8977-6b356d7d1db4", "comment": "Malware payload (AgentTesla)", "value": "9993ca62c09aa872f3f3f10f86b217dab7a4bb4fe95eeded2f58ddbeaf8bbba8b9bc68ae9fd3ebc97577f6bdfe8b148c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563769, "uuid": "eb92281f-581b-49ac-936c-f1ac5916ae3f", "value": "T1F4A4236770869C38A9F902A424006D6553D330D6FDF7467B2911CDA935A02BFCFFA7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563769, "uuid": "81eda2a0-3b93-436c-9ae6-164812dbce68", "value": "6144:ecMFjsZhW7/aRox/SDNMOimfV4KSux8UcqJqKGryXKHrsK5YtMcMJy6/kken+56y:dMFAXVRkSDNMO7ui8UFDKkWd5xgRLeQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651563769, "uuid": "ebb51710-0ffd-4e7c-86ff-98794d804460", "value": 465201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651563769, "uuid": "acb5c47f-e838-4b3d-acc7-302f4a292440", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651563769, "uuid": "a460cd75-8348-418f-8d52-58bac1070056", "value": "new bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62984064-caf7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651592440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651592440, "uuid": "648313b7-2386-4d71-98a2-3cc77bfb6018", "comment": "Malware payload (AgentTesla)", "value": "fcaf5b58497988b7ccce356b28189d62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651592440, "uuid": "cbb00318-c50f-4d2b-8db4-06b00a242969", "comment": "Malware payload (AgentTesla)", "value": "ff2c13ece9c72954e4338a9445eb78fd4f650c4ea92fba1463afa3bc4bf329b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651592440, "uuid": "d75968c5-167c-43cb-a4c7-cc9f43ffaa19", "comment": "Malware payload (AgentTesla)", "value": "f53d186da261d315f04bf19e76cd1eb8394a7297", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651592440, "uuid": "266991bb-d857-466c-8e43-09f12bcbae27", "comment": "Malware payload (AgentTesla)", "value": "e96a01f97b40f220ff581d6d7bc50dd5c21fae5e1d029846f4b982d25c47b5d6c61e76a23c16b9e8924ea184bf6c645c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651592440, "uuid": "ad510ef1-5d65-47e8-a2cd-848318d1954f", "value": "T120B28391E28185E4EDB907B59877AC04027BBE7DFC71E92D649A74695B733C300A3E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651592440, "uuid": "af166a7b-9eec-4efd-b04d-bfcddfefad64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651592440, "uuid": "6e1099a6-26de-4346-a0f8-55cdac96ad5f", "value": "384:LqlRJhOPv/6htq02fWz2XkHDnkfEDckrM5PNrKAhhmhxTbn5YqqGcrWG1W:Tv/6htqngDbIY7E+xTbn5QV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651592440, "uuid": "34b2a9f6-bc6d-4929-9b28-ab2141322b8b", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651592440, "uuid": "c9d89771-6ebc-4485-aa6e-30ecb534aba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651592440, "uuid": "319614d0-9aa1-4c45-9f0e-9f8b31e4b438", "value": "SecuriteInfo.com.W32.AIDetectNet.01.1900.23683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }