{ "Event": { "published": true, "date": "2021-12-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-14", "timestamp": 1639526581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0a595672-1bfe-4e0a-bfb8-04b4d48fe838", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d418ca41-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639466219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466219, "uuid": "b7ab17b1-d5f8-4569-b29b-677e14e2c998", "comment": "Malware payload (AgentTesla)", "value": "7311356d9420f387813a720981688e78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466219, "uuid": "7dcc0a8e-b74c-4234-b608-3a8327fa3d50", "comment": "Malware payload (AgentTesla)", "value": "006ff0395f5d90ac864f0324ad52a2ec8d9430a811fc198b552db1d86bc2f0b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466219, "uuid": "c6942599-b999-4ab2-b332-feb0ee4ffa74", "comment": "Malware payload (AgentTesla)", "value": "b0ddc75cbaf0f4fb163b1b38121a7e4bbef4506a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466219, "uuid": "f589ff27-e959-49cd-8ccd-9c8f98b9a580", "comment": "Malware payload (AgentTesla)", "value": "3a0ae9ca6cbb20a2b55eedf61fdc856739e0f10049a5e80cba2ea2364ddc4e9477cbfe3f8ab4d9f9b53d0b6a512f4eef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466219, "uuid": "27d903db-2924-4041-a78e-8c4bcddcbe10", "value": "T1AE45121C3E93DADEC5590FB933A950249235AC36A503E39BFD8932AF1C277583D93642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466219, "uuid": "2ed42768-116e-4456-89bf-5ce07db58abc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466219, "uuid": "c3e4cab5-5c63-4c4b-816c-45163fffbdd7", "value": "24576:z6v8tMdXjm/h81Hyq8egmut0uAYZjBPW2Ym0cC:4dXjohkwDH0uAQjA2JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466219, "uuid": "1c0cd93d-873d-4471-9d1f-50b1531d371b", "value": 1208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466219, "uuid": "44eef4f1-bd20-40c7-8f3a-2ade4c6e5250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466219, "uuid": "034d1f77-52f3-4892-b0b5-79a301e9d5d6", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc485bb3-5d33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639523786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523786, "uuid": "28bfd65d-32ac-4a67-9edb-26ecefd58baa", "comment": "Malware payload (Mirai)", "value": "4d8b252e912218e1ab84ea898f84e75e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523786, "uuid": "5ada4524-c0cd-44dd-b095-e65d1f7d5b88", "comment": "Malware payload (Mirai)", "value": "00defded5035be456c281596b1f2875c1adf753ae36f01701ba0c3c5f27b6c7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523786, "uuid": "7e88528d-5e93-49c5-9dc4-9e9adebbead4", "comment": "Malware payload (Mirai)", "value": "51f934b3a2aa81ffc60c29f8c51c024a6fc461bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523786, "uuid": "43793211-48ba-4b91-9e8b-7f7116134434", "comment": "Malware payload (Mirai)", "value": "d94d2968848d261e3ca5f2b69a08865272d19d9e255c156b61906829b13cd6301f5c704da4f7878da4dd04e685fe708f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523786, "uuid": "9410d937-0317-4a79-ade6-c8683e08051d", "value": "T10B73B70A7E329FACFBA9523447F78E11AA5833D527E1C685D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523786, "uuid": "af1c388c-da6d-4bcf-ac9d-d2bf0fc8b3d6", "value": "1536:3IHb8FMv77EKQHlyRR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMydFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639523786, "uuid": "db8c9483-95a4-487d-af85-e38ec9268ef4", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639523786, "uuid": "ad5b0fb2-e68a-4e0b-890f-06f5cc8ce2ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523786, "uuid": "6556c395-5bb1-4032-8cd0-88c783b03112", "value": "4d8b252e912218e1ab84ea898f84e75e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eacfb67-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639496382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496382, "uuid": "6d5e483c-91a5-4cd5-b187-ccdf0722f9cd", "comment": "Malware payload", "value": "0c5c9ddf6c6d6b7cbb91b3e9b1754daf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496382, "uuid": "6c17a755-fb31-4e7d-9ea7-042238bb751e", "comment": "Malware payload", "value": "0116480aba22121dfc6ea109e8f4e8cb09298c9fd15311a81c81bd1f8326c7bd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496382, "uuid": "addd5d98-6d68-4323-8305-078cc16e5b34", "comment": "Malware payload", "value": "7d29eacce081dedd60a1601721c4ca874ed01476", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496382, "uuid": "070bc9c8-fce6-4bc4-94fb-6e361f80ea63", "comment": "Malware payload", "value": "3daac9654f14b5a1d1e9f20616dcf7b0ae344b19e2011790404a0115770e0024afd55d6a844882f866746cddb54f4f37", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496382, "uuid": "8611e4c2-6f41-483d-9af2-148d997c7c38", "value": "T19946123332A64125C5EDC978063BBFA931F52635876294FF66D86EC929724D09333E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496382, "uuid": "adf33b26-21e6-45c0-96bd-77c55d319e6f", "value": "98304:JYHeCAJfS0yOUk912RhahfHjoJe1F8pWNX6Rjgswiso3R/k1k8/WGDQ7:vfZyOj12RajoYF8pWNKbJsqR/8eGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496382, "uuid": "1d2d55be-f93a-45d4-af0e-02e226e4494c", "value": 5831168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496382, "uuid": "2c58cccc-2f9f-4e5b-b85f-e23dde853934", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496382, "uuid": "cd57fe02-4c8d-42a1-9253-97b821b7b247", "value": "0c5c9ddf6c6d6b7cbb91b3e9b1754daf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986891df-5d16-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639511216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511216, "uuid": "ddf96b34-7843-4abc-bcf7-3a6f4ae7b9fc", "comment": "Malware payload", "value": "823ebdda6ac6c630266773a35f88eb5f", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511216, "uuid": "dc49bb1c-af7e-40b1-bd07-55f4a4656faa", "comment": "Malware payload", "value": "01473fda824942e60e0c4cff2fe145fc2bf873e5dd3f982029b8c97cc0266e0a", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511216, "uuid": "d0e14126-52d0-469d-a728-9146003df348", "comment": "Malware payload", "value": "b5058e5fac2af5006587e1304b5b1a484ea6b6ac", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511216, "uuid": "81de6fad-b778-4226-9a6c-943b9ee47a11", "comment": "Malware payload", "value": "085a9dd5c717948621122c9ad03ed73a939c110c1b5e06982c9a1114faaa5de61c38e80983933ee5645629db6da57256", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511216, "uuid": "31e30517-b46e-4349-95ea-5d89994bf7d4", "value": "T160659D1A72154EA9D9B7D07CC4434F5BEAB1B0019370D6DB17B496AE2F233E20A7E721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511216, "uuid": "bd36051e-8163-41f3-a7c1-433b959c4ebb", "value": "24576:ZThAFNV/UldqwUMOOHagCMnHngxnIhecnnminmtZy5r9pg+7EcGjDTw5WY:ZThADUd/jOOHagBODTw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639511216, "uuid": "98a52153-b965-4e86-8b69-626b727a9306", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639511216, "uuid": "5a5ffe89-16eb-421f-b7f8-162396ebb865", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511216, "uuid": "a2ca33c2-7371-48cd-b307-08d9d533ac1d", "value": "new-documents-2048.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913eb5c5-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497461, "uuid": "7342c671-eebd-4ab3-802f-646ac47a67b6", "comment": "Malware payload (Formbook)", "value": "68b45dd917df53df4bc304260a4013f6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497461, "uuid": "897b573b-1aa6-4d38-b962-6bf27bc90e2d", "comment": "Malware payload (Formbook)", "value": "01bdcc1eedec1fa92679346dc0cb1106483836cc484e75381fc89507639d64d7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497461, "uuid": "5a3e6ff9-9523-417a-a653-6bdde94edb64", "comment": "Malware payload (Formbook)", "value": "832daeab465575b2f52369c54a2de9ab33338892", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497461, "uuid": "bbaa9c61-df1e-457d-8e49-6eef786a616c", "comment": "Malware payload (Formbook)", "value": "e15bc0647c180df5485c7c77e4407ad99cee2e440d00b4379c99d7613bc4b625fd5b951283899389c3188a58b0c670af", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497461, "uuid": "ad4c1830-ceed-414d-bcbe-3d0720968b4a", "value": "T1BD64226E7C12963BD10354792CC8E1DAC129FD4ACE2EED9AD4857D0B6CBCFD8D224914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497461, "uuid": "fbac8218-06cc-427b-aacf-9512dc01e4f4", "value": "6144:9lyr3I166V22ntJU1RoIQ/PoNF/q5g4FwD+lQwRIwY6uPoP:9lyrYEzGJU1RoIQHojUwalQExfuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497461, "uuid": "f033507c-b733-4bf7-9990-245d3d3abe20", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497461, "uuid": "51c3b00e-0981-4545-a4d7-8113e89bcb79", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497461, "uuid": "25c41287-ba6e-4d6c-8ab9-9fe186d9bc32", "value": "PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e76ee04-5d1a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639512837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512837, "uuid": "6802ffe0-a2e4-433e-853c-ced4e3fe47f9", "comment": "Malware payload", "value": "8d3033b8b36435b948975fc3d91ee5e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512837, "uuid": "f4740236-d6ed-4c81-a8ec-d0217db51b7c", "comment": "Malware payload", "value": "01c3b24353de26b5638d7d9462b83d1b68448c4a0019be14aaa1dc60a09cd491", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512837, "uuid": "477a9ab8-3208-4f01-a5c2-50e6e905cc97", "comment": "Malware payload", "value": "a717d1a5ffc676307db80d87729224a5a64c6f60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512837, "uuid": "d78d49b1-6764-4b39-b6b5-23417da2d7b9", "comment": "Malware payload", "value": "2c01094d6a16dcda5f5c62e162a1a8b19df9792a910e772549c1c1baf685afce5409c6f3148bbdeece46583a3437fc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512837, "uuid": "5bd261ba-df02-4158-bc1d-6bc81e5371d9", "value": "T16AC49E8273634102EE82FDBF1D13746F4399369DF950F8A2F58E6A6A303E2B53165643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512837, "uuid": "b29c6c4d-88d6-4856-8376-cb9877852b20", "value": "c9628a85525bfe945f5e36dd40536a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512837, "uuid": "6e79d909-0d00-4461-9c3d-3980a86fa4c9", "value": "6144:MDwhfXAyRXuYDXCmFXayrX4S7XKyfXEyRtUWxXwEhXE65XcyjXuq5XqyHXoQ5Xm1:pF8uFvRiXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639512837, "uuid": "a79d994d-c7ac-45f5-a69d-563c82f787df", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639512837, "uuid": "46749eac-d315-4698-9592-0f0f12355d4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512837, "uuid": "c34a8352-a5b4-442d-956d-d8ac45cee37a", "value": "8d3033b8b36435b948975fc3d91ee5e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c610dee7-5cee-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639494113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494113, "uuid": "d7c71f18-bb52-40f7-bdb0-534e30413527", "comment": "Malware payload (RedLineStealer)", "value": "a0cc0b892d90e0a0a2a27795d6d7b97a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494113, "uuid": "706b807d-a669-4b0c-8224-728c27f8bce7", "comment": "Malware payload (RedLineStealer)", "value": "01e3c9b00293920e3586cb798de6404a68c49ee18a202858b7e529368ac4bb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494113, "uuid": "14b5267b-9fa6-4c97-aa66-7dd5f11fb689", "comment": "Malware payload (RedLineStealer)", "value": "953c4d962c3ad35e6bf6b9dd8bf597d59a6cffa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494113, "uuid": "c20cd121-2958-40d3-9a69-88933e6f92b2", "comment": "Malware payload (RedLineStealer)", "value": "2d3071474783119ed0edcdd1b03bce16acfdad4ea7936ccaef7b08d9fe31d956e6474e6c3fdf18a782842394ec54059f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494113, "uuid": "61f24ac1-52d2-408f-bacc-da26a6dc586e", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494113, "uuid": "cb2f8137-63f4-4571-8971-662afeb39ce1", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494113, "uuid": "6555855c-6f0a-4dfd-812b-04727ca86a95", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639494113, "uuid": "103b0d0f-e8e1-4890-b240-75f6d295964f", "value": 442389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639494113, "uuid": "ce167f99-efc5-45cf-8b5e-d79c73c688f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494113, "uuid": "58cba4f6-9a9a-40b5-8a31-23fc14930d74", "value": "a0cc0b892d90e0a0a2a27795d6d7b97a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77909e26-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510302, "uuid": "fc3fcde3-46b6-475c-9adc-044ac4270006", "comment": "Malware payload (RedLineStealer)", "value": "e53564d447e65378f41b8ec64bf31159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510302, "uuid": "eb626ef9-f8c6-4af5-98d2-3cd6b1b1f48f", "comment": "Malware payload (RedLineStealer)", "value": "029897ec408e127b806735b190d1a5cf477e6b63cbcf98af9b939bddc8849acb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510302, "uuid": "e5efb1f7-9ac6-4179-90ce-16c0593a90c7", "comment": "Malware payload (RedLineStealer)", "value": "77258427a598efae5b9512866b5f38e2cfc12b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510302, "uuid": "779d8677-1080-4d50-b7a8-beef58ab3d5b", "comment": "Malware payload (RedLineStealer)", "value": "97a931f39d9d102063075d7099a042887a7c0b043f4cfe1006fddfcf52a2a777b1386221ebf3637508fdc9194bb222fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510302, "uuid": "a860195f-4f5e-4aae-b5f9-b8ddd136d557", "value": "T15894CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510302, "uuid": "3afefb4c-c855-47a5-ad58-65d0420cf74d", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510302, "uuid": "a808ea66-679d-4f77-9aca-38767cce170a", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510302, "uuid": "77a23376-0ee1-4ea1-8de6-8967412f42bd", "value": 441946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510302, "uuid": "2f94a549-38b3-4740-9d2e-e40ad0f9ec4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510302, "uuid": "5312c40b-46f1-4f52-ae5b-f2aa67dd2cd0", "value": "e53564d447e65378f41b8ec64bf31159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5b6604-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639465030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465030, "uuid": "d85581ef-f89d-4dbd-bdf3-608b8d71dcd4", "comment": "Malware payload (NanoCore)", "value": "78536dd4af9c3445f025ac888c0515ab", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465030, "uuid": "2aeeecc7-7c66-4cc8-a700-cb58bb71f77e", "comment": "Malware payload (NanoCore)", "value": "02be2acc2bc4878da5f573a27400a480122da8ae3d68182fd009e379d490352a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465030, "uuid": "2c48e86c-7158-4977-88ef-03cfbbb9d212", "comment": "Malware payload (NanoCore)", "value": "8802519747e4c89ad715f55a1be83ce49fd86d54", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465030, "uuid": "fdc69e2e-2f93-43a6-9a13-222cfe1fdd0b", "comment": "Malware payload (NanoCore)", "value": "cd578d060c512fdb969607f2705d84e5ca64a4c50aec531eeb4fb3d20504fdb2c0ddeea1906d303f83887c47728a8db6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465030, "uuid": "4e160e1e-5bb9-4bb0-9008-213b2c505b60", "value": "T122553334709D144A0E0506FEB5DAF09E2A6F2616A388A767FD88C4DAB14FC4DD3F1E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465030, "uuid": "9aa2ee91-7ad1-424f-8311-71089e68eea1", "value": "24576:nzFTkD/KqFuGOwjU9hd9v0hlsEwE8MLr41Ac6TyAx4H2jfe/S:nVHwpjU9hdt0sPMLr41Ac8ymsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465030, "uuid": "3ea409af-7d8d-48ab-9a77-03d6a3da292a", "value": 1309991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465030, "uuid": "09bb21ae-2ac0-42dc-9a60-3d74680aeb63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465030, "uuid": "e35f223a-6467-4f6e-82ad-49bdfb49def2", "value": "VOLGOIL LLC SOFT CORPORATE OFFER VESSEL TO TANK.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068a6caa-5cae-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639466304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466304, "uuid": "c9a20753-ebc8-407d-8f6c-857f0fcf864b", "comment": "Malware payload (AgentTesla)", "value": "624846a7a252e2d409aaa6eb73a490e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466304, "uuid": "18370861-e642-4764-a570-d83d0d0eb74a", "comment": "Malware payload (AgentTesla)", "value": "02d0e201aabbd6fa20f787d929899fa1a4816deecddabaabc5f103c9612d5f54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466304, "uuid": "0051e405-d764-4623-9fa4-ada550d62a2e", "comment": "Malware payload (AgentTesla)", "value": "660b7b3d4bcfbc5601f4ee3e4eac29a0f816726a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466304, "uuid": "05818edd-a639-41eb-83d8-0ed22191779a", "comment": "Malware payload (AgentTesla)", "value": "2dbbfb757067f79d136b0af33faac7486537e2301f347b7dba5d82595b274c7a20ae3818de6b6d478bdd1db36a45d32b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466304, "uuid": "55daba74-755a-4438-b4f6-84025a4f3102", "value": "T11735431464ABA01DF0629AF11DD0F6F2BDEAF6B6158970BA63540F339712D81CC7363A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466304, "uuid": "43992f6e-acd1-4423-8bd5-5d481fce9f0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466304, "uuid": "2efd0f0a-54b4-4f33-9b1f-cfbe70c35c05", "value": "6144:FGlGKUioJpbIKusexgIIlNZBk+Zjm25UWSm+01rRy7m8PKqkYUogiOi7iiviii2t:KSAsexQM+M25UmrRy7m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466304, "uuid": "a74af21b-e878-4ef4-8cc4-59833822c884", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466304, "uuid": "8233c1b4-1257-4c77-bf04-55d0e3980982", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466304, "uuid": "8729f328-695d-41c6-b119-1a8ff5cd29d4", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cc3dfb-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444882, "uuid": "b5e3e2e4-f19a-4bde-a8ec-c184dc4ba3a5", "comment": "Malware payload (Mirai)", "value": "8a3786440c16e067baab16370f19a444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444882, "uuid": "cf0b30ee-4389-49cb-8bc5-37158eb70b13", "comment": "Malware payload (Mirai)", "value": "02e2a5efb3c291ea363801246eafec28adb5c67d062dfe0dd747733fedc67ac7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444882, "uuid": "fbda4ebd-e83d-4d1b-aa64-7a29c0b48ea7", "comment": "Malware payload (Mirai)", "value": "416392d00e3fe83627381989ceefe64e6cf5ed72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444882, "uuid": "b89724e9-a3db-4b0f-bb66-14edc457d4cd", "comment": "Malware payload (Mirai)", "value": "e9f74b22e1370ca0ec3ee76cf53173873fd63838d4cb8aa0efca83eb911a60362f598e9da63afbd576ea5028c31dcc3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444882, "uuid": "c3d1ce64-cec5-4316-b3dc-5e84eab9cc6e", "value": "T1A7234ACAB401AD7DF81FE77E44574A08B231B34556830F2767EBBD93AC331A81926E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444882, "uuid": "8bd51f8b-c0f7-43fc-acbd-d488f28fcc25", "value": "768:/hQSeG2YLvwRLNv6q0ufJSMOt5Oey/oK/mQ8bqEoQoDWXgh:ZQSDGh6qdfJ65OeSoK/78WSoiQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444882, "uuid": "225059bf-aa9f-47b6-a799-c041f0fabfc5", "value": 46208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444882, "uuid": "c37faa99-8109-4b38-a2c4-8f2ed5e949b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444882, "uuid": "d10496fe-f233-499b-98bd-66f731994937", "value": "8a3786440c16e067baab16370f19a444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6ba019-5cd0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639481212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481212, "uuid": "00b69920-2e58-4e8e-afb6-07f46f102b35", "comment": "Malware payload (Formbook)", "value": "626d2eaeaa7d0e72662e1013791e3e3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481212, "uuid": "75485ca9-a6d3-439a-b385-b9d53d07f3fb", "comment": "Malware payload (Formbook)", "value": "0395936a8ba215b288620216d3470fb7e7307be802c07684883c06d17a9cd2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481212, "uuid": "f82651aa-2e93-4d3e-bddc-2676efac0fb2", "comment": "Malware payload (Formbook)", "value": "1ddd7083adc22303434dc171d1e19dee6c404569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481212, "uuid": "978d64a2-d4a3-4346-83f9-5882a0c9de2e", "comment": "Malware payload (Formbook)", "value": "0849d0068e895e8095bd42219a1bbf28adf3272b0e61904c82fe282664c94f9470cce0a3baeaf704ed2a1d11f82d10c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481212, "uuid": "115c54f1-3033-4c03-aeaf-31a1104a033b", "value": "T199C401D2E6965DD8EDA90F3495370D1612E3BE7DBC74A42D0A5878B42BB33C3102AD87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481212, "uuid": "1a8cb83c-459e-4170-a03f-7857a9ecbdad", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481212, "uuid": "5de1f911-41b1-4c94-9de1-a069df84c3e9", "value": "6144:RGiSFb622O4dc4SNBcl1Pi5YvCvDQ5lN2AsWbXxG74ILPwBUxYQvPw2CD07H/d2B:fO4YN4165XslZbhG74IILsw2CQfdzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639481212, "uuid": "1bda5a67-991d-4364-b09a-e37ef231cc51", "value": 592495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639481212, "uuid": "37977ade-b709-4f27-b13b-0cc7711b3bb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481212, "uuid": "9b28f162-955f-459f-9f9b-bb6e8dd45ec2", "value": "ScanPMT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa38790-5d33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639523791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523791, "uuid": "81e6ffbb-8f11-4b30-81c9-a1f1f83fac74", "comment": "Malware payload (Mirai)", "value": "3fbd1aa13b556c40154332d4900214fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523791, "uuid": "6cb82ff9-489d-4df4-b5b6-7317e3e89a50", "comment": "Malware payload (Mirai)", "value": "04c2b5f981e2d81f4889bd2200e32799d3d900d65eec21251cff57e33f0b89e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523791, "uuid": "f3e14085-02ab-4b19-972c-45fdd1fcd0c4", "comment": "Malware payload (Mirai)", "value": "f35c9c4b7524236facea5f7f3bd05fe2b5731ed1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523791, "uuid": "a09c7e6c-0c1c-4e9d-a474-7055d545054c", "comment": "Malware payload (Mirai)", "value": "bcdf1956adc9309c751999c699bd5deccf70277610bad55d7c3824ace1194eec94c84e083a167b32ffccad7e5a7bcad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523791, "uuid": "2aa87ea0-cd84-4543-bd2b-71c2e1f143de", "value": "T15E832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523791, "uuid": "0d477aed-7b10-4160-b1f8-e9ef4fdf2b5a", "value": "1536:qLf0+QM5PHyVwi7f21UiEy+DlOo7cL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fI+DMTSJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639523791, "uuid": "05edddc8-86ac-4d66-a28d-e001017a5d70", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639523791, "uuid": "c8b3d632-79f5-4315-8075-d38dfbc23e53", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523791, "uuid": "69dcf44a-4b7b-4709-825c-e0fabc85434c", "value": "3fbd1aa13b556c40154332d4900214fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb26178-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497483, "uuid": "604fe2f7-a4ee-489f-a7a3-ec70b1c08535", "comment": "Malware payload", "value": "4ae685913e72c3c5099a083832306bf5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497483, "uuid": "f92cefba-0648-42d0-823e-8d6f3b5576b4", "comment": "Malware payload", "value": "052b18958ad3277ceef52d624ad4a15fef8496868763911ec70dde15c87793d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497483, "uuid": "7f8b97a8-ba46-4bb4-a2ab-b149b4f55959", "comment": "Malware payload", "value": "8e8f09255d39395b7e0fa0529558cdf6c0b6eb8f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497483, "uuid": "b1dde2d9-eba6-4ba6-a0a7-50ddc92f3196", "comment": "Malware payload", "value": "d0118c9798ddeabe8231e88b65a3bcd7dc9d41e7f0402bbd7941fc036c72a0783b32a0e650f20a39397b734cf54b588a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497483, "uuid": "33398093-00ab-41d2-804d-d970ea4ad01f", "value": "T105E5BFB876047DE6266F536BDE96ACDD13A627239ACBA4CC806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497483, "uuid": "0c6ae546-f8c7-4099-8d15-b98e56f8f7b3", "value": "24576:x24PdDFKUb/aj4mdLxHKmMQDU95HiIYGe5t1mUaopCFWqykshvisUf5sNLLJdZ/Z:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497483, "uuid": "75931ec8-968d-41fc-bfc8-2adf691d847f", "value": 3035422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497483, "uuid": "9a4bec2c-8095-4902-b08f-ee2cf78234c1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497483, "uuid": "269dbfb0-2fb4-47f5-bb1e-d88fa7a449ce", "value": "PO-HEQ211025001T-EXPP v4.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7fd540-5ce9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639491899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491899, "uuid": "31dd67a0-4ada-4c18-b7f4-6883d5d8915d", "comment": "Malware payload (AgentTesla)", "value": "d7ae733cdcc3564aa805ab40cdacc594", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491899, "uuid": "0a3a396e-1f26-4c15-96ae-830ddceddfe4", "comment": "Malware payload (AgentTesla)", "value": "0592c8cc4fcb54d014cd43b71137e754e8f26223a10ec46bd48a42e87c7dc685", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491899, "uuid": "d9087f02-237a-431b-9c91-647739387c8c", "comment": "Malware payload (AgentTesla)", "value": "aa8e8dcf833f6899aeb59c3ed80f2a97d9e651da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491899, "uuid": "a5529762-4904-4525-ba1e-123b79210331", "comment": "Malware payload (AgentTesla)", "value": "876c74961906d460f0cf525c0fc4019b610cbfccc9a231b6580ecea3a28cced83947d4ff8019c62fcd9b5f905038f54d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491899, "uuid": "a5643c7b-3af5-4465-bf57-5b46e4a86c91", "value": "T16045124C3A4395CFC15A0EB6776980686272AC76A603D2DAFCC9335F2D677583CA3712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491899, "uuid": "06e6f1b4-1d9f-4345-bdd7-a08885afb1ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491899, "uuid": "21b1b4ee-b043-40f9-90ea-19a3275b0899", "value": "24576:m6QEvVoeucVc17z3rGTqgyNH3EQZvK4HRu5OHc33dLkd:wuVoww7zbsqgyNX9UiwOHoJkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639491899, "uuid": "f28bbf11-bb4c-46dd-8b17-ed6d97da229f", "value": 1183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639491899, "uuid": "e4eeb727-26e0-4ca6-adea-3a8f0d862120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491899, "uuid": "2971c944-849d-424e-84c1-343c194d76c1", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04221f4-5ca9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639464522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464522, "uuid": "2df73716-de4a-4507-a7e7-6e6025f24763", "comment": "Malware payload (AgentTesla)", "value": "cdc1a45890db6598b2f7a532060e29c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464522, "uuid": "07ba4ed5-c160-4209-865a-9424febb640e", "comment": "Malware payload (AgentTesla)", "value": "05dfdca2313e98aa8f9db4fddd13fe777104bb11953c2a4932eb49cec0dd7252", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464522, "uuid": "56b1ae05-5c75-4a9d-b42d-c05b9c58b407", "comment": "Malware payload (AgentTesla)", "value": "de1e1e51ad2f7a336b12c9aa58c29d9fb34202ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464522, "uuid": "1405fd8e-f779-44eb-96fa-39b1af030640", "comment": "Malware payload (AgentTesla)", "value": "42adb5656cc47da33e9a035306da0591115b519c51f1a333b5ab777435d4757adb28cb01e5746b3c0dca220e17b8c780", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464522, "uuid": "40ac1904-f2fa-4fea-88b7-7d20579ed279", "value": "T180553310E9D2395FC3696745B398A47FF4FEAA1CB05383E7C07F592B09F541AA483A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464522, "uuid": "a35e9dcf-1d1d-4246-aafb-29b6768114fe", "value": "24576:8Im0w6wXRKnMukVPX5nB/nIpjGA+7biygMGF2FCYxN6fPnd:8IrLaKnMl5ZYGA+7biygMm2FCYafPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464522, "uuid": "1eb643a9-7a23-441b-af04-daf660706ea4", "value": 1329861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464522, "uuid": "eed178c1-8e6b-41d2-b999-799a6aefae3a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464522, "uuid": "f8551430-33b2-45c6-b480-210224666f66", "value": "Attached CO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e288d455-5d33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639523796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523796, "uuid": "0be7d423-4cd9-44b9-9766-39b990a3ce85", "comment": "Malware payload (Mirai)", "value": "4df4c99fa5d3747e8b97b64449908897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523796, "uuid": "24e040d1-7438-4add-94dd-fc61234de375", "comment": "Malware payload (Mirai)", "value": "062fa7ad48d0882345e9a749d3f9b012072a18a6a02001bab5766c30cabe8f85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523796, "uuid": "bf809e44-6fab-4b53-b05a-891ba87d27f9", "comment": "Malware payload (Mirai)", "value": "530f5ca30e220b8505bbeb2967a1e33b3f641480", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523796, "uuid": "c57a509a-9bbb-41a9-b91c-b6d89db5fdc6", "comment": "Malware payload (Mirai)", "value": "c51b912cf5ac6626563d9b5827ce1de6f9f9157d86aee8684ec81772f61cc827a4584616bb5bf4f4fe518fdd54f2665e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523796, "uuid": "6dab2a4d-a478-4031-94d7-e773dbc37697", "value": "T16C932986BC41AA11C6C61677FE1F108E331257ECE2DE73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523796, "uuid": "8950d111-edaf-4a09-a051-bdf955cd5104", "value": "1536:3hnSTNtjV7LHXGg9jfph5cBX5zVMEnICr7gaLuNbNzMJi3bZJ81dUjk5tYG:gNx5XGsfD5ehMQrkaCbZJ81dUjk71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639523796, "uuid": "0c318b4a-caa5-4fd1-9ffa-4b72a0e054d5", "value": 95492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639523796, "uuid": "631b786e-187f-4c38-8449-8c81c8b87a90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523796, "uuid": "537485e5-910d-4aa7-838a-4ae32f1d6111", "value": "4df4c99fa5d3747e8b97b64449908897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167c197b-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465472, "uuid": "0c6f2344-83b8-484e-ba59-d8c7524303a0", "comment": "Malware payload (Matanbuchus)", "value": "aaf943c5a95b3dd813c441d3bdca0e5a", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465472, "uuid": "732328b2-fb9a-4114-98aa-123695dae3d5", "comment": "Malware payload (Matanbuchus)", "value": "0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465472, "uuid": "1152ef8d-9715-4c75-886c-27458d2da7ab", "comment": "Malware payload (Matanbuchus)", "value": "529a1793f8019042952a379bbd91da51e02aa2b1", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465472, "uuid": "ec7c452b-497a-414c-aeba-d80fcfa2a7e7", "comment": "Malware payload (Matanbuchus)", "value": "630582fb53fd8e7dd89ca6567459eefc96b8264975e72496d18e43913f1b4ef74cc87b35c4881a5d8389ddcb9338bef2", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465472, "uuid": "9118caa2-9d0d-46b3-b122-39f3c6f092a2", "value": "T1B9B48CB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465472, "uuid": "aaeb907c-abd2-4375-8586-1f1f279e3c3d", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465472, "uuid": "84e875df-eb0d-48aa-879e-f3c9d618e126", "value": "12288:nCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp13d:nfcqtGWdZPuQIDHaxarC3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465472, "uuid": "9ee16757-4d99-4425-96c3-7d796355b361", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465472, "uuid": "92dc9a76-8c3a-4c66-98e2-24544cb719f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465472, "uuid": "2b626dbc-89d5-4ee6-8c08-31879e868d56", "value": "0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8617bb57-5cae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639466518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466518, "uuid": "f4ffcc89-3a47-4faa-b76a-d7d5989da9b9", "comment": "Malware payload (Loki)", "value": "f18ded26a129f5a6dae6d995c9c303fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466518, "uuid": "4b1f2d49-f64b-47af-84fb-ce1e00b9ac69", "comment": "Malware payload (Loki)", "value": "066dd4571fd42f031f6cf2d334770fea4907d0fe16d3f991e873b82bb4441d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466518, "uuid": "b75dd79c-d210-421b-a6d9-74c05eef539b", "comment": "Malware payload (Loki)", "value": "8e21f95f88a2f2224599a87ed39b0406dc331539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466518, "uuid": "3c8d984e-fc62-4ee1-8142-5b9679d5bd50", "comment": "Malware payload (Loki)", "value": "c959ef9f0d90fde150435cb9bac07861d1843d07f5ffdea9bbb0a877a33d5717b72af5e324929c03f7cb4b7cb396f25d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466518, "uuid": "6fb66128-cd00-4dd8-ac57-219d5bde0f39", "value": "T12E9423797FD06EABD6084832907BF781A73A1758534227832FA45F3E9D3274E92210DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466518, "uuid": "2b3923f3-adeb-4c54-9d4e-4189cfb6caf7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466518, "uuid": "72a80c6c-4bb2-424d-969b-cef918edd239", "value": "12288:ucnzz9pgWsg8kfYmxmfHpn+uACLJ+Hjo1ip2VpW3rp5Qi4:ucnPhfYI6Hpn+uvJ+HQqV5Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466518, "uuid": "95bd9850-9df0-43c7-b61a-2a471853fa7a", "value": 434616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466518, "uuid": "be1ef0af-f99e-4366-9ece-35f06141f167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466518, "uuid": "06ba6b4f-725d-46f7-a63f-100534030309", "value": "SOA Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e665bd-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639465204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465204, "uuid": "b5cf5e2e-110c-4fa8-9317-55d31bed6315", "comment": "Malware payload", "value": "8b8aee0dade0b114429e09585c60fa0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465204, "uuid": "90a018e1-2095-4890-ae31-898e2b599dfe", "comment": "Malware payload", "value": "0735f0a9d1bf15efb653b2af563225230bf5b1a6d4dd896a23a0cdce824505de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465204, "uuid": "d4c4bd78-c253-4fd9-a00a-87800f44e5a0", "comment": "Malware payload", "value": "1d57127a41e1da2f79e031992eca063154f50694", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465204, "uuid": "b63865da-26e1-49f6-8ba7-2cdb747d08b2", "comment": "Malware payload", "value": "48be6b0245ac4af6e17062ea07e785d0b3dc33aa8eddb5454a8797ad8d37b6a7f634f90d8cfd3f665d5acd67aeebf26a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465204, "uuid": "b5d68845-f88d-4ae9-8e9d-8f19f700e79d", "value": "T1C595334852BD7DECFC9F12293B6289D0C2FD72E0E841A0A562545CA45D3F1BE039FA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465204, "uuid": "e5747620-3175-4c46-9cf2-a54f217e81ab", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Y:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465204, "uuid": "4c077591-eeda-49f5-a53f-8cf539784845", "value": 2007040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465204, "uuid": "764e74f7-4954-42d9-9c54-635098104e47", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465204, "uuid": "9e54e286-f6b4-4f56-94fd-f0fe68683c2f", "value": "0735f0a9d1bf15efb653b2af563225230bf5b1a6d4dd896a23a0cdce824505de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd76f46-5c9a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639458075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458075, "uuid": "343feccc-1588-4b93-950a-cbf744e62270", "comment": "Malware payload (RedLineStealer)", "value": "6b46a1d6f63d3576e33e29618c1c43b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458075, "uuid": "4ab30821-cb35-4c46-9e4f-71be354de7fb", "comment": "Malware payload (RedLineStealer)", "value": "086038a56016d0935370cdda2ef64e90ca2147aedfd1a418a4ec624f0e262e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458075, "uuid": "f684f332-3402-4db0-96a5-a80fa740f9f4", "comment": "Malware payload (RedLineStealer)", "value": "1006a93dde7beae5fedafbd7b80dc73a5d89e395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458075, "uuid": "8d72a264-2f37-4f66-b959-a89b4d2501bc", "comment": "Malware payload (RedLineStealer)", "value": "464b8ccc856c9030b237a87a48250d17ba7acc780771a18a54a6f000ae2b048ad4fa55e5e01eb6c4773c4b0936a21d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458075, "uuid": "071bb280-cf5e-40bd-a6a7-2d6f70bf9eb3", "value": "T190C4E6383AFA5019F2B3AF759BE474A79A6FF6633707A41E209003874A13A41DDD163D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458075, "uuid": "920090f1-84ee-4be6-9429-b0e9cc0a67d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458075, "uuid": "4984cc29-c856-4a0d-91a3-c7ee85e3d438", "value": "12288:tuW0Iyltl8L0/OgX/TTcCGseACueEG8cowuT:kWRqQgsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639458075, "uuid": "209d3185-52f8-4e38-8063-bd68a9ebe2a8", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639458075, "uuid": "f9e5eebe-2089-4352-9e19-44d5f6c96fbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458075, "uuid": "ca154e73-57d5-4cc3-aee4-cc8cbf430454", "value": "6b46a1d6f63d3576e33e29618c1c43b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dabaee-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639498965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498965, "uuid": "70770079-30d6-4c73-943e-2631625c93d4", "comment": "Malware payload (Gafgyt)", "value": "09bf57ba5ad1beb384d6ef30748bf8a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498965, "uuid": "530a1c3c-3928-4045-9b71-c5b19635f216", "comment": "Malware payload (Gafgyt)", "value": "0863888e4208a3b5370012845f5d4a6186c8ed8c9b85c68f9a553b60f1964a75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498965, "uuid": "1fa7d020-c0f4-4be1-a460-7ee3c340a763", "comment": "Malware payload (Gafgyt)", "value": "37448d42bc27f43d8be6ba91db8ff0ea784dbf35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498965, "uuid": "b0454301-99e9-402f-a7dc-f389a646ddaa", "comment": "Malware payload (Gafgyt)", "value": "aac7df1f09652f6d830ce81a7f019d81a8e68ebbb669f3500bafac733e611dc73135630e51d107350618636ec1e0efda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498965, "uuid": "b6433282-8448-45ee-a51c-649499147d81", "value": "T16AB30741D6548627C2D32B7BA79F434D3336AA54A7E737185528BFF03BC27982E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498965, "uuid": "d7c2689d-b4e7-40b5-8861-beb96c8d7a3d", "value": "3072:IgslTyivFNvKyyU8toivc30fEqUCZycmaQnKBXCYW:IhD2TU8Nv8CEqUCZycmaQnKVCYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498965, "uuid": "7af79ddc-6ae9-4fdb-b4dd-43fe39b1c79e", "value": 111566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498965, "uuid": "0fae791e-2788-4e27-abcf-cc61e792fd28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498965, "uuid": "d4c46a7c-1045-44d3-862f-dc61e7095f6f", "value": "09bf57ba5ad1beb384d6ef30748bf8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15023e17-5cd2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1639481790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481790, "uuid": "b18f7047-0f33-4469-aa12-cd1c19a961d2", "comment": "Malware payload (Gozi)", "value": "d7ff82510fac517eee0b2e2b2143145f", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481790, "uuid": "30a8de13-5986-475e-bc14-d74f9ab97219", "comment": "Malware payload (Gozi)", "value": "0885362cf44eb1c4370d19bd3cd76f2f8b3efb266a40134292be6baf942d524e", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481790, "uuid": "d4ea2916-f2b5-4929-93bc-50e239160d5f", "comment": "Malware payload (Gozi)", "value": "ed05d55e90f405bc6571c52bbc8fe58a4b7f0c23", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481790, "uuid": "d3125354-46e7-4b21-b7ba-0eda3ee609cf", "comment": "Malware payload (Gozi)", "value": "bb88f9a5050a454081b877bd31e0641c6f4d38c3641176595885fa9dd3ae499ee03292084e848024dd5a3857fffad4c2", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481790, "uuid": "37f16172-2b47-44ae-b38c-153ea91c9863", "value": "T13E33D662BA96D985E95617394CE2C6EA7337FC509F6B87073204B32E1E751D0CA13B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481790, "uuid": "e4b42d86-420f-4e57-b46c-918eec710ab5", "value": "1536:xsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0Xs4aaRT5my3Zxid:xhlYkEIuPm3fNRZmbaoFhZhR0cixIHmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639481790, "uuid": "4d3eba73-cb76-4fe1-872e-2cd9d7daa354", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639481790, "uuid": "af3ec158-a5a3-4c30-a000-31db33be9444", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481790, "uuid": "491dd383-fb0e-4991-b91e-ad3c07bf8a68", "value": "XSG2498837.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d63264-5cfb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639499512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499512, "uuid": "afa978c1-dc1e-4b99-92b0-c01e30d1867f", "comment": "Malware payload (RedLineStealer)", "value": "af3f7d9c7b754aa8f858535da28e5867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499512, "uuid": "4fbdda5a-41fe-4d73-a132-d4118e811bb6", "comment": "Malware payload (RedLineStealer)", "value": "08be51dbcaded4357253da2c94e7f4712ccec990050585cc8003626a8e6a38e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499512, "uuid": "50d7ffb5-2561-49eb-81fe-4ede55f71c0a", "comment": "Malware payload (RedLineStealer)", "value": "b5b6a963b15ea4127bf5653024fe78cdc79715f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499512, "uuid": "98e412b5-90a4-45e9-af4c-fdc68c252be7", "comment": "Malware payload (RedLineStealer)", "value": "11230ac59c35dafcf848449c1b95ec7ae6a100d12fa70e42d87a4df7f41161640e3c555935685056a68d19f85866aa61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499512, "uuid": "c45aefac-5060-43e9-9487-39b48efab676", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499512, "uuid": "f470a0a6-010c-416b-8cb0-0739b832730f", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499512, "uuid": "93f24f96-3a92-4ec1-ae06-b4c4ff52ca8d", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499512, "uuid": "9fac0074-7d9d-42f9-8940-8a55aeeec364", "value": 442441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499512, "uuid": "9ce613d2-2c93-4ec3-b623-5cfc700c3a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499512, "uuid": "24d12797-4850-4511-aa12-bbc6bb4f3dd9", "value": "af3f7d9c7b754aa8f858535da28e5867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a320d773-5ce3-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639489330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489330, "uuid": "fb831c57-bf88-4d30-a74f-168bacd4e454", "comment": "Malware payload (DCRat)", "value": "d3989823d922d5c364d0961ab86c654c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489330, "uuid": "1e1df36b-34a2-4e2d-b61d-e620819a02ff", "comment": "Malware payload (DCRat)", "value": "08d33ebc1345be2cb6df4def34ec217776f55cff5d71e053706851014e23391e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489330, "uuid": "7152956c-57a6-4643-82fc-38a344add66c", "comment": "Malware payload (DCRat)", "value": "0d197edec6f1dfd294e0ecf15cc190d786871c5b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489330, "uuid": "8afde886-8096-4212-a864-f414f0fcf806", "comment": "Malware payload (DCRat)", "value": "fe3acd0fc0d22a53b12524960affb850b6e2217f00ffd5f22fb98545adf30da9ba5158d778373b1db8f1f4437cffee6c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489330, "uuid": "7ac4f5b9-9353-4519-8477-6f7d58d448cd", "value": "T12C3549123A44CE12D26E163BC5EF405847BCED417A62DB1A7E6F339E65423A70E0E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489330, "uuid": "9de7e855-537f-4d2d-8698-29b770ab399a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489330, "uuid": "f9aa5e47-a013-4573-8f84-b771d726ce20", "value": "24576:0qJH388XpySAwg8WFQNuGKjTFdNG0V6BPOfPqW+4:9sWp9gnFCBmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639489330, "uuid": "9b66b8a1-fff8-414f-bf97-a0acc6c4e7d2", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639489330, "uuid": "7f35f631-307d-4b51-83c5-eeca872fc617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489330, "uuid": "83f232f1-6cae-4a25-a70d-629864885cc0", "value": "d3989823d922d5c364d0961ab86c654c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6551f642-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497387, "uuid": "c10c49fc-21d4-4f93-be8a-256460805798", "comment": "Malware payload (AgentTesla)", "value": "114a8102475cfda7197fe15fce2d4abd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497387, "uuid": "e6d71e3f-4677-4f34-a6be-b64bb1a42ff6", "comment": "Malware payload (AgentTesla)", "value": "0939c2079a4e68e0fc9239bfa7e20f3ab69fb19984ed240009f4f3e001d7df2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497387, "uuid": "31f144f0-3f70-426c-8e74-1c2d394b7578", "comment": "Malware payload (AgentTesla)", "value": "e5e79ae01135c2307d5cf0678d4f30410ccdf744", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497387, "uuid": "52c50bda-5ffb-44e2-ace0-f838f676da15", "comment": "Malware payload (AgentTesla)", "value": "9418fdbd79340927482dd8e36b5b9625fd5351f53b8c90b5383cb05d56f66a16bc44eaeb6dda75505449a5bb6577602d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497387, "uuid": "3c5df083-0462-4382-b424-22b89b4d7459", "value": "T1EF610B606A7C4D81EED14253AC95FE7E0293B017A2DE094770CCD4AD07AE3061F76546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497387, "uuid": "a2840718-5289-434c-acf7-a583025aa395", "value": "48:gQ6aTrY83ZJawm9BB5aoMEAN+mbg9yd5IAgq7ATkewTJUP7+WFY2vvjJK:9H8qawYbaFPEUA1+Tk6WF53A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497387, "uuid": "f1a80714-92cb-4e5a-b4c6-42817de58f57", "value": 3317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497387, "uuid": "1ebaef0b-49a6-4636-8d21-31bd20c87a44", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497387, "uuid": "a8ce6779-f0ee-4f22-9c2a-3733616896fa", "value": "W556263747ONBGRT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b77b1f-5cf1-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639495289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495289, "uuid": "e84b6f53-1ab3-450d-94a7-8722639c3423", "comment": "Malware payload (RedLineStealer)", "value": "531c630f4a2ab5e1b6fd31faf6e19d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495289, "uuid": "b7d71e0e-5567-4599-b2b7-65b64469493d", "comment": "Malware payload (RedLineStealer)", "value": "0aa41cb0fb218285c2b73b3c7f704755567eaa0f23b959702301e63beb83c7cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495289, "uuid": "b505b3b1-a452-40a2-85c8-64cbeda5f803", "comment": "Malware payload (RedLineStealer)", "value": "282bca9dc467abec872d5e06f24afcb5b0ff36fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495289, "uuid": "b43fe54f-3b98-4985-be7c-4b885613165b", "comment": "Malware payload (RedLineStealer)", "value": "fed67ed6764fcda7faaa6dc1d79d70b436bfa6e143fbc39a45100f64d2154cb914f33dd08512a3c4a29bdf10ba08cf45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495289, "uuid": "6dcdf480-6e0e-4c41-a00e-9d1e1f0b49cb", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495289, "uuid": "eab7deb1-a2e0-444a-810d-a80cbe1a270f", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495289, "uuid": "b2084f36-45e2-43ae-bab5-4cf4774d1c72", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495289, "uuid": "d9472358-063b-4324-860d-218d04d721a4", "value": 442428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495289, "uuid": "a30b1858-51d7-41f3-b07f-8f447929e6e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495289, "uuid": "f65906ee-30f8-49b1-b7cb-dff16bffba33", "value": "531c630f4a2ab5e1b6fd31faf6e19d6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86a76aa-5cb3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639468804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468804, "uuid": "686354c0-135a-4e1c-b9a7-234b371d3aa4", "comment": "Malware payload", "value": "4f05d08c2c312ca7cacc881c1858c6c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468804, "uuid": "bee6b675-aa6d-4507-b43e-43b9f1a50788", "comment": "Malware payload", "value": "0b23d9940964c166e0dde9c57c929e05b7dca0df6c84fa50ffa62c217a06e0b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468804, "uuid": "ab060497-841e-459a-9f3e-94c9016ace74", "comment": "Malware payload", "value": "9cfcdc071bff1818e2f74b92e56a2929ba51d1d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468804, "uuid": "dc15046d-12a2-4167-80d4-2aac1f33ef94", "comment": "Malware payload", "value": "e1ca373e6e3e64be64291707339a1cd2950e6b2c9a8d34ac4acca996012bf43b76759373a302e4af830e8aa7c106ef2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639468804, "uuid": "f9b16463-8766-43b6-bb61-e898197d63b7", "value": "T1C2A5330C43B979ECFD9F06292B534DD0C6EDB2E0F50161A2A2545CA85D3F1BE03AF966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639468804, "uuid": "9ed5be51-ee98-4846-b6e0-ffaaa30c2143", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lff:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639468804, "uuid": "1aca0c5b-e65c-4e35-a843-f9d254b0e82d", "value": 2121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639468804, "uuid": "bcbf2664-6939-44d1-8411-774463be29f4", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639468804, "uuid": "78e7e956-44f1-462f-8e49-9b58572abc49", "value": "0b23d9940964c166e0dde9c57c929e05b7dca0df6c84fa50ffa62c217a06e0b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c723ff9e-5ca8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639464050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464050, "uuid": "032e7560-35e1-4d5d-8d24-e9206722057e", "comment": "Malware payload (AgentTesla)", "value": "5e1c9b4e130a7a9bb68ed6e6f414ff20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464050, "uuid": "63946db9-09e6-454d-b5fc-109ef01c7c86", "comment": "Malware payload (AgentTesla)", "value": "0ba7a7c7189d5bcd38048ba7418ff521d6a00ab36804b8980c4d51ba43fcf070", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464050, "uuid": "2008fd61-c85e-4a9b-877d-1d45985381bd", "comment": "Malware payload (AgentTesla)", "value": "a32852ea5047dd4ae75dfac7a7bb1bd3c241b2a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464050, "uuid": "d06705c8-82f8-40ce-a65d-657ee24de916", "comment": "Malware payload (AgentTesla)", "value": "99967900cdb90434b372f8fbfe32964c412006d0700587ace9faa3ae84068c6d0f0f7211e47ad9184d1bc0a4833fa833", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464050, "uuid": "3c7687f1-1853-41c7-a280-5b020037013d", "value": "T12CB4230876D243ACB0722DAF05923B9DB7C76406387947B17E34B1B35538EEAD6B6834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464050, "uuid": "d5d0daa4-9433-43a8-b45b-c8831305fc03", "value": "12288:YH8eNjWcG92dAPExTt5nCRxz7WVRys17fJcESIGsun+h:Ycc29YAPY3nG7W/y27wCdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464050, "uuid": "8f10d69e-e52f-4e49-a285-344908cc2368", "value": 513485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464050, "uuid": "23acfb72-602c-4377-be0e-1bb8c905e401", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464050, "uuid": "89bdbf49-9a8f-4412-98fa-d36dfb9dfde8", "value": "Purchase Order 1212200205_PR21220055.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c297a56-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639466045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466045, "uuid": "b3269fbd-2a38-412f-adf2-d7b720baab3e", "comment": "Malware payload (RemcosRAT)", "value": "2fb132a4b50eb81b3ba95e4e0b2ecb76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466045, "uuid": "bed72f83-e1da-4592-a48e-86bd93bd8242", "comment": "Malware payload (RemcosRAT)", "value": "0ba8a2b8978511bdfe72399fa7ce35ae07a12c34e1ccb8d12d4a7de4b1106eac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466045, "uuid": "7050dd3a-4ea4-4d7a-8cd2-df69f36ec80e", "comment": "Malware payload (RemcosRAT)", "value": "a65169cabd66875ce8bee72dca741c2c8ea42775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466045, "uuid": "6748a984-9653-4ed3-90b8-6866c1ae71ee", "comment": "Malware payload (RemcosRAT)", "value": "e9846f1e9be9f7e1954f73d9fda71c98b9181decedb87754f865dce149d01d7559dd8b7c1c99f5192a408fa2cdb01944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466045, "uuid": "db270858-927d-495c-8b69-8b0372a71132", "value": "T15BB41224B2F626DFC951ADB08FB6DA50B3B25865125C2B1FCB903DE28933355C2524F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466045, "uuid": "d32a468c-57a1-4ee0-8cf4-dc3932aeb7c7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466045, "uuid": "b192cec9-1a7b-4791-a74d-c053ff0aba1c", "value": "12288:3lneNaGPKXRhV4dA9xltwt7WLREoOdwVSt20jGWWDUf:3ojKXRhV4e9ts7W1EPwct20jGIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466045, "uuid": "c15a4e87-33c1-4580-968c-dbf3ca4999ba", "value": 511017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466045, "uuid": "c31fb113-0556-41f1-b8e7-6c7bfde4070e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466045, "uuid": "47eac40f-63fe-4c1a-b20e-f962e856c246", "value": "Proforma Invoices_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235afbd3-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639498994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498994, "uuid": "9e01787e-4aa1-4636-8f53-7da915994c36", "comment": "Malware payload (Gafgyt)", "value": "235ee0cff85cc1f6aba245c6a9d8b41a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498994, "uuid": "6343095d-5da7-4752-bf96-e1ab7f8b7dc0", "comment": "Malware payload (Gafgyt)", "value": "0bf6a4ec2645de1e6af4bfd1a2dfaaef7cfb483b646e2a791891fa69be887e57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498994, "uuid": "ead1ef4e-167e-4f30-a254-2ea8f16d532a", "comment": "Malware payload (Gafgyt)", "value": "a4dfc7694f88e71c6c4655322aa3a1f4fd47c03c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498994, "uuid": "a7f5f61d-34b4-4ccf-966a-0d0eb59bc941", "comment": "Malware payload (Gafgyt)", "value": "fdb519da890e51aa056ad8350e32eed0d9cab8ac5c949a88a0299b781fd34b37678853a44d377fae744b8c846611d206", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498994, "uuid": "585a6f4d-9f9c-4e7e-b914-48df5904c063", "value": "T145D3B62E7A61ABFEE169D63107F35F7083A625D227A09345E26CD7181F3128D5C8F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498994, "uuid": "74fa5ab1-bcd4-43db-9f97-68d9f001d027", "value": "1536:rHfdlkOQauj3u4882rKz8y1KinHdzZO5Ax+zCcz/qIz7Z4bylVDsrrjgybCum/nj:pxwxZO5Tz3qIR1Vs3Mkm/BgxYy0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498994, "uuid": "5eb7f1f8-d471-4361-9979-39e11fa5f99c", "value": 140048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498994, "uuid": "c809b99d-b95c-4be2-b845-88b9e16ab211", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498994, "uuid": "a470fdcb-a386-4dd2-8458-7863e2564cbc", "value": "235ee0cff85cc1f6aba245c6a9d8b41a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1378de79-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444851, "uuid": "52fb0c1a-9d62-4f71-a156-c4df8e29a3f2", "comment": "Malware payload (Mirai)", "value": "458ed84a0dd64f31995e66887cea267a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444851, "uuid": "9dd954ac-e73e-432c-8295-293fb61779b1", "comment": "Malware payload (Mirai)", "value": "0c15b9def3587a04db11e7b65d0aeaaef3ccc4cb9b57610a3c98b90ebc35a81f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444851, "uuid": "6dc3bbe9-b7b1-4082-b481-c2960bcbc122", "comment": "Malware payload (Mirai)", "value": "5a0627f79c9a72860b6b5ff8031137c4007f1c3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444851, "uuid": "7efca4cf-0d56-4dc8-999a-d1b191f57bc4", "comment": "Malware payload (Mirai)", "value": "bf708786cb5d8d97933af02914b1688686df24d21828128bb2f126b8a2a8355e575ad47728a8c193a94e9d5825788621", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444851, "uuid": "148be1a7-0684-4317-8a8f-9b8f952df8ae", "value": "T1B3A2BF60E1C4DF46FFAAA9B11DD1CB903BB11B8933745D9751A4AF005F1A823A49DEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444851, "uuid": "ee848f5d-a9e9-45ac-9b6a-46e72e4cc4d9", "value": "384:6Y7a1EulgncOiFst6UYbOsCliyLBt6PTxdXcPOv3auM4uVcqgw05VxJO:haM+bRbeBVYbxp4Ov3at4uVcqgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444851, "uuid": "0359ca4c-e62c-43d3-9c7e-5efeeaa07d81", "value": 21768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444851, "uuid": "8ad9cf6c-db12-452e-bfb2-fdde687411ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444851, "uuid": "0fc652f1-5def-4009-848f-1ebdb9ebb689", "value": "458ed84a0dd64f31995e66887cea267a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bc608a-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639465066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465066, "uuid": "c0242f52-25b7-4a79-bbd4-c440ec8ae800", "comment": "Malware payload (Vjw0rm)", "value": "75f85ffac63ed2e49f0ce8f4d6a8e929", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465066, "uuid": "e8f55d21-8a70-49b0-81e4-14d741ec8abe", "comment": "Malware payload (Vjw0rm)", "value": "0c576250fd7f281b88f55de3f3c6aef2fda03fc3a2e88ee51b92af6b317ae515", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465066, "uuid": "72153bc2-19a3-4975-a9a2-4278d6634bd7", "comment": "Malware payload (Vjw0rm)", "value": "863a9708f5f0117f10cced46e80e42259c919d5c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465066, "uuid": "f5637358-4ec9-4861-b74d-2419b980ec89", "comment": "Malware payload (Vjw0rm)", "value": "3ae7e64556375b231f3bc4cbe4e3241a6b8310c0d8c9da19c20b03d7923fc249a5ba0ee669608ec20a0eaea7f3afe8cd", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465066, "uuid": "47bbca50-d427-4797-b54a-fb7d5df0ff03", "value": "T1C5639F8A2BC210B2C44347348E87BD6C7F77B5A044F1B72A31CEB54A27F3A1249A2759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465066, "uuid": "2360d328-1fc6-4f4a-b315-f35eef090e84", "value": "192:AS0JAb/NfbRSq17hrtlYa6IxyD6StNkfDk5h33lZTdcVFgnPPcpG6iZsV:IVq17hZf6ND6uifDGhlZmFWf6iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465066, "uuid": "a15964ca-3f70-4611-9157-4059e57a0f54", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465066, "uuid": "f4977438-2f48-402f-9181-3ef9d1b9f139", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465066, "uuid": "a6675fcf-5d4c-4750-81ca-99d728f35f0b", "value": "#00957.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f130c9-5cee-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639494105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494105, "uuid": "cb4feb58-6201-4e6c-8bf2-fbfe1270e960", "comment": "Malware payload (AgentTesla)", "value": "e3b16e192c72089a85b9b9cc7269b881", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494105, "uuid": "851bd8e9-bfe0-4a93-849a-13680e81fa62", "comment": "Malware payload (AgentTesla)", "value": "0d0c4d190389186970313686287876eed4afd90a55a2f5bdce21ee8a8ac469cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494105, "uuid": "8edcc1cf-7a52-4be2-9391-4ce759de2383", "comment": "Malware payload (AgentTesla)", "value": "6fa663946a0277fcaf6b5afe5bc15ccbb9f6fc06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494105, "uuid": "2ea7a937-2f64-4a34-8ff3-996e59af0089", "comment": "Malware payload (AgentTesla)", "value": "bcef27ae4da288512b8ef65b56c466fdc045099365e586433d7df55747b00ce7a5da9664f2e42a085662a757bd71d925", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494105, "uuid": "cbec6b35-dc7d-4562-8211-f5fe28b4c2d3", "value": "T126B423A0DAD899F3E81943725131A73893937EFC69B0EA5F2B183F258B731DB0416217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494105, "uuid": "72009216-6727-4d18-a613-6effb8889160", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494105, "uuid": "c14ccc1d-9537-41fb-91fc-8532b7abf289", "value": "12288:0uiGtsKmLtYQ5MmR443xRenCF1K5eQ1i/4kA8/bC:0uMvLG+z46in958/9As+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639494105, "uuid": "c6af0330-2a5d-47a5-a50e-a6e1fc1f9b9f", "value": 502066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639494105, "uuid": "ea90c2a8-4eb6-423b-8aa6-35164f42c36a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494105, "uuid": "2206b546-6241-470a-8157-58ffcf7feaa1", "value": "E008_SWIFT_MSG_13122021_26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac254a57-5c94-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639455415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455415, "uuid": "b4b40586-8fda-43d4-a7fd-33c96440b596", "comment": "Malware payload (AgentTesla)", "value": "9a5b5175f8306c233ccd51b8d6ca67d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455415, "uuid": "bab8dad7-4d90-46ca-b627-853b0367184c", "comment": "Malware payload (AgentTesla)", "value": "0e31063cd4775f4819986f00513a22d959b5bb3e66d7883af0622d8a76e95b67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455415, "uuid": "17beb667-1aba-43d4-8e85-b8a518ed708f", "comment": "Malware payload (AgentTesla)", "value": "c4ab6dc8da5461edf96aed5d9475d34951fee006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455415, "uuid": "1338d09b-7152-4d59-b72f-dabf839c0826", "comment": "Malware payload (AgentTesla)", "value": "7fe4151e9068a358e3b1cfb13d6a760e60ad91e9558bc234ee037a7cc7f91abd35e3da6e538c8cdb9e7e5d51c45c3fb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455415, "uuid": "0bf33f72-8ee8-467d-8d3d-c6fa2871d1c2", "value": "T1A5E4F193E2DA0896FD264B7280374C6D5A63BFB6BD71E02D510DF5762BB33C3101A91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455415, "uuid": "2d4130ee-2468-4ced-b7d8-9b476e45c60b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455415, "uuid": "68642c94-594a-4152-9ced-6094781d26b5", "value": "12288:D6ZedZqns+CI3kmLqszBQkCdMHs2vN1XDMqN9fFml0f:EwZakHsx/HsMN1zZ6l0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639455415, "uuid": "c7f18c20-693b-4a9b-9f18-624b0421394e", "value": 712894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639455415, "uuid": "c0644fd5-1f7b-40b3-8860-22a4562fd567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455415, "uuid": "ad336bdd-87a0-44e3-9247-5d056b6fc34b", "value": "EDC purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd2c9f1-5cd4-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639483043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483043, "uuid": "26609713-ccb7-41b9-a114-efbab9e12889", "comment": "Malware payload (RedLineStealer)", "value": "b11a60d866d6dc5cc2d649aa3a066cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483043, "uuid": "1ed8ef44-ad65-4b18-b13f-f02293c0da92", "comment": "Malware payload (RedLineStealer)", "value": "0eddaae3a17fd5ab04c86240a0750f5afe1ac23a2461d70c24cde83957f508ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483043, "uuid": "db965af3-68b3-4a09-a5bf-e6d34dc7d662", "comment": "Malware payload (RedLineStealer)", "value": "b534bdc96ea734e8fa2373e212e804eba914eb6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483043, "uuid": "45d3794c-916c-4cd0-a5a6-229fc1474f9a", "comment": "Malware payload (RedLineStealer)", "value": "a013cb0ce43995c8a03e3ffbca744674998492d0091c5a88acbbb18663235ad578d131b77c2d09ce0532bc343fac2379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483043, "uuid": "819b1181-b2fe-4edf-9014-9ab554196011", "value": "T14064E0D176A0C472C2A2FE33A8654EE05E3F7951E960814F3B782F9E5F722C19A25317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483043, "uuid": "dfc893ac-e32b-4c69-ad71-1efcdc9a44ab", "value": "307bfa2331726fa806b2240a5641cf4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483043, "uuid": "77938227-2ab3-4495-8b48-e099a577fe69", "value": "6144:irwqe4VjQEMiJtM9OqtCVkuXRVwL9RcBONCu2b7ITsqs:qwqe49snpslXRB8YX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639483043, "uuid": "fa276962-8a19-46f2-af2b-4fe42e6fbdcd", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639483043, "uuid": "f6d106fa-a934-4d50-a472-fedcd617cde1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483043, "uuid": "cd0306b0-ce31-41b5-bd0a-9a7e8a6b24ba", "value": "b11a60d866d6dc5cc2d649aa3a066cc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6388377-5d04-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639503616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503616, "uuid": "0b284d9f-bb0a-4a08-9d12-f6605b48e0fe", "comment": "Malware payload (AgentTesla)", "value": "997100a0a6ce679f15190a4a23b3688b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503616, "uuid": "5137f4b1-9e73-46b6-82cc-4871a0eb80c7", "comment": "Malware payload (AgentTesla)", "value": "0ee04d0fba707a502550fb622f1e562a7b29029e24027424d34c9b5315236e1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503616, "uuid": "3607d4c2-7eff-4b4c-8ad8-4b006f16f991", "comment": "Malware payload (AgentTesla)", "value": "4bb390f6af2e4ecd65584e392ab5b110ce88316a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503616, "uuid": "40027037-8165-450d-b25e-58b68183a830", "comment": "Malware payload (AgentTesla)", "value": "1b76ea84957ac145bf22d1ecf6a369b05f4c202f359b11a1320e1163559d3ca26ad7e7436de4fbf4b94ccb8e7ee18bd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503616, "uuid": "c7c2c3f4-8a04-4134-8736-c5052a8804c7", "value": "T11E55334372644B3EC629CEF81B927B18D372B96A1845F31C4D8992E37B17F9381606E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503616, "uuid": "c600a30f-e95f-41b8-bb36-c25690ba3de4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503616, "uuid": "227ff97c-aa01-4d0f-b7d1-9ddcc1d8dbb7", "value": "24576:1KhgqlGpQfUuTemB9Uql7QlUzzJ01KeqPNnUXL1t+PCJTbDMwEVRbNjB8ufWhJIL:163gqhf9UqSSzzyIewnS1tZJb43NjBvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639503616, "uuid": "4c4e4b64-b4b5-4b0f-a600-59a3d02a91da", "value": 1367552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639503616, "uuid": "2c38f806-9932-44e9-88f8-8d222d865f12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503616, "uuid": "a637e1cf-8261-4f34-b40f-3dfadea51f71", "value": "997100a0a6ce679f15190a4a23b3688b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36857fda-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497308, "uuid": "8f2436cb-6e14-4b5a-8df8-c04f80888e90", "comment": "Malware payload (Formbook)", "value": "d09e0b39d0fdaef8394a20eaa33cd12a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497308, "uuid": "cf43b145-9360-40ba-a0fc-8acdecb1db2f", "comment": "Malware payload (Formbook)", "value": "0ee912f9023209747e60617a512cc7d5ae6bf4820c37e1e20c4e7abe27b8dfc0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497308, "uuid": "fdfbdb61-6a83-4b07-8cea-c313663fdce7", "comment": "Malware payload (Formbook)", "value": "ab9662a66e9da4956e1cad89fdb52b63b6df62cd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497308, "uuid": "90cd18d7-b702-40ef-b893-ff5818d93721", "comment": "Malware payload (Formbook)", "value": "0bced91b01814526bd6c8efd505eb42ef30aa66df58679ffeb6413cbb394d4c2a65ebd91da562d960fe04e334ece8638", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497308, "uuid": "da2bbfd4-22da-4b6c-bbbb-27c13d0a6389", "value": "T1EB75121C3D83D9CEC5590FB53BB180346275AC762A07D2DAFC8C3A9F1A6B3193963606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497308, "uuid": "01a33ad1-222b-4217-8071-dbf5cc5e07ba", "value": "24576:5zG8crwkdUU8e+iK8e108KmhbVIcXZMZJSZXPwpXAr:Jiws8viP58K0fZ04gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497308, "uuid": "534831f2-178c-4ed6-94dc-021689b8635b", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497308, "uuid": "f635eebe-bdf9-472e-ad64-4500c4fdebbe", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497308, "uuid": "9ef5ea06-bbbd-4b23-9b23-5a7ddcd9695b", "value": "Nueva cotizaci\ufffdn.1119918.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7761a40-5cdf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639487673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487673, "uuid": "ac7041c1-c5fd-49f8-a946-9fdb52db86b4", "comment": "Malware payload (Formbook)", "value": "f2c6d74d9faa8dd958dbd50101a95792", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487673, "uuid": "e0cd4ccd-7c16-4d8b-80c9-23444693226d", "comment": "Malware payload (Formbook)", "value": "0f4df99356c9f5c4d67b60d3a7d352782aa83ea82057716eb706d480c8616b26", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487673, "uuid": "89813147-637a-4ae6-bafd-56a838491d20", "comment": "Malware payload (Formbook)", "value": "489079097bc05626dccd8d6079e925079305ca43", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487673, "uuid": "ed9ed9da-36e3-46c2-9ef1-1087bd081cb1", "comment": "Malware payload (Formbook)", "value": "ee0fb4a6f26d5ac80a14f77d4eff0f3b5d388a15b37c66ff76be3c9bab567f65f7a669336c1b32662db1bbc6309ff50f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487673, "uuid": "3c810e6f-d688-4194-8515-69311c6d3aa2", "value": "T15C05231ADCDA125BE261F73CED7959708209EC9CCF83EB02B009771EA5F776548D121A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487673, "uuid": "97b5b982-e662-44c9-ba99-5935874483d2", "value": "12288:RcM0Ql0LwsJq5trsZqRQSiTFCnXKyZS4fCaQwyNsY4Pbbkfs3sFn1ErxNs:CM0erxiU6yzg34PbbkfsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639487673, "uuid": "236c379b-60ed-4272-a549-a6d75643c285", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639487673, "uuid": "d1ab42e2-bb62-43d8-9b79-a6f5ffbcd0c7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487673, "uuid": "1a822708-bacf-458f-91e0-36c5481e2e3c", "value": "Order Confirmation nr. 2021-O-1274.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b615a1-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639467266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467266, "uuid": "b0cfccbc-c19b-4cf2-b3ab-9dd5bd5f83b4", "comment": "Malware payload (AgentTesla)", "value": "6e088313896299776969c3c4c40cbf68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467266, "uuid": "116b45c5-d68d-451a-b956-1adccc310b28", "comment": "Malware payload (AgentTesla)", "value": "0f6e76a198cb4ab682eaa6ff5b4503c75259b4da4c987720cb1a30b94fa272b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467266, "uuid": "01b3fbda-3e73-4b94-9f25-b50e03060c83", "comment": "Malware payload (AgentTesla)", "value": "723e0d942f90bde2357d08774e4196fcabab9b41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467266, "uuid": "f95b2c49-4ad9-462b-8aa7-b94470ff0577", "comment": "Malware payload (AgentTesla)", "value": "addfe279aab72d2130d08e96b395224886cf4ead85699edd54daa3971a59e5aebb91a180d8f53a232e35d9a968586adb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467266, "uuid": "ef9d0b12-a2ac-401e-97c2-c2c1b009f184", "value": "T1C655239725D8C691E37B6B78F8126918C7B83D150622C7389CC4F3DB09FA3A64D246E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467266, "uuid": "02b66f0b-dfba-4f4a-b5bf-bc86a0562ff0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467266, "uuid": "542c03dc-4176-4c65-a7d6-8eba0bc319ea", "value": "24576:BxM4rxCr2CjxUty1om1PWkTSyDpRNZmw2cnxTf0e186ln9s5DIS3:I4Mr2C1Utrm1DSEJZmdaxwa8GDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467266, "uuid": "a8b043f7-c22d-460b-bc21-88ecd2d5c4a6", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467266, "uuid": "a0137e94-e6e8-40b2-ba81-f1c2ea1fd359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467266, "uuid": "d1cd2797-2a44-4a00-936b-c8d0bd987fe1", "value": "498209567411.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e05101-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639465097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465097, "uuid": "58195d8a-5bfc-441b-9516-3a92ff7c82ce", "comment": "Malware payload (QuasarRAT)", "value": "591bb2b50c347846a568c82d300969b9", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465097, "uuid": "f5cb060b-76bb-45ec-8926-59e5f0fb8527", "comment": "Malware payload (QuasarRAT)", "value": "0f82668bfc4a7cb6bfa8f8b0acfe7aeade12584e9929423de0fbbee8f0686384", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465097, "uuid": "680a5403-5fd3-425e-84ed-1258cf4477ad", "comment": "Malware payload (QuasarRAT)", "value": "4bc646ff1cdf8488d7ad8e652cd13f11cd5e0441", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465097, "uuid": "f589ba5d-2826-4f48-af0c-05f5cc2630a9", "comment": "Malware payload (QuasarRAT)", "value": "e353c85fd9de6498225dc980c8b63491301824fed77757760fd77256b740d778dfe6260665016d7f030245ef43a0c64e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465097, "uuid": "c5cb72ba-a673-41a6-b456-82249a64eaab", "value": "T12753DC082B41216BD439DB3569E2B2249223F48143F52F3EB1AE606A4FC32E049893B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465097, "uuid": "b503eff6-e0a3-4577-a875-4c93de64c255", "value": "24:54GpWoazbG/EjrIERTLVX6KW2Yc0Db2ugEZAeVNMYt:54GpWoazbAEjrIERTZqFhz/ZbNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465097, "uuid": "705366da-e02f-440a-907a-70b20691f06b", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465097, "uuid": "e840b9c9-f21d-4ee3-bd9a-8341aa2cfdc5", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465097, "uuid": "dc29aea9-4dd8-4b1a-a661-aedca45e9912", "value": "#00959.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688e41ed-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497392, "uuid": "f36085da-55d5-4834-bb69-88265faa4d3b", "comment": "Malware payload (Loki)", "value": "b539fb5731b1ceaa1095dd33978a7d84", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497392, "uuid": "41f5d720-832b-4b01-b86b-4be7a143530a", "comment": "Malware payload (Loki)", "value": "0fff85c16469321bc30312f628e5f3d955bb086c20812c2b3f536e6dab2ea5c0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497392, "uuid": "2b681127-76da-4426-90c6-1886803e8478", "comment": "Malware payload (Loki)", "value": "7b5cbeb95ea466ce123b4b8cc5935b964cb8bd54", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497392, "uuid": "5e0eebd7-fb45-4b61-ad39-831511bf03c8", "comment": "Malware payload (Loki)", "value": "6b38817cb02ce7bb203e7d9560b6d42a49569f251e8754d58872ff9d82115c2810a6ec2afb9cb7929d370d9b4987fb57", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497392, "uuid": "0865118d-57eb-4d78-aaa5-488052c59273", "value": "T16B81E7705BBC4855CE3340F2C67AFE036AF3F0C29ACB0854794DEAB11B693744AB5956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497392, "uuid": "207f8a47-6e97-424b-a9c0-69f2bb7e9703", "value": "96:TaTwPs9qeq32vsLpBBBNi76Xa1eJZ6SyEeM78:TJP1ebvIpjKXiWM78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497392, "uuid": "ec11e045-fc68-42cd-97f5-27b25fbcc932", "value": 3874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497392, "uuid": "b25e2978-05ef-4fb5-be35-1489a5c9b91e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497392, "uuid": "21f3ccfd-7bc4-4751-a5b7-464a2e123411", "value": "Order DM8 6700356.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a3b6b2-5d36-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639524733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524733, "uuid": "f2311c87-8f84-4bcc-9071-34b28e874171", "comment": "Malware payload (Mirai)", "value": "cd010698e3b998617e4264cc3c304605", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524733, "uuid": "ed9e0eb3-5170-4935-8368-9e5d9143d9a7", "comment": "Malware payload (Mirai)", "value": "111ca0d63942f2c44e3a42ed24b94b7803773a7259c7e0ed7e34530365e66006", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524733, "uuid": "cd88d745-072d-46b2-8d5d-ab176e7be81e", "comment": "Malware payload (Mirai)", "value": "a05d15724329d4b9e431f9135db08704f47c96f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524733, "uuid": "a88f5968-1f26-4c81-a675-71886d24e8df", "comment": "Malware payload (Mirai)", "value": "fab5e1ebbbbc17573b3d3fccacc65a2d20b31dcd4681740ab7aec6565dbada69a107056d9c542b0e824c948e746b9327", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524733, "uuid": "d8636c65-bcaf-4600-a9e2-06447992244a", "value": "T15973AD33D1686DA8D0664B75B9988E309B23A28416933EF6D794CB784013EECF509FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524733, "uuid": "fe479616-82df-4415-be4b-d1dbfd26d1b6", "value": "1536:9aD/MEGvbwt+i7EhHYDn8C/0rrnmFXlrKkNGIkFgCJl2c:9OkdzeEh4H0rjqlOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639524733, "uuid": "136fb614-f4b6-43c8-9fbf-b97049e5fa03", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639524733, "uuid": "2e9feac2-15c0-4f81-8426-f81f65b6d41b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524733, "uuid": "f24533c1-ed49-4b9a-95bd-bb310511d2ae", "value": "cd010698e3b998617e4264cc3c304605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60d9bbb-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639498838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498838, "uuid": "6f1a64e0-7a64-4249-9be3-6be93c345d50", "comment": "Malware payload (Loki)", "value": "4fde698a0f139313259ba84470751f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498838, "uuid": "e4ec78c0-e768-42fa-bb25-efbeac0c6174", "comment": "Malware payload (Loki)", "value": "11c493f071a37154525990bacd3c84efcdd751719ea82786a36a7503911a4d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498838, "uuid": "5a428a98-b5ff-4091-abea-972c69b09289", "comment": "Malware payload (Loki)", "value": "30e82d0af5c31f4ed2681f052a8eb0270436d0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498838, "uuid": "5bf31e84-72a0-45c4-bcf8-c1b5d3e1b2f8", "comment": "Malware payload (Loki)", "value": "7111697f71520d693b2dc0e1aa61c3a49868189284bb30a68a63b6c7248416e039bc11cbfa5053eb18e0125c409548a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498838, "uuid": "a8a650bf-3daf-49d9-a932-e75f7a751f87", "value": "T19B84D0452AD6D1E4FD7FEBF10CB076C14B38F2D5E541B2DEE588284AEEA2B944E005B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498838, "uuid": "d78c9d5d-bc2b-4c86-af88-873dc1f045c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498838, "uuid": "e84b21dc-c5d8-43fb-bafa-1278ceff53ab", "value": "6144:a4mWFRSWQr2pEoMEzVF7xNCYB2EV/51y5cJOxBTkDl1GwtpWdA6vnQDD/3p1vJY/:asU10VtxN92E345c0xB4RqPQf/RYlPMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498838, "uuid": "3dce7fe8-d3a3-4a8b-8192-f86ec5888a04", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498838, "uuid": "130386fa-bf63-47fe-b82e-16bdb5b86a99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498838, "uuid": "a6308a48-535f-4fe7-9353-a51a1d8ce54c", "value": "4fde698a0f139313259ba84470751f6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4e7c1c-5d01-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639502234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502234, "uuid": "d4ee8445-f988-4566-95f3-1b0ec83affe4", "comment": "Malware payload (AgentTesla)", "value": "9e45f0e9dd7310cb2b6396906d8d535a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502234, "uuid": "ad03bece-5f42-4d7b-982f-71e834544105", "comment": "Malware payload (AgentTesla)", "value": "125456fe8027b40d44b67ae250f582c06e13e852d293738b439e5fced671b134", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502234, "uuid": "5a6d7e2f-8efb-41a0-ba7d-42c1a94c67e0", "comment": "Malware payload (AgentTesla)", "value": "41fad4bba0c0dc2290cb551a4714b0bca551515b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502234, "uuid": "0b5f48d1-e014-460a-8f59-c192faf79672", "comment": "Malware payload (AgentTesla)", "value": "87c72392c5cb02fc8dd7a5d2750526a3142ab594a84330d2e5d9aa064006fb68f1329c16cbebc36d035df4438d71c452", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502234, "uuid": "b588ebea-b824-4576-9473-09376bb2b849", "value": "T11E5523BE229365DDC82A47F87738803C53753D36904BD289ED99B6DB0927B617E23423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502234, "uuid": "3fcbff08-eb55-49f8-99aa-269bc1130fe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502234, "uuid": "e441a541-8148-4890-9fd5-647acd0cebf5", "value": "24576:dAD4zaXVGviQymnO8iP3OHpRnhjsc6L5vArHXCsnah6iBay1u:dzaXVGLn9iP+Dd/6V4rHSsa00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639502234, "uuid": "2c1e3b3f-428f-4d38-bb93-96bd48cf99bd", "value": 1387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639502234, "uuid": "01b31d80-81ac-40fe-9d71-478ea02f15c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502234, "uuid": "59855f3f-56b6-48fa-90de-64b7ef2643ad", "value": "PO 5536894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86412aa6-5ca9-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639464371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464371, "uuid": "1a8820bf-eb80-4da7-9d12-534ad8f18597", "comment": "Malware payload (OskiStealer)", "value": "0c42ac77af3d8c0738dac9163d858513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464371, "uuid": "8ee551fc-10b5-42cb-9d6c-16d8a18e353d", "comment": "Malware payload (OskiStealer)", "value": "125b5a322966a51616fad074a1d5aa4dd1979ff453889d55b01aedd9fa54262e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464371, "uuid": "48764f07-daa2-4513-aa39-98301818250d", "comment": "Malware payload (OskiStealer)", "value": "f3c83c2d3e955899af85790221b7fc2e0392796d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464371, "uuid": "ca1c2318-0ae0-44b3-95b3-ead6147999f1", "comment": "Malware payload (OskiStealer)", "value": "494f2a08ef5e7364015bbd568ae072f3bc7728e16c5d63225cbc665ecac35632f197b317f5e912d1b3eb7a5260d11bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464371, "uuid": "3ed67dcc-5a10-4d40-92e7-61c0cbb03d65", "value": "T19635122C3A87E5CEC5560FB53766903452B1AC36A607D397F9CC36AF292B3583823716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464371, "uuid": "b26d2e63-fb6d-4927-93f6-4edc081856f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464371, "uuid": "3a64148f-55f6-4ab7-befa-7683853f6013", "value": "24576:Hlf2X07vci3ePUOusPoK+Zlfcy4ES0oPL4lygIqqQbyLsp7vLnVVIGG:hmecKX1DZxUHElY8bqSvL0GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464371, "uuid": "a2c47dd3-0c03-448c-8b81-55f3881d127a", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464371, "uuid": "2761904b-afa0-4be2-894d-7386fe931a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464371, "uuid": "76f3ec45-54c9-42fe-a5ce-d40b24e1e4f9", "value": "0c42ac77af3d8c0738dac9163d858513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b332ff64-5cb4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639469171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469171, "uuid": "3de8bb63-e623-401d-9771-354fc5c8042b", "comment": "Malware payload", "value": "c1f1b06e01b59370aa4380f4414f9910", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469171, "uuid": "9f42e32e-1703-4244-b007-62b392048d9f", "comment": "Malware payload", "value": "138f4c4e3fe1b47bf861cb232a7c31db42ecfbcbf49807bdefd0391f4730179d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469171, "uuid": "4e7ce01f-39fa-45f8-a296-7cadbbe53f06", "comment": "Malware payload", "value": "f62b008816c995da893f0538d92a03bf8c3e3800", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469171, "uuid": "1bb0d2e9-1b81-400c-9c9d-679b0403ed49", "comment": "Malware payload", "value": "fe70334126ffafe45c3b41ca7ab75f19fe7e340927693291fbe2d0b230769d92a15ff528687c4ace4dc447c1937911f2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469171, "uuid": "d8e05a2a-cfcf-43ef-9ec7-403f0c188101", "value": "T17D46232372D98226C0DDC571593BBFD930B25A754BA294FB52C82DCA36725E09333E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469171, "uuid": "9d7ca074-036c-4794-9d07-bf6d0909022c", "value": "98304:MYye56sJ2DyE8vdSuvNJS3z2ZGkPTR839R9El72ulBrldNRsgElMjyTwYeNHnEA:LPAyE6NNJ97PqXuZ2u7f6A8wYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639469171, "uuid": "417df876-b552-42bd-ad91-1138bc58454d", "value": 5854208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639469171, "uuid": "67205844-2ba2-41e2-9df8-c10f1b7e7cc6", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469171, "uuid": "a733ded2-57b6-4c2f-b174-54f9e7eddc42", "value": "c1f1b06e01b59370aa4380f4414f9910.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e757b079-5d33-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639523804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523804, "uuid": "c83bc3a6-f9b8-4050-aa24-24094d8d8b7d", "comment": "Malware payload (RedLineStealer)", "value": "3b96115b899b776732a45c42f12dcd2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523804, "uuid": "7409069d-85f8-4b49-a235-137f1389ea08", "comment": "Malware payload (RedLineStealer)", "value": "1486bdb5accb1ddffe9042c595c18a932c7807e903d89f8d71d62ba766a37a0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523804, "uuid": "bda50db7-d226-40e2-8568-9ff5a432d55b", "comment": "Malware payload (RedLineStealer)", "value": "21545b1b7ddef7f9ea27ca9b03e138c5b6419034", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523804, "uuid": "1b5c155f-ffe8-41af-aafb-89fcc4ba30fe", "comment": "Malware payload (RedLineStealer)", "value": "de2822ffa71c97ce10bdb7b31c327edf581431af197b272de56d88f1d59f4e54eca7680f8ed293235679a9e337348fe5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523804, "uuid": "cf4b8c35-773d-4db6-a3ce-53b53a64454b", "value": "T13FE44B424799BE8EC03842B79F7BC3CC434C9E0C6657F94829E864F6A32E6B3B551794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523804, "uuid": "41d676bb-484f-4fda-b85b-ddb914bddcd3", "value": "75a8a128219a23d96ece7a8f04d52702", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523804, "uuid": "ed8238c5-6972-4407-a2a5-6b3b9acdb7f5", "value": "12288:NK51FCJ8pKpxPF58YQZPQX0aXM2i4AFIjeyiQJsJbosJUK530:NwaJ8pCxd583ZIX0a82ijfyiQQoQ530", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639523804, "uuid": "b44b584d-d155-4439-beae-0d9761e5e98f", "value": 683040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639523804, "uuid": "ee81dba7-685f-47f4-bcf9-b048e6dc2883", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523804, "uuid": "d3ee729f-768d-4f11-9970-cedb1af1e355", "value": "3b96115b899b776732a45c42f12dcd2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad67054-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510308, "uuid": "fa5ee01d-133c-4fab-ac09-a4ea904ff6f4", "comment": "Malware payload (RedLineStealer)", "value": "c13fcbe8568a12f56eb86b3e8618548e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510308, "uuid": "3ca6b1a4-adba-4a16-997e-9deebefa4033", "comment": "Malware payload (RedLineStealer)", "value": "148dc2a2163bd038e971ed2ae998be61c41518001b2b79cfd3cb5699cbaaada3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510308, "uuid": "e0354d6f-aa38-4434-8c5f-b594c8b66baa", "comment": "Malware payload (RedLineStealer)", "value": "0436a19dfb47ae15c800c4099160b8ef88a4a202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510308, "uuid": "a5cf8736-0a9e-4992-8f19-582d262c6f12", "comment": "Malware payload (RedLineStealer)", "value": "1e6f76217d0b8a1b3de938f14b6659e3fa703eab9b75f7aa40053e4d6a74f9089cca7ad6ef5c4855def25b71f6d496df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510308, "uuid": "a5196afb-b089-4350-a1ca-05e177c435ca", "value": "T12264AE10B7F0D435F1B752F44ABA97BDAA2E7AE16724A1CF12D516EA16306D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510308, "uuid": "ad501a32-9a31-498b-a5a2-fbec8819831f", "value": "64c3015bc2aa34c4a562366c38bb7689", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510308, "uuid": "9e8d58d2-caa5-4719-90ee-be9fe8be5b8b", "value": "6144:SCxPMqIwLUsqLEfj0t3y7oX3y7cHCmQCK+x7:S6isgE70hZX3bHCw7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510308, "uuid": "c1a8ba5c-a12e-4d2e-9d24-9a14436cfa72", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510308, "uuid": "2dfed3f7-7ada-4e57-83e8-2b9c2a9656c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510308, "uuid": "aa0d68f1-cba1-4b66-b8b7-cc5671227816", "value": "c13fcbe8568a12f56eb86b3e8618548e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef60907-5d15-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510610, "uuid": "4db35814-bc39-4fd2-b285-4806260a7bc8", "comment": "Malware payload (RedLineStealer)", "value": "d5ea6def759eca87925417ed7ae13eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510610, "uuid": "dc33ed63-98b9-437e-8c54-dfeef4cde781", "comment": "Malware payload (RedLineStealer)", "value": "150582eeb39232fc684e1957c57e039f62329198a43e2c473c61c456a77b7468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510610, "uuid": "7c8a86d3-339c-4b83-a5a5-83a1e5010c80", "comment": "Malware payload (RedLineStealer)", "value": "668dcb7473960c411e9932e275372c52c9c7b210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510610, "uuid": "6023c7cb-40b5-4a68-8937-679b3f82907e", "comment": "Malware payload (RedLineStealer)", "value": "70696fcd88396a53cb61141a247f7809c08abfc5999101e9517c6dc6cf202368a6ab5b9869e32f9317748ab92fa12413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510610, "uuid": "34e7c735-86c5-4d7f-be20-47f6598f35f1", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510610, "uuid": "61128663-1f51-44ec-bfeb-9ab6a21d1027", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510610, "uuid": "56331f94-6da9-420b-9f0d-7524b0ea6b93", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510610, "uuid": "3eaf97ec-4fa9-4cbe-8fe9-f96af64a5879", "value": 442440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510610, "uuid": "d0da4cee-461a-4997-b7ea-7be2d512f551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510610, "uuid": "1537b19e-ee23-418f-aeb1-d2998d530759", "value": "d5ea6def759eca87925417ed7ae13eaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f10eee8-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465486, "uuid": "cf066fb6-66ba-484c-b244-413ae75d8164", "comment": "Malware payload (Matanbuchus)", "value": "84702bd6e798481f81066c1e0671ae03", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465486, "uuid": "7b97b356-2c6c-403e-a537-8818286ad2ff", "comment": "Malware payload (Matanbuchus)", "value": "15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465486, "uuid": "23cbf70d-841a-43bb-ae61-7ae348f726b6", "comment": "Malware payload (Matanbuchus)", "value": "c53a1d8aa4495cb5acf07ddc069153fbecd37a91", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465486, "uuid": "ce610432-8222-4ed5-90d0-03e4f976158f", "comment": "Malware payload (Matanbuchus)", "value": "c79126213f912a3186c768d1dbf2245cc09cc80decb5078482570534f688d97c247b7d09351aefc18ac696c342c6f8ca", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465486, "uuid": "2d026442-281f-4ca1-bdf8-ad9380f1f6a6", "value": "T1F0B48DB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465486, "uuid": "f0749fb4-1c12-4104-b770-8b64dc5f78e5", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465486, "uuid": "f12d0c20-482e-4212-8faf-67be71c658ea", "value": "12288:rCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp131:rfcqtGWdZPuQIDHaxarC31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465486, "uuid": "f72dee77-b66d-499f-9171-25a37eca0052", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465486, "uuid": "f2b7c831-8ab2-4915-aeee-e9a93e8f3377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465486, "uuid": "52f8418a-2ba0-4251-97c9-eeeb68cc44d1", "value": "15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e08c211-5cb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639470719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639470719, "uuid": "9521e246-d6ff-4bf0-934d-5b91f71e66bd", "comment": "Malware payload (RedLineStealer)", "value": "687c8b3f3d13412d966145e6bf8d5b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639470719, "uuid": "33365503-11ea-474a-9307-30141c50a9ec", "comment": "Malware payload (RedLineStealer)", "value": "15b63d992ffe0d409860c873afec5c359f87200fc229c25d8c2d5c20a760473b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639470719, "uuid": "7c9dd6be-98a2-461b-8f56-a96870e80a1d", "comment": "Malware payload (RedLineStealer)", "value": "100ef49c36df0e5f82002a2a6ca0bd073dbece4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639470719, "uuid": "f32a4e9c-a216-43e0-8352-3c2edbddfa6b", "comment": "Malware payload (RedLineStealer)", "value": "15dbb2597149022670156e956a724dc32389adeccbae7a40f1a06378b0f8aba9316d3cc3cce3dadf9bcfe6aa65fd6c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639470719, "uuid": "73e51d51-a105-422f-9c34-320aeb93e4d6", "value": "T1F364AD04BBE0D435F5B712F959B993ADB93F79A26B2490CF22D226EA16346D0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639470719, "uuid": "a5276d78-f097-4b39-ba12-e4316ef46a62", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639470719, "uuid": "b47ac6bd-f98c-457c-a0dd-2b5a0b991722", "value": "6144:wkHXZ/aKbL5nJT5Bzq4NazwD5nsHwCWx2+:5JtL5nJT5Bzq165no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639470719, "uuid": "907b561f-34d2-4a7e-acea-4f89645c1a51", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639470719, "uuid": "7864f816-dc6f-4f99-85ff-ae2fc225684a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639470719, "uuid": "07f59f77-864d-4ae7-89e0-81591b610694", "value": "687c8b3f3d13412d966145e6bf8d5b0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eb648e-5c77-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639443008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443008, "uuid": "9927b4be-9cc0-41c7-bb99-edfd64841be0", "comment": "Malware payload (Mirai)", "value": "2632c9047bf268ed6433515f4069b9fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443008, "uuid": "ede01151-c780-4b9c-993a-97945afdfa36", "comment": "Malware payload (Mirai)", "value": "1696dab556121edacb133e171dde352a374d4f31b93087e9cb7b5a1327a23131", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443008, "uuid": "f69bd3a1-0d64-42bb-b126-9539ebd46b17", "comment": "Malware payload (Mirai)", "value": "f1bc9d5a09730678db9227b97901ae4aa9dcb6b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443008, "uuid": "20b0a7ad-42c9-4c48-9ff3-50b7bbe92925", "comment": "Malware payload (Mirai)", "value": "a765e26807f2da30683d3db3d1cb09cbd9fec150fb7b1704ee9089f7f1ce06b9fe857938e67ae78ed4ff59f0ec2f4639", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443008, "uuid": "b6ead539-0ca8-4666-a2b5-2123c1b599e9", "value": "T18FA2D0B44155AC72C3F06035EE2648C977A109B9A9FE3B8313094F7DD8E35D7A2FA541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443008, "uuid": "f74fb470-4fbd-4449-8975-37db25b1b462", "value": "384:Ig38x8fpXNLv+udQi8m5/AbbwyMAjUgajF19a53D+WdF/jOXW+wuhymdGUop5hG:+x8l9S+A3z2FGF5dFbJnus3Uoz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639443008, "uuid": "ec39756e-06e8-474c-9d8a-76bc82026098", "value": 22184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639443008, "uuid": "e5b81e72-ceb3-4132-9bbb-a45e17df2714", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443008, "uuid": "f71f7311-9341-4e73-bab4-b46c6d523d33", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b618853-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639464782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464782, "uuid": "6e424bc2-5443-4092-a7c2-494ece1e70aa", "comment": "Malware payload", "value": "e6620acbca8a2b40c0db5aec6edea34d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464782, "uuid": "60520f88-1453-44ba-8c8b-a4cd747185b4", "comment": "Malware payload", "value": "172b16b0c900237b74392f68692216fca996ee04d09bd960b88dc631e6199c32", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464782, "uuid": "d09ceef7-4580-4438-be14-5238a91adef0", "comment": "Malware payload", "value": "f1a4007f016ce3b06bf2e8c4d40f01355717bfc5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464782, "uuid": "e2771e83-9454-4731-8507-51bf74ddff58", "comment": "Malware payload", "value": "3fbd41d770ea577cff8bc1dfa082394492af15fe6ff253aa27574e22aef406fb0ea98321c8621d14d0c4c50a111ef533", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464782, "uuid": "a8579119-bf9b-4f18-a348-7e631079929a", "value": "T1CD62BF39DCA2BC65C1F3C83CE04602E159C81086C65A790F39E9B2AD3A94597F3DF2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464782, "uuid": "338106cd-4919-4897-9877-e8b2fdf83d4a", "value": "192:KLb3UndW1cd+CdyiVGQx+zmzpq7Fi2mUGeeBKo55LcVFdonYA9WgfcUsm:KH3gdbdyiYRzspqU2mHV5OVajGUsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464782, "uuid": "db935148-9d75-4366-b329-a0255632f031", "value": 15191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464782, "uuid": "2d65d719-1ba8-4194-9117-0ebef05d86d5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464782, "uuid": "b6e85045-a245-43ba-a367-bb3af9539bf6", "value": "Nachkommen_Schuppisser_2018.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfb7c53-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500515, "uuid": "c30eaeac-8b9a-4da6-8297-59cdb680e85b", "comment": "Malware payload (Formbook)", "value": "5f9463ab7e12322603b950cbbe539bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500515, "uuid": "471d76f2-c50e-4d6b-b8e0-67eebd76d3cf", "comment": "Malware payload (Formbook)", "value": "174efa98c8e09e5ac9d2916509eb3323fa20dd47dd3173ad069a2cb5e17b1852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500515, "uuid": "91bf9006-6c84-4866-8cf6-503fde9c0df9", "comment": "Malware payload (Formbook)", "value": "52434f6a1d0d3602a0eb9fdd2134c55b27336bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500515, "uuid": "d53e6c6e-76bf-4bc2-896a-a13ab0f9be96", "comment": "Malware payload (Formbook)", "value": "b2b6cefcfb741f1c4a72e068ba30b9bc170f5d960b2fe6be4b908c35e941ac74deaf4c6b2d422e3d9b56988997c10549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500515, "uuid": "819c2afe-6c79-4104-9486-b0da990ff504", "value": "T1AD5512AD3A674ADCD43853BA7368407493F16D3A2407E395CDCA32EB15377A03A23687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500515, "uuid": "d4cff747-4496-4f6d-a5a2-688767ed8414", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500515, "uuid": "6f1946c7-dc85-43af-80d5-73f78d2a805e", "value": "24576:TvgaLCOfy+fD25+C2+BniCO2T/hngAAsPuAh0Yvs0ZcAGJyIOVs94qhdj4jhU09:DLVRS4CbTpngjr0CATIqyZhWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500515, "uuid": "830f70ef-8c22-4876-a1ac-2237082ddee8", "value": 1347584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500515, "uuid": "aafc6029-afe7-460a-a916-92e8551e009d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500515, "uuid": "c91cdca7-226e-467d-a0e5-4086cdd3c82a", "value": "5f9463ab7e12322603b950cbbe539bf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cda445-5d1c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639513952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513952, "uuid": "15f24653-9025-4e3c-8bfc-a56447f489f5", "comment": "Malware payload", "value": "92e8f0cc5ec7031ea54fb66963abc007", "object_relation": "md5", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513952, "uuid": "1001431b-314d-469a-8031-01ac5c014941", "comment": "Malware payload", "value": "17546c1535da87d43db61cef931d041f78ad6dfa901c4ba4b7bb5727b55fa507", "object_relation": "sha256", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513952, "uuid": "559da00e-45a9-4c8a-abcd-3ef2a6acc82d", "comment": "Malware payload", "value": "9077b6239ff138774ba119b7c32387e3b6fc88a8", "object_relation": "sha1", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513952, "uuid": "4631a871-4ecf-47b1-ab42-6540e34f76f1", "comment": "Malware payload", "value": "a79fb103acd01ed2207d72e2e4673283dd8712e37f6664d96261d96e06519d8cb18959e89c9cd3b738720b3237b118c7", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513952, "uuid": "c8169e16-0031-4a34-b28e-dcaa2b3bdb47", "value": "T1C262D746ED1D10932FA9F06ED4749D143F08833150590979B2AF5EAB22ECE2B621FADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513952, "uuid": "1389acdc-10f0-42b4-a98e-b1b7a93520df", "value": "192:FMofWik/qcRr54E2E4iKDWKQMM41k1LlOqcRr54E2E4iKDWKQMM41foV:FMofWik3/4dKKQ74C5k/4dKKQ74M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639513952, "uuid": "6bd323af-e63d-4c2a-b446-ed1609b20924", "value": 14887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639513952, "uuid": "01da797b-7c7d-45c7-90df-87b1d1986d51", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513952, "uuid": "94a85aba-2614-4227-a09e-ca9a9e728660", "value": "cktyvfqt.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f459c37-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639467419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467419, "uuid": "1ac6337a-8a69-4f1a-aaee-cb3dad03f43d", "comment": "Malware payload", "value": "2da9e52a28c78f0eacdb19125ae29998", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467419, "uuid": "cd9ecdeb-452b-43ec-a666-a7ae14f5d236", "comment": "Malware payload", "value": "17e11f632be2a66ff28521b5f6ccceb79754a3c5ce3575771b7d370fbcb996ea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467419, "uuid": "802936ff-fffa-4d2b-b9e7-d6d05bc53f65", "comment": "Malware payload", "value": "be7b5c1d6038e4e25457a06ac5a6955932ea6a7c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467419, "uuid": "bb9708e1-3d1e-4f1d-890e-d2e35df97d33", "comment": "Malware payload", "value": "928ab85b737cebed1438daabc91b6bb29452a3f7863fccad5155899f18fa55c911fcc1475213e042e845d2b3087c1596", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467419, "uuid": "ae04a696-5b15-40e5-9133-ce9b01ec6b65", "value": "T16213D004E0239E01C69D1B7A21FD01E07FB7439396918156AFD2EA5F4C212EFCB9F986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467419, "uuid": "cdad9150-b0b8-4b66-89bc-34defdf4aefc", "value": "768:277rmIutpnYC1DoTF0n0BKW2rq/eEflhRSfwdDQWk/HQFCqrLfxl1I6bD:2TStpYqD8F0n8KWG0lhRSfwd8WgtyLfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467419, "uuid": "e734e0c3-489b-4943-9762-2c2a570238e8", "value": 43305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467419, "uuid": "26942dd4-33c3-4f3a-86a6-0d52d9433938", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467419, "uuid": "103a59e9-db62-4631-8e79-79c5508862cf", "value": "official paper 12.010.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7aa539-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639498389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498389, "uuid": "57a09308-6df2-4cc0-b550-4cf73fad6700", "comment": "Malware payload (Gafgyt)", "value": "991d4890dcc10a9359d7b974fc938f12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498389, "uuid": "e9c047cf-2357-4a77-9917-4fee131809ba", "comment": "Malware payload (Gafgyt)", "value": "180d2ba7881924ea3f70c98452c56b85013522f640762b9dc27ececa01a8666c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498389, "uuid": "98510d69-447f-4b35-9a18-aae7a12dd9bd", "comment": "Malware payload (Gafgyt)", "value": "40d7155417b802074edb0d5636adc8be8085251c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498389, "uuid": "99613e67-1e58-4031-a3ef-d2a96bb37302", "comment": "Malware payload (Gafgyt)", "value": "ad70faba4b11c1c55a6866f2f741a6b339feca80bd8adbb4498c81998f2b738d6bd3fec8cd42be152b94613decea51c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498389, "uuid": "7012e0ed-f4b1-4ef3-9d57-e688c85c8bf0", "value": "T1A0B31B93F515D6B6F44AE73308D38B247270F6A14F53192263173B7AAE362D4385AF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498389, "uuid": "35a18d8d-c8d7-4afa-a8d3-67b11234a46b", "value": "3072:d+TBQeqacWucW0JcWcBDwWnvaIp2r2b8OBZyqDyV51f0immHBzTQLHSLW:YBQeqacWucW0JcWcB0Wr2ib8Oru51lm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498389, "uuid": "ced11f4d-2213-4309-b033-b280e619ea96", "value": 109492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498389, "uuid": "873b9ae8-60a9-42af-beca-36c3a6a1d9e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498389, "uuid": "ef2e41e3-977a-4664-a899-6436030b1800", "value": "991d4890dcc10a9359d7b974fc938f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b91735-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497418, "uuid": "4ec1db3b-4630-4498-b855-93c3b18a153d", "comment": "Malware payload (Formbook)", "value": "4cd2a0217febbc6d5a0ea7dd83349b95", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497418, "uuid": "c48fa4b6-239c-448b-b190-64afe3b4ab61", "comment": "Malware payload (Formbook)", "value": "18327aaa288eba70b35cd019c0125144c8e6ee1274f22e55f7422b6ef5ff3fcb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497418, "uuid": "db31a157-7be4-4a40-8cbf-b1a6967e798b", "comment": "Malware payload (Formbook)", "value": "19d7ec900ac571fca6e41f993ee18fd8f049021f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497418, "uuid": "faaf9310-1c35-42bf-98a0-aa2bc5234876", "comment": "Malware payload (Formbook)", "value": "a5408cf1c7d91378e497f894ae27a66712b0045f1381614c45c8a4d2bdff7ed96ba252f1901e479da8fd10e1dbc5afac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497418, "uuid": "c5c54f45-e387-4859-8834-08d6230f0dc7", "value": "T1F6641273B4D3C71BF6AB3B7100A6B34A34C6EEC19FA0718593927264C0FDE5946358A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497418, "uuid": "d8af9911-99b1-4732-bdd6-d9af70fd55c3", "value": "6144:i0aH5u7mAXrqFPIzmt/2xmP4BTxsMWDxQp5xh1UwD23/zmtXTrx:i0m5uaAW1IzmtO24xdW6xh1UvvqhTrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497418, "uuid": "de72d77a-69c2-4268-a43d-2938a300e0c0", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497418, "uuid": "deecfe3f-f4ff-4d5c-ac5d-3a1126bfebeb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497418, "uuid": "c52874e4-19db-44db-8722-2bbe65734ae2", "value": "RFQ - Mopcoms Turkey .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e45a6c-5d25-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639517727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517727, "uuid": "abf4ccc0-5986-4c0a-bc81-90d8cb6e771b", "comment": "Malware payload", "value": "5ac883c6437240f50428e6b7392e6049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517727, "uuid": "98b1236e-1b56-4851-a9a3-764c315c0058", "comment": "Malware payload", "value": "1857f37001c2c96b7cfb6850dace37d19f9b5bedf49038ca93d2f421444b1816", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517727, "uuid": "3ba341e3-6a6e-46c1-a8fc-8091acb48715", "comment": "Malware payload", "value": "ced3edf3eff90f6cf68d52be9215a8ef58fd2338", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517727, "uuid": "037b87b8-8c44-444a-97c7-11a4831fbdef", "comment": "Malware payload", "value": "9c7ad9f38852e916fe2e963f9bac90436b4a7c4e40846243a16942987ff3dd745fcbd75264ec80420c540b60c8951a31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517727, "uuid": "107e2c16-5e6e-44bf-a35d-345a0c4e3fd3", "value": "T1FBC49E8263634102EE82FDBF1D13746F4399369DF950F8A2F58E6A6A303E2B53165643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517727, "uuid": "af33abbb-d884-4860-a930-fac97a1c28a3", "value": "c9628a85525bfe945f5e36dd40536a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517727, "uuid": "5d5a150a-e0f2-47e9-81be-e9dfaac0fc3a", "value": "6144:+DwhfXAyRXuYDXCmFXayrX4S7XKyfXEyRtUWxXwEhXE65XcyjXuq5XqyHXoQ5Xmy:bF8uFvRiXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639517727, "uuid": "f058a7c0-52e3-4f31-8e81-4f49df13d446", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639517727, "uuid": "a5f5d6de-d95b-45c6-8b9e-72a94978ecec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517727, "uuid": "81443144-78a9-43c0-8bb3-b2af317a43a0", "value": "5ac883c6437240f50428e6b7392e6049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8bca19-5cec-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639493002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493002, "uuid": "ec2c750c-fc2e-431b-b0df-d6dad7a2b14d", "comment": "Malware payload (Quakbot)", "value": "3142cbf3b97b301f787b5dfdde5e4b62", "object_relation": "md5", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493002, "uuid": "daaff9cd-d858-4374-a942-2ed1b844bfcb", "comment": "Malware payload (Quakbot)", "value": "186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc", "object_relation": "sha256", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493002, "uuid": "9ed014da-02ea-4b0b-a2b8-e7589d32ed97", "comment": "Malware payload (Quakbot)", "value": "d5c85a79f8afbaf828538e1544abcdf254cb2c6a", "object_relation": "sha1", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493002, "uuid": "848de326-a1a0-4c2c-a349-549b0e2f982f", "comment": "Malware payload (Quakbot)", "value": "e91f327b1f78c3ffda74a75550034161974ff0ab9154cc18ceb24457dac329f33d483cb5be4dce2efe3d32cc9a0255e1", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493002, "uuid": "e30a042a-b256-4e91-ae73-3cdfa7c292ec", "value": "T1FB05D9CC1428D31BFEBE287C6202CAF397655C431B344ABE6A63B65E24703953667D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493002, "uuid": "16eda208-b2c2-40dd-920b-953fa187e4a2", "value": "1a9c25728798d3a2361b57e0b333c3a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493002, "uuid": "9fae1b42-8836-4efc-af85-59df272d08db", "value": "12288:mNypAZnflvCNb6yzejvwP8UQw8MzcYEE:hGlMz6K8UQw8MAYEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639493002, "uuid": "13abee72-ba3d-4095-bfd0-45339859b6b0", "value": 845450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639493002, "uuid": "fdbf2e93-ca38-468d-9fbf-b3268efcaa96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493002, "uuid": "f0ca43ac-7399-443d-a460-ed53bcb9660d", "value": "186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8626897e-5cc3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1639475538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475538, "uuid": "47ccff43-b82b-4229-9486-d1c879ff0979", "comment": "Malware payload (Pony)", "value": "ad56afef7ce18cfbbe12a32b2b30bc15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475538, "uuid": "14eefc8b-a4dc-45f9-8f7f-594e82489072", "comment": "Malware payload (Pony)", "value": "18757739e1fdb5ec7fcbccf6d6ffc7c58951138173badd5823d72f3a40f50c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475538, "uuid": "106fd9f4-189b-44d5-8e98-7df1fe90c9be", "comment": "Malware payload (Pony)", "value": "d6534b64452d416b940e81da3bb257bbea50eb69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475538, "uuid": "147b7f42-7dab-4351-a551-30c0b015a37a", "comment": "Malware payload (Pony)", "value": "d4e488bad4e31a7567f00ba2eaf8d49593c30a782a629a3d71981a04dbfdd37c93edb57bb33a8138a8febb794bdd96a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475538, "uuid": "2006455e-c784-4c86-bc4d-c18395e6b938", "value": "T13444CFE7AA28FA2CD1955BFE4D82474129072D7D6D03EE862CC47E8A2D7C1323F57264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475538, "uuid": "58fb6f83-a062-4031-99f8-0c426f08a853", "value": "a9141d2010cc9d0c8916973ce68339fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475538, "uuid": "11d19b87-06ca-411b-9234-525c0ea7acbb", "value": "3072:Avw9xgSERbQyqDpyAHu7iO7BngRONH7LzlLqC95+aW:AcgQrd1A/7BgQJVLqC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639475538, "uuid": "36df09d1-d296-4bd8-bf21-f7ef888f8a11", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639475538, "uuid": "3eaf414e-8c27-49c6-82cc-1e5ee4e4baea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475538, "uuid": "f916fa13-7415-429f-a98a-9838e398433e", "value": "ad56afef7ce18cfbbe12a32b2b30bc15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340cfd77-5d30-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639522215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522215, "uuid": "777f6be3-1745-469b-bcf2-08c28532d9a8", "comment": "Malware payload (Mirai)", "value": "658350f422e6c84e74fe194568a6fe9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522215, "uuid": "6bf72d74-93f9-4607-8508-d7c15af0aaed", "comment": "Malware payload (Mirai)", "value": "1960152f9bdced24ab31f7b7900fe4f6e24f5d70db84cf104def580777c653cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522215, "uuid": "c793f7f2-5fa2-460a-8cdc-74d2b417a60c", "comment": "Malware payload (Mirai)", "value": "5628e87d64d6ec3c432180adde0fc225a0fe4f6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522215, "uuid": "a5912cbf-9314-4964-8c34-7a822d4efd77", "comment": "Malware payload (Mirai)", "value": "1ecf8039eced3007b61e4c41270970e3550b16ee437f4cc56af0fe1a6f98da5d3dcd7ade2d563ca900ec644cd5d65e48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522215, "uuid": "9feb3bf7-f8c7-4821-b85c-adc360bdfeee", "value": "T196F34C86EA418B13C5D71776FA9F414A33229794E3DB73028D286BF43F87A5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522215, "uuid": "1db38017-f08a-40c8-b6ed-0e9ed38f3bbf", "value": "3072:2S9b/5D8yKQhMtu8hxaGGLKWojfBV68YE3PqJ6M/9FnMqM:J9VD8yaoyxaGGLKWWfVD3PqQM/9JMqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639522215, "uuid": "d8b5636f-3eb6-425f-9721-8cc8210d3401", "value": 165387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639522215, "uuid": "847eb1ad-0e2b-4333-9e3e-a4aad5e13cfd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522215, "uuid": "f58cc4a0-bb04-4178-94c5-a9778e4157f6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7035db70-5d12-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639509431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639509431, "uuid": "0223d736-5c67-43df-9678-ece8b4a397f0", "comment": "Malware payload", "value": "2ac1a2cc6ed85ef3398efc85f860d3cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639509431, "uuid": "e807b4a7-fae9-417c-a2b9-b620ee92c8c9", "comment": "Malware payload", "value": "1b2c180b41a470da3b379291f571dd14860acf99a6b09e0a4aacda9f4fad2909", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639509431, "uuid": "9a362899-62ab-41f4-b5a4-59a1324ae5e8", "comment": "Malware payload", "value": "c354c9fd701a3a600624298681ed3a9d129446a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639509431, "uuid": "63a1cd8f-2201-42a7-b84f-9b8e622806c2", "comment": "Malware payload", "value": "1d939dc547d846a13a79fa7aa64a5ce938c4ddb4c15a652185613cf5045fba37a21836ff233d44d0b20a805487c70d45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639509431, "uuid": "e9b4c654-92d1-44e1-b957-1bc736986eaf", "value": "T1E0450295A7386F33C57F5BF694A0220B47FEA4073992E7764CC5B1CA1A66B80CF01963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639509431, "uuid": "1155bd8c-17fb-4c53-99e6-efbeb1657071", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639509431, "uuid": "59481381-4b9f-43c8-8aab-1b675d683887", "value": "24576:VYRLuky0qvDz/eWyEjRCWL+EUiAthC4D2QhtYYcvPsfF:+t/qGlEAWL+Eue4D9sUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639509431, "uuid": "bf853dc7-7c7c-4ebe-82da-3b2ae4187d2a", "value": 1185280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639509431, "uuid": "3970714c-2ca3-45ac-9591-d1bacddc8517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639509431, "uuid": "2aa0f3d3-a970-4999-aff8-952c53d84ef7", "value": "Invoice 3816 Outer Banks Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6428bf-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465457, "uuid": "a8f47480-2aae-43fd-8651-2374ef0dc290", "comment": "Malware payload (Matanbuchus)", "value": "12e2c8e76b743119b86815d4862031a9", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465457, "uuid": "389ec5ba-c150-46a5-84da-2f455a3558a4", "comment": "Malware payload (Matanbuchus)", "value": "1b4492c9bddd75f120430bed21a6db9f09a7763464443276ef21e2c9b2697cba", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465457, "uuid": "476bb61f-dc2c-4ff4-8c9d-958239849c65", "comment": "Malware payload (Matanbuchus)", "value": "1d56765ae610cd3c2641e3b284d9a5ca4489c01c", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465457, "uuid": "75ae3a77-7002-48d6-bec3-8412ec5a5e69", "comment": "Malware payload (Matanbuchus)", "value": "54bbe31c7f0519b1fdaa41ab634652c0883889cf842b060f4725609abf386f9d5c6c5ce46b11001d8ea3bede95e28b92", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465457, "uuid": "b2dfd6c6-1828-4cec-b7b6-3539aa215bdf", "value": "T1FAB48CB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465457, "uuid": "2035098e-b7de-4c07-b387-b5b43beca27f", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465457, "uuid": "fe305a74-b471-4e2b-a707-a5bf621f1693", "value": "12288:hCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp133:hfcqtGWdZPuQIDHaxarC33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465457, "uuid": "a15cdc34-8f41-4db1-8f29-50ccce2a3b59", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465457, "uuid": "54c17b56-4018-403f-9cd5-f6a4a114be1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465457, "uuid": "781f63c7-36ee-4e8f-92f3-064de713dcda", "value": "1b4492c9bddd75f120430bed21a6db9f09a7763464443276ef21e2c9b2697cba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d282722-5cc3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639475496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475496, "uuid": "70814bf0-0fda-465e-b4c0-3c8ded6d9c55", "comment": "Malware payload (RedLineStealer)", "value": "ec0782134008d041b0ebfbff1c7749d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475496, "uuid": "2b18396b-32ee-4524-86e8-bd80e058eeed", "comment": "Malware payload (RedLineStealer)", "value": "1ce01e7c0e9eb5541007e9dbe42100e0891ac760c5a9bd020720735a7033e978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475496, "uuid": "e9b83bd2-6549-478f-96ea-c286e582ae1d", "comment": "Malware payload (RedLineStealer)", "value": "9fdcbb0ddf70c2eabb784a5bf06623ef8cc03074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475496, "uuid": "c756cb1f-7ff0-4de7-9316-e673e93f7c3e", "comment": "Malware payload (RedLineStealer)", "value": "b20e41d373b6e44364e49ac9330dc54511160d436180973c409f30d9187b3e54b525d9f3f64e522fb4bb808caadc1b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475496, "uuid": "0fa53ce6-f3a4-4f9b-82ba-f2f2aaf7f141", "value": "T14A94D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475496, "uuid": "df476054-5ef5-4897-aa4b-78f2a1048ab0", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475496, "uuid": "cfdbfddc-426f-445c-b1b5-19fe455f2a53", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639475496, "uuid": "d3847e1b-d2c2-46ea-a0e5-28ed4a87b4f5", "value": 419912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639475496, "uuid": "e2ab85a3-5437-4939-8208-975b494442e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475496, "uuid": "9d461585-e6d1-48d6-829b-3bf25212b23e", "value": "ec0782134008d041b0ebfbff1c7749d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68082a8a-5d04-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639503404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503404, "uuid": "87f62927-aa8f-4960-bffe-ca923d0c8c0b", "comment": "Malware payload (RedLineStealer)", "value": "f4bb3274478c3e467b7a84faf8ff9b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503404, "uuid": "0779af17-b9fa-4d56-a288-39f88e9fd488", "comment": "Malware payload (RedLineStealer)", "value": "1da38119f4ba54cb341609f84ce9031519f2184a2cdceda2e30a0d1c94b29c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503404, "uuid": "2c86719f-b22f-4a98-9fe7-dc871b5d075f", "comment": "Malware payload (RedLineStealer)", "value": "c52b02b21ce8798cf2cef28585251d449fe97b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503404, "uuid": "11ec596c-7e35-4147-9a95-a06c12bc558d", "comment": "Malware payload (RedLineStealer)", "value": "974272e4a47d8f46a6734cf1319476f6eb83887e75132e69ace65c2d47b3484f9b75c6debc0a34ef6ba4b539fd50bfb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503404, "uuid": "b0b9d234-b5eb-4db9-9baf-d8aeb4d29ff0", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503404, "uuid": "ea945912-473f-4534-a7b6-4bffb753bbb1", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503404, "uuid": "b3554320-a77b-448b-afba-ebfb23e01c1c", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639503404, "uuid": "c1d3f9d1-9906-4471-892c-ad3f14a40251", "value": 442372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639503404, "uuid": "7ac44fdc-cfb5-444c-b1df-1af6c1198050", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503404, "uuid": "3b534f5b-4f4c-43e9-b882-40719f4eb6f1", "value": "f4bb3274478c3e467b7a84faf8ff9b6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5289384a-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639495637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495637, "uuid": "6e211772-6090-439f-9b7d-48754ca1924b", "comment": "Malware payload (RedLineStealer)", "value": "251f4bdd90b22de47377351be877b316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495637, "uuid": "7723f51c-44eb-4b77-b3ee-b8c0aa01c16e", "comment": "Malware payload (RedLineStealer)", "value": "1dd6f3a953e0432c7fa8b9a3fa88493bd72b3c69081ff288d07f216581552ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495637, "uuid": "99ebb91d-ce2d-4560-8412-255bff566b8f", "comment": "Malware payload (RedLineStealer)", "value": "71269a59e266240b0e94f09d9d791d4d6a3a6981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495637, "uuid": "3259f41d-5724-4817-8c81-75aacd302ca0", "comment": "Malware payload (RedLineStealer)", "value": "9e717f635da65d94033c5a5f783fe8ba399fdb45ac8f8a8c2003ff2bf7517267acc4f04a349629d18412a535cf043ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495637, "uuid": "019da7aa-48d1-4e66-a8ed-d3fc5b2f884d", "value": "T1DBD49C82129C3EABC03592B63B3757D1A32CDD0451EAD3DD51C251EC88AE4837D9EFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495637, "uuid": "aa779a80-6efd-4c8e-b65d-2372e420e02b", "value": "04c853d18dab80e399e9ca655e9d906a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495637, "uuid": "bfe323f3-9f55-40f2-bd52-c987d36e86ba", "value": "12288:sKB/0UzDZy0lhraFmmm24xwXrjieo0FrrAOGeNuctH:BB/0UzdyA9mmXwXreZ0FvAQNuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495637, "uuid": "b0608232-e4ed-4d2e-9ffa-fdfe7ce17fdc", "value": 623904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495637, "uuid": "d820d97d-0b74-41a1-a11d-ec31b34c543e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495637, "uuid": "5692c5f7-45fa-4a2b-80aa-90e473638b4b", "value": "251f4bdd90b22de47377351be877b316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f67ea9-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639466068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466068, "uuid": "4d4a4370-bdfe-4300-a2ca-b6e54b7bcc38", "comment": "Malware payload (AgentTesla)", "value": "060083683ebadaa188b4b767e29de365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466068, "uuid": "7fef3fc0-05c2-40da-8191-a14922ede9d3", "comment": "Malware payload (AgentTesla)", "value": "1e5fc7146cf6fc6416b3d607f552323ee5c47da0765f2efb628f2ed569850ca1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466068, "uuid": "1f959251-0f10-4644-af0e-b6803b033898", "comment": "Malware payload (AgentTesla)", "value": "4c5ae2b7324cd631222d699bfe1716e1c36be891", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466068, "uuid": "0e098852-790c-42f0-b21c-ca5a8999e2ab", "comment": "Malware payload (AgentTesla)", "value": "9b94d52152e79016e3fca6ac3564629cfc146f310d4a9ca2fc3b237746da565abcabd137fcd6021569d0a4036fb909bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466068, "uuid": "5725b2f8-3b30-417e-815b-4353ee347f1c", "value": "T12F65236D3693AEDFC45A53BA333A803453656E380607D3D8EC8A32DB18237697937356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466068, "uuid": "c422fd9f-24a8-4518-a5cb-5d2266046f93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466068, "uuid": "d4e489d9-9dcd-4e2a-a9fd-bfc69a9c062f", "value": "24576:XaXEa4EeGa8sZWy1wdzYeNk3Faa/NSqHVr9Kae4Uu5HtulPeRoSoZXz0:qUaz+ZUYdFKcZAae4BHtuVSoSoZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466068, "uuid": "fb9f152f-07da-40e9-82d2-a04b969936e1", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466068, "uuid": "47629a93-55d6-4c11-a581-d287ed4c3a7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466068, "uuid": "0a4d3e13-2630-4744-b309-519252dcca5c", "value": "invoices (67021) - ORDER INITIATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350d33e4-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639467241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467241, "uuid": "776fcce3-b4dc-46d7-90aa-49ec6fb158dd", "comment": "Malware payload", "value": "e08b61f2157ab3e150f33783d8758490", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467241, "uuid": "190cf078-5e96-42c6-98bf-aba2f0bdef28", "comment": "Malware payload", "value": "1e69204d8b871c68c993a0c3ee5974094c3d5fb1e84cd94b93ec8fbfd56c6ff3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467241, "uuid": "153f963c-485b-455a-ad2d-f414bd8f430d", "comment": "Malware payload", "value": "e61bc09a6f8df8dc4358da54ee38d15e8b14c9a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467241, "uuid": "8c447205-e715-4060-a73d-6162fa57a18c", "comment": "Malware payload", "value": "db73e70d7ff0f1fb0f086840eaf14a6476f75c3b533f34fc2e600559ad0530150e3cad4086e353e4ccde7f273cecea85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467241, "uuid": "e15f4dd1-98b1-4e6b-8ed1-0fcf68140bfd", "value": "T19EA5330C43B9B9ECF94F06296B634DD0C2EDB2E4F94161E1A2641CA45C3F5BE039F966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467241, "uuid": "dd6aac2f-3a25-426f-abda-58cef1151acf", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lf1:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467241, "uuid": "ceb74fd0-9fb2-48c1-8c72-308de6fe88ed", "value": 2199552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467241, "uuid": "8e83424d-d1ff-42a1-95b1-f97df4261995", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467241, "uuid": "976ec92a-e27b-437c-b0e1-be1a69f1dfb7", "value": "1e69204d8b871c68c993a0c3ee5974094c3d5fb1e84cd94b93ec8fbfd56c6ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2b8792-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497318, "uuid": "56164a39-9f99-44d4-9a45-2b0c8eb122a6", "comment": "Malware payload (Formbook)", "value": "7ac8464ddd3d85624b847db23920d0c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497318, "uuid": "5c4a05f3-ec67-41f1-b341-60718f06ed66", "comment": "Malware payload (Formbook)", "value": "1f6332659b86679dbca04702befb65a62ed5a39f8862cca054dda325d74af0d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497318, "uuid": "e8fc676a-5fef-4038-84f6-e649e99e2020", "comment": "Malware payload (Formbook)", "value": "0984aafdc969e3034aa6c61c83387c353df0d86d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497318, "uuid": "cb915603-e4a4-449e-8633-dc6739c787d3", "comment": "Malware payload (Formbook)", "value": "72cb0f22e55a5b64cab78418373eb77ff0203348456fc065b80696ea681a3d142e23d1f7fbe119c74d17c6d1bdfa0db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497318, "uuid": "d2008c0f-6b5d-47b6-a856-eb4e8e419533", "value": "T19635121C3D87D9CEC5590FB53B7580346276AC762A07E2DAFC883A9F186B3193963606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497318, "uuid": "af3fe5d5-a383-415a-91b7-d3790915665a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497318, "uuid": "073d4ee7-262f-4a05-852d-d517088fa917", "value": "24576:AzG8crwkdUU8e+iK8e108KmhbVIcXZMZJSZXPwpXAr:4iws8viP58K0fZ04gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497318, "uuid": "acf34026-4c21-425c-bc5e-c0a1dcb32775", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497318, "uuid": "292c7ce8-972e-4a2d-ae80-f371cf65efed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497318, "uuid": "bd497abe-132a-4cb2-bd05-b32ef40de058", "value": "NUEVA_CO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e572fb-5d1d-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639514271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514271, "uuid": "49ce9202-e326-4c96-8738-8f5d3fddef58", "comment": "Malware payload (njrat)", "value": "a7dedb1a3ddc4f894e81f0be200fb51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514271, "uuid": "29d33cc0-4a0d-41ea-87b7-560494e1647f", "comment": "Malware payload (njrat)", "value": "1f95987c21a50e65063ea256bc7c36a3b88576b5e2bfe59f422bba18afaa8156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514271, "uuid": "f333063c-bb2a-45b1-ab10-7d1067b70869", "comment": "Malware payload (njrat)", "value": "116f0adaa6c0b41d6cae2b0f81b8a785e3417b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514271, "uuid": "383eaf95-8909-4e25-a380-d70b91ba07c6", "comment": "Malware payload (njrat)", "value": "54e49ed76c479ac0ae59d2feb047b9d4e87651b6f44c69d3091964fb10091014dfeca2784aa420fa3690ffe4f1eb8507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514271, "uuid": "f15011e3-e754-40dd-ac98-c93244f3728d", "value": "T1CA13E74CB694E175D5FF8BF1B4A2B2890B71A01BA902D30F99F114D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514271, "uuid": "09f48b12-a8e1-4bf1-9f6c-317842a870d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514271, "uuid": "3f71f03b-30f2-409a-8784-f9d95975031a", "value": "384:aZy7J61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnpmgreTf:4kQk4smKS3OR9Z0OuXQ/o0C+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639514271, "uuid": "24d13071-27f2-423e-a545-f720dca2c282", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639514271, "uuid": "a317523f-27f3-475e-a18d-a24e1f152c4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514271, "uuid": "e61042b5-2987-4a37-96e0-88c4fd29fa78", "value": "a7dedb1a3ddc4f894e81f0be200fb51d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae1148-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444858, "uuid": "5ec2cd63-5c3d-4b9c-b589-4227992ae158", "comment": "Malware payload (Mirai)", "value": "28d96b686cedfc8a84db245b3ca13acf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444858, "uuid": "e15955a4-da04-44fb-b58a-d7afd0470a9c", "comment": "Malware payload (Mirai)", "value": "1fabe926edfc43265c4512aa2691dd81ab8f4188c5559754223c2ee5ef480efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444858, "uuid": "9524d8fd-03ee-46d1-a2e8-fb2d4c204187", "comment": "Malware payload (Mirai)", "value": "2a61333cecf7beee21369ffb05fceea7ce78c86c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444858, "uuid": "d002a7e0-157d-4d75-85d3-e7bd9c94c0f2", "comment": "Malware payload (Mirai)", "value": "2d2abccb9bfdb5b8ac372d29f42add039a382ed12292b03604dc5e7c6549bb56960236e2374c6f12383d4d321982b59f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444858, "uuid": "b1e20528-54f0-4902-bc40-ed633d3f2605", "value": "T19D036DB2D43C5DACD15886B4B8308EBC5B43B514D2872EFB0A9A81A58047DECF65D3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444858, "uuid": "6cf14092-e238-4306-99b6-bdb88905e0dc", "value": "768:OZax8cChbkRheqzeeeDqfc3NRsoJuTeCS/yZH10Ut:OZax8lJ7V3Nt4aCS/yR10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444858, "uuid": "3b6768f3-971b-4ab0-b395-b85f906b64e1", "value": 40384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444858, "uuid": "7ba042b9-1005-4093-88b3-f06ac6db63b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444858, "uuid": "66726a16-14d7-41e8-a267-b6a8d3b1de80", "value": "28d96b686cedfc8a84db245b3ca13acf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f75e83-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639496386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496386, "uuid": "adfaf362-b5eb-46d6-b8ab-50ac11c5b0f9", "comment": "Malware payload", "value": "3f2cb6796637701757875ff1ab50d312", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496386, "uuid": "2ac69ba9-1c06-4d8e-a538-bf0633dd73c2", "comment": "Malware payload", "value": "212eab05f724567587534506a7a6d29a6de7336634637d14c7650fe0446e00ee", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496386, "uuid": "f6a8ac99-88ee-48fc-bec7-22f511ba42b4", "comment": "Malware payload", "value": "130f1ae9cf6734ce32ce545c45ba08f867aa1d75", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496386, "uuid": "da80c824-3e1d-4be6-adb4-4b64832e53b4", "comment": "Malware payload", "value": "c719a6cc6059f22a4f7aca7ee97ba58cd4409e7b4b457eb4b527e9601fe581b0a360ced2148d844f9391d98bfabed428", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496386, "uuid": "dfba911a-b657-401c-8f7d-cc4893d02f17", "value": "T1F0C57D22B2C18837C0776E3CDD5BA359952A7E602E38884F7BE45D4C5F397807A292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496386, "uuid": "9bbd3e57-3cbd-4b2a-8784-6784400dc9db", "value": "49152:Mia20UaqKOb9KgVCcj5Gy7I9jQQUx1snTPDyvGY/3A:o20SKOb9KbyQUQU7uaGY/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496386, "uuid": "7a050533-de4a-4465-80ce-e1e143f673d9", "value": 2632704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496386, "uuid": "d1f9587c-5cdc-42ab-8855-89aee32f86c0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496386, "uuid": "d70534ff-1298-481a-a772-c314a3934f61", "value": "ArchivoEndesa.AdjuntoFactur.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb3fed9-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444866, "uuid": "a9a49397-58bf-497a-8eb4-fbaa0e2e059a", "comment": "Malware payload (Mirai)", "value": "1608fadd7fa5385caa2ddc7aa7363051", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444866, "uuid": "5f42946a-eee8-42a6-8e6f-bb26ed1b5dcc", "comment": "Malware payload (Mirai)", "value": "226d1687c99d7952d74e86fb7cc5374d51ebc1411d02fb26bbb918e7a9a4b644", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444866, "uuid": "757429d3-efe6-46e3-b10f-c60f5e8b3f27", "comment": "Malware payload (Mirai)", "value": "7e88d7860efe559f368ed4301abae5718ec6a2f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444866, "uuid": "f517d511-0ed9-4bf4-ad87-6077fe07fde9", "comment": "Malware payload (Mirai)", "value": "eb5d9753561f42b4b91929a876bb4d616d583ceae3b25218347594b225fe48f1ef84a44014da2dfe6577a76b9cce29f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444866, "uuid": "1e76fce1-f263-49b8-bbe0-a4e5e119c31f", "value": "T1A2A2E13065069D60D7A01D38DDA94EC7136FEB7DA19B2775A73402B9EAC300623F9F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444866, "uuid": "d10bb67d-518d-48c9-9a29-b2bdd072dd58", "value": "384:7XJ/Fs/nj8pGQ6lE0XqIlzpAn5RHqKkDUtn1tkATFwhymdGUop5hg:7X1gnUf6lEW+SUtnLkATFws3Uoza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444866, "uuid": "ca323c47-537b-4e25-af73-5c0888d4a39c", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444866, "uuid": "e5008dcc-aba7-4208-af88-a72a75434eaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444866, "uuid": "051c01fc-2f5a-4cbf-96f8-2422d2ceb557", "value": "1608fadd7fa5385caa2ddc7aa7363051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98803057-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639464831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464831, "uuid": "8d69d46e-82f9-41d5-b323-e130881d4d20", "comment": "Malware payload (Formbook)", "value": "ded5190cfaa6ab27303caea6f9bd2e00", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464831, "uuid": "558dd09f-1b13-49aa-921c-9420562afa25", "comment": "Malware payload (Formbook)", "value": "22bf512a38e371b7fe797e1d539a3bce0079bd76f58abfeeaa6be698df43ff4a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464831, "uuid": "fff178a8-998f-44c6-93a4-4adacb894cbe", "comment": "Malware payload (Formbook)", "value": "54d4b43d3df3198812bfd2bfb4806822ebc8efa3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464831, "uuid": "5fdf97d3-6c09-4f07-94cd-13751174adbd", "comment": "Malware payload (Formbook)", "value": "fa8a8a662bfa105aea41d560718c40f52be9855be16e2aea1a3c45534e89bd71b1186836fc7b6ae6399ce1c5ea113f64", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464831, "uuid": "ebe858e6-b578-46d2-811a-54bb7da82a80", "value": "T126A4233429CFF94B91F44BD2056AEA89603305F328D697C946B83E5A95BDF2C4334F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464831, "uuid": "dc99a5d6-ac10-4373-9598-6b58372e685f", "value": "12288:9WRXbGCFZAB38CZE6cwsbhtGiHqIxNu6y81qJE:90aCsB38CZEvNbhBHpxNvyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464831, "uuid": "808bcf7e-bff0-44c7-891b-5b01d6f94f0d", "value": 459578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464831, "uuid": "f9c48265-d92c-4601-a1ad-aa24eacfeede", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464831, "uuid": "2f4f8016-5d94-4318-8271-1a7118732299", "value": "PI S30C-921111218111.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c588d5d-5d2f-11ec-96a4-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1639521880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521880, "uuid": "ebecdc76-42f3-4d5d-ace7-d4716eb71132", "comment": "Malware payload (GCleaner)", "value": "ab452564344e23b7e08c7da771c61548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521880, "uuid": "577e1d29-9ba9-41cc-9593-6d4f6e58fa64", "comment": "Malware payload (GCleaner)", "value": "236dad58970dbb32df7df1c6e317cf5c2a4cba4ec44e872542d926c709026f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521880, "uuid": "2543761d-3dd3-443c-b963-5cba26775f57", "comment": "Malware payload (GCleaner)", "value": "30dc549e6b511a6a9136f248c0d2cfb53407bf9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521880, "uuid": "5f511c82-c7e2-4a17-acc1-e7ae32630434", "comment": "Malware payload (GCleaner)", "value": "b99fec96c0a2f6fbd79365ea30db6a2fb4bf98ccb18183bdd200c18cfd43718b310954e1bcc3a12fbbd1014cbef84b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639521880, "uuid": "5b38b620-75fd-48da-8682-ae73c98f81af", "value": "T13D0733B56F2F0DAAC89207710364DDFF50A2110E1D4221FAE4EF9DF0F46AAC23695799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639521880, "uuid": "668bb99a-74b2-4e52-9598-acb6ba4a0f73", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639521880, "uuid": "dff321b0-74de-4710-b1ad-08a6018e6f49", "value": "393216:JOJdS+D5UuNxtUW13jLtdA/4fnz+1cTpNaw11mD1FY:JOJk+9zXtUW93tdA/4fny1cTa6mD1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639521880, "uuid": "77968883-72d9-4488-890d-5acc169b60ea", "value": 17382091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639521880, "uuid": "ac324dab-ce30-4975-b632-f5a38685d5b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639521880, "uuid": "162db12e-5faf-46da-8b62-f87deb402c19", "value": "ab452564344e23b7e08c7da771c61548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323e5d75-5d07-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639504603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504603, "uuid": "0257fada-3c14-438f-87d2-ee70d3016519", "comment": "Malware payload (Formbook)", "value": "1a8dd785f1b5ad00aef250b2ddb7760c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504603, "uuid": "7f5a78a6-cbb9-4373-94fe-4b0e6fc12d44", "comment": "Malware payload (Formbook)", "value": "23cc653ccf677673adb0aef167fdc3e661a401eb9774bad371b7aac17e71e072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504603, "uuid": "dd9e2e71-7764-49a7-84ea-57a385cab2d2", "comment": "Malware payload (Formbook)", "value": "ad68d81e4beeee72c5b70a1403ed9d241923d512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504603, "uuid": "eb703327-e331-4851-9a03-5af26cac5636", "comment": "Malware payload (Formbook)", "value": "3fe7941d528cc414e23af78de7e79df337ea0377d8fb9191601ccf04b1bbc8e72ae5c87db15fcfc5a82adbd37e5430b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504603, "uuid": "96e846be-0496-4081-977e-7d5114ed2615", "value": "T1E9350294A378BF31D87F5BFA84A0624983FD650735E2E77A4CC4B0CA5926780CF06997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504603, "uuid": "c15ced50-ba7c-4073-a5c7-3780684410c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504603, "uuid": "62c1f8e7-f7c7-4a6a-a135-ae81c4371c76", "value": "24576:9YRxzUs9RfuyRk7SZcnWpaddNW2/Qxmw2vlZNwc5sxWBmac3S:w7ffbkAQdooBN6i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504603, "uuid": "a0ca1c0c-f929-4e5c-a9ce-e71ea4e73d37", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504603, "uuid": "91880089-d9fc-4805-be99-e9148a3eea62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504603, "uuid": "a1e7f69a-ca75-46e1-8c4c-929e07d7f8c1", "value": "Muestra de orden de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7062f0d4-5cf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639496117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496117, "uuid": "d9e0325e-7ae3-4889-af38-8692fd5edee2", "comment": "Malware payload (SnakeKeylogger)", "value": "26e46e0c211a9085020588b7e7815587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496117, "uuid": "e10de56a-1e23-444a-bc99-70075a16ac79", "comment": "Malware payload (SnakeKeylogger)", "value": "23cfe2786b8343a225d7d8ca6906c364ab19d6f594c92dfea39c8f2eb26a635f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496117, "uuid": "463e0a81-9ad3-408b-bedd-7f9da2309991", "comment": "Malware payload (SnakeKeylogger)", "value": "f4eef2b5776fb5d312805ae809d4431eb5b95110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496117, "uuid": "5ce24947-30ee-4f1c-847e-58509e1d325e", "comment": "Malware payload (SnakeKeylogger)", "value": "cf94eaf84ca13ec57a7de2600f5dd4da6606ca3b500c92915dc66a1236228a72b3d5dde3809a2f378b81283c903203bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496117, "uuid": "0bdb5222-e6c0-4efa-92fb-4fba40410ef0", "value": "T19B55220E3973A6CEE05507F2B32D81685374AC366413E369ED8A76E7186BB613C37643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496117, "uuid": "c5aa647b-4046-4d85-892e-5905edca18f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496117, "uuid": "fee2e0d6-57fa-4b93-86af-2e9e6c48fd81", "value": "24576:ycUFvBqsCL1wm4i59gyg9BBfrm+1ZHFBaWRqRz4:ycUFvA518i59YfrtJ0Rz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496117, "uuid": "874f9481-3918-49a0-8490-3163d40e6a0d", "value": 1304064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496117, "uuid": "248335bc-f6bc-4bb9-96eb-b4a4c1982d36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496117, "uuid": "2b2392f3-2d86-448c-93a5-8b4f8fac7965", "value": "26e46e0c211a9085020588b7e7815587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16257993-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639498542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498542, "uuid": "fc52e87d-338f-4f5d-882e-49144f4899b2", "comment": "Malware payload (RemcosRAT)", "value": "93f074ac8008a095fcc0de3e4b1fabd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498542, "uuid": "a214dc7a-8de2-4934-b148-31f61a1b4986", "comment": "Malware payload (RemcosRAT)", "value": "23d503a7bafa84fdc2e0bb47b10d090b66a78512fd2468c489754fe22aa4957b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498542, "uuid": "75baad79-8ec9-4ec1-b99d-c7158240727e", "comment": "Malware payload (RemcosRAT)", "value": "208235a2443f173a3a99b925ecab4fd1706fd452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498542, "uuid": "25f4879f-b3ec-46ef-9880-6750d8a7a789", "comment": "Malware payload (RemcosRAT)", "value": "1d01fa40840d0972c81ac06da26b632a30212832f7326d862beb186db87b440f34e89e24f0b4f2714bb359a6f071568b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498542, "uuid": "ea5bc1fc-9226-429e-b719-d9d94a2fae2c", "value": "T12825F158A378AF32D57F5BFA98B4220A43FD610335A3EB7A5D85B1CA0913781CF05963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498542, "uuid": "1f993bd0-26ce-4dc1-9deb-83f8e9e0fa4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498542, "uuid": "121cac4b-42e6-4a2f-a7ba-5d542ea4a888", "value": "24576:HYRYqK/vgDB1p/niEqmYRqJEEV1iHzwrdSYn5QnWF:UKHg3ERoEEPiHMrdXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498542, "uuid": "4dc671b6-aed2-4eff-9690-98abae3d9ef1", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498542, "uuid": "832a431d-756a-4f55-a13a-5d2b1bedd729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498542, "uuid": "1b2b97a7-61ec-4ddc-94f2-234eaf8f8189", "value": "93f074ac8008a095fcc0de3e4b1fabd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd792f4-5cf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639495975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495975, "uuid": "d772a9af-bbc3-45ad-8baa-f8ef23dbc2ba", "comment": "Malware payload (Smoke Loader)", "value": "33285d0bb3e071ad80d77106b9ca16a7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495975, "uuid": "7a69a9a6-f666-466c-8180-cbc5dfa3b4ad", "comment": "Malware payload (Smoke Loader)", "value": "23dd00e8284e688e738bf39cad483b44dd6dea2e0d4f512a402a27511d9baefb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495975, "uuid": "2859bb27-ae98-49cc-ace1-551a2cf8ce3f", "comment": "Malware payload (Smoke Loader)", "value": "090fdd1d64ccc23389a7ea5a1e7a8ddcc268b242", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495975, "uuid": "6367fc26-dbc0-4e94-8b72-32399b37a4a2", "comment": "Malware payload (Smoke Loader)", "value": "cd7f7c49d2aaf830d20521faf586a8414941c2b3f8c0a87095ccf8778911bb652c3612cb21a5eaefb84d92800acacb0e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495975, "uuid": "d382c1c8-7917-474e-8e61-30aabff84483", "value": "T19AF3BE123AD0DC71D2E319708832CAE11E7BF8A15A64455F77A82BEF3F722915A36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495975, "uuid": "b7713ee0-e161-4a53-9e7d-9ec8e7df819d", "value": "ce74c352c7a68a20cfb87163e6a8e0ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495975, "uuid": "1361ea4c-7b30-4fd4-b888-883efb509141", "value": "1536:uJUbNJuk4AI4CNAKNF4ckNZIj69K+mxNXYe7nO9b+DWSvM2I4qLG65OjahsZJ5Aw:5Il3dzxNXsb+DvMBNLG65OjahsrLnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495975, "uuid": "f74b520f-8303-4519-a029-514ded08a65a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495975, "uuid": "a1f80791-37d4-42ac-91ff-7fc0c63dc06f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495975, "uuid": "3155bebd-6d21-4a43-85d4-6bb506139384", "value": "33285d0bb3e071ad80d77106b9ca16a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953aeb24-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639466114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466114, "uuid": "e4d67fff-30dc-49f3-8b9a-0ac43355fc24", "comment": "Malware payload (GuLoader)", "value": "2f19182da895afc914c7b9851a4f2d49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466114, "uuid": "5f2ea1bb-4d2d-4159-a6cb-98756d0bf92c", "comment": "Malware payload (GuLoader)", "value": "24d5129d6ecbe5ba5e88077d1207bc09fc68d076dea00892bc614a267f9f0b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466114, "uuid": "5c96ef91-2fe8-44f5-a153-6d8af28f67d7", "comment": "Malware payload (GuLoader)", "value": "7d111bd6284cdd87498e72d90a595aea9fc35d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466114, "uuid": "cd348b75-d0b1-43eb-a777-4f04b14f4014", "comment": "Malware payload (GuLoader)", "value": "043b8c9f19c0fdc972ee4918eca748bbf6b8c5ca2091e8470b0f977af3f8db10ad08267dc9eb523b2ed09a850d205060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466114, "uuid": "24fa6b40-7e67-4dae-946d-6140a5f61183", "value": "T14CF36CA16581FE63F366D4F05314AA2445E228B1C702A03BF05F3B663272BD37E5676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466114, "uuid": "1b6482a9-dc69-4e95-9c7b-e98477b297a6", "value": "e7597de960f525af7c9e8aa5873fcec3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466114, "uuid": "88f72079-d9a0-4da1-bad0-77f5a1468d04", "value": "1536:w4P8PO3YuBX0051Zy0U4SfGaIsmJNa+I37KTqzc9TPVhp4N3L32DdX0:nP8mVVztUjBmJNS7hzc9c32DdX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466114, "uuid": "4d8efd2d-9492-457a-81f2-63303e450e2a", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466114, "uuid": "5482cf78-ff2b-4fc7-966c-55632175d845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466114, "uuid": "62fcd38d-b51f-46d0-be08-fc793ee35901", "value": "SWIFT_ACK-89813.02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9920357d-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639467409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467409, "uuid": "f5a2d587-4fe2-4315-9938-29d50551b0c3", "comment": "Malware payload (SnakeKeylogger)", "value": "56ed8c499c215b1a8512dcb5f97a535e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467409, "uuid": "e6f2b41d-1661-4861-bf86-a52651a226f1", "comment": "Malware payload (SnakeKeylogger)", "value": "25174b783f7d0f9bbe462343a5ba871e0817d898081abcb5f99da47ef1a0c794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467409, "uuid": "cdebc503-b71b-4790-9318-1ef537d8f47a", "comment": "Malware payload (SnakeKeylogger)", "value": "5d204fe0d78393d9a99a1740dafb322c8b641b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467409, "uuid": "5fd77978-7941-4c9e-a874-64f25834f6ae", "comment": "Malware payload (SnakeKeylogger)", "value": "1edcd4b4c22b69e4cbf64b3382c2e319304e2309987ed41152649c03c2098d264a1d00fdd6b2ffa8f84829f3714feb80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467409, "uuid": "3d179114-e5f5-48ff-ad22-369d79ef9d51", "value": "T106E4D0935F5488B0FC26CEFCFA65D71B5C1D9ED22CE6912712DC0D4612A1A2BF2D8932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467409, "uuid": "e53b37a4-a18b-4835-86f0-9769c7b84a4c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467409, "uuid": "0c6fa1ee-dca6-45b9-be14-391b8aaab66b", "value": "12288:U00S01a1Q5WJoyJ1qmzhW1xmM8PB0ujgwDIs2mPF8tYxjTh:yat1BhYxRUBhsH7mN8t4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467409, "uuid": "3a5f0c4d-535c-4cd9-aa62-0379c58386d8", "value": 706367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467409, "uuid": "d5415a5e-b269-46f4-97b6-80af6efbd858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467409, "uuid": "5f098ca7-e296-4bae-924a-c351341b779a", "value": "IC TEKL\u0130F ALMA-ICTSM TC-730-TE-849-TM-559-576-TW-755-TC-885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8acfab-5cbe-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1639473272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473272, "uuid": "45f3d185-dc64-4a46-a8d6-279c7a0e3371", "comment": "Malware payload (Gozi)", "value": "26788bdf519813ff2600570a5c8e23d9", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473272, "uuid": "17e0c933-46e6-4c1a-94d2-a9d84f1db46c", "comment": "Malware payload (Gozi)", "value": "25f74513f1f0a72453bf096337daba7268bf77371f7fc210f56672f52b7b3af1", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473272, "uuid": "20cee161-543c-4178-b7e1-62c0f9a327c4", "comment": "Malware payload (Gozi)", "value": "44f22a053e84cd7afcf34a4fa19dbf512c8a624d", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473272, "uuid": "4cb62d83-bc17-49b0-8485-17e8828264ec", "comment": "Malware payload (Gozi)", "value": "aff8a02d3672508ff2b73f1659314930956ad1919c715dc46c61ec36957c46ada34d0d9d070389afe1f9f89ae6163963", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473272, "uuid": "c1beec7f-321d-46f4-b307-ed590c450f0b", "value": "T11785E4DC2281871BE825723C7469D2B68B156C875B75813E6E473EFF3532346A68EE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473272, "uuid": "ad931f19-4fe7-43f9-933f-a87d0ff951e0", "value": "90a569c76737ac6eae14ae164dabea89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473272, "uuid": "7f086540-65c7-4417-bd28-599ad178ad28", "value": "49152:dOMY8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8Mc:9Y8UQw8MT8UQw8MT8UQw8MT8UQw8MT8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639473272, "uuid": "c9347bb9-b396-4df3-981f-58f9ea985b25", "value": 1781920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639473272, "uuid": "d1393fe5-368f-4434-892d-67ad3945e970", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473272, "uuid": "2b7f839c-d4bd-403a-8bb3-d0bbeb1d124d", "value": "61b85f75e6a7c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9463e76-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500534, "uuid": "bc6bd647-facb-47b3-97ee-37a92b3a1866", "comment": "Malware payload (Formbook)", "value": "97110081f9f5a7c3e1b325b9f83cdb5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500534, "uuid": "cddee274-0b94-4aea-a52e-902939743917", "comment": "Malware payload (Formbook)", "value": "268f31549715ba5100a49d8b7dd4858118e864c44e153d40d6dec3cdbb223336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500534, "uuid": "5a919f4e-b058-4ec1-b307-f5a30fc9665c", "comment": "Malware payload (Formbook)", "value": "4abe22a109aec36a89c979860f003049dd735362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500534, "uuid": "a0473db0-6db4-4bd8-b80b-d8c50123a878", "comment": "Malware payload (Formbook)", "value": "e4bf8ab65d6c0a1aa86fe999b9ff2abb8aecb5db82f70357e4dbaf8663a0d205bf19cf624aa89c38326d74d5fa69c68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500534, "uuid": "9a70fe42-5155-44e1-8f8b-6c8a0229d455", "value": "T172050F2428BF902DF072DE685ED476E6A9DAF362224AB47A13600F734723D41DDB3539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500534, "uuid": "c12f6b5b-58d9-49a9-ad37-18dc8d3403ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500534, "uuid": "904d2545-e330-49ee-b5c9-53a5439109c5", "value": "12288:Ywm62mN+ITadPQe2hnPpmQb5D+7+MmcjS3lUtFaxLzS27W5ahsrRy7m8D:nNm2BXHzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500534, "uuid": "a1b82895-5b35-448c-aec1-ef1f1120d56b", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500534, "uuid": "d2aa445a-976e-471a-be7e-b281669ea008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500534, "uuid": "f4826aa0-d314-4d4f-92d0-02820553d5d4", "value": "97110081f9f5a7c3e1b325b9f83cdb5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2251b62-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639495825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495825, "uuid": "8159510b-de90-4c62-b9b7-4978949d0734", "comment": "Malware payload", "value": "6bbe38545b58583a22390aabd3257873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495825, "uuid": "0a694ccd-bb46-47ec-a102-e990b4ae5247", "comment": "Malware payload", "value": "26a0c49c1b91722ea73d11f6667b1c8c486e569a068d5b79cc5b2181075f17d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495825, "uuid": "9eee628d-fde7-4670-b8dc-eaeb950f74e2", "comment": "Malware payload", "value": "4035b6261f29bbbc793ab7c0c334fd93d9614029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495825, "uuid": "780672ec-3d11-48b5-82be-5969eb7f9cdf", "comment": "Malware payload", "value": "de21e781367acdd287ad3494c761953facff255b825da6016c150687cfb68943a6eb0f44a7cb249a294dafa591504f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495825, "uuid": "b46a3ffd-8e74-42ab-9b9c-7a02c6ac8b99", "value": "T14F36A8468F688598D4A18077D932ADB445B27DD4C1335EA37BC23DA63E3327091BDBE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495825, "uuid": "2d921e69-e890-40e1-a843-5c2c465144eb", "value": "4bde4f08c217ad48a6baa148956a6236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495825, "uuid": "e92e30be-d923-4418-bb60-626cba49d168", "value": "24576:VE9yEcTNLOPhtwFAQwDiKpGv9qo3N+OmLyxW/uk+reNWCyTLW5P9fSt3qr13qIgh:VEc1k+F2DzGBGx2ZeNWDWeCB23EUJLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495825, "uuid": "977b9570-fad5-4306-ab75-13c8e97fed32", "value": 5279744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495825, "uuid": "709bc257-714d-4410-a260-dd6f72c9f235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495825, "uuid": "b0f589f0-b4f0-41c2-a935-90936f5523e1", "value": "6bbe38545b58583a22390aabd3257873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b429d4-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461603, "uuid": "537a7f9d-3d4d-440f-b854-dd4aeb51157f", "comment": "Malware payload", "value": "05c7d29458580a7d04c2462ac530ad51", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461603, "uuid": "1db39bbb-9313-4f91-a6f6-2fe97ea7ed2e", "comment": "Malware payload", "value": "26ea5a14451a0736aeb8449878b1f78574c53c243a4648cb7faf27e69460da80", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461603, "uuid": "a7aa50ae-27c5-4999-b5fd-9bc90023153f", "comment": "Malware payload", "value": "09c78c1ea685b582402f966a84a372edb9b5363f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461603, "uuid": "204e4643-4d6d-40db-a659-791ed570f91f", "comment": "Malware payload", "value": "032f87fc327b1a09dddd1d20cc7e39694821dc9b9c2782e8ba47eb65d77feba8b385f7a038a7a0409243f73a53e09052", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461603, "uuid": "b5fd52bb-0bad-4e6a-ad9a-51c590072387", "value": "T1AF85330862B97CD8F9DE022D3B6249D0C2AD32E1B440B0D676995CA55E7B1FE038FD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461603, "uuid": "1e69cb3f-1a9b-4419-85d2-e5138ddf481d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYym:IDSTOhnXSI0Wk5jG2nfBtkaeym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461603, "uuid": "1e5867c0-d568-476e-97fe-79f7cbc5e1b6", "value": 1777664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461603, "uuid": "75707c3f-def3-48d8-b4b5-5bdc193c04b6", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461603, "uuid": "ecec2929-1702-4408-9801-f7f6f3203a73", "value": "26ea5a14451a0736aeb8449878b1f78574c53c243a4648cb7faf27e69460da80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cfe345-5c77-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639443009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443009, "uuid": "03cf2093-8955-4f50-85d7-cfd19c7b84a0", "comment": "Malware payload (Mirai)", "value": "9b50a8ff662fb3fdf8bd8ec1c5bb6ed8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443009, "uuid": "3c65224e-fdb3-4efc-af97-c457628a25ac", "comment": "Malware payload (Mirai)", "value": "27f949fcfa569de1806bc0a94d60cfc8cf95415237bc9abbbd2d5aa41d8a817d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443009, "uuid": "9af0be98-9998-44ed-8311-cfd698ae8415", "comment": "Malware payload (Mirai)", "value": "1a7d67995c14cc21ea04782d3818ef233beb1baf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443009, "uuid": "e686d4b4-17d1-4b33-ad76-4a9f66bb963f", "comment": "Malware payload (Mirai)", "value": "17793d1fdf2bbbcb35bc742e6ec8fe4997fd60b7674aafc4f6676998fff538696212ce520bf643b89b19c9d2675250d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443009, "uuid": "fa70bab4-58ce-4ceb-9c05-5e429a0df43c", "value": "T16003F1406DB32BB3E374D432FC6FE48938A10326959B2B760591957C8BB52C78A393C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443009, "uuid": "bd932015-a342-4a28-80a0-3ac61e02dd61", "value": "768:qIL7CZ6Y93TbBztyf63JCCyIeBZyyvG8c7gU3VmhiWPNLfwgiTIIJs3UozNh:VL7CZZ3xtYmgXyAsgU3Vw9PNLd7zNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639443009, "uuid": "2215378b-8d9f-43dd-94d2-3aef3e2967ec", "value": 40116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639443009, "uuid": "b2ee7050-d218-4f51-9cb4-b4c74b5d17ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443009, "uuid": "bc4bf212-45b9-4664-9368-3c2d3f83562c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d78ae61-5d17-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639511413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511413, "uuid": "ef0ca7fe-6b98-438f-8295-0c27a98a4af9", "comment": "Malware payload (Mirai)", "value": "eab77e454a71c0e4b661f2e20e50d892", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511413, "uuid": "9e4d93e0-08dc-49d2-a1a4-93de6997dc2e", "comment": "Malware payload (Mirai)", "value": "28b00bfa64dd82c1942cc97358ce66eb8049e46818874ab3727fb114765d88bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511413, "uuid": "b542ce4b-15c1-49c2-bec9-d7db1b05024d", "comment": "Malware payload (Mirai)", "value": "1d43672189f0c19ef5ac41d7b348a9aba242d56e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511413, "uuid": "82a68ca7-6767-401b-8b92-d94c3895934c", "comment": "Malware payload (Mirai)", "value": "6f3a6c1964b8632dd4191548cf765f94cc357b5651834eb5ff72054f9c7b00dd19d60b159360264f4e7c5a31c13d7e96", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511413, "uuid": "92696aab-12fb-470f-8a96-0a1c24c7d51d", "value": "T158635AC5A5C7E9F6EC140A38307AAFB15976F13E6178EDDBD3D42173A841702E6022AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511413, "uuid": "b8bd6f63-9cc8-4404-b6d5-b303c4b24536", "value": "1536:rMNmNGDT33f2eZPFxzC++OHItYer+dLNtmchC:rkmADjDZPFxz2k4Yer2LWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639511413, "uuid": "8c6e70ab-c784-46a7-b677-e74e74732424", "value": 66768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639511413, "uuid": "168d42cf-876c-43c8-add8-f0370d5783b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511413, "uuid": "b2a391e7-3ac4-469a-a637-7099706855d7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4775d0d-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504472, "uuid": "be062676-114d-4514-a549-2833f42be1e7", "comment": "Malware payload (Mirai)", "value": "f6d9f09119c65db37e09f6558cde3a87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504472, "uuid": "b4ba7c1c-a2f5-4959-b4d1-7076dc494ea2", "comment": "Malware payload (Mirai)", "value": "299e27a115a51e552d8c1e744f50e6b58374c890b3fe701ad6e16af0f8f5fbfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504472, "uuid": "36daafb2-c373-4431-b8ab-d90defad4e1b", "comment": "Malware payload (Mirai)", "value": "10f91a0117da7d98d98817ba45aff84a05f21d49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504472, "uuid": "c4e83a7a-ede9-48fa-90d3-5905a15c26b6", "comment": "Malware payload (Mirai)", "value": "e84f07758e862a3b532184344562cad241bc9fb89dc9c86830b5563ff62a8fa6edd83e9522d889c5f8d03bc441320ead", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504472, "uuid": "509ec642-ba97-40fb-814b-89b9553da551", "value": "T152337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504472, "uuid": "d16e5dd0-9f7d-43bc-be3e-f1b446482ef4", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvL:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504472, "uuid": "88febd5d-44e3-4ad4-bfab-505c4a73669f", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504472, "uuid": "12b1c9df-e176-44ab-95e7-b791653551ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504472, "uuid": "929324eb-6006-4ba4-839a-5e9ea600bd2a", "value": "f6d9f09119c65db37e09f6558cde3a87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862f7217-5cdd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639486705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486705, "uuid": "48385d09-44bc-454e-bb86-a25f6a2ba54e", "comment": "Malware payload (Formbook)", "value": "9a1518ed709f916360e56b5ac7d76995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486705, "uuid": "abe4167d-2df5-4625-aea0-6a83134536e2", "comment": "Malware payload (Formbook)", "value": "2a0878c196278384aab473c92977d236680c788b4e5ae0cc1f415a075a6fa9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486705, "uuid": "fca305f5-9196-44e1-9e43-a204fad511ae", "comment": "Malware payload (Formbook)", "value": "7c85312d66edf5b02ebd6c25cfe9c036a3471263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486705, "uuid": "3f63f8cb-b28c-41b7-b60f-d1f8e519cda5", "comment": "Malware payload (Formbook)", "value": "cedece0a376b25bc5fd649e9870b939605611355b886223bb49a17c2f629adb80e7b2836b03a61d05448e0024f2dda6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486705, "uuid": "8e0eea79-5892-48fa-9648-197ce878d954", "value": "T1FEF37CF1E490FA22F326D0F66328866884D62875E6006437B58F5F9266B0BE37D1477F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486705, "uuid": "e0278a30-bd1c-4e9d-8d3f-8cfcb2bf7fe4", "value": "e7597de960f525af7c9e8aa5873fcec3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486705, "uuid": "4f99b37c-10b7-4c91-8ebf-0b8063a22cd1", "value": "1536:FrdvP8OOzT80mFxgs0HtyWPK0xljCwioDoWjJNa+I37KTqPRzV5pkNXuUAnq:ddvP81zTGUjKWMoDhjJNS7hPHUAnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639486705, "uuid": "f1e9857c-6194-40f3-922e-c55ecb2dc15f", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639486705, "uuid": "3b708131-c639-4c80-854a-68f3113da0a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486705, "uuid": "5165f65b-817b-4307-94d1-c23e376f5fdf", "value": "pago12_14299038859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e413822-5cf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639495979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495979, "uuid": "578b69cc-03ee-401c-9f7a-2470c4befff8", "comment": "Malware payload (RedLineStealer)", "value": "185a1618971eeb1f343e81fabe987041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495979, "uuid": "4c557632-525a-4625-86b7-3f889ccd96db", "comment": "Malware payload (RedLineStealer)", "value": "2b27fc044a4ce3bfc1f7a46be0ac6e68da908ffaad2b7dcfe94df252123e22f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495979, "uuid": "13a6ab80-2e10-4b3e-84e6-0ded69404d6b", "comment": "Malware payload (RedLineStealer)", "value": "9ae4c684a1e94214b3bd46d60eb71624ff8a676b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495979, "uuid": "cde7c748-374f-4d99-a619-14ae180a528f", "comment": "Malware payload (RedLineStealer)", "value": "252092e504adf9750b2fc8c7203b463bf739e777e5860870e330f876e854b8a89149e87f85d3f023fbedc43e9cf894b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495979, "uuid": "444765fe-40e4-47a7-b649-995038f3b36f", "value": "T12F15AA0BEEC392A4EE824BF575F3B7004F7555D90F2B03E89324A9E15A893673B0C965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495979, "uuid": "ef06d62c-4773-45ce-a1a3-8466f2c43b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495979, "uuid": "d1f5f5fd-d4a8-469c-907e-fbc44bd71cec", "value": "6144:ru45TeznA9tkUAIU1lTVU/uOSnyGwgfuvUnDNI34f1UvVKaWvFMj544DeBykJg0Y:y45TOnA9KIUoaGTi+f0XOn3RIjZGpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495979, "uuid": "1c2e2b19-004c-493b-9d1d-fe11c0e9343d", "value": 955784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495979, "uuid": "e706154f-0b74-4958-9a23-aebe743b6ef6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495979, "uuid": "bd561686-cc76-4e5e-b45c-c4a38dae45a7", "value": "185a1618971eeb1f343e81fabe987041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a624b8-5d0e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639507665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507665, "uuid": "344ba01a-2d2a-4914-bd4f-f1e24601c18c", "comment": "Malware payload (Formbook)", "value": "0975b530448106159ca8da6099391901", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507665, "uuid": "1b6e885b-d12e-4045-af08-a50b97fc2350", "comment": "Malware payload (Formbook)", "value": "2b79a539c923a5ed65891331804be81fcd6c85c0a63bd6e89180e7f0e9eb3239", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507665, "uuid": "608ed797-8be4-47c9-926b-c6779bb226a6", "comment": "Malware payload (Formbook)", "value": "b8947fa658f9170eb57c9701b268233448f3bf86", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507665, "uuid": "8c5b4ff8-3356-4d06-a745-bf2231922bf2", "comment": "Malware payload (Formbook)", "value": "66c7f30790a018a4adbe8d4fb6b67a7203897cb6390b3441d22779b4fb455f915aa41a1319c0327c19d5ad1a514c98fe", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507665, "uuid": "73591973-d8d4-42e0-8eb6-3f3bdfded2ec", "value": "T1E83502A5A3686F75D57F5BF684B0220A43FD690339A2E73A4DC5B0CA1D53B80DF40A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507665, "uuid": "1aa912cd-2e9a-44f1-a848-966b64e533d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507665, "uuid": "e7b70d14-8aec-4388-9bda-5d292a86fdc2", "value": "24576:mYRiEThxFE99sP9IQL/5BUMVG4MIH8BwYkXt2ArdEQjgI:tEkVL/3Hl81kXrd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639507665, "uuid": "fe0ded54-8246-47d3-b71b-bf22f1e46bbf", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639507665, "uuid": "bb460d5b-01f1-47ab-b521-2c77e2b5cc5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507665, "uuid": "3d91a2ab-900f-48f1-85ea-eb9043afc4fb", "value": "Quotation for Urgent PO 110921.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611ac898-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1639466026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466026, "uuid": "48701e00-016d-439f-8efe-cf3449feef06", "comment": "Malware payload (CobaltStrike)", "value": "2ca43fdcb734596a96399a50d9120f87", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466026, "uuid": "6b76ce40-7ae2-4430-b1ae-acaf58d17a4d", "comment": "Malware payload (CobaltStrike)", "value": "2c568da9e5b57d99dd1934aa7dd4a463bc1d761c236ea89b171e58389ed1e2c9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466026, "uuid": "85d14c34-2ac3-478c-83e4-872e28ebcd63", "comment": "Malware payload (CobaltStrike)", "value": "8dfd564d587bef309e57b18ae656b99191e2482a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466026, "uuid": "9e946262-5e51-4a4d-9712-13cba1a9e3a5", "comment": "Malware payload (CobaltStrike)", "value": "7640957017ec46ddc8839511a219b257c83861bec34d49569117bb2550982e96c1e0ce19346551430aeb798516a19050", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466026, "uuid": "fa2947ea-24c6-4550-a892-b4016ccc1d4e", "value": "T108351890B2B1E830DC670675DA94CAF6B6EE7CB4882159B762E67F137C62145C8F4C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466026, "uuid": "5c9c14dd-d462-423e-9ea4-edb5a15bca69", "value": "56f67c079e0d778545b134d2d5913607", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466026, "uuid": "75432d13-5714-435d-88e5-d4873de60b58", "value": "12288:1ngyFSO4dQokddCkcBhNuta7TWobhNaWu:1n1wQmXNuta2obh/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466026, "uuid": "9de11ee9-6ba3-4e84-a520-23e166876022", "value": 1160024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466026, "uuid": "5bd1eae1-fbfe-4054-8448-536cc76e60eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466026, "uuid": "5394a6b1-6197-4959-9e45-f340d266c108", "value": "2c568da9e5b57d99dd1934aa7dd4a463bc1d761c236ea89b171e58389ed1e2c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afb1bdf-5cdd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639486525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486525, "uuid": "d2f4293b-42c0-4c31-acfe-9ee27bf6787d", "comment": "Malware payload (Formbook)", "value": "7c8fbdef3b33f6a11926627e671d7b7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486525, "uuid": "5ee6158a-683d-4669-bc8f-9af690e7aedd", "comment": "Malware payload (Formbook)", "value": "2c8f4b4a178ea06cffe462e08ba5ddabb964cb715b9cdd4024c1b0f7bc7e78e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486525, "uuid": "ce9b79bb-9152-4148-8528-13ec0acbebfb", "comment": "Malware payload (Formbook)", "value": "2f357de6dd13643fa0d70cdf2eafc2449b544190", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486525, "uuid": "1ce67a9d-23d2-4f83-90ed-8492c1074d75", "comment": "Malware payload (Formbook)", "value": "188f1160b9b2dd03228f4a18ef198aae53039b001ee68f150ba92870b7aa22c0f88c2b51fbef3d997f61d9eec45465fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486525, "uuid": "ef016dcd-4e93-4295-985a-c996307b9364", "value": "T1B155236D3293B9DDC42447F9B36CD03C53B29D729A03D79AD99631DB082B3687C23586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486525, "uuid": "45df2b1e-da12-4d8e-b662-e0b71fb94ce2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486525, "uuid": "77f89418-5c24-49b8-9cca-8ab67da76986", "value": "24576:+6wtJFMY5NqtlzSt7geF0w+v+0J2gT496A7GxXr/wUa:rwGkNeGOzEcohap/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639486525, "uuid": "a133812a-a092-4a06-9303-327d8c877f4e", "value": 1394688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639486525, "uuid": "3ffcac42-a15a-49bc-aeb7-c843344467d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486525, "uuid": "7fb2603c-910d-49ee-9b4c-478ea5eb88bb", "value": "7c8fbdef3b33f6a11926627e671d7b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902e7ed3-5cc5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639476413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476413, "uuid": "a49bad81-6c6a-4a2a-bfaa-d7e471d196cf", "comment": "Malware payload (RedLineStealer)", "value": "23ae28e81f1e63455a51ed79e36eafd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476413, "uuid": "e0b0d457-9ac8-4ad1-a831-6650b71330d1", "comment": "Malware payload (RedLineStealer)", "value": "2d83a975458e9b1cfacbf8ed5a5a4518b6300965ba370331bee769f496d26d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476413, "uuid": "532d5214-10fa-48f8-ab04-b007a9418fed", "comment": "Malware payload (RedLineStealer)", "value": "952ba8bf7a07bd3c28540fae6666a7c341c49cf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476413, "uuid": "1eddb52e-6514-4b46-93a2-4885c2a16625", "comment": "Malware payload (RedLineStealer)", "value": "280999e2514df73e0aa00a8e006f206b41aa7e1f42d2cc0b41d7c0890d22df2d292403445c9b6aabf90c66bdc3d8f25d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476413, "uuid": "44d2c1e6-299b-405d-8ba1-868be83b6eea", "value": "T15A94D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476413, "uuid": "d677194d-5f17-4a5c-802e-e0ceb853eeb4", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476413, "uuid": "621ade4d-e2fb-4f01-8f4e-edf5f59208af", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639476413, "uuid": "9d17c9f2-46de-4488-b471-a43b9952695c", "value": 419920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639476413, "uuid": "9ce5a609-5197-45e6-bebd-30d3dd6c92d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476413, "uuid": "d33b3a07-8e67-4885-8551-6b934e8389fa", "value": "23ae28e81f1e63455a51ed79e36eafd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f42501-5cdb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639485744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485744, "uuid": "6c133ad0-ec4e-43d4-8e56-7e31de36ef3d", "comment": "Malware payload (Moobot)", "value": "04fed72a3325198f21c8967b3469a507", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485744, "uuid": "4f2d18aa-334d-4e92-80c8-abf34560a577", "comment": "Malware payload (Moobot)", "value": "2d874dbced05312789da35937fabe209537303dc932594abdfb297dec5a4b956", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485744, "uuid": "902a733a-5c78-4688-b88b-c842ceed3a49", "comment": "Malware payload (Moobot)", "value": "da3ff1a84062f82b6e02306084149b092326600f", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485744, "uuid": "00402764-790a-4aa4-ab85-658a22883077", "comment": "Malware payload (Moobot)", "value": "8db65650fb91553bd9bcc89e5a2217bb17ca71edebcc08d18dc30e0dbcdc2bb9c52874fefc8afcdf028f2f147b88e747", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485744, "uuid": "ffd379f7-c33b-4e4a-9227-6d4d24bd38e4", "value": "T161D2E844BE869D07C5C94377FB0E028D376523C8F2EEB213DD163F56E68E527099A0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485744, "uuid": "b4f43a8b-f823-4ade-91e6-55979f4b5e54", "value": "384:Vju9yliPJpzXqS+YyBfZvgTuQqXnPTEvcp4aZybRi3PvIzuICv7PsfaBIXMIcPTz:Vjixza7fZLBTzpbzwRw1Ikt4LnwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639485744, "uuid": "caeceb49-78be-419f-8659-f750c2704b75", "value": 30420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639485744, "uuid": "f26ed661-e5ad-4f2c-97b9-6b62a66e5635", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485744, "uuid": "14fd0990-b8fc-4542-b80d-2ef82ee23d62", "value": "la.bot.arm-20211214-1242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ae7583-5c9b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639458402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458402, "uuid": "5fe0abf6-a31e-4f33-89fd-3a9454231d96", "comment": "Malware payload (Formbook)", "value": "02e92cd81e96503e161af2816aceeca6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458402, "uuid": "2fe34732-9e10-4c6f-82c9-fef88c4f7271", "comment": "Malware payload (Formbook)", "value": "2da5894ddf4a54f105d7a36e1e8940b00313b16ccaa74f270c542ed140247386", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458402, "uuid": "c7079bc5-e53e-4482-a807-a867451bc9e9", "comment": "Malware payload (Formbook)", "value": "ae3badc4e7dc0cac71d93e12b9b6349afd12eab5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458402, "uuid": "898d5f1a-1788-4f3e-bbd3-71812c8a703b", "comment": "Malware payload (Formbook)", "value": "57eb757c34b4a76ca59d4cd87bd3ce30b85f742d121c3c605d3f7a7618dd35346121d8184b6344c4cebd3d7f6c275ec2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458402, "uuid": "4f60e8d9-9127-48c5-b38a-c1b909ab2389", "value": "T1F9A423BEBCC1149FD71E09325772FE35A7F6826C142DAEA3CF0A1EB71A55142D934282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458402, "uuid": "d0330fc5-f330-4381-94ba-047b73ad2a74", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458402, "uuid": "d95de678-b2c5-445f-b834-804b04bc79ed", "value": "12288:ANZHWGXqqdGN2Yh29ch+O+mXZ+uAEnWr9MyIirq:AOyt53O+kZ+uAEn299Iie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639458402, "uuid": "252474af-f434-4717-8a1a-4114c1c32ca1", "value": 471073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639458402, "uuid": "eb759e5b-68ca-43f5-92d1-adaaace52fa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458402, "uuid": "7f06de1e-b297-46a3-9ffb-8537b07356db", "value": "02e92cd81e96503e161af2816aceeca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74abcee-5cbd-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639473124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "0784f78a-e14d-47d7-9960-146d3c2868c1", "comment": "Malware payload (RedLineStealer)", "value": "96bc0cf8c293d89845f1dddb4c211c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "77943a9f-8441-4f3d-a075-e08ad7ad2349", "comment": "Malware payload (RedLineStealer)", "value": "2e6ee519c03027ea1b07d81a8ff35e5ea98ba60df702492435bc5a1134e6c894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "6d1a3666-c757-4db6-83e7-73909e3450b5", "comment": "Malware payload (RedLineStealer)", "value": "ec0d992a0a60a2f66797a8062666af6d957ee8fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "f3a74840-b872-459d-a087-8d4a86e5568a", "comment": "Malware payload (RedLineStealer)", "value": "11e1464074ca22f0441133d5f5eb418606b7268a6bb46c0afab28094c3151ee0d30bf2e2d21f3db367cad962c502e21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "70ff1a6d-2795-4fbc-a17a-864af5b6579e", "value": "T11E14E595A3759800F03DF578CBA1EBB03162AE5C55E75ECB62F97D27EB2A306DD00290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "a5c8e50e-ecc4-43be-97a3-46c794a09ee9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "a6356a8c-901f-4c31-9ecf-6bf0fc2e4015", "value": "3072:0tzGiNfaZ353c4p02FzlbThmPnvLgufoVZL0neER15djk1e:2GiNfaZ3q92FBbFQLguwvER15dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639473124, "uuid": "39bab3a4-8fe9-4591-9c6e-a906d9066fc8", "value": 194016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639473124, "uuid": "bcf28604-a82e-44fa-b753-bf2279d2d2ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "b985295b-4b42-467a-982b-bc1aa8875a89", "value": "2e6ee519c03027ea1b07d81a8ff35e5ea98ba60df7024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd7319b-5cdb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639486046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486046, "uuid": "68dfba85-7e3d-4106-9c70-a212614523d0", "comment": "Malware payload (Quakbot)", "value": "b80c1aa361cb9d0fe2d98e505334f9bf", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486046, "uuid": "1ca1a08f-e4a2-4909-8d36-c91a68a8a412", "comment": "Malware payload (Quakbot)", "value": "2e7c6b9eef00daba7e9bdb8355cdb71278645579f64a892c79e0d57892766681", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486046, "uuid": "925a2902-9dbc-4ede-9faf-468995dd5d1b", "comment": "Malware payload (Quakbot)", "value": "a02d5e37dea04791776087ece3a6d665e51dcf64", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486046, "uuid": "8833dc21-3709-4dad-914e-db449429368c", "comment": "Malware payload (Quakbot)", "value": "ad0bac83143348e4a346d81426e96afbd473244eeb6593ae1ac802b72d7db0e48cf9da57317e3cda4b12c040cff112d8", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486046, "uuid": "194b96c5-b5c9-47ce-b785-89f68b89696d", "value": "T1CFD39D47EC090683D8648BB9BD0B1D3CBF2D192DA9E123FD14260DCB6EA52675D9F04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486046, "uuid": "fac72e12-f1fd-41c8-8332-3c11fb95494b", "value": "3072:7zJxZK/FGOztQNL0cBLJUq1dJZvPpz7+fp7Kj:7znQ/0OzSNLJNUydJZvPZC1Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639486046, "uuid": "158a9bde-7074-4453-a19e-76d3e1564c4f", "value": 138848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639486046, "uuid": "23de4694-ed84-4734-ae19-3dacb01da8d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486046, "uuid": "fe9b5cc0-23ab-4106-b1eb-7cc7c1d60776", "value": "PP-1296358929.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b8f875-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639497809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497809, "uuid": "dc338a1d-8c12-4a47-a914-4fc3a0c912f2", "comment": "Malware payload (Vjw0rm)", "value": "758be74d9c92c2ee9c764aef35d6255c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497809, "uuid": "b72084ff-f494-4cca-a3aa-0e0a923822d1", "comment": "Malware payload (Vjw0rm)", "value": "2f080144041bd1775e78932739ef2c7e81289c5910854ece723b83970b5e8264", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497809, "uuid": "dfa06821-345f-41f1-b770-7378cf8b336e", "comment": "Malware payload (Vjw0rm)", "value": "1872f276eda68e63c8982918545c88bd22bfd8da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497809, "uuid": "30caff16-6fd9-4f1b-a5b1-64d1e5363e4a", "comment": "Malware payload (Vjw0rm)", "value": "7eb9346778616e7a52db4997b9244d5ab4e70d31c83e708b3ee1ab4fad5e0cddd81d826f74d30c70d2afda7dc773f4d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497809, "uuid": "a00d93b8-d4e9-4bdb-ba82-9ab99fee1a6d", "value": "T104647D90BAD0657AAA8664E714EF670F23F8A15735019049F2D1F6302FFBFC0961BE16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497809, "uuid": "957e3c9e-a0ce-48f9-8003-e7bf302c1e30", "value": "6144:OaLfslZvvb4tNj0ncIQFZ2DWUoZZOohN8gMaoXn:rBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497809, "uuid": "b12af207-499e-490e-93ee-d9365c0dfc3d", "value": 317387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497809, "uuid": "9e6a1a4d-ecfd-4b1b-8cb6-cbb6ec48bdd0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497809, "uuid": "b0ea6cd9-66f1-41fe-b035-3a7934e898bd", "value": "HUD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e96e2e-5cb5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Numando)", "timestamp": 1639469684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469684, "uuid": "e64b1a3c-e3dd-4396-b2cf-097b5150cec8", "comment": "Malware payload (Numando)", "value": "505f30f0dc5db5515870d49b8a058c27", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469684, "uuid": "709a973a-7844-49cc-aeb5-e475d695c6b0", "comment": "Malware payload (Numando)", "value": "308d07fa6ea5a3e88f7bbdcbc5d7df86efb1c39c6736ab16059d88046c99933f", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469684, "uuid": "4cff2257-5212-42cc-8b72-0c65e7c61346", "comment": "Malware payload (Numando)", "value": "3933bbddc8723d8ebfdeb5e961b9a317d11988bf", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469684, "uuid": "0e06211d-5204-4952-b2cd-74d7d905ea79", "comment": "Malware payload (Numando)", "value": "d8f874c22ac5fecc22cb8d753dc7c6704d57431baf8b04f278e58c6357c7d00b28154e8f8ee9b02660dfe406ef3ab4f5", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469684, "uuid": "f4ba0c41-0a48-4bba-87f3-9c1aec89550e", "value": "T18B863307042E929B51272AA3FC94720E739B31AC77A9D240B57CA9C7BEF09F81725F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469684, "uuid": "5a49c02f-633e-4463-9e25-9380c525227a", "value": "196608:6abd9oDJG0UKYmnkqz6JuTn17Or2pIqjfjb+oVix2x:6aUG0yE6QlOr2DfjrQx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639469684, "uuid": "3969064e-afe2-46ee-ab76-4460474769e4", "value": 8280101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639469684, "uuid": "2fb51520-4e0b-469a-a57d-913eb6c4a764", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469684, "uuid": "a2d514fb-97df-459e-beb6-16e08140938e", "value": "Object.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a212100f-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639466135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466135, "uuid": "da0a6b98-4337-4a99-a34e-9590cf709709", "comment": "Malware payload (Formbook)", "value": "794f8393b656ad2a6ce69f38386d9694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466135, "uuid": "f6b964ac-91dd-4e99-86f5-39ddeebb8680", "comment": "Malware payload (Formbook)", "value": "30f6a48b919be938faec9d5bcc1616549d3df4d80d20984e2c21cd77da47d207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466135, "uuid": "45cb6a00-ad28-4332-a867-a740e789df1c", "comment": "Malware payload (Formbook)", "value": "7180fe3d9730c3a112a665255006b2909745f8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466135, "uuid": "51845821-a9e1-4658-9167-0c2a783c3df6", "comment": "Malware payload (Formbook)", "value": "04e12ebc5a370a7c1c061e016c45e2a09e3644485ae582ba749da7bd0db521835f9be8a3af08e4fcb81776544521220a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466135, "uuid": "e6416c72-da5e-4673-98e2-ff0f980bfa7b", "value": "T14CD401A2D1904863CC6607F8D872EC3C1167FEEA65B1DADF965EB929EB737C20012507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466135, "uuid": "3958568e-5c6b-4a63-b9b9-248f741999c0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466135, "uuid": "cfbd57ef-8a8b-4925-940e-b3c1cbd8a7d8", "value": "12288:/5QkJeHQTvi98WHfDqmy5EmtzfHW4+Pgsgvc+GGkSSqdGTc:zQHQrikmyqmtzPWpgv99kS/d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466135, "uuid": "ca04d5e7-ebb8-42f4-a69f-ea8bb75d44d8", "value": 607253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466135, "uuid": "a3def805-093c-4687-9d36-ea76cb16a20a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466135, "uuid": "8ff36af4-9572-49c1-8a7a-0d26dc712d86", "value": "Salary Receipt_27845 pdf (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a135183-5cb1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639467786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467786, "uuid": "d0ebdb38-3415-43e6-80f2-13926d06a48e", "comment": "Malware payload (Guildma)", "value": "0fafd82a75e05423268a989a5b405c97", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467786, "uuid": "211fa12f-7bcc-4d03-a9ed-66549f7f8290", "comment": "Malware payload (Guildma)", "value": "310784375206b436866610b30033afb579b5b047ae0a50a4658cd17f31f3a08c", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467786, "uuid": "e02be9d2-c695-4797-8a26-0235d8585e60", "comment": "Malware payload (Guildma)", "value": "39d98d7ae008f2346acd8b083e18c20de57e3d0d", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467786, "uuid": "24a14f4e-3347-4de0-8a13-aa533864ac60", "comment": "Malware payload (Guildma)", "value": "d1ad1a3cfb9b34c026df2c8b2855ad54f7111f8316026e699f974d261f3e8b33d4295461c111661bdfe9b28329af5741", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467786, "uuid": "2c98df1b-30af-431a-af7d-c35fbc4d242c", "value": "T10EF02394476427F4C036863DC47B6F489D39259F8D88BB7EA1E16980C2108C06F1C8D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467786, "uuid": "c9363207-31a4-4f91-b529-8409f069607a", "value": "12:8DpOB+PlyWfkEV75F33LEcUMPfYe4GrgSw:8HPlDcE6cUWfYsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467786, "uuid": "d45ee18c-8540-44d8-a937-2f9b95451e56", "value": 541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467786, "uuid": "9efbd842-5f49-4782-b8f3-cb914173c9da", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467786, "uuid": "2a0374c0-20c9-4418-ae10-6272d86ba904", "value": "0fafd82a75e05423268a989a5b405c97.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a20f4e-5ccb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639478812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478812, "uuid": "702198e1-ac7c-46b3-a81f-471bb977bb50", "comment": "Malware payload (RedLineStealer)", "value": "65b1c1c5d71ed82150dabcdb7ba2d44c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478812, "uuid": "c5f2bb27-2e0b-433a-8b10-f07d3e2fb6c4", "comment": "Malware payload (RedLineStealer)", "value": "3145372ce2fe9323d94fa6f6d9dae5d7e6895a12513e91073992efa970ada2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478812, "uuid": "bbf5dd47-99ed-45a3-ba62-713458af9c2c", "comment": "Malware payload (RedLineStealer)", "value": "f7d29d47a527ff2a15b1c1fa95d16550353c2114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478812, "uuid": "7f5adcb1-d454-4cdc-9e75-812c692b2bc3", "comment": "Malware payload (RedLineStealer)", "value": "5bb9da96072032614593ea86238f3af915c84b27c096a711724f01bcb6e4bbfe935044ac6a9730b42c692155afaac978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478812, "uuid": "d774deb2-2404-444c-bff7-139f91ae9e49", "value": "T1F294CF00B7E0C034F6B352F549B9A3BDA93F7AE11B6895CB12C516EA5A746E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478812, "uuid": "732cebcf-0a19-47bc-acf0-c88b40c15cf2", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478812, "uuid": "c6416a46-36fe-4fc9-8d89-829e505d3a31", "value": "6144:ej8hPMxoVOypQXfFgMrSnRWcMiKLliVXHKZ1F5B3tEdqV6CrwYpr:k8hkmbpQTORdMiWlmKZ1FvtEdqpMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639478812, "uuid": "c89c88b7-8e03-4f6e-9c1d-e53a24a15557", "value": 420398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639478812, "uuid": "0a8fd4d8-8acb-4987-975b-c55ec55374b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478812, "uuid": "9fe4b273-e79c-4872-a90a-8fe21c6eb9b3", "value": "65b1c1c5d71ed82150dabcdb7ba2d44c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26c21bc-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639504361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504361, "uuid": "97ca4ef1-14b2-4fc0-81d6-67f87cbad0c7", "comment": "Malware payload (Formbook)", "value": "c39719a6c92d215dacbeb12f74597718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504361, "uuid": "21292bfc-55fe-4a37-928b-30f5977ff84f", "comment": "Malware payload (Formbook)", "value": "32a772bf42a8618de49966314146a1be7a20fb5aed41195b498491e115905d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504361, "uuid": "08af621a-2ca0-4658-8c85-8f753b587af8", "comment": "Malware payload (Formbook)", "value": "636d43459d1b58a42e9a888bc4f4eea9ffa12ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504361, "uuid": "790e5c15-78ca-46ea-b769-a9fe246f4a67", "comment": "Malware payload (Formbook)", "value": "ef96d46310c34c8e31a568c20d821d0646fd522f0e046c92f8c9a5800e1d00b7f3fb1ff0b04e1ed7187a60a07bcb623e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504361, "uuid": "b786c005-5671-4ab2-8d40-fd75bda08dcb", "value": "T100942328EDD659B7D4890C72687E4733F3B62E40B9300E5F03E9AF671E52392460B653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504361, "uuid": "51b78d80-e0eb-4806-a979-e62d13c428c7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504361, "uuid": "18e5a0ca-cf28-4f92-b2c5-2232275b0674", "value": "12288:pVYzFU7k4ojUeP4lko+ofQG81NG8CQCdSu:pVYzwfY/IlfQ31V6Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504361, "uuid": "17d668e5-b26e-4073-9242-dae771932fa6", "value": 437754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504361, "uuid": "2443ec8a-9efa-40a8-acc8-70ba8d590f56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504361, "uuid": "fe03f415-52a3-4104-b1cc-acdc8d237c1e", "value": "Remittace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1094e9fd-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639465891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465891, "uuid": "29d9d040-97ef-4f81-8d32-255568c611ba", "comment": "Malware payload (AgentTesla)", "value": "e3501484abfa0c2ae27e6b451af4da80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465891, "uuid": "a46dafc3-f4d9-4c7a-89dc-8a5be03b476d", "comment": "Malware payload (AgentTesla)", "value": "3479539c4d759187ef256d5958c99c06cf3329cc51d0e7f6c11240bf35a08da8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465891, "uuid": "c3eb1e06-dc32-46c5-9ffb-81e3bbc12c1f", "comment": "Malware payload (AgentTesla)", "value": "f23df25b0d3ddeee1e9b7e8dca149f53a74e6e81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465891, "uuid": "a9c6f564-d75f-4ae5-9363-feacd55de628", "comment": "Malware payload (AgentTesla)", "value": "e7bddd32939a6cd53546d8c2cd1863de394b97f6475240eb3bae4914d8c966dca9e0fe8fec574049ca89fecad2c79305", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465891, "uuid": "b5c6095f-8979-4aa1-ad0b-0edb49e4c459", "value": "T15745129D39C3E6CEC3620AB6BF6440249225AC765507E3D7F4CAB35F09B77983D22612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465891, "uuid": "588f0c30-fb5b-4185-8f46-7d138a62ff94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465891, "uuid": "299fe7d4-34c8-441d-b4a6-65f560e3d0c3", "value": "24576:gtWKtB158Htb9PH13Y7iZisk0W9Hrts3ApWgLIlorSm:gN58NbDGbJGAM2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465891, "uuid": "0ca596b1-43e2-43a8-8067-944c11244ad2", "value": 1229312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465891, "uuid": "3859fcb7-3c70-47e6-b59d-514c202727e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465891, "uuid": "c4d89e50-b022-4ba3-a990-e5a4428758f3", "value": "095678847666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c44415-5ca9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639464367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464367, "uuid": "6fe6d389-8987-42f8-b68c-433d188bc056", "comment": "Malware payload (RedLineStealer)", "value": "a6a7cffa63d513a784a70083c79ba1a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464367, "uuid": "e1e5408f-573e-4789-becc-8c76d7b4f713", "comment": "Malware payload (RedLineStealer)", "value": "350366b9d4dfcfb5ca84f1d8f932299e222ae76b2c2f6db72a893bc65c47bef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464367, "uuid": "ee5a6a19-9dac-4625-90ab-5bb1ee5dd770", "comment": "Malware payload (RedLineStealer)", "value": "c5ca855831c760444b11d76a0fb3a9d9fbb62eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464367, "uuid": "ab38be60-1b5c-4da7-9137-4ef5a623cad4", "comment": "Malware payload (RedLineStealer)", "value": "e83d9d363398a88641efcd2e2f05fc841a3b7574b64079936e488448eb793f226f9272456aac590539a8310a7f1c7f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464367, "uuid": "d7f6a207-088a-4cd2-bf76-9963583840c7", "value": "T15C648D00B7A0D434F1B716F559B6A3ADB93F79B26B2491CF62D126EA16346D0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464367, "uuid": "08c96965-bdd2-468a-ad90-c3375dbd7389", "value": "fa0d97a230fe11fa07527833b096cd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464367, "uuid": "82021668-2b83-4b4e-a7d2-25b7fe89688e", "value": "6144:8CyL3S553Qp7RFZNn3z+RDczxTQ1wCTWFq:5x27RFZN3z++FTQXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464367, "uuid": "2865d968-5360-40d9-bd9c-116e65a36404", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464367, "uuid": "40d37f8f-70ec-4900-9459-03f0dde74052", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464367, "uuid": "4282fa06-ad36-4abc-bf2c-b2ac97b15887", "value": "a6a7cffa63d513a784a70083c79ba1a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e1947e-5c93-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639454792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639454792, "uuid": "157b7449-a3ab-4484-8766-9b0b351ee1cc", "comment": "Malware payload (RedLineStealer)", "value": "67f22c74e6eaeb8ec2224174eee11ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639454792, "uuid": "a330fd9b-f734-467d-86f8-393213c3f533", "comment": "Malware payload (RedLineStealer)", "value": "35d49811fd57af38242822a0ec8f33449cc654c97d82b20143134d2f1178f0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639454792, "uuid": "1f8e2444-9037-49fb-b57f-53a3d463f559", "comment": "Malware payload (RedLineStealer)", "value": "14fc9d1ec723497e7c942ff3e5908c270f47dd2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639454792, "uuid": "ec313e65-6e8c-4f39-a83c-024262d100e3", "comment": "Malware payload (RedLineStealer)", "value": "9aade1f0750506ddcdab7d6f93a93dac5bba11b083c4b4709b7712b9509cdfbd1c12e9718a479bc16417a2a02f185bf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639454792, "uuid": "873b75e0-3c36-4e50-89ef-2b4ac08324fb", "value": "T1F555338477C43F4DC0528AB8D786160689DF1A47CD6DC22EA487222DE5A4EB3DEC963D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639454792, "uuid": "e8c7a402-528a-4269-9cd2-8a282d31438e", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639454792, "uuid": "bab8f4c6-92b3-414d-aab8-0e8830017b90", "value": "24576:aMib8YftzVd+SeP3rWEn/OHfKNcOTi67cNcfEnkEaHNYK33Bw4YQ3LrS3r4G:adrlvEfrWEn/UfKNcOF7cVnNaTJxErj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639454792, "uuid": "9370e1c4-85cc-48dc-9944-c91ffc5adb29", "value": 1379328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639454792, "uuid": "25cdd4b2-8cf4-447d-98a7-e6eb0d7d1806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639454792, "uuid": "04586ca6-ffdb-4d50-8572-92b7f5ffe647", "value": "67f22c74e6eaeb8ec2224174eee11ce4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91416049-5d1d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639514211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514211, "uuid": "0a5e3373-3e75-4e18-bb14-90cfc286f6af", "comment": "Malware payload", "value": "57c7de42cf38103ead369464079a6b04", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514211, "uuid": "b8e360d9-bc81-4b49-bead-28ac6325fb4f", "comment": "Malware payload", "value": "3664ad1886e4ccac07d9acefafd983f040bf9388a4fb906ac4d87fce26192154", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514211, "uuid": "af78c975-6f17-4e68-8185-d2f2cb480056", "comment": "Malware payload", "value": "3308e3144a3fea2e20b5a0ef8d80e5f503e942ef", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514211, "uuid": "888b18ee-1d82-4071-9728-0d3f3d98ab22", "comment": "Malware payload", "value": "f8f07b48e653a206efd48d85a59d158fdfb6f5f45e4eca33ca6332f9f4bfb72232a7a5e47dd2f0c4ba68426d97ba0393", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514211, "uuid": "18e61a29-35f2-4785-af46-bd3a960e2f36", "value": "T145B58531B1357AC7D3260460529FBE4A531C7D46B3D61F88840DDBF92CAACF9930AE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514211, "uuid": "a372f243-74af-46ae-a5e8-a9084fa4de1e", "value": "1536:Hbz4J3fbgjEpSLfL3LiLqLILxL3LSLILyLWLmLILCL6LvLlLELLLSLILyLWLmLI3:mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639514211, "uuid": "da28c816-2c22-4891-8679-87d7f5b990e5", "value": 2334257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639514211, "uuid": "ae370e0e-9e6d-4680-a2a1-4ba57f0635e6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514211, "uuid": "376514ef-151e-4ca7-8059-6655895e231d", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.6120.4670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26965b86-5c7a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444024, "uuid": "831a2583-16b1-4bb0-a4fb-a9435e43e941", "comment": "Malware payload (Mirai)", "value": "d6be36cbfd5320d224ca5dfcde0738d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444024, "uuid": "75aa72d1-bebb-486d-b21f-fdc0729023a0", "comment": "Malware payload (Mirai)", "value": "368f74242f793b79379224b112298a368b53dbdef1ccf1cf95414a3c3f0b19bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444024, "uuid": "bae4c648-b4a4-4a49-bc14-5d82389ce3d7", "comment": "Malware payload (Mirai)", "value": "6f5f6c25147ee261a9cbd0a88066fe0e8c13935b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444024, "uuid": "2127eaa7-dedd-458d-9570-e8e2c22b993d", "comment": "Malware payload (Mirai)", "value": "659d916425b2af10978a43e74da527029ca62e351225af31c517d37183052d201b4c76ded2d59b01bc6669ab95058034", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444024, "uuid": "79975be4-2772-40dd-abc1-e20f00a7e3b9", "value": "T1B6230281C2C57C82EFFB6E14D6488AC872DABFCC65B0F654E77870420A1BC785669372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444024, "uuid": "42182650-2939-4f13-9522-8b5d9d1da450", "value": "768:DpjqKtxjeXq7JaO6odeMHDb34Jn1bq9hHK78+mYUg9zkmM4uVcqgw09SvWuR:wKtJeXq8iobgb+mYUAImM4u+qgw09DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444024, "uuid": "55769229-d14d-40ea-ab77-ad57a8b5f534", "value": 48784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444024, "uuid": "2fcdd42d-a965-4c59-a147-5bf7f9e83d32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444024, "uuid": "f33f7051-ca0a-425d-a85f-8d132867e55b", "value": "d6be36cbfd5320d224ca5dfcde0738d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f7ec92-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639467422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467422, "uuid": "69accf98-d229-4709-91a4-7c0b6e65c457", "comment": "Malware payload (Dridex)", "value": "e71ab5dee730139f80923fd42c873752", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467422, "uuid": "486b87dc-95f5-4b10-8498-97ecb4635994", "comment": "Malware payload (Dridex)", "value": "380f15a57aee6d2e6f48ed36dd077be29aa3a3eb05bfb15a1a82b26cfedf6160", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467422, "uuid": "97807670-60b8-4108-ad47-d88fa8121a74", "comment": "Malware payload (Dridex)", "value": "e340ff7bffea35fa7c0a6f4218384233c15546d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467422, "uuid": "372fe977-f023-4326-b615-cf5a11e8f69d", "comment": "Malware payload (Dridex)", "value": "d7cf9f5c6a977f876f8cfe807721ce64ef8fafe89bb366bcb9d5e34288082619f0df48d8742a85f13aa2dc93c7f3df4b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467422, "uuid": "29c738fc-d804-4b2b-b372-0376680e0d8c", "value": "T1BD25BE96BEC6AEA2EF7F55B7C360DA3D1156636D03A09ACF760301993915FC2413EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467422, "uuid": "ca31d2c5-a814-409e-9642-aaef69460fce", "value": "8c8bba54a9dc287053536e212411cdac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467422, "uuid": "ff848174-d333-4a9c-adc2-d5474af5fc02", "value": "12288:OHB8k2IlwP0iruRPlOF8bzbBSre4NlKVWf9lcd2akmx1Iqk+7kc5Xgd4W9nfRyg6:E8mO2X1csgLcYEIJ+7Z5Xk4UnLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467422, "uuid": "2c668d67-42e3-464a-9b73-4eb15390060d", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467422, "uuid": "80fc3daf-5415-4990-8f12-99fa988dc713", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467422, "uuid": "853f17c6-107d-4ec6-9805-2769fc7e70f8", "value": "Order QW1502.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aea1362-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465506, "uuid": "0697cf1b-5b1d-4d4f-ac05-0d900d467c38", "comment": "Malware payload (Matanbuchus)", "value": "32dcc8ff4729cebbe0b103b77ea9a0b2", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465506, "uuid": "2301cd11-fe49-4645-b029-2cca29578bc4", "comment": "Malware payload (Matanbuchus)", "value": "3935906e0dd97de6a439dcacab2676d1790c179135bb4e2cb781c95a4ecb0742", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465506, "uuid": "5896a778-72c5-4e94-a240-7b73c9f97275", "comment": "Malware payload (Matanbuchus)", "value": "19ff87a1a773aa282997e2df0820933f6108fbaf", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465506, "uuid": "8a8347e3-7f6c-4cd1-878c-b2ee04515494", "comment": "Malware payload (Matanbuchus)", "value": "15f9a1e7f278f972c93ba8dd69ac0768fd0b910cf7423055a019fa084f67e8c2cc60833c245be0b87531a4c3eca7b70a", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465506, "uuid": "602e27b4-7d88-444c-8fe8-86a3a3d69386", "value": "T194B48CB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465506, "uuid": "9154a1ab-aba0-4890-9277-bc9ec4160ccb", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465506, "uuid": "180a2f53-d582-4c8d-865e-313021b3ca57", "value": "12288:HCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp13z:HfcqtGWdZPuQIDHaxarC3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465506, "uuid": "7cb7e450-0a9a-4a94-8cab-a1812ea97337", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465506, "uuid": "6f6981d4-6b7c-40e3-a468-8987a990fe06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465506, "uuid": "0d3ba674-ba83-4389-851b-498e898e96e7", "value": "3935906e0dd97de6a439dcacab2676d1790c179135bb4e2cb781c95a4ecb0742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179d23f9-5ce0-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639487808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487808, "uuid": "392fcef9-4813-474e-8492-01b70f470d67", "comment": "Malware payload (RedLineStealer)", "value": "09ce9f2d16450ab79b058b5f35744c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487808, "uuid": "9eb56a72-fef7-475c-83ff-f7293dc54067", "comment": "Malware payload (RedLineStealer)", "value": "39d08e14a9204703d56d5c04401753b55298a3d7e74fd11efa84dde60befd85a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487808, "uuid": "b0ddb71e-0e6e-455f-a5ef-0c2719523482", "comment": "Malware payload (RedLineStealer)", "value": "d21d2cf8d5d1b024ca11ff994a43169cf8ea610a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487808, "uuid": "110fc634-513c-4d13-92a5-1d6f4f3d307b", "comment": "Malware payload (RedLineStealer)", "value": "c850c529c713c51095f28fbf381d9072076acb5958a5cf0436333efb88f0e497f9038c2459026cf44b1e2acad4211d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487808, "uuid": "7157e9f0-beae-49aa-b0cb-9b290499f5e3", "value": "T10E94BF10F6E0D035F6B356F44ABAA378A53F7AA06B3850CF12C516EA4675AE1DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487808, "uuid": "3fa42503-a813-4fb5-ab5e-96a657da9865", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487808, "uuid": "e6718911-88e7-44fe-bb57-c4ff6e84a03f", "value": "6144:I/zeCuXRBJU5o3hw/82JZzsBzKgoKAhvRMXcrmG7fRa1cYr9vvwCaDS:hC2BQ0qNsBzQvyXcSGrWcYr9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639487808, "uuid": "751807e7-8759-471e-8bb0-c7405731f20b", "value": 443416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639487808, "uuid": "6972a9cc-7330-48a0-ad62-ce7ba3c62549", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487808, "uuid": "b3f1ea22-1a1d-4aba-bd07-bef1327c7c37", "value": "09ce9f2d16450ab79b058b5f35744c65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38161ddb-5ceb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639492586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492586, "uuid": "2700f49e-d471-4a2b-8fdb-4c2b1e40fb16", "comment": "Malware payload (RedLineStealer)", "value": "11d2ee895a506f32fd54623dc1ad6977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492586, "uuid": "cae832df-9500-49d1-9761-385f51abaad6", "comment": "Malware payload (RedLineStealer)", "value": "3a24f95c80e86639c2817a193b26e2e0d6f290173decee3979241d1d8252adab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492586, "uuid": "2fe784c0-5914-4dda-8cac-7d42458e5a2d", "comment": "Malware payload (RedLineStealer)", "value": "12c6fbae18d379ef62ddbf121874a9a11f5ca82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492586, "uuid": "beebb138-f9b7-4045-9168-91b3c97d182e", "comment": "Malware payload (RedLineStealer)", "value": "dba4c46a1d1c35d56643aa9ad71d9ffae73f313761c6620c70be24781eec4338305077fad45150ea6152ae1c046743c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492586, "uuid": "fb35f3ca-86cb-42a5-b111-3bef944a0b52", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492586, "uuid": "3274d309-75dc-4631-9bea-ce09c6dbd578", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492586, "uuid": "f951fdc7-8b56-4769-b586-8e7cf6dd45d8", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639492586, "uuid": "2beda4f1-1162-487a-9b76-f107610a4ed4", "value": 442384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639492586, "uuid": "e05a144a-a318-4745-9b03-89374f1431da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492586, "uuid": "c28e86e6-5a8b-48a2-9262-c814c59ffefd", "value": "11d2ee895a506f32fd54623dc1ad6977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef00bf8-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500436, "uuid": "e23f390e-dce7-4635-aaad-7590c1f85ddc", "comment": "Malware payload (Formbook)", "value": "ce38337d7ca0611374bfae6ed9edc702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500436, "uuid": "69981403-953f-43ef-af70-353d29c70551", "comment": "Malware payload (Formbook)", "value": "3a536da54a1cdf554d1fe3301c4a7936f889a7c86e166cb081429450e97cd4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500436, "uuid": "1d143a9e-7832-4cea-8509-ecfee2fdc500", "comment": "Malware payload (Formbook)", "value": "d554a57ae4a7a500ae72deb7cd82df2a3efcb611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500436, "uuid": "12b43673-76fc-40fa-b3e7-697c91730999", "comment": "Malware payload (Formbook)", "value": "eb89ead9426e49a9258a49dd4086ae398ce9925f0ac6b5e9c54a517ccb3b3900077c829b5cca4a287d368f16fe1a03da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500436, "uuid": "1650aee1-888d-4c78-acaf-fc95917b3bd6", "value": "T12055222C3A5397CFC52503F833A9A07853A11C7A6507E24AEE8972EF29377097937617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500436, "uuid": "1a01fcde-7d42-4cc1-8d93-757ffbdf086e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500436, "uuid": "81c024de-d2ae-4ff3-a296-045e29cee38e", "value": "24576:ocbVBflnV0J95qEXBriFpnse1sYfc+ev6NmyTjrMuQYDDmPraHboUbwKz1bzG0Ua:oQ/IJVBuXf1bU+u6+HYDKDUt1HrUaZGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500436, "uuid": "7cd3c117-93c6-4f31-bf70-fc3563d27e8e", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500436, "uuid": "bd6eb9e9-4bc1-4a69-af7f-25f766cd5508", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500436, "uuid": "89b33a21-bb17-4244-b97c-569afdbe3351", "value": "ce38337d7ca0611374bfae6ed9edc702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739a040-5d05-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504074, "uuid": "ab84c3ac-c190-4e77-bdf0-e4e9cb75d373", "comment": "Malware payload (Mirai)", "value": "f5dcf430c2a094c2e1d755b78f1e63fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504074, "uuid": "c7b165ca-ab8b-4a0b-b777-0ee031ad8c0f", "comment": "Malware payload (Mirai)", "value": "3ac9018f80788e1d4f966f3131d515cdb4222c7cf10767abfbda6caf2bc6bcf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504074, "uuid": "01e82778-c3f4-40e7-ae87-72d370b58485", "comment": "Malware payload (Mirai)", "value": "f3d1a548487b683c515484a41ea1feb1b0d25397", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504074, "uuid": "0ad51ce5-07b3-4219-a077-3c6001d0a7e1", "comment": "Malware payload (Mirai)", "value": "2fd53937d3461be02dbf4b977d0b372334b12551c59d8542580967c08d054d1e298059421803961b04529849d102bbf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504074, "uuid": "9702a910-dae6-4b0b-a8df-86361e68bb03", "value": "T17EB2E01DC0AE6E74FEDB7E356D40E2817B619BDF3A62CDC016C15A110222D2C1F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504074, "uuid": "06071fcc-e363-42c8-b10e-bd82b92be916", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo1LWM4uVcqgw05VN:2AApCdvwJr69VJoA8FZtxCo824uVcqgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504074, "uuid": "b15a5556-f870-42e2-9ae0-a5f27a6cb31a", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504074, "uuid": "4b22bcf1-b6c8-4304-bdfb-e6e0dcedac92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504074, "uuid": "87b7bdc0-84e6-4510-bbc2-58784feef04f", "value": "f5dcf430c2a094c2e1d755b78f1e63fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dbb5b9-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639467407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467407, "uuid": "46358c6e-c2c1-4717-a520-ce588f6b619a", "comment": "Malware payload (RaccoonStealer)", "value": "12fc76329125aae988f097f127fefe34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467407, "uuid": "883615bd-4e7e-43fd-a17e-321ff38dc4b9", "comment": "Malware payload (RaccoonStealer)", "value": "3b02d9b504566b2ed5368cdf46cb9aea9f3377848ba4e4a29cd38794abc45759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467407, "uuid": "77dbd20e-21e0-4790-9dce-078e2ff5ef69", "comment": "Malware payload (RaccoonStealer)", "value": "4593145e9da88098d36b7f60f4da527e16c1eb08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467407, "uuid": "128dbcec-5035-4e5b-9ca7-d756461bad74", "comment": "Malware payload (RaccoonStealer)", "value": "0149ec2a1f6474caa6458c59c5441a57d2322edbc08cea574ebd2c173de9b235fd38e1d5735497b93c4c2d21e135db8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467407, "uuid": "309fb85c-3bfd-4199-9ed3-51bd23580594", "value": "T1C7D42225438D9BA2F0D52DBC84F22614A335E612868FEF0F9BEC85744E5B7E65C63903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467407, "uuid": "3d98d878-b180-46e3-9293-f41bf2ef5b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467407, "uuid": "c77400e2-18b3-436e-a272-9fc4fd66d86b", "value": "12288:KB6JVObRA0ZNxLbV3j8MsACy1crXYj8N/C3/Bw4o2:KB6vOe0xnZ4mCyOrXsGCPB62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467407, "uuid": "e90bb3fd-deda-4033-9798-1fccc13782af", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467407, "uuid": "e4a87a24-8ea3-4489-bac4-f31decdebcc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467407, "uuid": "746b9b83-5ecf-4c4e-a914-a81ae2a4bd2d", "value": "dec_order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93b3792-5ce6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639490629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490629, "uuid": "1d4b7c0f-687f-4c62-9933-407caf290a1f", "comment": "Malware payload (AgentTesla)", "value": "cdf5e6a768ef330d15b6980c2e28aee7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490629, "uuid": "b408fa5a-1987-44e2-b1d6-e957eae40aae", "comment": "Malware payload (AgentTesla)", "value": "3bbf5a5e8c8c2943b13b78a3c0f472e83b547a89fb588cba81d907a2d71770b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490629, "uuid": "f5a63429-7a62-4eb0-852b-5cabb39710ce", "comment": "Malware payload (AgentTesla)", "value": "349308d587d9f7fb23e5b2f72cf91df1ec7342bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490629, "uuid": "65271a50-51e4-4080-9dbc-346781e1043a", "comment": "Malware payload (AgentTesla)", "value": "4c6c40d581765c6f5a9214251b16d766c70b238a98827c2d3947cce01673cf95bc5af8d640bc418d0ccd85aae6e11f29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490629, "uuid": "f35ebb37-2ba9-446f-b4a5-f7bde4fb2772", "value": "T1DE35127D2A57AACDD82917B97399503863B09D369687E3CAECD032DF2A233447973503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490629, "uuid": "f1ba5384-d3e1-4b6d-992d-8e187986eeb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490629, "uuid": "400ae6b7-e55c-4d90-9a78-e71745991424", "value": "12288:4svYkejo/Wiqwzv0fnlpb7sWwcrC39C3jdHwo18LmbS2bO079/S3rzfp9hj:TwvWRIvsWVg90hQo18ie90RUrzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639490629, "uuid": "d9a81952-3c14-4492-9af1-f6d6b52814e3", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639490629, "uuid": "01796464-72ba-40d0-8240-f6702ad3489b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490629, "uuid": "9accac7f-e4f6-4068-bdd0-afef9d2f59eb", "value": "COPY-Telegraphic Transfer TT copy hefco USD 242,357.59 overdue payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9623dc1b-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639467404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467404, "uuid": "5af5a6f4-f083-4ab9-a211-cad916049fc8", "comment": "Malware payload (QuasarRAT)", "value": "0e6fab9bb850ff541ed51908707543e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467404, "uuid": "61c08115-ce3c-4277-8627-23c9d05fd75e", "comment": "Malware payload (QuasarRAT)", "value": "3bdb6ea8a44107f96f72caeb3aa28cbdcf25b2c08c265f76685df5348bdd98fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467404, "uuid": "a30513bc-e13b-402a-ad83-5e60d52477f9", "comment": "Malware payload (QuasarRAT)", "value": "897ad5e208289ac0cd55c14fe1f576a4952d3eb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467404, "uuid": "012d6064-9f5f-48fb-82fd-3a5db1cb68f0", "comment": "Malware payload (QuasarRAT)", "value": "b8847861311361437430e08b0ee5c6ad8f5191892f44d7f2039d6c51652e71e580db5c18fb9bf3f13a5268cc11dc9848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467404, "uuid": "815cb802-63c9-40f8-9d1d-6b9cb1b14016", "value": "T1FB243EC5E98455A0DD19AB716A37CD3582237EFDA874A42D28DE3E273FFB2931026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467404, "uuid": "c4f43d04-9f32-42c2-a322-25f285cf8474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467404, "uuid": "dcd8d327-dd70-464c-96ad-81c149f012aa", "value": "6144:Lo+AkzL7r9r/EDppppppppppppppppppppppppppppp0G:vP7r9r/+pppppppppppppppppppppppH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467404, "uuid": "1b291211-a611-492a-918d-dd59f39de936", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467404, "uuid": "67b97e9e-dff4-4d5e-9bfa-7c3efcbd06fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467404, "uuid": "c02d5e3e-30ab-4d73-af63-f1e49d1828a2", "value": "c1d35edc-2df8-559b-abe2-5185c1b9b0eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8997ec-5c7b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639444814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444814, "uuid": "70ac7675-5a09-4179-a422-55f5d2f6fa1d", "comment": "Malware payload (AgentTesla)", "value": "7c2836461091aa35e0ecaa6cae57d004", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444814, "uuid": "64cc1439-ff13-4ee8-a5a9-7172435888c7", "comment": "Malware payload (AgentTesla)", "value": "3c486d26fb6c05a849d4b5bb2531ab83034e3857a8a210f147d130dcabf30ddf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444814, "uuid": "57c897d0-9812-411a-9829-438e9c1ad4e9", "comment": "Malware payload (AgentTesla)", "value": "f33c159bc733831f441f9ce0e7c063beb1f96787", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444814, "uuid": "518bd9cc-61a7-4e2d-89c5-fec0d90ead7b", "comment": "Malware payload (AgentTesla)", "value": "7c420c204b0b615ddffdd40b94a7c10c627e757f1d2766205d7bcfd2a5080c9341db275e4622fb7c3d89c78e8ba9c45e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444814, "uuid": "2e3973e3-37e0-4505-9e0a-d0ba8589f54a", "value": "T141B3AF01CBC78153D69A66F270D38AC31B74A34E58A34F5E68CD715A4E9F7427282BCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444814, "uuid": "4ae03281-144f-4af2-a55e-e2a21176438b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444814, "uuid": "8ec64181-fc90-4764-b534-a71f680e19d7", "value": "3072:sy6a9YRpga/eHUTQQQQQQkdBft/2YWLrm1IgGM/NrGRZxph:8oJ8L2FjCDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444814, "uuid": "8a4e27e4-fd0b-4a05-835c-734b2fc5023b", "value": 112992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444814, "uuid": "2ae4f448-b027-4053-b48b-b4d91737aff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444814, "uuid": "d769d087-b987-4467-b3b7-f973aab74937", "value": "AJC INC New Order Inquiry_pbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd932d1-5cec-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639493264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493264, "uuid": "d03cc285-d797-4511-8869-cdcffe1d100d", "comment": "Malware payload (RedLineStealer)", "value": "9316a1a1708a94afb38126b5e24b3c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493264, "uuid": "04c1acb4-43bc-417a-a5c8-e741466ea7a5", "comment": "Malware payload (RedLineStealer)", "value": "3c820da115d083116a24d73cc715283f26b5f4cae406e79e8faf088c682a172e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493264, "uuid": "39bc1fc2-b245-45c0-8699-365a461dc877", "comment": "Malware payload (RedLineStealer)", "value": "92d6b531fe53ade80117c64f8ee00b5af7f6fccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493264, "uuid": "7ddc05d8-98b8-4311-9c61-db80a9df4912", "comment": "Malware payload (RedLineStealer)", "value": "003ad8a1e0d36039f8057844044928f6f1ed2fee7062064f3d39759032cae54419303b452713619e00d70ce446a7ae90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493264, "uuid": "a887346c-cf35-42c7-8792-844687f1f2f2", "value": "T18A5533EBE318B19EF240277C5680D676C1BAD371AC8EB7C83A6AED84404437DE61E15D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493264, "uuid": "05381b5d-2a36-4ec4-858a-8fff23e721f0", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493264, "uuid": "fe0ccfca-7e4a-42be-8736-c7b9c5bec741", "value": "24576:ocQinxhCG8x9UDwfihVzQQQE215wrTc/5UeWWhDKvAAUkEaHNYK379vHF:Yin38x9UDwfwQ15wrARUedAvAAUNarvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639493264, "uuid": "aba2fc8c-edbf-457f-b91f-fbecf0553812", "value": 1314648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639493264, "uuid": "9483f30c-1fd9-4d90-bc97-90c0eefc8f01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493264, "uuid": "9ef69b36-5cee-4706-90d2-780983a4026b", "value": "3c820da115d083116a24d73cc715283f26b5f4cae406e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497796a6-5c96-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639456108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456108, "uuid": "314e902b-cb59-4725-b0c9-e1266ec273d1", "comment": "Malware payload (Heodo)", "value": "35464563b83ef420d8860531e211d814", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456108, "uuid": "0f9c618d-6076-4b8d-bb3c-7076a05568b4", "comment": "Malware payload (Heodo)", "value": "3c82a166af1e32daadbc1781dc0067508352b0429b8c980e4a743c3d2d7cbc1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456108, "uuid": "10163338-8acb-4400-be31-322f674b38da", "comment": "Malware payload (Heodo)", "value": "9fcc088ffc071468c597334422ce379f1908f1a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456108, "uuid": "64b16505-a43b-46c3-b613-0170f4245e0e", "comment": "Malware payload (Heodo)", "value": "fdf1a065fe32a6d48dae203e6f9022ba66bb36ac1c6104b848099beacc59458d148ce52c12d70a7b79011cc0315c71b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456108, "uuid": "c766a95a-cf76-4f1e-b828-06794b0d303e", "value": "T194A47C1177C2C0B6D56F02314906C31D72F2A5908FFA86C7AFD94F3E6EB01D29A39666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456108, "uuid": "2d8ac490-61c7-411c-a5d5-f475fb4fbee0", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456108, "uuid": "05513686-e9d4-4698-bd07-a3b3def88716", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3rNOW1V1d7JI0L047XsMAgHsTM:WKEUkuAOLka1miSmuYr1V7eAobw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639456108, "uuid": "0fa079f6-25a8-4f58-8c62-be302338cd69", "value": 474658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639456108, "uuid": "187f48a8-35a7-419b-9c4e-a4f8d238ebd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456108, "uuid": "dd554707-5a0c-4ecd-a3ce-84d6471467df", "value": "emotet_exe_e4_3c82a166af1e32daadbc1781dc0067508352b0429b8c980e4a743c3d2d7cbc1e_2021-12-14__042824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef6ca38-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639497779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497779, "uuid": "9570e897-7fc4-4d61-ba19-18a7d8fb93c8", "comment": "Malware payload (Vjw0rm)", "value": "f91ad741727a485b74a5cd3d0a32163a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497779, "uuid": "e3b5dd1e-d7fd-43ec-85be-f933dea6a387", "comment": "Malware payload (Vjw0rm)", "value": "3c85914030d8cdb4c41ca8cd0d24b785fef114aa2c1f9864feb028abd3d80356", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497779, "uuid": "2fe34ddf-ec9b-4ad6-9432-d0898e14286e", "comment": "Malware payload (Vjw0rm)", "value": "05fcc5bbd03cfbd35174d7d2ef991f345d167ad0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497779, "uuid": "5ebc9f89-e885-4d51-b27a-70705be121b4", "comment": "Malware payload (Vjw0rm)", "value": "4464bc463d7bff59047c86535943dd68d925b8fd1fa97ce56832158f8f3b8b16fbd4f89ffe47ef7941d2b15ceaf22758", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497779, "uuid": "c679659b-3910-47d1-b122-564165db2200", "value": "T17F53738237C57C811247977BB727B4E1E56E9C88B484884EF404FCA8F0ED916FAE46B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497779, "uuid": "04c45c1a-85bd-4624-989d-ced525757372", "value": "1536:MZ5ckEjg76BaoNj/qbI/E758n8c4+y+FcdC8j3S4xZ:MZLEo64I/EK8c4+yNDS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497779, "uuid": "47c9922d-7075-408b-b26c-0afc88c53ec5", "value": 63670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497779, "uuid": "bcf9e3bb-abc4-4233-b45d-798ac18f891f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497779, "uuid": "98caa51a-1ccf-473d-876c-abe5a6cfbac4", "value": "8023_Payment_Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f9412c-5cb9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639471291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471291, "uuid": "5b8a423f-3d17-4d4f-a56b-cf58487d0250", "comment": "Malware payload (RedLineStealer)", "value": "98659733b4d553f2b81d2006c497fdb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471291, "uuid": "fba24c95-3966-485a-bb8b-98ec7215ffb6", "comment": "Malware payload (RedLineStealer)", "value": "3c93dc4e1f47c0d34e14848c6bac79cb328fdf56b4c4e50323a4e839ea651153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471291, "uuid": "8ae0b2fe-e420-42cd-874a-089935d766a1", "comment": "Malware payload (RedLineStealer)", "value": "de50778e8d3fc5000cd0218e2b8ba4284d5161ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471291, "uuid": "5829cc81-568e-4fbc-8dd0-18e890726603", "comment": "Malware payload (RedLineStealer)", "value": "0c729370867c8c8c5bff30de4fdc64beef46a515cc4778c0ecaa4e25550faec3a8390b28b806994f8bae9b07a33ee57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471291, "uuid": "1924c1a3-fe4b-47a9-b52f-fb1b64817b2f", "value": "T1B194D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471291, "uuid": "6bd7e103-cbb7-445c-bb8f-bb8c88fcf7b6", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471291, "uuid": "c9b049d8-1c2e-477f-9536-1f4f2f742897", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639471291, "uuid": "378b27ad-522a-420a-a2af-cb006fafcbdf", "value": 419911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639471291, "uuid": "671f14c5-8b53-4f1e-b656-7ffe25cd2598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471291, "uuid": "708ef641-703b-4f8e-a2ea-e55aa6b5d6a5", "value": "3c93dc4e1f47c0d34e14848c6bac79cb328fdf56b4c4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df8c931-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510313, "uuid": "245e868e-6efe-465c-941b-d47eb73ff5cb", "comment": "Malware payload (RedLineStealer)", "value": "af9154922ac4f3904489c826293f152c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510313, "uuid": "04554700-fd6b-4b24-a091-a7ae131947f2", "comment": "Malware payload (RedLineStealer)", "value": "3ceb2f66176dffac7e59d840af27b23e6e9874b343ef7499530bbd9241a0d065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510313, "uuid": "c4f0ee8f-9e4f-4d38-ad83-c52948056e58", "comment": "Malware payload (RedLineStealer)", "value": "b8b259e0e2976083892412c15bf63593bcb22d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510313, "uuid": "0f0845d3-6aa0-4cd7-b774-64da99af0e67", "comment": "Malware payload (RedLineStealer)", "value": "cd97682d1da18d01175fc3d9b0613d346eb702b4cd9988bf865079777772025bbd1e7685746dd86f4eaa37daeeffb490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510313, "uuid": "9ab9fe28-3804-4a46-b214-1d8938387e24", "value": "T1A094CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510313, "uuid": "733e8632-d6a3-43d9-adf1-5f311d75950b", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510313, "uuid": "2703e770-4608-4df2-866d-2ce3c279a437", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510313, "uuid": "9d943907-e160-41a4-ac3d-aba9a45d867e", "value": 441956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510313, "uuid": "c17e3695-523e-447b-855c-31bd9af6bd62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510313, "uuid": "e8c1adb3-5090-4e30-aeda-6ff3084cff21", "value": "af9154922ac4f3904489c826293f152c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fddb80-5cd2-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639482116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482116, "uuid": "0736e9d7-1f92-457d-a585-bb33c1f12622", "comment": "Malware payload (GuLoader)", "value": "1547238c5f89a46f4f3d448138478e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482116, "uuid": "5cbc66f6-ec34-4474-98d5-1af769353af5", "comment": "Malware payload (GuLoader)", "value": "3e6418ff545a4ca402fd68da393fd9db7ed7e798ffed1de2fbcdbb31fa08817f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482116, "uuid": "abf4a2b2-28ed-4d6c-98f7-b662271be023", "comment": "Malware payload (GuLoader)", "value": "b83e59cffe50f76e819731d506efd045c55aaabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482116, "uuid": "3a31b2ba-bda4-4cde-9efe-928acd2c6763", "comment": "Malware payload (GuLoader)", "value": "5c4d1dc9656268df07ba3a4b2b67c01fa14eeb228e558ae8531830e02bc3f80f7e9bb00e2cfb04322948a9a69d9ae9e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482116, "uuid": "e369c21c-757a-4c01-a5f8-83759c06069f", "value": "T1E2F38F90A595FD16F226C4F42B51D3A4099B38B2D600A02BF54FEA666371FE37E2431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482116, "uuid": "e7690451-e5d1-4389-b1a0-27960f6a8043", "value": "e7597de960f525af7c9e8aa5873fcec3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482116, "uuid": "ed0b9361-f9ec-435f-8e81-24209227aaef", "value": "1536:ggh9P8HOja+Zg/EsPdCfWGUbu8yIjJNa+I37KTqXpzV5pkNXuUAnX:gG9P8u7ZQmeGUbUIjJNS7hXvUAnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639482116, "uuid": "d2f4662a-f9ad-4e5e-9e12-28289d91f83c", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639482116, "uuid": "2dafd75b-9ce6-4d69-bdb5-e3531cebb112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482116, "uuid": "f290148d-12ed-40a9-890d-5fcb543a58af", "value": "210629 Purchase Order 449 BURGHAUSEN (uZ 20-270)_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c8f2e2-5d0f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639508105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508105, "uuid": "e4778116-7ccc-4af0-aa0a-e30ac7c8cebf", "comment": "Malware payload", "value": "f685cc7a35c18f8948dfad741d830871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508105, "uuid": "1e24262d-db7c-403e-b7db-ea2ff830bbd4", "comment": "Malware payload", "value": "3fff4baf83e75e39c51a2484ca04763852b6d6bf0a24ecb341e65dd2724711a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508105, "uuid": "aa01007b-6ea6-4b30-92f3-543f4aeb9c75", "comment": "Malware payload", "value": "34d9e559ee878fc1f7a20ce073a902a81568f67f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508105, "uuid": "efb97c10-c2e6-4af7-ac14-3b92b978d6c9", "comment": "Malware payload", "value": "77d9a3cc003020d751077d6fdaf973c3c31c5365fa8cf86ee5ef73f376be263b59decb3cf6e5a0c51f39d2cf7743ba27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508105, "uuid": "8a04e2c9-02cf-4948-a522-e36e128531b7", "value": "T12D85F6CD62C1970BE825627C3829D2B657156D472B71413E2E473EFF3A3274AA68DE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508105, "uuid": "34ca5d6a-e2f6-4f1b-b734-c752079f5824", "value": "05e4e1045777d757fa17eaf53eecd299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508105, "uuid": "3d8be899-f9f2-458a-833d-3775393beea2", "value": "49152:qgf8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MO:qq8UQw8MT8UQw8MT8UQw8MT8UQw8MT8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639508105, "uuid": "9663e09a-f8ca-49cc-a7fe-cc87c90fe64c", "value": 1776800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639508105, "uuid": "7478fc43-1302-40cf-88b5-d1f37de7aa82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508105, "uuid": "e788af41-9f84-41b6-aa86-79fc2a787884", "value": "f685cc7a35c18f8948dfad741d830871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fda0c3-5cea-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639492414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492414, "uuid": "7061e903-a9e2-4c8a-9112-42c3acc761d4", "comment": "Malware payload (SnakeKeylogger)", "value": "398fea6cc3128fe28252c8a29692f91a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492414, "uuid": "472a0135-e4fc-44a4-a2dd-3eda738ce24a", "comment": "Malware payload (SnakeKeylogger)", "value": "413c67ee147430c3d1a39e18601b33b90e3c434db8850949c08e8b1a4fa4f399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492414, "uuid": "001031f7-b10f-472c-8be8-b7ab837ec6dd", "comment": "Malware payload (SnakeKeylogger)", "value": "c378d2d969920f5a060afbb26dab9941f4ff6d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492414, "uuid": "a3f7920b-61dc-4abd-805a-a1425f909c59", "comment": "Malware payload (SnakeKeylogger)", "value": "a0b889f64caf82a545b535dd5a8e52323a26f520548e37d17a6cf0a1affc959d3b1ffb14564d24c1c5296893ba1e7df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492414, "uuid": "6afbdcb6-9969-41de-a444-b1975a2679f1", "value": "T1B235125C3A93D5DEC4598E7A3B955024A375ACB62E13E296FC8D331F2C677683833206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492414, "uuid": "68289d6c-1648-4dfd-b2e7-43ee53bf168d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492414, "uuid": "33d15235-734b-46f1-a019-53128e6e573f", "value": "24576:LsE5UICcXrimqXQsZ5Pt9wcisXELyjy2HC0gQ+eBqy79UiKNZ9UTmKCWHhiKG:fCMSAsZ5TGsULCy2HC5QvBqyZZ6Z1WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639492414, "uuid": "efff53bf-d181-4364-8421-a04eb1106d32", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639492414, "uuid": "5d284f72-a801-4dca-b19d-a3beea33e725", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492414, "uuid": "225b7ac8-fd9b-42a2-801e-f33bc11adf11", "value": "Bill of lading 204103842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f387af91-5cfc-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639500202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500202, "uuid": "81ef3332-8859-4bd6-b957-2e74d3f97f78", "comment": "Malware payload", "value": "d232c8c0120e0b2a54b59a4acdef21cf", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500202, "uuid": "5b249c97-75c8-493e-8ac0-dd7c35b810cd", "comment": "Malware payload", "value": "4163fd41ce3f6c254a2158ec1b7a10a92f4772fbd529e66ad7ac183ba928931f", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500202, "uuid": "4f329456-037f-4105-bbe4-87a89840440b", "comment": "Malware payload", "value": "4ac985d7a11c0b665e4a92039bab02cb511a4778", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500202, "uuid": "715359d2-389a-4903-be72-d2111bca06e1", "comment": "Malware payload", "value": "c12f67f415a6e2ee21eb1dfa3348b66c92d9e1d78c8bf0bc4b64a8a91a717e22a20e8ae704736cc22caad9e322e6c149", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500202, "uuid": "7fad7ea8-924d-4e63-8858-dacbf625c106", "value": "T175D46C56BEC6AEA2EF7F51B7C360EA391156736D03A09ACF760305993915FD2403EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500202, "uuid": "b2059d80-e8b3-47bc-a0c1-5fd9a6e614e6", "value": "8c8bba54a9dc287053536e212411cdac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500202, "uuid": "8e3b423c-f68b-4d32-a097-b797c067ffb1", "value": "12288:MHB8k2IlwP0iruRPlOF8bzbBSreIN91KVWf9pam:a8mO2X1MmgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500202, "uuid": "69dacec2-1442-4a71-9e15-5f450d203c07", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500202, "uuid": "463c4742-72a2-4ff7-9e8f-76c1462c0ef3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500202, "uuid": "7e31723b-f78d-4fe8-905c-bf5d6c6d4b17", "value": "Transaction_1321.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e051051-5cdb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639485751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485751, "uuid": "df3c5fc1-0c49-4a91-ac32-e82d0e376fef", "comment": "Malware payload (Moobot)", "value": "be6b0e906169321e35bb141aace83a84", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485751, "uuid": "ade80956-6721-4eb5-91d2-648ef07f4b79", "comment": "Malware payload (Moobot)", "value": "4261fe4f018c2d74e911c734bddf193da32225275f3b2bc53a284bd484af2a4c", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485751, "uuid": "dc727e98-0097-4b3c-92b0-47fa3d9b0afe", "comment": "Malware payload (Moobot)", "value": "8756a9291d3ced5535af2cc4326e3f9474cb9ee9", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485751, "uuid": "635e81bb-dc2a-40cb-854d-ab97d7e19af6", "comment": "Malware payload (Moobot)", "value": "b3266b8955c3e9c8232562015709d74d7a4b8f3cc98779779fe3bb23f6fb2afbbe011a6b75828127c6d7447152c5bc18", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485751, "uuid": "07e009d6-8bb2-47ff-b6d5-964753269207", "value": "T19FD20803A94188BCC99DC33147BED92AFD63B47C1236FA193B943E23EC5EE511E69052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485751, "uuid": "bf8bf148-5c2f-43be-8f7c-2e3048c559ae", "value": "768:GK7rtux8Omu2cba7nFNg/G8WHqPG9vbeTBn:Jt67t2P7nFX8Wv9vbeTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639485751, "uuid": "46f57f47-5272-4b1a-9ed7-ab8f966545fc", "value": 30016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639485751, "uuid": "e1037ce3-9e76-4707-b08e-d967ccb414ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485751, "uuid": "fc19c714-a076-44ff-9326-d85cbd95305e", "value": "la.bot.x86_64-20211214-1242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea8964e-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497805, "uuid": "9a77d464-d0fe-4fd2-9c61-eace605f9ae5", "comment": "Malware payload", "value": "d84d7318b3498eaba846cd0648655ba0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497805, "uuid": "b91e1c99-cc4f-45ab-8af5-248d090c9858", "comment": "Malware payload", "value": "4263ce95dc9efc8a15bff008cdde3beb480507c57a135ed21975c99de35844e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497805, "uuid": "7bc189e7-9b72-4cf6-9efb-f635e937eefd", "comment": "Malware payload", "value": "c587cef3ba2a342affe6f4833a889b12cae02e50", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497805, "uuid": "d3e2f7e3-5fc1-4725-b7dc-7060b3385171", "comment": "Malware payload", "value": "243f6fa0a05a815275fa2246e244ccb88b36bf2fdfdceb6e0f1b58a01628aa4a88d65b8de7c7d81b630e0c958eb256d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497805, "uuid": "0ad59770-3510-4b28-a9c5-6f947e6de0b3", "value": "T10D3512082B7ABE064C6144F83A424A45BCCD0DEDC4F9D3F156D3BC6F52969B963ED890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497805, "uuid": "75e5d265-efd3-4474-abe6-cbb71142de73", "value": "24576:o7lF78BCLd4/+lrCtQJ83LX3HWO/Uf0UONlWL/gX8QPkvM:YF6Ch4/KJqLT8gpPkvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497805, "uuid": "66eb4530-a246-47b2-87c8-c45367670446", "value": 1117475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497805, "uuid": "0d5e2820-03c4-44a1-8391-f54ee33b7b93", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497805, "uuid": "43a4858e-4048-4f4f-a07e-f4fbeed98c43", "value": "MT940_Transaction_Reference_No_9980035023FS_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8ea31b-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497481, "uuid": "f968016b-9300-4203-830b-1b0b5b779ae7", "comment": "Malware payload (Formbook)", "value": "314baeb98fa59830a1e64f3286b1dcbb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497481, "uuid": "898cc3e3-7cc4-4d4e-9395-7c5ee9b99815", "comment": "Malware payload (Formbook)", "value": "42e5a299ec97c49aed10f7e3cf2855264727618511015cb9528b3604053e1e90", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497481, "uuid": "b9edcf9d-aafb-4f10-a3b4-30b9bae0371a", "comment": "Malware payload (Formbook)", "value": "ffa6d5ddc347c342738f209167b75342dc95a556", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497481, "uuid": "652b8b4f-7ad5-41b0-8971-50c927eb4e15", "comment": "Malware payload (Formbook)", "value": "06f3852cf1a1b7d0804bfb7d2c896e960d629b4a583f6dc1532880a21214765c305ec01367da825722e0832283e47649", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497481, "uuid": "73efc08a-9748-47f4-98b8-d6e073bc5d5c", "value": "T119421EACC0A742988F85ABB46B27AF8800CC3A6DF7549573313C477557E2E7A211793D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497481, "uuid": "22759dbe-0a94-4913-99e6-1f04a00c4c47", "value": "192:9Wjd0fUfJ0bsssQCy1ktqw47BV9m7PdkzCi0K+yUjwkUGRJ1c1:wjd0fUfJ0j31nv9IPdti0gpkUGRJ1c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497481, "uuid": "b637e9ab-09d9-40ab-958e-4d55444208b5", "value": 12883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497481, "uuid": "83f8007c-e388-48d1-8a97-21a77276af8a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497481, "uuid": "82c64b1d-04b8-498c-b8f5-6c325492064d", "value": "SWIFT-163169.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6b7c9c-5cea-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639492273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492273, "uuid": "b1581a3b-19bc-4ed7-a5eb-33ecaa9056a2", "comment": "Malware payload (SnakeKeylogger)", "value": "9d2103931119d2d80055b2f2512fc1e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492273, "uuid": "6ee29cd0-d348-4492-bd8c-2e336637dd6e", "comment": "Malware payload (SnakeKeylogger)", "value": "4544c0f6f2ad421265500481531a22ce1727be7d5e143e119025dfec688279b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492273, "uuid": "b989cddc-de10-4b88-8067-9140532e283c", "comment": "Malware payload (SnakeKeylogger)", "value": "2c857fc5cded72643cf8479c33286778a8be567e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492273, "uuid": "954868d1-7450-4e26-bad9-796c6859295a", "comment": "Malware payload (SnakeKeylogger)", "value": "acd36258607675e9a5f431ccc318ce0d4b5d74b4477327c605a3a1903f91b4ae24c5ed0932d2749ba200f8ce8b5502d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492273, "uuid": "80398923-d288-454d-b388-1ea36f062015", "value": "T11125126C3A8795CFC9454EBA3BA5D02462656C766A07E3C7F8CC329F186BB487523307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492273, "uuid": "8c45f449-bdea-4e0c-b877-1c15da6c278a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492273, "uuid": "4c7c62cf-2890-4aa4-894f-aa91ce7c7c39", "value": "24576:ZYxLnqTfAknGFIntmarm09l0Xi6MHy3iS87YfYJUdK+LWO:OeGFIn8Vib6MHy3iS87YfThy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639492273, "uuid": "63ffd4be-fef0-413c-b14f-22f91d528d85", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639492273, "uuid": "232831b3-d64f-4e33-9d5f-b1b32d53c55a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492273, "uuid": "3e327f95-a358-4fad-a308-724ea009e1b1", "value": "Payment Swift#8765498.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70a2880-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498383, "uuid": "7b872a42-865f-4b40-a8f4-fb8eb8311406", "comment": "Malware payload (Mirai)", "value": "18df1c923b2a23a5093d8a40583900ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498383, "uuid": "c4430ac5-2ce6-4a96-89b9-6d25e8fdd3f7", "comment": "Malware payload (Mirai)", "value": "457a93069ec99472d01ea626f4dd7e29840c7c8406999980e6b259bc0e62cda2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498383, "uuid": "82127ef5-a960-4a62-af8c-3c50d12a9358", "comment": "Malware payload (Mirai)", "value": "693e604c8c0d94564bfef231b0a238e38555908b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498383, "uuid": "727aafec-87c4-4355-8961-77397689306d", "comment": "Malware payload (Mirai)", "value": "9bf74e562575847a1e90b39ca0ed730207905a632434eef4efd6adcaf7ea083e8eecb342e6621051c05c1560868f7fde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498383, "uuid": "852ae6f1-7271-430e-99d1-c80074a0f287", "value": "T1FB23F158632AE1B7D460583AF388CDE2768B3BBC95CD69E1145B4C8138E12358BB73C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498383, "uuid": "a8631b85-094f-4219-9491-a00d63ac290d", "value": "768:+GPx00ys/aBzv/krFctEU1WvTZe3cGYmm9ouc9q3UELwgdqqtwOli0XcV:+MODzkrNU1cTZe3cDmmLlLNdt3l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498383, "uuid": "f1524307-54b0-4d74-857d-d56399b45d3f", "value": 50084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498383, "uuid": "8d9ac845-2e03-4cd6-84eb-2f8d8c35b75a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498383, "uuid": "d475bc55-2ac4-44c1-a037-72ff498eccf5", "value": "18df1c923b2a23a5093d8a40583900ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513ae017-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639497783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497783, "uuid": "e79285d4-d3d9-4b5f-84cd-0394f66b4e59", "comment": "Malware payload (Vjw0rm)", "value": "534f0d3228422bb6d787f2a2ba8a1eeb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497783, "uuid": "0ea5492a-09f0-41d0-8017-85dc28e5951c", "comment": "Malware payload (Vjw0rm)", "value": "45e51faaaefa2dbcb343a56b2c0be3c64b5fc0010f97a19bedc32d166f200435", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497783, "uuid": "7af47ed6-07b2-45fd-9a96-8f9f42495075", "comment": "Malware payload (Vjw0rm)", "value": "2ab7150b65771c21799e373dc23f32f6cff31496", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497783, "uuid": "fc67808d-ee78-4925-a889-32861a13d9b6", "comment": "Malware payload (Vjw0rm)", "value": "1694a2e926b819e0886094eae55121122731a581bac6f2d55ed31f5e416604faff15c5bfe6f177e2385de7b186d26050", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497783, "uuid": "f42d95f1-1173-427b-a1d7-a6e1a2d38b02", "value": "T13F129E4A72836C7152A76AB252294823FEEF4F714A48333D30F9D4BE7D94385CD99128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497783, "uuid": "24ca544d-851c-4d9a-800a-8014a0e9c9f8", "value": "192:p4/WFzXjXjhS/zMMwSwwEf/RI2l5SDhaeAio+JnMZP6oKkX:+/WNXjE/8JwE3e4SD1gLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497783, "uuid": "c62e810b-c52c-4b2f-b715-f22ab9c43875", "value": 9906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497783, "uuid": "6310e39c-8c22-4dc7-9509-1f6b117d1061", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497783, "uuid": "399f97c9-31ad-4829-802b-12f737b2e685", "value": "8022_Payment_Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9341fb-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639495867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495867, "uuid": "bf930f11-c9ad-4a69-a3c6-8a08ae120021", "comment": "Malware payload", "value": "ac8e09a97515366b4fa82a9743f3b60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495867, "uuid": "db6ddaaf-cc66-4175-8443-86cc44be958e", "comment": "Malware payload", "value": "45f6ddbd042ed8b79ed6b2ba8aabba58b6f43fe045ee6db7f543ae02fb42e041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495867, "uuid": "742c4122-25c2-43b9-af95-7e0f5a5d2c8a", "comment": "Malware payload", "value": "eb69d8e57992baef0893904afa47b30f0457f5e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495867, "uuid": "8bd5b0ef-0ed3-4b0b-ab77-5438dc591577", "comment": "Malware payload", "value": "53c274299a232f637d9a336a1b3cec6ae047407a01d5efa5340031000b36f8d6d7952387338608d424054c2c5489fbfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495867, "uuid": "1aac4663-236b-48de-9a33-9ac6f3454cec", "value": "T1B716339370B0210CC7B246F2EA955748E7B07179876073EF8FA8A1652F5A4E2DF6D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495867, "uuid": "69111b0a-eaab-4531-9c02-7010eccdec37", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495867, "uuid": "5ee92936-0702-4628-913a-a7f0b2cd6956", "value": "98304:I8pxRieFWNcDltC2Z5PS2OTTrFt+CJsWjjHtksuxz+9XTXmko+efA0w:I8p+eFaeW2VOTVt+CJsWdjud+9Tm7jfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495867, "uuid": "bceeb5f8-7347-4078-90df-9440e812f46f", "value": 4256691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495867, "uuid": "e1aac13e-a26f-42ad-adb0-696ae67b0ea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495867, "uuid": "01a93601-d4b2-477d-a3fa-f4e0d8c296de", "value": "ac8e09a97515366b4fa82a9743f3b60d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce985ff-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497480, "uuid": "0beeb08f-7e43-4620-9b4c-a13b9c48ec30", "comment": "Malware payload (AgentTesla)", "value": "fa8052f5085690c324e90696404aaa01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497480, "uuid": "04848061-90e0-4f18-afa1-ea73a93cc129", "comment": "Malware payload (AgentTesla)", "value": "46f2ec8954bd1cfec1906ef597976b7f1e10d4358030e6b5cb884509bf35e2f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497480, "uuid": "feeefe10-27fe-4881-ac98-aeb0f1bf8ca6", "comment": "Malware payload (AgentTesla)", "value": "5ab8492bc08117a0a84c32b5b9b0d9c80d40ea0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497480, "uuid": "c8ef341d-5a97-4997-ada6-b9d94ed1b567", "comment": "Malware payload (AgentTesla)", "value": "dfae8711d1b2fc97596da559aabb6aed102e98be5c4e09f2835c30d56f04cc49a75e862f6e0c04e15fdbf80704e785c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497480, "uuid": "52c0806b-caae-414c-9da5-78859f61003b", "value": "T156721EACD46706988F856BB85B2B9F4401CC7A2EF784A533363C97391BD6E7A501383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497480, "uuid": "076365a4-b7a2-4862-9a08-be274ec070de", "value": "192:Bs7JnZcWusnXMyFUqgW25WODK1O7qHfyG0bli1IwES36y468SoWS0qws:B2ZssnXMCRZOGVsb81IwENt68SnShws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497480, "uuid": "e9a40c4a-9c5d-4f50-a751-dbad3d502a7d", "value": 16265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497480, "uuid": "6de9934c-4fe1-457a-913a-2d489d81fee3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497480, "uuid": "9cd9b4ec-67f8-4b67-9dd3-e1c8dcdacf7e", "value": "CV.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e75b115-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444896, "uuid": "909d3b5f-b9ce-48bc-9b1a-229cec191dbb", "comment": "Malware payload (Mirai)", "value": "2800ad303f630756b30fc460ccc1fbd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444896, "uuid": "0b4ec158-64bf-4f02-b66e-d3205033c438", "comment": "Malware payload (Mirai)", "value": "478b6615d0d786bfd66c811f0b77c335f30ee7530d497c2d5affa1b47470b4d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444896, "uuid": "2682034a-df15-436c-b8e0-97e34651d5b3", "comment": "Malware payload (Mirai)", "value": "774dc89eaa2c3e155e84a13f5c50c69c25a2b502", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444896, "uuid": "9871e84b-aa5c-4584-b19e-4b8ab0123f12", "comment": "Malware payload (Mirai)", "value": "f775f34c14e6d8d5ce609f5179354397596a79e006012bedd1e0e5d7877c5596a0bf787600b641af90f89185aa93b230", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444896, "uuid": "15ca6d20-7c29-4ed2-b4f9-c00c7dc47103", "value": "T1213302FA2E70B956C98C8E3C524D9BA4CD94714CA5DADBD41B034DCAFF3214BF9440A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444896, "uuid": "fbaf50ce-c0ec-4283-b162-29d60a57ac3a", "value": "768:2btGO1FwVUAu6CrnbGNr0vIxLH2mwoLPocawJXrjakFHJbog8UaLT2GWHPfhryXE:UtGO1iUAgr6NXPofwhjsTUaLAfhawQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444896, "uuid": "a0bd1d12-8c22-4bdf-9d01-f2adb4b26300", "value": 53736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444896, "uuid": "1e31ce00-fc11-4986-b2bb-2f7884571a3f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444896, "uuid": "64202d42-fd59-4fba-82d9-8a89a7875169", "value": "2800ad303f630756b30fc460ccc1fbd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f925c63-5c94-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639455233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455233, "uuid": "6d3906a8-35f3-4de3-ae0b-edc1add090d6", "comment": "Malware payload (CoinMiner)", "value": "7f23a024a1ee93b094169210dbc5a612", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455233, "uuid": "eb5aa479-5c6a-4738-89c3-e22918637729", "comment": "Malware payload (CoinMiner)", "value": "47a48d10d6a249bab803c4927358ea78e97f42232667fde0f5a65bc642928ef1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455233, "uuid": "a42ad16a-5967-452e-808e-bd5b95adef97", "comment": "Malware payload (CoinMiner)", "value": "249112ed1201a3f2aeab23c9f80c519ab9cc6578", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455233, "uuid": "8e245bd7-0cb2-4ca3-b7fc-5f57d2c3ddc8", "comment": "Malware payload (CoinMiner)", "value": "73bab9f352efeb76cbbc5ad7c4477dbe7a9caf35424d06fa09a0847fb164752d4cd991b986bced095130c9ee14735026", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455233, "uuid": "2020d604-1a5f-4f2b-96dd-261fa4db2e67", "value": "T129F533C3F48FDEF9D10708B7AA156214AB2E08728EF79521C74CA74EB1D3913139BA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455233, "uuid": "01e89f4b-951b-4d6c-ab90-3b506c0c0e0e", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455233, "uuid": "a44637bc-ea82-488f-9b63-9ff111fc0395", "value": "49152:2PS5ymy6Ri+UeqqJFxrcKtTqvbXVubrlNkX5G6kgINlckE7jjFDxCPbaAxTjT4sL:2Pyz0J4Fc4brKI6slckE7/PXAHaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639455233, "uuid": "21b9add7-e19c-4dff-b618-85ed3fd70640", "value": 3340288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639455233, "uuid": "8057c226-df71-4e50-8c91-10e57af8c038", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455233, "uuid": "8682da04-0521-4882-9128-0c0438774c15", "value": "7f23a024a1ee93b094169210dbc5a612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a0c5c3-5cec-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639493148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493148, "uuid": "f709f1f3-518c-4d1a-90ee-9703a004a1fa", "comment": "Malware payload (RedLineStealer)", "value": "f907efcf1b25d2e457bd2fe9bbd5791d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493148, "uuid": "a5885b04-7462-4cad-861f-01e0ab8f4986", "comment": "Malware payload (RedLineStealer)", "value": "4879803b6326f27bb8b68448fe7394b2358c2eeb25ec2c4c6a176313d003c29a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493148, "uuid": "473c369a-209f-4780-9dc7-3f7f50cb7b12", "comment": "Malware payload (RedLineStealer)", "value": "b8daaf9554e114be90a84cf099ba3853357a6f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493148, "uuid": "69f6978d-360e-4f53-936c-b490829f3d57", "comment": "Malware payload (RedLineStealer)", "value": "617184ea20eb65884d8bbe4c797e2d9654fa94b7295bdae1bcbe0490f18b1f426386285c683f03c1db9f097ca3c5e8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493148, "uuid": "ea593025-a30d-42c0-80a5-40cc0853169e", "value": "T15A36330276E7C4F7F8519032664957F669B9CFC942500FEFB7A8C2590E5188F42AFE28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493148, "uuid": "0d2cc858-89bc-4bd1-83ad-1d91f6a09a2f", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493148, "uuid": "08ecdc72-8c13-47fc-8036-ad3f84febd13", "value": "98304:xsCvLUBsgi2o3sIb4bk36hM4MUqD6Y8gkADgaelBRxYallcyeIqk:xxLUCgyLbFNuY8gLylxlasqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639493148, "uuid": "4d089cae-1748-4653-a23a-a502394f9840", "value": 4970984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639493148, "uuid": "48660cf1-d88e-48f9-87f2-9c8381cab8f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493148, "uuid": "f219896a-9501-45b8-8782-ca68e5f885ee", "value": "4879803B6326F27BB8B68448FE7394B2358C2EEB25EC2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e866a1bf-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504479, "uuid": "0e13b272-d48a-4248-9721-47ec23bbe0ac", "comment": "Malware payload (Mirai)", "value": "43ac223f9c9c1babbd001f1ea0fd369b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504479, "uuid": "72424de1-4dfd-4692-b0c3-01de5b337d04", "comment": "Malware payload (Mirai)", "value": "48e748350d75840775e4959fa1f96e4a164f473e87bc9b1eb379e458fc34a6e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504479, "uuid": "821cab5c-a5da-43f0-9f3c-64676c5f3bbd", "comment": "Malware payload (Mirai)", "value": "c9e37e3cd5e708151c62a09bdc320d9afffbeb71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504479, "uuid": "ece64c24-3eb8-408e-86c1-8ce8efaef4a0", "comment": "Malware payload (Mirai)", "value": "0201451ee1279c82334d3bc8466f8bd3a5ec4af97e04a14546acaa4aa40e3ab6d9180306c2913267e6d4b18c5254f8d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504479, "uuid": "c526f0db-28e5-4d56-8564-614b7890a3e5", "value": "T14D333BD6B902AD7CF98BE6BE80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504479, "uuid": "63d85c8d-9e95-487d-b922-2298ec25273c", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380Dg:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504479, "uuid": "81fdc4e1-feb9-45e9-98b7-ccff6f9bcf07", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504479, "uuid": "810d34d2-38a7-4fe2-9403-0284c505eb1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504479, "uuid": "9426ddc1-6a6c-44e5-895c-3feac8e53c7d", "value": "43ac223f9c9c1babbd001f1ea0fd369b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b1bd21-5d1d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639514213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514213, "uuid": "814e79e4-35f5-48c9-a49a-e6a9cafe218e", "comment": "Malware payload", "value": "11309363b89510aec3d401f9bc5be0b5", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514213, "uuid": "9f1fefb7-ecae-46a1-9582-96fe07e3ade2", "comment": "Malware payload", "value": "49d542a526726d12fde02aa1fc69037c3effbb6ff55a05b9481f65882cd89d30", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514213, "uuid": "76232861-14c2-4098-bff4-7877a49d2278", "comment": "Malware payload", "value": "23cbb35f319204efe83f75f81554fdcf335d0093", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514213, "uuid": "8f76d0f0-e8c8-476b-a68f-0546f42ae92f", "comment": "Malware payload", "value": "0ef8f1a6705857b2a6c737cccca7d2327ede4f77f5073d6617db3e0de7885a27bc585917918801354cd2a684c052589e", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514213, "uuid": "690e6bf7-1a37-4eb9-9d45-39db2b19241f", "value": "T1C8A5AB32B27432DAD72125A2433B3F1B432D7D4BB3D66F19449ECBB45CD98B92249E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514213, "uuid": "614507e9-7e90-4a07-b579-46b8b29d2e65", "value": "1536:hbz4J3fbgjE+p848w858B8b8u8w8p8b8J818F8b8Z8R8I8K8/888p8b8J818F8b/:snFhzZ7ww4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639514213, "uuid": "b13d0c88-c183-4a4a-b469-983e801006b3", "value": 2195025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639514213, "uuid": "048d33a9-d8c1-4376-b04e-1629ad5da117", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514213, "uuid": "c4651f45-eaab-4ea3-bac1-57439f21a77c", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.19965.10852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818ec0b3-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497434, "uuid": "c759dcdb-85c2-4102-ac71-2c99f29ea336", "comment": "Malware payload (Formbook)", "value": "870683852f24103ed52e22e6290da814", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497434, "uuid": "c0c462c0-e455-4eca-84a1-36f7ca295b56", "comment": "Malware payload (Formbook)", "value": "49fb11fa447ffa15bc2cabad5a9acc009a7a490c481e923b6cb25857934bcbf9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497434, "uuid": "15df6a56-daeb-493d-819a-9d227a3dc7be", "comment": "Malware payload (Formbook)", "value": "b6f623814adc4f460cdcd34f4a0363ac1a377282", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497434, "uuid": "73569440-ba0c-45f7-b0e0-b108088645b0", "comment": "Malware payload (Formbook)", "value": "96e5b8ab359e3216e7ade711817076979ead781ec701dad3d43845715c7474279f9cf8777ed9d9a587c61ccc53659a95", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497434, "uuid": "daa3568b-dbc3-4f92-9df3-93a576044982", "value": "T1996412F5B9079FA5D066213B7AA8A0D41C60CD0FBCD6B98C15A0F5DEE53B3288215F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497434, "uuid": "d7f947ff-4566-42e3-8d4b-442c2e7b7f8a", "value": "6144:yiMv5tSkFyZjGFAGhI+5TWO7z+WOOVCoyem3aNwlLprxx0NmMNUi:yiMv57pAGhI+5x7KtOYZa2lvMmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497434, "uuid": "db664fdd-ec14-499d-b3b3-56ed489fe527", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497434, "uuid": "6cf85b6c-3c49-4c86-8d31-1afb43aef142", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497434, "uuid": "53ff423b-5222-4847-b1e7-1eac55246a6d", "value": "NBK Swift .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27e835c-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639467452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467452, "uuid": "3b567f90-acb4-4b8e-8e19-4b5e5dcf50e9", "comment": "Malware payload (Formbook)", "value": "52f36deae94102b8eaf8e540623e2f80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467452, "uuid": "859ad0ff-a38c-4eef-a8f4-cec18db76ffc", "comment": "Malware payload (Formbook)", "value": "4b8d1024fb2edb12a1abf91738a6824ac74a6c918ab470f906361f3a4d27edb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467452, "uuid": "48a50281-d11e-4704-b2cf-cc236e551e56", "comment": "Malware payload (Formbook)", "value": "94581b0a96ab5d3615452e89023d0a8536268ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467452, "uuid": "f2e6b583-8e3d-4094-80cb-3a026c3f6d5d", "comment": "Malware payload (Formbook)", "value": "ed514fab425e4217a7ddf84ade596780455bc9eee9f9d91d36f9b2910c757d550e2404b4288962db417813518edf1109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467452, "uuid": "1f85564c-74ab-4a57-8d48-83bb8a8b9c42", "value": "T16635223A6D9DD925C6BF2639DCEF081003BC69066553E72E36F8B2FC2EA375240A155C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467452, "uuid": "af02d818-86d0-458f-abfc-4529b59a38bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467452, "uuid": "04a668d0-386c-40d4-8883-0afd92eecc32", "value": "24576:ge3M2k0OtCOiKPrR2BmPU3Y1Kd5oZr7OO4NQpg3/:gWk0Y7UWknKZr7OO4apk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467452, "uuid": "dbc8c29a-e110-4d2b-9c47-5151688e6b85", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467452, "uuid": "f7b6d885-b02d-49c0-864c-46d7ed3f6744", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467452, "uuid": "6a911502-7af7-4496-95d4-c5ed5139c2a7", "value": "Shipment reminder 9487464738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ebc9b-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465462, "uuid": "c221394f-f026-414a-ab05-8d9b0fef45e5", "comment": "Malware payload (Matanbuchus)", "value": "7d6e15aedb546b3859e79e008a809827", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465462, "uuid": "76f58d51-4a05-4f50-a3cc-43b8397dae21", "comment": "Malware payload (Matanbuchus)", "value": "4c9992cbd70698549e2d6e48d8f2bb70b684e0bedc835e1412153ca67cf0da74", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465462, "uuid": "08a92894-5b65-4570-b79b-90408adf9477", "comment": "Malware payload (Matanbuchus)", "value": "e42189ddaecc837bec556b9fc9573b4b626749ee", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465462, "uuid": "551cd896-29e1-4fbc-bd09-b605f360846f", "comment": "Malware payload (Matanbuchus)", "value": "178251ca7906927d07cb50f560f65aa3c8a2e12992d3a8055dc74007385ab8e4a87b8d21e45e0f1bd46b7254f58dccbb", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465462, "uuid": "0cd3de66-65e7-4c43-98fb-f8fbd170d1d6", "value": "T182B48CB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465462, "uuid": "337d9ca9-f1a8-433e-a586-0e13be8a256f", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465462, "uuid": "9e71e8df-eccb-4d30-9fac-2f319db8ff9c", "value": "12288:DCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp13Q:DfcqtGWdZPuQIDHaxarC3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465462, "uuid": "e0887c61-e44a-43cb-9e7e-1602bc6b1cca", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465462, "uuid": "8014eaea-7327-47ed-ba9f-227553702e5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465462, "uuid": "4a6366a7-5466-4b9d-a372-e77a89cc1a3f", "value": "4c9992cbd70698549e2d6e48d8f2bb70b684e0bedc835e1412153ca67cf0da74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afc649c-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639500322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500322, "uuid": "b41aa51d-742d-4b11-9ddb-c96502d7bb6f", "comment": "Malware payload (Loki)", "value": "b697639a175548ae781b0814ed4f33e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500322, "uuid": "9ad92a74-352e-49f0-84e7-1be32fa8850f", "comment": "Malware payload (Loki)", "value": "4ca2fb7c466c0c5998348e92c24216f9c33e48f905bb1a157464b3f6d8330d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500322, "uuid": "cbc34b0a-e6d8-4a19-a7dd-35200f640763", "comment": "Malware payload (Loki)", "value": "85891a346e3e3088d4053e505d0cf36b549359b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500322, "uuid": "b0c3c65c-2ae8-466f-8a74-dce40c00ae69", "comment": "Malware payload (Loki)", "value": "b17677815412345def0dd146b06cc701ef2e28645d0c11421a4a40dc775e454acc42e4a7f95f722f01e564ede0d65e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500322, "uuid": "3b0033ca-a281-43a6-b5aa-726a03281b78", "value": "T135539D3536C198B2C5966031B0B49BB26EBC5033222469DB5B396D756F302E1A3FD39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500322, "uuid": "984c76f3-0ec8-4f72-9307-dc29a37b676e", "value": "1536:TydcYNSdgcN5kVfBpo4e9fqkTunujTG9dR/MXjc:WICc3Epps9prWdiXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500322, "uuid": "5c0d2a8b-851b-44c5-8d27-df91cd74a6d9", "value": 64830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500322, "uuid": "7256c16b-3853-465e-a6a3-2a85ddcdc52d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500322, "uuid": "1eb4c793-6ca1-4163-978f-9dfd83397512", "value": "b697639a175548ae781b0814ed4f33e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77a6420-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639498921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498921, "uuid": "cab252ee-86f8-44fc-a06e-89ad82688f33", "comment": "Malware payload (AgentTesla)", "value": "e5fefa7e61876477d252e02a5d9fb2c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498921, "uuid": "fa06ad77-480e-4306-977d-39227e059ac8", "comment": "Malware payload (AgentTesla)", "value": "4ce19eff1f4d107c79f406c0f20434ebc7eef1d369d927aefb61215f1bda9ae5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498921, "uuid": "d653762e-b49c-4903-bf4f-46d550ff9f4e", "comment": "Malware payload (AgentTesla)", "value": "209d7e6b4df0ee8cb597f1364272cbbcd844fecd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498921, "uuid": "3021f203-56e6-4eb7-9780-8a7647077c21", "comment": "Malware payload (AgentTesla)", "value": "ef7b8e763ccc61cd8f601832cad4e39047ea4e12abaffb361005ecee6dfd6ebe940ab472796878ab93301687450706ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498921, "uuid": "4e64d286-da7e-42bf-9ee0-09d8a0836801", "value": "T11BA4E08536D6D2E8F97FEBF00CB135C64738F6D1E941E2DEE4C4284AEA63A514E005B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498921, "uuid": "7cbd7e8a-4f63-4f81-a9e0-74a81ec3e532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498921, "uuid": "946c5bc8-4ecb-4232-8eea-6bb354e3f366", "value": "12288:RwmslJsbAi+Rgf8dRztaqH0ZU3O9K9FC+7OYdiZz6:R3sCd+RY83zUqliKvDncZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498921, "uuid": "4a78625a-22c6-4cc0-8091-3772f7a124b7", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498921, "uuid": "feb979eb-8a00-471b-a632-6ad0e448f9c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498921, "uuid": "9b428ff4-b724-4e05-adc6-bb160452ec2c", "value": "e5fefa7e61876477d252e02a5d9fb2c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54dc23ba-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639495641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495641, "uuid": "1727245f-dc6d-4338-a1a1-c69139b43447", "comment": "Malware payload (Socelars)", "value": "97c53abd6a0cdccf92b24f0a57b3e6d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495641, "uuid": "77bd2842-ad14-4381-b4ce-41e5708bc3ad", "comment": "Malware payload (Socelars)", "value": "4d3393ff4a6049bcc2ba1bba0609ecf2238d40e1e5d87c7a74a9312e0207af0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495641, "uuid": "3e379c34-a04b-481d-ba68-3375335c1e16", "comment": "Malware payload (Socelars)", "value": "bc997f2f58f3b67babdc7c84abc323743b25cdb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495641, "uuid": "a54d243b-f767-4a39-855f-0ad0d1165ded", "comment": "Malware payload (Socelars)", "value": "2383bd2746511a7d166f05ac6b3e2d3dbf8f2c115947e147549190e587be706a43efe5ac27494b4d6757d9fd9638b848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495641, "uuid": "ade5c344-f6f9-4e4b-95da-a787f6958781", "value": "T16D659F11F642A036E8E300B281FFDAFE8D686E21130894D7D3C45D6B7A619E37A37657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495641, "uuid": "1b786a47-5153-4616-a1ad-a42e24b22964", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495641, "uuid": "5a581966-5c8a-4726-a5e9-9bdb493b0d16", "value": "24576:maApxEmUociWVxvX2LfeEyS2ZTU2xbVJTpNyn0iNupdcJj:YpLfvjillbyn0iNupSJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495641, "uuid": "94c5eb1b-1953-4ec8-988a-fa87cfa12032", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495641, "uuid": "11c65451-468b-4fdd-af7c-65fad4870bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495641, "uuid": "3b41bf10-2798-4a42-92b9-7156483b63b2", "value": "97c53abd6a0cdccf92b24f0a57b3e6d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853dd66d-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639465228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465228, "uuid": "5b3848ff-a8ce-48d5-8614-280eff647196", "comment": "Malware payload (Formbook)", "value": "335886f67b3724ecdc7326fd00446b5b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465228, "uuid": "a5d53a65-986d-4d21-85f5-8e5b2e676f7a", "comment": "Malware payload (Formbook)", "value": "4dfdf9be94f946ee6fd91be20934b4faaf6610f87e3335eae5bd325fc49976b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465228, "uuid": "b6ab4590-6f28-4d08-ad8c-467d43d20173", "comment": "Malware payload (Formbook)", "value": "585866efd7a327b131e9f6ce98be2f52b10d113e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465228, "uuid": "3ff26de2-16c1-4396-bebd-0a320d4602b2", "comment": "Malware payload (Formbook)", "value": "eff808677ee63334dfd80d33a0a492be3d8f80719cb4bac680d3663f676a2c27b5f233c8a32cbcfe579f2c37385f4ef3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465228, "uuid": "85b75254-b4b9-4160-b76a-5a9878db32ee", "value": "T11FB4232F88095DB1AA23EF7AFE04FF319E056366ED8548757D6BCE0A70100FE4A1256D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465228, "uuid": "1b19b6b9-15d8-4ce9-9803-1c04a73e874e", "value": "12288:yZKfFptUy9jEuW2BnGvjJZLUcWKrcracTV:yZ+Fpt99jExmI70wcXTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465228, "uuid": "f8cdefb2-c773-4b3d-acff-fbe0ceabbf02", "value": 510308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465228, "uuid": "fdd25189-1150-4039-a4ba-bc834d96c5dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465228, "uuid": "da2aff64-7ba6-4e62-bab0-ed3748226119", "value": "PO_4781RNY2196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ab0394-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639498812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498812, "uuid": "585b36ab-686c-4233-a1df-ae5ae03b3fbf", "comment": "Malware payload (Loki)", "value": "f1c441db6675af29bbf28a7b95b83243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498812, "uuid": "9c189f4e-d993-42d5-b0cb-0239f8ae6355", "comment": "Malware payload (Loki)", "value": "4fd66580e8d664821c64b4ca3711ba680f249ef2b804f21b2a1220900bf8d75e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498812, "uuid": "9e4ef4f1-f1ab-4e64-b063-4ddac79eb50b", "comment": "Malware payload (Loki)", "value": "eb51343dca8f976fd3d5a56c861ff7146995a6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498812, "uuid": "62f4e15a-b435-4c31-b9ab-11873021db37", "comment": "Malware payload (Loki)", "value": "93226980d9ebc9a0797174fe09221bcb0de6fb067514504b0db8abb2ade24b4299d6de3fbb38af9d7add328d18ecd03c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498812, "uuid": "b8cf0f6d-037f-48ec-afd6-b397c9325b6f", "value": "T125D40281B1C1C16ACCA40670EC7AD5E811A37D5EFDB1684F7AD6739E3AB22A3035D907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498812, "uuid": "316736b7-e99a-45e0-9388-c3e1cac72f85", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498812, "uuid": "6cffc5b7-51d4-4056-90eb-5b8b540f6784", "value": "12288:McQlhBK8Avw4NdKFSdL0HBTgskvcIGGZxxvHcTih:/Bv3dKFEoBVkvL9ZxZHcTih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498812, "uuid": "16d3cb2d-6a8e-4107-9075-591e8dd2f754", "value": 633957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498812, "uuid": "7b91e879-5f38-4e17-b18c-99061df44225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498812, "uuid": "925a6bfc-1bb3-471d-bc10-ce94b01a10cb", "value": "f1c441db6675af29bbf28a7b95b83243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1404db-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498980, "uuid": "544fe672-18ad-4e46-97ad-fcdc0b816fb7", "comment": "Malware payload (Mirai)", "value": "0c9e4455b03cbbf615d83eca0fdd883b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498980, "uuid": "f23f5a48-8e80-43f6-a668-210a971de0a2", "comment": "Malware payload (Mirai)", "value": "501d751ac81dbd25e662582d0f302e46be0eda44aa576914c5ca781df96ae78b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498980, "uuid": "59ada10a-853f-4e6d-bc41-643dc9744aec", "comment": "Malware payload (Mirai)", "value": "cf212d6e3282be4411d20db09bad3269c371599b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498980, "uuid": "74dff020-7830-44c2-aed3-7576d94dd29b", "comment": "Malware payload (Mirai)", "value": "419304a7ca1c732368688ee8ed94616e3b155c1d28cfb22e4bdda6b8387e2895f87bd33f69c8a1a562fd430bbaf0198f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498980, "uuid": "13104444-7a58-401f-a5a1-38855ba58c35", "value": "T178D3D617ABA15EBBD80FCE3302E64521108EE4961295BB2FB274CB5CF74B98E09D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498980, "uuid": "0743bb07-654c-4d75-a39d-1e9a18cb40b0", "value": "1536:j6ej1pypR+eh2oA40b4iU6m2G30F7STKoD1U1lm/nBgvJYy0h:jl/eIoqsHEF7STKoD4lm/BgxYy0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498980, "uuid": "34981c9f-6921-43ad-9487-4f78633fa579", "value": 140048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498980, "uuid": "95844986-130f-4fe3-85f9-79127cf827da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498980, "uuid": "aa16f93e-591d-4ff1-978e-27b33c7de5c6", "value": "0c9e4455b03cbbf615d83eca0fdd883b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c058307b-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639498399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498399, "uuid": "0163bf0f-609c-4b59-b3bf-f0bdd58c9512", "comment": "Malware payload (Gafgyt)", "value": "7d61b8580bd36cac760dd329aa6ab8e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498399, "uuid": "9df7206e-e196-488b-8091-adcd7435f8f9", "comment": "Malware payload (Gafgyt)", "value": "513794055aadfb863881f1fa7ca7e358d299e56243996b705a7abd86100d63e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498399, "uuid": "0b7dfd92-a5ab-413e-83e1-9d5a8b8f9178", "comment": "Malware payload (Gafgyt)", "value": "5d15aa9fa15e7dffa45b5ed8f4a44d26fc43b161", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498399, "uuid": "ab990660-69d4-497f-b91c-a7d0cd9a88cc", "comment": "Malware payload (Gafgyt)", "value": "612b7d878ba267b1fb588e50815869bc2a885c529eef1975645908bb560e37a59e60e4868b5475d46df85b4dc08ce15a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498399, "uuid": "3dcebf4d-c052-4a22-b8a7-33fcb76b9bc0", "value": "T1AE93294785719EF3C0476EB926FB9A74072368214B4A1B68612E9BF8070BDCDFC8D725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498399, "uuid": "e31b5998-3b5c-4f73-9ce7-087f32371e85", "value": "1536:De+w1+KPv+MPIPdoNR9K5PZZiXSfmoUs2ttYVc+:DO1+KPvvXyPZjmHs2jYVc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498399, "uuid": "b94c3e9f-a3b3-40bc-8bd2-bd5a244bd301", "value": 96226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498399, "uuid": "22a96d02-9ba1-48ff-abea-912c62e777c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498399, "uuid": "8dff626a-2ef5-4836-8ae7-80cc3fb7f97b", "value": "7d61b8580bd36cac760dd329aa6ab8e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83367d2c-5c8c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639451910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451910, "uuid": "a151afd8-208a-454b-8ba9-0d6807b6cc12", "comment": "Malware payload (AgentTesla)", "value": "e3b34db310dfdbede001753909203cc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451910, "uuid": "0f4b3923-9650-45cf-ac3f-9d10728d2989", "comment": "Malware payload (AgentTesla)", "value": "519d644a733298b76bb65666b15e22151c27aa8bbdf69cc04fbdf7992a5935ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451910, "uuid": "c82bb27c-3c28-4acc-85b1-208b0410d9fb", "comment": "Malware payload (AgentTesla)", "value": "94776277a07a463fde17cd8fe4026309a0ad1f05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451910, "uuid": "1d5c96d2-4e68-4e8e-8043-1cfc2bd3bc82", "comment": "Malware payload (AgentTesla)", "value": "cae238b430617927fb192bd088b5045ff79bafbe112d7789acf4af693e5201de17106f8e2fcabaebef859fc4c647042a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451910, "uuid": "09108b6a-9fb5-4476-90d5-64145d1c4e0b", "value": "T1737501AD1507C6CCED11CB7C7768A628173A3DF6253FE58DECA478833A3724628E2546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451910, "uuid": "1d56876c-44c0-4f1f-bcab-647ca8e9c86b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451910, "uuid": "66ef4335-b4bc-4997-b31b-b256004472fe", "value": "24576:8Z9Ru/xWHVVe+TkucBVDdOy9XOo6y41JDIJtY+ionMgGMZWfn7LrqwKF8hUxZaLt:8Z9Q/aVe+QBtay41JDfonM9Munrqvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639451910, "uuid": "413d1ca6-0026-4e75-8d7f-48735c50f7d5", "value": 1562624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639451910, "uuid": "9b9b17d0-9005-4c34-9711-601f1b4a8d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451910, "uuid": "f8df447d-e2a4-4a9d-9eb2-29505f8c4542", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.GGK.genEldorado.10648.23781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b823a706-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639498814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498814, "uuid": "3b437499-46cc-475a-abba-8cf60ea876d1", "comment": "Malware payload (Loki)", "value": "d4a4db09ba4666aa15083362dc835727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498814, "uuid": "8cb895c0-5539-4a01-a009-e79a967f5063", "comment": "Malware payload (Loki)", "value": "524f4bee46fc825847c3ca6ff14b3d457e3a3d3629ab3b9489b6716c275976a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498814, "uuid": "319d2723-a2eb-4f66-929f-a93045c3a361", "comment": "Malware payload (Loki)", "value": "22db82bae0cf1c47b06cec775a4e9aa379b1a8fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498814, "uuid": "23deafa6-717c-4468-b104-e069ba7c6643", "comment": "Malware payload (Loki)", "value": "35e59a6c27a0f9f118227f2dd512bcb52acf08817695f76e289747676dde08356943ec2a5bb639f9dec481e4e0c53aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498814, "uuid": "e54d5a83-ae62-4a42-b8b8-25ecdcfc8187", "value": "T1709423015F42A6E7F9EC0435147FA357EBFA678821700B6B2B4C1FBD05719CA0756AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498814, "uuid": "95761457-42d1-4d15-adc1-762fbba0f262", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498814, "uuid": "958e1a6c-35a2-409c-a305-d7ee75d7d6df", "value": "6144:rGiev//DXYsxpJ1RgB/5bIwEHGUIfl/hDfY6cYfNK5NMWWerQYnYdYSLMZu1U:6v/rHp908mx/hDQ2V1W3rpnY/MZAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498814, "uuid": "128f1383-7c71-4ac5-8a4f-810134a37e74", "value": 430826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498814, "uuid": "d26640d4-8ef1-4564-8aa5-650ce137727d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498814, "uuid": "70ac6e59-3b2d-494b-a1a3-fb11f59d41e9", "value": "d4a4db09ba4666aa15083362dc835727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7ee933-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639496758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496758, "uuid": "fb230a41-371d-4724-9414-1aa546070566", "comment": "Malware payload (SnakeKeylogger)", "value": "8153878607856dfe8fe2e80ffb198514", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496758, "uuid": "7be33f4e-1648-4ff0-b2d0-7c20ab2ead08", "comment": "Malware payload (SnakeKeylogger)", "value": "529271437ee1960fc39854963c8da79fc43842959d0af0674518827eeef72289", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496758, "uuid": "6d09ea9b-17e7-4326-9e74-94155db6ed28", "comment": "Malware payload (SnakeKeylogger)", "value": "17042343de979f5d0cefba39731185ee4448ba90", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496758, "uuid": "e8d1e77c-6bed-45cb-a65a-0dc131e0de24", "comment": "Malware payload (SnakeKeylogger)", "value": "9464f0c391989073e7c0c1c9f08099715ab49cb4cae1a734612cd39a30d271ef133d13628b7c274f0486871533e989e6", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496758, "uuid": "051f9c72-4d4f-4b63-bb11-6999032b8c0f", "value": "T15015337C5FDD20434DC99AFB7EA6FEF86589302B5F9453A0766D899180EAC05853810F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496758, "uuid": "1db8ea4f-d543-4978-86f9-d0334fb72364", "value": "24576:chrNqHfgkfq7snH8Srmm9b0/sM2lyLi4G5YfkVU/4+nUg0q:yrAS7sncNEVM2lyLi4G5Yf/p/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496758, "uuid": "17951287-d841-4a06-8744-cb71504da044", "value": 953424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496758, "uuid": "116ca091-e24a-4d27-9934-828fe4ca440e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496758, "uuid": "35b3e5b6-11ef-4f69-9f74-b0ee65b4085a", "value": "Payment Swift#8765498.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8111c0c-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639496720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496720, "uuid": "501ad2cc-1b50-4a2d-b2dc-ca1b8fdc0f39", "comment": "Malware payload (AgentTesla)", "value": "e102c31a628e1338b997d8916fa8c820", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496720, "uuid": "21dca840-3777-4743-aaea-743a3c90d5d2", "comment": "Malware payload (AgentTesla)", "value": "53800d0333233122697c6e3eef1864370d8e4cb62cc47420b49c38ac23c68411", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496720, "uuid": "6acf1fed-d4aa-48d9-9752-6972ad0b96d6", "comment": "Malware payload (AgentTesla)", "value": "08d4f5c38e87b24428b2b28cb84b8f391c64e6f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496720, "uuid": "581318e0-747f-4776-a243-e327bd653588", "comment": "Malware payload (AgentTesla)", "value": "d764e23a8684466caa84489c4de8f7be82895691b39dbef72b7d666c47318cc454d2e4ef0e59aa1dfe491d15791c8115", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496720, "uuid": "a9d9b50a-6e7b-49fd-a9d7-c7d88d03c78d", "value": "T1B1A423F0DFDCC827470CEE9A1662927865913FB0C862DE4D653AB42A89F02FF755A131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496720, "uuid": "3bd8ef8d-10e9-4e81-aeea-7cc19f12a135", "value": "12288:AmjUyGFjUrBbk8iCCF1K5emBW/4kA8Bp7:Bj2oBbkY95A/9Akh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496720, "uuid": "622f5758-d273-4b14-8c73-c9b78fc1b6c2", "value": 478823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496720, "uuid": "d705782c-d7d7-4cd7-801a-f7b3d336f5a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496720, "uuid": "8cf5ad57-0c5c-4a69-8362-b0feb9ead6aa", "value": "E008_SWIFT_MSG_13122021_26.pdf.z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fe1996-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639498975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498975, "uuid": "81c2c42c-626d-4404-aaa3-d543950ef8ed", "comment": "Malware payload (AgentTesla)", "value": "3b6201297eeaf1a21dbd0f56cdb232e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498975, "uuid": "a4ba8333-20fa-4e7c-80a0-9f377e64663a", "comment": "Malware payload (AgentTesla)", "value": "53d6b0c6a8f47b0f72b70d65a70b91c181071db96eac4abe3384680376c3fffc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498975, "uuid": "ac20bfba-dcbb-43bb-a933-b991d1d83071", "comment": "Malware payload (AgentTesla)", "value": "c26bb2150c24d6d10785e769b566c5ea6f7f00da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498975, "uuid": "0eaa2ee0-abd8-4ee4-91f1-60d3e1b12684", "comment": "Malware payload (AgentTesla)", "value": "915f7db609eaa9761e0a5175b6a1bc2efb2563a7c027543f139c98be7956a0546ea823c07de24719d60d4b2215d865bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498975, "uuid": "f44e97f5-2593-4531-b6c8-b90f7f51bbc8", "value": "T180A4E14536DAE1E8F9BFDBF00CB075C64738F6E2E941F1DEE484244ADA62A514E409F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498975, "uuid": "aa47fb39-6198-456f-9a21-e63fe97f5aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498975, "uuid": "11940be9-aca3-43b4-974d-ae72fcd709d7", "value": "12288:Sqvs0LYu0fDyaY+/VZ5JFW71Mw7MiseYyhUY:Sqvw7ya5/VZ5JFWRr7MZPoUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498975, "uuid": "bea948f1-c72c-49eb-afc5-2ca9d69946fe", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498975, "uuid": "b6237627-c904-4a48-a320-4f661ff6632b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498975, "uuid": "60f5be45-7e80-47bd-9585-277c14a4bc13", "value": "3b6201297eeaf1a21dbd0f56cdb232e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792bc8b4-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639465208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465208, "uuid": "4f0be255-46da-4e06-9c0e-0ed235391361", "comment": "Malware payload", "value": "7741262e58e62d815e5e6c6cc0379a79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465208, "uuid": "e7da176a-318e-40c5-bd76-d0f60fab0f10", "comment": "Malware payload", "value": "541f7368e6abd22663dbfc0951b46caaceedba758c8054de44bb5e52623a7106", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465208, "uuid": "5e066362-debb-4006-939b-0ed461e67cf2", "comment": "Malware payload", "value": "b3bea035c149f551de955b37319249f5fb1a5609", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465208, "uuid": "b0cd69d0-ae27-472c-9929-75baa072ec47", "comment": "Malware payload", "value": "b32d04685e3da0552bbf88bf1c28ac386b800877e392a8c4711f93b68f12a09c92eb692a67b511c8202ad079415bcc98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465208, "uuid": "48324d40-985c-4f73-a4da-8c6c40146d22", "value": "T1E7A5330852BD78ECFD9F06292B538DD0C1EDB2F1F940A1A1A2545CA85D3E1BF039F966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465208, "uuid": "738ce9dd-ddcd-4237-aa99-b654b4c52059", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfG:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465208, "uuid": "030824a8-5a0d-4df1-be24-fcfc894b3f71", "value": 2084864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465208, "uuid": "bee73e76-1552-4243-869e-4105173cddb7", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465208, "uuid": "510b0d4e-3d0b-48a4-abfc-e7d86f7484eb", "value": "541f7368e6abd22663dbfc0951b46caaceedba758c8054de44bb5e52623a7106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dee1b7d-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639499012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499012, "uuid": "08cb258b-6fc4-4899-9d30-79a3d85ed09f", "comment": "Malware payload (Gafgyt)", "value": "8e3b10178c625e1fbae26933b756b3c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499012, "uuid": "ac7ea38a-41a1-4035-a257-ae09623ef1df", "comment": "Malware payload (Gafgyt)", "value": "542f21e58a27be0e532daf890476768ebe95cbf7196edb1558ad237e10cb6750", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499012, "uuid": "f8cc2da4-c818-45a8-869c-6490547b1aa6", "comment": "Malware payload (Gafgyt)", "value": "9e845d68844635bc03ad13b916ac65f9a509256f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499012, "uuid": "06f5381d-bdc6-4692-9db3-bf27f350e6de", "comment": "Malware payload (Gafgyt)", "value": "5da8bac0ea3d042cf3bc511e20d546d2399552357f5edb9f11175a40603db2a6bcb9e76bc3b0ec785e39e64ac44f25b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499012, "uuid": "8032a440-b9c6-4aae-a814-47337e805e79", "value": "T139A34B53632D0A87C98B9AF02DEB37F187AAEDA012B25244950EBFC05773BB41152F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499012, "uuid": "57ca9791-ee68-4e4f-819e-c80d1e03463f", "value": "1536:fEYni1cRRWkcy5XahyfJtAOoe86AwbWWmFnSD4msBskFZnBW:fPecRsyAs7omw/m8skPnBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499012, "uuid": "0d5eaa92-18a7-4125-b4db-aada70e3e0a7", "value": 103537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499012, "uuid": "746e6c34-2277-4790-99ec-67c5ef6ed6db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499012, "uuid": "6cded525-5ad8-478c-bf17-03639d65c5ae", "value": "8e3b10178c625e1fbae26933b756b3c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdce14f-5cae-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639466534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466534, "uuid": "19fce308-0b97-42ee-b595-8fdabb9670f1", "comment": "Malware payload (AveMariaRAT)", "value": "4cf2c3c7b8e6629ad21816248b044962", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466534, "uuid": "6c5a6ebe-57d1-47c7-8945-96c968ac966e", "comment": "Malware payload (AveMariaRAT)", "value": "54aa6e5e41e6cb58c4b33436407972f1825c696c08ee2b4209be4a3e4d52020e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466534, "uuid": "95567a30-8c83-4796-b7ce-a11224da5fbb", "comment": "Malware payload (AveMariaRAT)", "value": "44676385079a092112836e971df3a21582f15b17", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466534, "uuid": "14b51509-747a-4165-a126-1189da9b0f48", "comment": "Malware payload (AveMariaRAT)", "value": "854890d889d8bcb0a1baa078b49ad727f3f79976b07cb15cc7e5b6f473ae19bf59926f1aefb56a7df27b2421eacabc49", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466534, "uuid": "26a7745f-476e-4131-be69-34aac3b8f13b", "value": "T1D285336239188B0AE179D2F829D19A8103731DA87560D6CC7CDD71E63BFEBD12E492C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466534, "uuid": "709be007-3f79-4735-aa1c-0cdcfa10c91c", "value": "49152:CY2EQ5NfDCEFQM4vt9CCWean/WuprzjUb:aEy0qQ+n/Dr/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466534, "uuid": "a30872da-833c-4f74-9999-76cb8cc7bfa2", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466534, "uuid": "7bd8327b-51e4-4d5b-9058-dca288895cb4", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466534, "uuid": "c84940d6-1bd9-482a-a268-6374ce0b93db", "value": "AWB#BL576945509.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6534a5-5cca-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639478472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478472, "uuid": "21256e63-ae3d-4fc9-9f7c-83c42bef52a4", "comment": "Malware payload (RedLineStealer)", "value": "143e6af4f3622d36ca6893188ebf80ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478472, "uuid": "b8fb17b8-07ba-4138-be35-42ae3ef5534a", "comment": "Malware payload (RedLineStealer)", "value": "54b99b5c0546238ff1a9876a139d60f55225d13407fc8e328ff7bd2ea7e72edb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478472, "uuid": "4eb49ec4-dbf0-40e5-9280-f7f356acd0be", "comment": "Malware payload (RedLineStealer)", "value": "f43528205dfce2cc1a884f5135d0a864c7946bae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478472, "uuid": "72748bb6-2271-4ea1-9bcd-260f41049190", "comment": "Malware payload (RedLineStealer)", "value": "9da7b21d3121143d9618a31e29fd6b1df8c12d6d2dca38979b5ee0f7668d697bb32b20be4ed9da54438548efb5491982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478472, "uuid": "f86a1090-7c8d-405c-90a9-62720f28ed00", "value": "T13B94D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478472, "uuid": "d88f78d2-cf7e-4eb3-b1fa-da305cae918b", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478472, "uuid": "576d729f-641d-4bce-951b-f7ffaa4ef7e1", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639478472, "uuid": "82717c03-baff-4af5-af7b-9d6ffafea87d", "value": 419922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639478472, "uuid": "fb3323bf-b101-49cc-ba12-3a410b270dfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478472, "uuid": "df66c978-0136-4ffc-b90a-2ef6808105b6", "value": "143e6af4f3622d36ca6893188ebf80ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b92adc-5ce8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639491559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491559, "uuid": "a97999ba-633b-40e7-b5ad-9fae083287bc", "comment": "Malware payload (AgentTesla)", "value": "26ea1b76e11081a0101578f8da764598", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491559, "uuid": "0ead70fd-d69f-4f44-b9ad-75af5baf7610", "comment": "Malware payload (AgentTesla)", "value": "54ff05c5d4545469d3fe478c21b8851a70eff6598a3a109033d9281ef08a11bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491559, "uuid": "ab438de0-b284-44be-b7e7-dd05c9af6f6f", "comment": "Malware payload (AgentTesla)", "value": "683cec6c4553b9930291485df5f128be6106a431", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491559, "uuid": "6de7aff2-4809-4fd4-88f9-ab47420b89b9", "comment": "Malware payload (AgentTesla)", "value": "f1a45883a45b38130205aa47e7e376adfb74e85c9ab2f9deb42086e8e80198709e576db408274f6de8bd46919f9f4d7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491559, "uuid": "a5e17bac-d037-4100-9da8-5c0b3a922864", "value": "T1B25523AD3AA7A7CED4B983BDB368D07853746C324117D3C9EE8A35972423B457A33142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491559, "uuid": "f631c71a-19d4-4ccc-aa41-2e51340943a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491559, "uuid": "ae1de21a-f1a9-415a-a611-984515027cc7", "value": "24576:U29FJm71DbWQSNEheyPFVNnNQzbkPNpDAqV65cUUiQXktYGgR9kIGG:FKnU6FVpNQzbkPTMCTUUiaktY3kIGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639491559, "uuid": "85980f11-b93e-4166-98e3-4f4a8338d60e", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639491559, "uuid": "26adfebe-4739-487f-9eb9-864a8680e965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491559, "uuid": "c753e2b1-eff3-4174-9e5b-732dfc641f9c", "value": "bestzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffea30f-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639464656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464656, "uuid": "c41509e6-26ed-4c7a-a5f2-0653b9b0126c", "comment": "Malware payload (ArkeiStealer)", "value": "c01b4113dcc44ebf6e11fabe213ed4e8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464656, "uuid": "df36c82d-40c8-44e7-b335-fcbdb5388194", "comment": "Malware payload (ArkeiStealer)", "value": "55cf9ff19de4bf3dab3d00f6196155833eea3af6d74fe9240c9aec3cda6f4439", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464656, "uuid": "22a98c7a-56f6-4652-aa85-191480c34523", "comment": "Malware payload (ArkeiStealer)", "value": "aa30062eb5d63c15eab8db126b78a46e0583e3ba", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464656, "uuid": "194ccd0f-70f6-485b-9992-a4598163f129", "comment": "Malware payload (ArkeiStealer)", "value": "54286394be8f1976203ffaba7a145737d6ac6470dfa5d043d8f7803bdae7cef8b43d97a9553ba1ad605b1781a89118e1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464656, "uuid": "7811a3fb-8a68-4d9b-a650-30a5bc64e508", "value": "T176F4F110B7B0C034F5F316B81A7A93BDA52FBAA26B7891CB52D156EA0B346D1DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464656, "uuid": "4b7cfd97-e21e-4304-9b0a-4c56edf32a0f", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464656, "uuid": "05f6291f-4bad-461c-b395-6b79765d6c7a", "value": "12288:NyWMyGC0xITXzl7pg3JjDH4yBp2Te051y9gyqvIL4d27fd:NyKGCcEXxpGJj0SYenCd3dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464656, "uuid": "9623395f-14e5-4d3d-8974-1f9969f39a4b", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464656, "uuid": "cc856468-8c2a-4b69-ba11-065171a0d0bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464656, "uuid": "8b2cc61c-e930-4731-9112-f6c7ddc80162", "value": "c01b4113dcc44ebf6e11fabe213ed4e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee6ffb8-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498987, "uuid": "9f2f6aae-bf9c-4a05-b4e9-9aa14c636b11", "comment": "Malware payload (Mirai)", "value": "6e6e071c016246a7c1d00fb18b95629b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498987, "uuid": "6fd0c14e-7836-45e6-b995-7dc75af58074", "comment": "Malware payload (Mirai)", "value": "56283cfe270bbe1fe5bf42b29565981106825a0d5b577e6e9dfd588945c92c3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498987, "uuid": "8d1dfe55-0dcf-450a-81dd-5351732d26be", "comment": "Malware payload (Mirai)", "value": "90a6e3e10a1665dca72814e0f8cb815b1f332d41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498987, "uuid": "6fcfdbc9-0f43-4d3e-bf39-1b0bf051a0e2", "comment": "Malware payload (Mirai)", "value": "c1ad50b60a02119b4594d833759f4d1e31168435d97d1e4c13899b4cb88443d02ab94c6e61d01d07a6224f042bb1ed28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498987, "uuid": "121f8eea-27d8-4f68-a6c8-0218fe16d922", "value": "T1AB13E19DED242A49C0BC6D3DC1EE462C0A25B1C265EF1FECC33A4C69ED5B44B126D0B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498987, "uuid": "333d32be-44c5-4219-a0c0-10dd04846165", "value": "768:W+L9uLi9JAOI6+YQL5HX8ktsLUc3A9x0vXU436tWIy23r39FV:W+LC95sRLUcGivE43Iy2739FV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498987, "uuid": "31ae3696-09ae-4e78-bee7-d91a0ab8f51d", "value": 44528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498987, "uuid": "e1b6ae92-2f5b-4bc7-9e5e-87344bb2cc65", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498987, "uuid": "ca9b902a-1cc7-42d0-adde-89003df5ee52", "value": "6e6e071c016246a7c1d00fb18b95629b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1448e12-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504467, "uuid": "7e5f05c0-43db-40e1-bfe9-a2dd50f98b36", "comment": "Malware payload (Mirai)", "value": "b4af16d7f7c53318b06ba6494153ef4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504467, "uuid": "2b1249c9-e86c-416f-bfc9-b27d9e96afa1", "comment": "Malware payload (Mirai)", "value": "56caa2b8c975349888f5c035b005436d6626546b333fe0b207d10fadd3e1dba0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504467, "uuid": "56d1efcc-49b2-4797-9cdf-e0714024209f", "comment": "Malware payload (Mirai)", "value": "d9dfa5311634ff2ab4595db62ec2f1204152e1b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504467, "uuid": "e2a6b7f5-fe6c-4b28-b67c-74e8a126602f", "comment": "Malware payload (Mirai)", "value": "839bcf1358cae5221141629fd32bc3698aba41507d91153cd479b10d27b60fc98f074a861c1200659183a409e841c10a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504467, "uuid": "7a7061d3-d8ef-42f1-9e21-215481a66792", "value": "T150C2D0981B8919E9D2F9C17C07781B6C1DA40FAAF809EC8578E8F7629D8A4753013EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504467, "uuid": "76d9a066-5cae-4023-8f30-29d4bb5abfc5", "value": "768:I2G214DFyosXqgvV9o1ndB08yJgGlzDpbuR1JQ:I2GdDgosaaO1nd8VJue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504467, "uuid": "b40cfe29-81df-4815-ba9f-c91a02a480a9", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504467, "uuid": "15250cd5-f804-4dc4-be00-0f40980c2754", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504467, "uuid": "fb25fffd-1b16-4e62-9677-92d0e5f2ec78", "value": "b4af16d7f7c53318b06ba6494153ef4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3359bb75-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444904, "uuid": "136388ed-267f-4cdd-8c8d-4353ab56bf15", "comment": "Malware payload (Mirai)", "value": "f589039862a827c30ec8c713f81b616b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444904, "uuid": "3908d0ea-0831-4f05-9f86-4ae66314f97e", "comment": "Malware payload (Mirai)", "value": "5734f948fee90954d7a6d08ba1ed063fb8ddb5679974082819939b74ff941454", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444904, "uuid": "ad8721f2-193f-4dce-b68b-fd315049a212", "comment": "Malware payload (Mirai)", "value": "6211ae7d4b11ad75a74d1ccc4f0c2d1be16d46cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444904, "uuid": "b361f03a-2bec-441c-bf3b-8c1f5562bc0a", "comment": "Malware payload (Mirai)", "value": "db06e86b2c0288bb3e2f766f666d0ac8f0c6233e4fea86e8db0a7c3ff741e86a3f8966ab93974e9520797706444dc64e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444904, "uuid": "c672b4d0-71fc-429a-928a-d5f593ae8df6", "value": "T10D53F2BC9285E9738B1508BAF00E055B37E5233075DC387206951AB57EEE406CBED2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444904, "uuid": "4950bb2f-34b1-4250-90a8-5f41ec1d35b7", "value": "1536:4gcam7eTWJILfiYZgrPMGcLgsLK/8w6nbf+9VLhkQPk9uj+6hs+lhaHuj:iaIeqJ63LzS8wmWvLh29m6Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444904, "uuid": "44ec5978-0b23-486d-bb85-831706c5db05", "value": 63132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444904, "uuid": "804055e8-85e6-4d54-bad3-17fabb0ffa43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444904, "uuid": "09a51acd-539a-420d-a795-fa94661014de", "value": "f589039862a827c30ec8c713f81b616b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb6f7d3-5cd6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639483795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483795, "uuid": "ef0e9213-f89f-45e1-a80d-4ff504a082c7", "comment": "Malware payload (AsyncRAT)", "value": "4c4402d76eb1974b1ac22a6c296ff24f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483795, "uuid": "34b4b392-acb7-4d09-86a4-2ec225aa5f8b", "comment": "Malware payload (AsyncRAT)", "value": "5783c118fc01c32cd3186ef276ce672325c422dd19a919e16bea8e9537a775ff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483795, "uuid": "85ec70b9-488a-403a-9865-01c97d95aa4a", "comment": "Malware payload (AsyncRAT)", "value": "d5643ca115f3dc991aae0e7d50096243e769cc76", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483795, "uuid": "6eb36cc9-a461-4afd-8d6d-9498eadec4fa", "comment": "Malware payload (AsyncRAT)", "value": "16de9b70922080dd0ca1caf6378acfc60fd64bd5b5a4b4e90e7c053b863f5dd6b5009df5ea37f4bad1f3f0aabf36e527", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483795, "uuid": "0eb84b10-075a-4d68-9f34-360b33ab1d0e", "value": "T1E763A288830BD3AF695F14BFEC4A595323E40E26E9FD8189D3F8049E25BE51D64E058F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483795, "uuid": "5353f437-c52b-45e4-94cb-cf72dce791c4", "value": "1536:JGC0jKzo/rJV4Jx59PwpMvj7QInrLdJg9mRY1tM:MjKE9WJ1PRnrJJgUGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639483795, "uuid": "6b9de4b7-cbdf-44d4-9493-c049088bc690", "value": 70493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639483795, "uuid": "b86ad4f1-4729-4276-b4d9-3b721cb5934e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483795, "uuid": "07810047-f28e-42e7-838b-f1de7abfa837", "value": "0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7158d131-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510292, "uuid": "7e7c51f1-2964-44f0-9e08-091ac3cc4ff5", "comment": "Malware payload (RedLineStealer)", "value": "008985e18475dd4467f6a273276e2faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510292, "uuid": "fb16eb97-3be8-4ad5-9743-1e400d0fc0ad", "comment": "Malware payload (RedLineStealer)", "value": "58116382e7019312e18dfdbdae06e6ec224e9ffdbedad299673a53f002cbb7ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510292, "uuid": "0f86c796-14f0-455c-8577-e071e5111830", "comment": "Malware payload (RedLineStealer)", "value": "fe538a45be8c7e1241f1a83273f9dde025d7f958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510292, "uuid": "cf81dd45-df57-40f2-b0bb-343441f5fb62", "comment": "Malware payload (RedLineStealer)", "value": "a7126162d69de39d3e8b978cbbea9bd18cfb0b5eb04162abeaa7eb4e01a737e9bb5d2f5ba05bd333522eb202fee59482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510292, "uuid": "73130d22-8a91-4eb8-bac7-6842d712c965", "value": "T10494CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510292, "uuid": "65cbc806-6973-410e-9ceb-2373655d1613", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510292, "uuid": "39277a0a-feba-44cc-8382-737ba55544af", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510292, "uuid": "aa572928-7148-46c9-8a80-7d751674d079", "value": 441927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510292, "uuid": "61f90b85-b76a-4651-9f4b-a4e4fea74496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510292, "uuid": "ac7d7f71-1bf7-4083-91ed-edf50c516ee9", "value": "008985e18475dd4467f6a273276e2faa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9957e13-5ccd-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639479999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479999, "uuid": "14ae75ed-5af0-436f-afd9-186e4d01ea98", "comment": "Malware payload (RedLineStealer)", "value": "87914611573c554d3413ec012f6ce200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479999, "uuid": "02dc8707-6d98-49b0-a13e-0c9f82d5e731", "comment": "Malware payload (RedLineStealer)", "value": "585571b462580906d4ef739384a054a753f9cd89a325f7b24f67b842f0643c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479999, "uuid": "11511314-6d88-48cb-a8eb-baa5a7cdf79c", "comment": "Malware payload (RedLineStealer)", "value": "29607c3eca606dc5e94f57b9cb46411ca54a99a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479999, "uuid": "f5a37c29-8c94-446f-8db4-7a907dc0028d", "comment": "Malware payload (RedLineStealer)", "value": "42d61a0339697a70381657a5c5229a35efe2fa663e13e5fcfc5c7428edf1c0bda1448e4390f59542128bfc52568d8c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479999, "uuid": "8881e54c-1d19-4450-95d9-9f12c1396c67", "value": "T1EF94CF00B7E0C034F6B352F549B9A3BDA93F7AE11B6895CB12C516EA5A746E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479999, "uuid": "2d0313cf-80a7-4162-9e63-f5455bf0958f", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479999, "uuid": "f811a9a2-2362-4598-a8ff-c3231cfe2853", "value": "6144:ej8hPMxoVOypQXfFgMrSnRWcMiKLliVXHKZ1F5B3tEdqV6CrwYpr:k8hkmbpQTORdMiWlmKZ1FvtEdqpMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639479999, "uuid": "5b7408e2-e7b9-4937-b75f-5854e5def640", "value": 420412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639479999, "uuid": "38ba1268-d9ee-47c7-b400-0e16c04cd254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479999, "uuid": "ec59d7d3-c3fb-40a2-950b-0f98bfa3a5db", "value": "87914611573c554d3413ec012f6ce200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14c5363-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500521, "uuid": "3f85d099-2446-41eb-a8b6-dc91ace330ee", "comment": "Malware payload (Formbook)", "value": "5a5121a0040f1f9492b661b709ce42a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500521, "uuid": "5401a410-b083-4d46-ba65-9393f9020692", "comment": "Malware payload (Formbook)", "value": "58d05ac8e9716f4322f5d39d676a3415c7f499e99c8fa5d920bbbecdb4a616b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500521, "uuid": "b7dd0d31-7b26-486c-8532-8d2ee15a5081", "comment": "Malware payload (Formbook)", "value": "7c7553e07b6d074575c21e8c515ef39aab4756bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500521, "uuid": "85595b8b-2818-4828-b76b-095655b160c8", "comment": "Malware payload (Formbook)", "value": "0fe005d40d40ab87962a070366fbd424313248cbc02f574c4362ee3d8dff2f5a45cfdf2daba810d2efe421550239f028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500521, "uuid": "629d1b6d-bf2e-44d7-bdc8-050f98fb427f", "value": "T10E55226C2A576ACCC57283FAB3A880345331AD36A14BE3C9DD9973D72C33715B823656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500521, "uuid": "8b39cf3a-c92a-4cf3-a528-1a7c2810ca06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500521, "uuid": "9e33ef31-9a83-4fe2-9526-63316443bf0d", "value": "24576:WBgHI/HzFeHAOnDUyTvd0+6gp3tr6c1/k+ZPOUMd/z8za1W9I6FLGG:Ob/BeHAmUyTvdF6gv6gZ76QVpGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500521, "uuid": "0728ff2d-9453-48e9-a05b-3be672537488", "value": 1366016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500521, "uuid": "7c8f3f33-50c4-43a8-9545-f79ba841c131", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500521, "uuid": "2c58a993-48a3-4825-a0e0-d0403ea8dda4", "value": "5a5121a0040f1f9492b661b709ce42a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4a0722-5c97-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639456627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456627, "uuid": "1e4f7861-de25-419b-8f4f-1cd1fe19e76c", "comment": "Malware payload (Formbook)", "value": "7c6ee2eb65836e74b45c3da1f6b3aef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456627, "uuid": "f06f5c63-4867-4ca0-9e99-442687fdce62", "comment": "Malware payload (Formbook)", "value": "592c78e1e6520240a3c32c81aae504ce05a1b66a032ac0056c7fbcac9d3a4150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456627, "uuid": "c5912f54-cd12-42b2-a26e-2db1c23ffd57", "comment": "Malware payload (Formbook)", "value": "9c8b11524ccaf791ed7ae6f6791846826335dbb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639456627, "uuid": "436429fd-2626-419d-a54f-6c63f1d866ae", "comment": "Malware payload (Formbook)", "value": "243646279b062eb87ab37ff93710e9de7f6df0276e3a8cc116a5a17243905ca52f5938586f9e851270cd029eff38f3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456627, "uuid": "3c2d706b-fadc-483c-b26e-74ee63ee6dc1", "value": "T180A423087BD3A5B3DB598E34A0B4D3ADDFFDE23532A89E49CB141D2C2703BA25985345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456627, "uuid": "55834d26-51ec-4c0a-b6a5-5775de14ef70", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456627, "uuid": "46e84444-a13a-41aa-9d58-363a1a2d66e7", "value": "12288:K9TODqJwipEN0bKWdMjF5A+XqOeG0OAdJ+Sf+gwNTwA:WfpEubKxjjA+a9SAH+OflA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639456627, "uuid": "97a27ef3-c523-4363-a246-e88e49aede8b", "value": 471149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639456627, "uuid": "af4eb097-6e46-4ec3-9ceb-f766205d9d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639456627, "uuid": "5f1b5ec1-feaa-4624-83c6-2121827f1ce8", "value": "SecuriteInfo.com.Trojan.Siggen16.5769.27257.14368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a22154d-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639465209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465209, "uuid": "b4d4cef8-8e17-43e0-82cb-1ea50913f7cb", "comment": "Malware payload", "value": "8e1442befa8fc4a873fc4f1c1bec92d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465209, "uuid": "2e561364-088c-4194-bf90-7acf2030567a", "comment": "Malware payload", "value": "5ac9faad413a50e3500bd3ff369920cb3a46a7d46ed1f6de6fc68d283d435742", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465209, "uuid": "32d39fd5-9fcb-4f44-8b53-ac00ea598f39", "comment": "Malware payload", "value": "976d75ac84213659f4edef44b728cbde8b9b1969", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465209, "uuid": "b5ffff5e-1903-4198-a86b-b54840b2aac1", "comment": "Malware payload", "value": "342e3cd4d24210d7746cebdc22e26269e929764102116f714a5ba3d1a6d429002934c5e1387fdd924fdc100ceb89b5dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465209, "uuid": "99edebc4-14aa-4f4d-9269-e008cc3b396d", "value": "T1FC95334C52BDBCECF89B12293B6289D0C2FD72E1E841619272545CB45D3F1BE039FA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465209, "uuid": "d1cdcfc7-5a67-4208-a6e5-da4619b8f8e0", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW2Q:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465209, "uuid": "b6404bdb-470c-4aff-a8b3-cebe93dbe82f", "value": 1998848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465209, "uuid": "06df9bb6-a228-4238-8e42-299fc3a487e8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465209, "uuid": "125fbe99-01cb-4615-9353-ec0e3509e084", "value": "5ac9faad413a50e3500bd3ff369920cb3a46a7d46ed1f6de6fc68d283d435742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e95704-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497755, "uuid": "0819ebf6-d0de-491a-a95f-78c923e2c336", "comment": "Malware payload", "value": "d4469032dd2fa795e7eeb995a3b7f1f1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497755, "uuid": "d4b51fc6-96c6-422b-b163-d2d1b415963e", "comment": "Malware payload", "value": "5b2751fa6c0c93f8f625375a87c8f235d7b61eb9941633f59cf2ec18352f915a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497755, "uuid": "e387950b-7fee-4bf7-9af0-ebba37894a38", "comment": "Malware payload", "value": "e5157c3c82726be307f329b198a9223fdf6bf48b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497755, "uuid": "f009f2a3-08da-4c2b-8306-6f9ff933ad92", "comment": "Malware payload", "value": "2e4a79f33b47e57293df8a9eb4295b04ffff442f63c1e479f68b1288f01b3aa347a7baf03ad6cdab0c83981ea9e9a745", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497755, "uuid": "675917b1-2fec-4247-8930-bfaa4f8749cf", "value": "T1CE41FE062BE96751D3B74E335DBAA3809612B4A1ED67C32D8394818C6CA4710EC3AF26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497755, "uuid": "6a09a2e9-1fbb-4946-aafc-7b736bb11379", "value": "24:8lJTRrF8zAvA+/Bx2LlYq74I0ci85Gh5iH7h5iHCJntUXHgMeJ4zm:8X3pxklYxIEh5I7h5ICj3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497755, "uuid": "b73172b4-a2b7-45bc-8bfe-911c6ede96ba", "value": 2113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497755, "uuid": "d55a2ca5-c904-43a5-ba92-df1ce8703e2b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497755, "uuid": "1b9e8660-effa-4594-881c-d0684bbd53e0", "value": "Stolen_Images_Evidence.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f2f5da-5d1e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639514618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514618, "uuid": "28ef64fb-5591-4a29-b7ba-4d3b016f2d88", "comment": "Malware payload", "value": "331abeb75cd70218fd30fef0d4786445", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514618, "uuid": "75d8373e-4484-4464-823d-07befab51fba", "comment": "Malware payload", "value": "5df0d16070c1bf4a86ed0ef3e7b3f9e1eb49da4545476684b7b4341b232d8746", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514618, "uuid": "cbc52d54-140c-4dd3-a681-331e934c2afc", "comment": "Malware payload", "value": "58c33ef21fbca4e81c41e8e7a1c93a6398cb2993", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639514618, "uuid": "075bba98-ad3f-44c9-8ce4-f62572032b5d", "comment": "Malware payload", "value": "0e7d753aa6dbcc2341bbf0dab3833f648d7a7a4cf406eedf7970d22bd8dc1f26b19d05620310d01f88e865d604933c8a", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514618, "uuid": "b88e101a-1e00-4d28-b2e6-78d4a0b2691a", "value": "T14B51871AFD47D15C9B79235BEC978962FF1B401B9DA2104C71DCC2495F30809A66CF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514618, "uuid": "6549ffbb-08b3-4b37-963a-b8519a17c6a5", "value": "48:AxVhQs0A48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOA:dYGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639514618, "uuid": "2bf2421d-a84e-472d-8112-0b3c777bb2e1", "value": 3136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639514618, "uuid": "43720791-4444-46e2-8058-d9a0aab76bed", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639514618, "uuid": "0e44cbfe-4775-48e9-a509-55c9f1f870ca", "value": "sjZmdpp1.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbb5028-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639497455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497455, "uuid": "246ab67b-5360-4621-9e06-67b784ec8d60", "comment": "Malware payload (AZORult)", "value": "1393e5703964fd90e491371b51db782a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497455, "uuid": "45a45d27-8a2f-463a-a90e-560cf222c55e", "comment": "Malware payload (AZORult)", "value": "5ecbede7e01f58eefee2ccc3afb54af12096d862c0c9b50b7710e94d7ca4acb5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497455, "uuid": "0b05d1ec-3834-486a-bd47-2fe20754996c", "comment": "Malware payload (AZORult)", "value": "bfb507ff1779684c4ea98df967035b7f206b9ffd", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497455, "uuid": "10182a01-5632-45fb-a074-b81e889b222b", "comment": "Malware payload (AZORult)", "value": "a470ac363af65f0e4cc907c787d811fbf2e17c7f7db97520d66d2faacb379efe8dcf53e3c598529072df6a7be875921c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497455, "uuid": "b331e427-9f22-4bdf-a634-0adc8ee9a773", "value": "T1AB6412EEB16B496DD06784333E3C74D01EA4EE828F28511D5585B70F2BB02A42F5DCAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497455, "uuid": "c6d6b40c-a86d-41bd-841d-99c617b8acb0", "value": "6144:UrrA+ujylsZyQ/+2GVs+gTCrIRiQZXgTagAethWkV4unxbcP1knnZX1yAaB+:UrrAOlsd/7Ys4URic61thWkV4unxbvPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497455, "uuid": "4a986bca-c33f-4a92-86d8-c359ef1e330d", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497455, "uuid": "0b075861-b407-469e-b544-975cdbf3e823", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497455, "uuid": "fd18ee71-b6f2-4fc3-a6cf-878d7125a05c", "value": "Request for Quotation - 4RFQ001247.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d20233e-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639498554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498554, "uuid": "a98237e5-1d11-4edc-8f00-187d66dd69be", "comment": "Malware payload (RemcosRAT)", "value": "888daa6c99bb78736eb28cb661e72172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498554, "uuid": "810d63e4-b482-4147-a3b9-aab62b721436", "comment": "Malware payload (RemcosRAT)", "value": "5ecfba2425ba981af54ae9c114e07e5408999615185a0fbe60e00a22c29aba15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498554, "uuid": "1cfdc4bd-e877-435e-92c0-7bfe0c52f151", "comment": "Malware payload (RemcosRAT)", "value": "ea00ed1382c57cbd3da99d2742a9870ad9bb4091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498554, "uuid": "990b3f72-1874-45e4-a25c-ae67d1f368b3", "comment": "Malware payload (RemcosRAT)", "value": "44163031d00b3ab247602039a824856ff704869da57d4eddf843ef6c64c7ce35162c41fc3fe2f8098c351df45456d6d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498554, "uuid": "b77652d2-4afb-4c05-9cef-a1c148a74a61", "value": "T1E765231C3943A9CEC6660F7A776A50204334AC369607D3DAF8C9335F2A7B3987563B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498554, "uuid": "052af828-ef51-4dae-b9ad-97345d2e07ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498554, "uuid": "db4d38b5-ed0f-4de0-800f-3ba800babf2a", "value": "24576:5hCeZU86DHO5N/+KIPgRVz/7jDsFmZrTez1JfB2G5m5JffX:+kUhLWY+ZXDdPe7pLm5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498554, "uuid": "6d010925-f121-4aa8-a856-1216e280ddc3", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498554, "uuid": "e4a1b585-423a-4aff-949f-056d2d33dd03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498554, "uuid": "c6032e5e-36f2-44e0-a621-2d23d7585c0e", "value": "888daa6c99bb78736eb28cb661e72172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0ec2a7-5d05-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504086, "uuid": "a0b22e9e-15e8-4f19-85a4-afa36bfe2407", "comment": "Malware payload (Mirai)", "value": "846acd850b26518a61520fc5c8a16070", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504086, "uuid": "5717417e-64c1-4391-8c06-3f3addde9b70", "comment": "Malware payload (Mirai)", "value": "5edacac60bc2efc3da919bfcea5aed32ad13e1718f8fb84913910324301b4e10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504086, "uuid": "de682bd4-86fe-4230-a430-5fb91e340cfd", "comment": "Malware payload (Mirai)", "value": "717a580317c6412951dc17d52af91cbdcc982d06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504086, "uuid": "7193f7ba-d2d9-425c-8287-e232222cb225", "comment": "Malware payload (Mirai)", "value": "ddd34b9a514ddbb899a9c29423b811827e6c8a417ee8e421657c0cac8916e2c0a1418668bd4bb8c44c7afa7dd8c12d9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504086, "uuid": "03bd720a-e685-45be-b81e-dbd74e462380", "value": "T108C2D0DFF49A39C5CC1C5CBC619C5AD11569A2C3234B9F0837502DC9B9B645FB8AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504086, "uuid": "0c8fa468-2f4b-4681-9a87-9a75fb723dd2", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBkUAW7:5CrJgHiOJrfwmQrctMU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504086, "uuid": "6fd7a90a-5366-4fdb-a82a-239121423429", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504086, "uuid": "7ec1cc26-01ab-4fd7-9a69-53bb2a90323b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504086, "uuid": "ea7282a9-718a-434a-b793-9d26986bf2fd", "value": "846acd850b26518a61520fc5c8a16070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c516ac-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639464984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464984, "uuid": "753f6b71-1904-4d48-bbfd-3f4870bc874c", "comment": "Malware payload (ArkeiStealer)", "value": "eee853bdf1ee951134ca2e7d263c8a8b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464984, "uuid": "7f889404-8447-4264-80ca-8de8d3dfdd57", "comment": "Malware payload (ArkeiStealer)", "value": "5f50dd0803e8259dc5998650dcaa40c4ac1ab883218209e41028af0baee7b4c3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464984, "uuid": "ef289cdb-e2fb-4e0e-a19f-6a293ac4ea36", "comment": "Malware payload (ArkeiStealer)", "value": "1c7e28ed6b3cb3591ccad8ff2b994b16110a751a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464984, "uuid": "603a12e3-1e62-4a6d-9ed9-c91352a28d97", "comment": "Malware payload (ArkeiStealer)", "value": "b319377f362c91a4ea6b2c1194b47ecb2587bc1310a45b367b80d8c539d2878bba4b865190abb9800c6bc454044ada08", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464984, "uuid": "c84ff73d-4344-410f-bff4-3bd7c594954a", "value": "T1E2F40110A7A0C035F6F352F4597A93BD793F7AB2A72891CB61C166EA4A346D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464984, "uuid": "9671b58f-ffc9-4288-a4e4-1cc64322cd14", "value": "fa0d97a230fe11fa07527833b096cd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464984, "uuid": "088a49b6-edfb-4f2d-8bb2-96a0dba2b991", "value": "12288:sha66g3IVt38irZkx9thv6LJFt5b/80H5xmxKRZ78fGNglJvOoKpZ3oYLLpkLNU2:h66kITfZkxMdFt5bFZ4xKR0GNg/nKpZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464984, "uuid": "f7f27600-503f-4d1d-bcd5-1a160ee8b9cb", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464984, "uuid": "8ac5be68-871d-42e7-aea8-21c6b966282c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464984, "uuid": "58da32e0-ceb2-4cca-8a70-4657af333c2d", "value": "eee853bdf1ee951134ca2e7d263c8a8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fa8802-5ceb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639492630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492630, "uuid": "21916864-0523-4ebf-bd7d-a060d744d430", "comment": "Malware payload (RedLineStealer)", "value": "f3bee182898049939990cd97e7f3f5f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492630, "uuid": "407fcf79-a9b8-45e2-9d31-67a2e4815e45", "comment": "Malware payload (RedLineStealer)", "value": "60872e28675c5cd612060fe7f3c58c0b28c23a243ce0ed4fa0d7fbc66240863c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492630, "uuid": "e33ff6c6-6361-4189-9b71-19bc040963a2", "comment": "Malware payload (RedLineStealer)", "value": "7b42fd830a24ce14535246b50b330ceb79e0cacb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492630, "uuid": "674e4be3-9cd2-49c0-9bae-aad9faaf87e9", "comment": "Malware payload (RedLineStealer)", "value": "f58cbef7d6b0be99d162fd82e17b17bd6efca2beaaf63a101053d6028a190f3f8bffba3db0531a9ad7480eba06b3ac9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492630, "uuid": "68e37dca-6d92-4ea4-9683-e612258b3205", "value": "T1E555337F2E41674AE14CC8B0B704DCAA785A31E80664D7393EFC9A8209FD592DD1937D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492630, "uuid": "b84f1c03-834b-4daf-9123-7ca34df7d249", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492630, "uuid": "2a83cb54-2c65-4996-a9c1-978135cbc867", "value": "24576:tl7RZ4Hoy/+Gl1BZlMGNK/nTxqGoRn13uGUzNA4HkEaHNYK3RoPDQWd8UW3f:tl7RZ4b+QMg+nT8GoRnRON/HNaCQWdvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639492630, "uuid": "7434eafa-b61b-4ddc-894b-0e28b3a93e88", "value": 1355480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639492630, "uuid": "fc31c1a6-2885-47f7-811c-6b262cb80aae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492630, "uuid": "f9a7bb5e-9f02-439e-8174-0d0e5d3ea9f7", "value": "f3bee182898049939990cd97e7f3f5f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7607f635-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639465203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465203, "uuid": "d597f3c7-82b2-4159-b142-3f99ad86f187", "comment": "Malware payload (Formbook)", "value": "d0567533d3fdd72f2924f99d98336a38", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465203, "uuid": "75ecbf42-7362-457e-8e2a-f3086d61b9aa", "comment": "Malware payload (Formbook)", "value": "608a227b1f369c8d6199cb345284e689dd96b1abb0498d4fc64e1041d5f62dac", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465203, "uuid": "0a4e34d7-c04f-4b59-8136-fe13c0767234", "comment": "Malware payload (Formbook)", "value": "f60c29ef089134c2e111c4ba1e152941c9ccc1bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465203, "uuid": "32f1fbe6-fe1a-43d4-b4ae-1d0ac442d77f", "comment": "Malware payload (Formbook)", "value": "19378396a65c1fe221ee7c930d21221b277515fe181603f5947b7720d64ec9a5181998867f3aa2af1ee3f7be59d4ce90", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465203, "uuid": "9f149bf2-d1aa-42c0-a6a3-f5d9bbf33c44", "value": "T183B4231F88095DB1AA23EF7AFE04FF319E05636AED8548757D6BCE0A70100FE4A1256D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465203, "uuid": "dd182bee-bfa1-4db2-88e8-780b4d1bae0a", "value": "12288:IZKfFptUy9jEuW2BnGvjJZLUcWKrcracT/:IZ+Fpt99jExmI70wcXT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465203, "uuid": "87ecdb9c-67fd-42fa-841e-aef1ebe0e105", "value": 510294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465203, "uuid": "3a44529e-f7d5-410a-a5cb-fdfd65e325a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465203, "uuid": "a41a1f93-7536-466e-a64d-0f5d5ae589fb", "value": "Drawing.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5d52ae-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497484, "uuid": "9ba16ba4-2110-41b1-bd94-594fa9db04d4", "comment": "Malware payload (Loki)", "value": "b8be474d768de2588be70e671f340382", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497484, "uuid": "5b281e4e-980f-4e24-a9ae-84f06809a606", "comment": "Malware payload (Loki)", "value": "60bf38351075022fb10f8f9a954e27e7164f6983ec36ad444679ab0747fc9df1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497484, "uuid": "3f2ef8dd-ae25-4d3a-9e40-49c90d8897e1", "comment": "Malware payload (Loki)", "value": "b26d3542e1d999f688122ac31ee219db4b913567", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497484, "uuid": "8cde2c01-9cb4-4b2d-b240-3cd849806bd8", "comment": "Malware payload (Loki)", "value": "1157587af7a29d40d0879358548d831aa8ca7d6a507853bfec4ee3dfde0191f172928127c0a4a5a75dfe7305252fb3c6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497484, "uuid": "ba0e5415-75f7-4e11-abb4-f19bcfbc4bef", "value": "T1D3F1EAB9ADD41439F78747516A7EFE3058BAF187D6C9050273ECD4310BFA1624E25846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497484, "uuid": "4b29732c-aecf-4822-b3c6-ba4cfdd547a0", "value": "96:4RzD3prvItovKf99AzpURJguTCVNHLtWfCD7wR8vO:gzT5goIbxRJTiHpW6D7i8vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497484, "uuid": "924296a0-d705-43dc-bc48-af2c6366e390", "value": 7681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497484, "uuid": "ade614a4-05b2-4d81-a131-682f01ef5a89", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497484, "uuid": "52360328-d5ff-4f7b-a433-b2d5a3e97519", "value": "BID FA-0002040.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e52f79-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639499052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499052, "uuid": "1638cd01-b1d3-4858-a2e2-748a090dfe0b", "comment": "Malware payload (CoinMiner)", "value": "98ee1a52021513eaa04b6d88cc3dab96", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499052, "uuid": "f315e689-a18c-4c4c-a2e6-74233c0bc94b", "comment": "Malware payload (CoinMiner)", "value": "6100e27dbb0c2cc5e93f307cb3524d62b88fdef2e2ab5d66408f091d44059f8d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499052, "uuid": "95dce3af-ca81-4e3e-bb41-e04c03cb3e5a", "comment": "Malware payload (CoinMiner)", "value": "88b02f50933ab68c4a4d73d175c5e88891e9d108", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499052, "uuid": "3e7a007c-5772-4294-98bf-852e1d819414", "comment": "Malware payload (CoinMiner)", "value": "e115c8065205959eda4d05585e341819a205961a323e1477df31e0cf199a7a0d1af317fd5b34266987dd5f8de9d99c76", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499052, "uuid": "d83697bd-8526-405c-b6f7-8bb67e3ac578", "value": "T101E5339BF84F4EFDC80588769A583121960B46770DF746A6D3CE0B0E31E3A6761CBB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499052, "uuid": "0ed9b6f1-d2f6-4a60-886c-e82e01db0f16", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499052, "uuid": "39605d7f-1f58-475f-8e5d-df136e735f1f", "value": "98304:xTvV935Fc+q7sY7fIdM8gIlgNjSClztB+T09oqs:xTvV3RHY7wDnAel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499052, "uuid": "dbf557d8-ba2b-434a-bfc5-1b02158e358d", "value": 3303424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499052, "uuid": "9c8f7ef3-d609-4a6d-8de5-2a69047888ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499052, "uuid": "18208043-797c-4b4f-add7-e4771e072728", "value": "98ee1a52021513eaa04b6d88cc3dab96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed472e40-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639498903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498903, "uuid": "2fa21a41-3a1d-452e-a8fd-69ec25e90ec0", "comment": "Malware payload (AveMariaRAT)", "value": "0ffade8431e0d54d7c09f77f92c6716b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498903, "uuid": "0b0cf1ce-795b-433d-bc2d-45e8393fe640", "comment": "Malware payload (AveMariaRAT)", "value": "61b66a44485e4fd5475d3144b4f3dc095ac25bd2504f3eff8cb4de6cc95990d5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498903, "uuid": "71487550-f41b-4cc6-aa22-eb84cf2dd9c9", "comment": "Malware payload (AveMariaRAT)", "value": "4ccabd547e2d84641e2c875b67b656bfbc661113", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498903, "uuid": "8d91c0c3-f481-44b7-8349-d6841fc01721", "comment": "Malware payload (AveMariaRAT)", "value": "4155e6d8e5e1145572362a6c05b823db1be7a15ca424cab40890639040163fd538759f8a42982848ebde046a1d203729", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498903, "uuid": "07925ca6-8c67-42a4-bfae-6152a005bd53", "value": "T18DB39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498903, "uuid": "7837e618-7e18-43b8-800b-6317a00bd13a", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498903, "uuid": "63e2ae91-a2c6-4142-b7eb-574edf4a3150", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01r:K1VmhaH8EFvW+0OVE0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498903, "uuid": "3549eccf-936a-4834-bbe5-43c3d4775bfc", "value": 111588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498903, "uuid": "866be308-ba7d-42bc-82ac-cf1ba8705bed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498903, "uuid": "442966c2-d33b-4a4d-bec4-a669fa8a374b", "value": "0ffade8431e0d54d7c09f77f92c6716b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddebb2c1-5d04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639503602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503602, "uuid": "48336da4-179b-4f5f-a2fc-72efb6d810ed", "comment": "Malware payload (Mirai)", "value": "13287b92b4a9a85179e6409c21e8cda9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503602, "uuid": "ab99f7a6-cf0c-4ca8-8b9c-a5c82687d0dd", "comment": "Malware payload (Mirai)", "value": "63a0a06798f7f60f408fa1da28ec38c8b9579d0b31bfeb70ce78e1dee2dcddc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503602, "uuid": "c75afdf8-e30c-440a-8af3-6b2abad01d82", "comment": "Malware payload (Mirai)", "value": "af7fc497d6e43040debf1254fc9db3e9daf72362", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503602, "uuid": "0bcf429a-3ee2-4af5-9917-4252bf444a9b", "comment": "Malware payload (Mirai)", "value": "75914a6ca3a10abee8ff843d11cf6d8ef5480c81285f4084e769acac715b204ff3b791e8a27721c26c4d476ad37fe7a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503602, "uuid": "370bb6c2-b982-43c5-843a-f0032792fb48", "value": "T192D2F1026641FEE2D4B00232E9668A5B72357D79D1D170FBC63C0DF8A6E961D47F8943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503602, "uuid": "f6a225fa-5305-4548-9b9f-4011740d5f07", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXg6X9q3UEL7Y:HRwynNIOQQ1KMw6mLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639503602, "uuid": "a4034f1e-62fb-4774-850a-2679428e0609", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639503602, "uuid": "50a68cb3-556a-4353-aac7-fdefc6296ec1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503602, "uuid": "3eb63db7-11e2-498a-b060-46d16540e007", "value": "13287b92b4a9a85179e6409c21e8cda9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228cda3f-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465492, "uuid": "b174c0e7-8767-4ce8-a1b2-b6061352c3b2", "comment": "Malware payload (Matanbuchus)", "value": "6db05064d40df7fcb691dc518ff16d8b", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465492, "uuid": "8328d1f8-2a67-4f7f-9c06-3334f27a0c39", "comment": "Malware payload (Matanbuchus)", "value": "647230baf87469b45f90d441ec31b60acd021896a6d26a1cc223fc83d659812e", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465492, "uuid": "2d1e37d8-513c-4654-a4a7-302d697c9065", "comment": "Malware payload (Matanbuchus)", "value": "e677bc818dcf532b225bcf2105f5b7a234eebb1a", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465492, "uuid": "1799010b-c05b-4171-8935-a43888869933", "comment": "Malware payload (Matanbuchus)", "value": "6cd9493f9c603efe17049d783b8223a4b6db1dd2eee5f6e728e0194d36ec15aabf941b39259c42e721b5aa782603e254", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465492, "uuid": "5bade53e-cac6-4738-b6eb-52b8138d29c6", "value": "T128B48CB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465492, "uuid": "047e8224-4141-49f5-b724-61a4b35f22b0", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465492, "uuid": "5b5f65b2-f8c2-47c8-a8e4-a657c25c1fde", "value": "12288:uCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp130:ufcqtGWdZPuQIDHaxarC30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465492, "uuid": "4220f446-3861-4726-98bb-469ae969b4a5", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465492, "uuid": "459e9758-4958-4132-a1ae-1739910fdff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465492, "uuid": "63247999-14e6-4e24-b167-9264bf8ba1f0", "value": "647230baf87469b45f90d441ec31b60acd021896a6d26a1cc223fc83d659812e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a2a920-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639467450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467450, "uuid": "5a6c6915-dcbd-40d1-9e61-f35e149e489f", "comment": "Malware payload (AgentTesla)", "value": "8ceccb1655e040b0a1bc9b51935fe37d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467450, "uuid": "06c63944-e9a5-4cdd-a2bd-0d86d67a9300", "comment": "Malware payload (AgentTesla)", "value": "64ea442da690dc7398edbb8c9e5e1139dc0c755d6487be4125990928f0917dca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467450, "uuid": "e8a24ee4-652c-4857-974d-bc8f283d4e6b", "comment": "Malware payload (AgentTesla)", "value": "f3add235ec267ab9a4b50886dd136e03c155e1a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467450, "uuid": "b46ce91b-f0fc-4ade-acd1-0d53aa646117", "comment": "Malware payload (AgentTesla)", "value": "890ae818dd6eb4a9d124bc3bd1a3e901298b59096167cabc1623a060270d313f0cd32ec8f4521b34d186afd6e360178f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467450, "uuid": "cde6986e-6dd3-43ba-8b6b-fcbc6c659fa5", "value": "T1D355330666780708D02547FDA81437115BB67403AA02EB686DD9F2DD5E6BFE00BA0FEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467450, "uuid": "ecd6e287-4142-44ac-9ba2-ae904e6fed3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467450, "uuid": "ffcadb6c-3d08-468a-97e7-8c2b18158ade", "value": "24576:7t7ksi87kQvN5rcjLcbWbs5ExPSTbSGr6Tx4cTsu7XEKNBgW1V6:VksSKN5wLWWpQbpqxB7X3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467450, "uuid": "d9f67179-f49a-40e1-91c9-eaf3b86c15ee", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467450, "uuid": "93111c38-f551-482c-b00e-ada6b3c49763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467450, "uuid": "eb8c55ef-7b11-42c5-8b00-9bdba2452b83", "value": "scan.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b05714c-5c7e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639445723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445723, "uuid": "802ae8b9-beb3-427e-87f0-85dfdfc002c2", "comment": "Malware payload (Dridex)", "value": "c8aac7332b8caed8d762ac7790c8849a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445723, "uuid": "68a7127a-c71b-4389-b95d-7141b701de2b", "comment": "Malware payload (Dridex)", "value": "65a5017e05c78e8fa52197912f8b1003e06071321ec1b46859f8581d372d2959", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445723, "uuid": "05472e6b-686f-43d6-8869-544f9b5ac84a", "comment": "Malware payload (Dridex)", "value": "3e4183cbe78cc63cce7964221fc3ee14135b406f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445723, "uuid": "dd424767-fd3b-4600-aaaa-63e5bdefb018", "comment": "Malware payload (Dridex)", "value": "cfb7a3be04b473dafb10323d4c8d04cff53a425a48239d2c68a0db83408ba7dc107e8e76a120b95f365a2953bc883316", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445723, "uuid": "25f2c341-9d70-491a-b7cc-a4b873cf2ef4", "value": "T17CB4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445723, "uuid": "8935ad58-93cc-448f-974f-f97cef53364c", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445723, "uuid": "f571d02b-c805-4bed-a94e-b812267f6b52", "value": "6144:gKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:g9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639445723, "uuid": "333657b2-0b8b-4119-86b4-32614f79d539", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639445723, "uuid": "d2d0b3c5-4c44-49a2-932c-ba049f140e31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445723, "uuid": "00853ce2-65d5-4dd6-b943-7742a53207b8", "value": "SecuriteInfo.com.W32.AIDetect.malware1.1504.21081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fae546-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497739, "uuid": "5f72182b-3502-4f07-a99a-e543061d4dbe", "comment": "Malware payload", "value": "bf6bc6c00515193f273f18f0f24b3b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497739, "uuid": "0fbe2eef-f41c-4492-9a59-cfbc9d5e3409", "comment": "Malware payload", "value": "6614c8aa9bd5a552e14fec93e6e25fb29089fbaa6ae6a7c2c4a00567d4be6f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497739, "uuid": "85924dac-40ca-458c-a7bf-8efe1046ad29", "comment": "Malware payload", "value": "3363c431f7422859c4a121f272dd1fffaee9a472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497739, "uuid": "56e8f257-1572-4541-832c-36ff37254bb8", "comment": "Malware payload", "value": "9b245b18e0ae249bb31a0241963820e20ce0f86ac071a8257686fa789c97e7b87ecaabf2bc65b23bc3a12f1b065e07af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497739, "uuid": "91c9371f-c463-42d1-95e1-15ed2b082b70", "value": "T1A1C4BF1236D897A4F9BFD7741CB0619003F5F9CAE660E19DFDD8109D9872B808AB1772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497739, "uuid": "6d10b798-46cd-4355-8374-bc9d6026b039", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497739, "uuid": "924391c3-d858-45dd-a835-5897d6ea6da2", "value": "12288:L9JNZH3rYp+e9DRBm8WkMIScBbaf1fOEsURk:pJN9DSRBQrHckxfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497739, "uuid": "f7bef9bc-f719-4a73-8872-ec38041ea954", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497739, "uuid": "d560a0ca-974b-4862-979a-2586f6aca348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497739, "uuid": "b51f75da-92b9-4a82-8bb9-821c85cfcb01", "value": "SAMU-HSBC-2322 USD 68,500 (14-DECEMBER-2021),PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fcc5fb-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497388, "uuid": "eacfa89c-61d7-476c-8800-c3e8c91a8b30", "comment": "Malware payload", "value": "f9e780d8c37b55a8920ba24ceecc9378", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497388, "uuid": "7abf6c9b-f8c0-4317-afb5-dfa8631bd9c4", "comment": "Malware payload", "value": "667165b2dd0be5e1d2976a91117a36c873203f0e220ea9f99413fbc4c69503a9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497388, "uuid": "aad7bb1f-241f-404b-bef5-c56c91f35c32", "comment": "Malware payload", "value": "8ab0fc925f1e1eb2e3557b5a644529be576e485a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497388, "uuid": "543a6621-a914-4c51-bb12-310e5345ad27", "comment": "Malware payload", "value": "d65feea09d3575bdace67672b9a10ba68450d59e7d15a4344215c334048cf15a8041cf8e3ef05c10fcaebbb9abfd6c29", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497388, "uuid": "0664c557-ff09-47ca-a068-bdbcd7990a37", "value": "T1C09107A9A3BC0C93EE470967E575FCD708D2F14246CF1A48706CF9F21B5B3648616182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497388, "uuid": "93b1b280-beca-4e80-97f4-4caac31e787e", "value": "48:mQB06qi5R663xFQUe86Q9B/wJD3SYpzdy9vm7iF4cQjPUaQKIzxCaRoSo3+FO5lD:H2AFHeM/4S6UVFGcRFR9x3X/xch4xCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497388, "uuid": "955845f2-16b8-488f-86e5-9b16c16baba4", "value": 4391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497388, "uuid": "5227e10f-4c37-4356-a7e2-953f256c2115", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497388, "uuid": "acf9cc99-daf5-46c8-b072-a1d8636e5f15", "value": "PI 28482 .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0cffc0-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639495625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495625, "uuid": "d1cf6e65-7e4a-4cd6-be0e-70ab2496c009", "comment": "Malware payload (RaccoonStealer)", "value": "71c3480031525d1a60480d197c6bfe5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495625, "uuid": "0e0dc803-188b-495d-b1f4-a84739a57653", "comment": "Malware payload (RaccoonStealer)", "value": "66a9cbff27e024246451609eaeee179f7e6e8dce3210f6b4e8c24c6a7e49a421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495625, "uuid": "d0c55ae1-3399-40a4-a4af-53700efb21ab", "comment": "Malware payload (RaccoonStealer)", "value": "8de103d261799c6738c5dca374f5fa6e3959b6ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495625, "uuid": "b63e6dca-5926-400e-a8cb-c9c95ca28369", "comment": "Malware payload (RaccoonStealer)", "value": "5a8e6cafbc0a59fd18ea5fc8a96d0bf904c1ffb75bad60c3290fb12ac792c511d336430ea7666f5a7c7fb8a799655cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495625, "uuid": "0fc62019-07e5-44de-95e8-2ffac0cd1b43", "value": "T192C4E110B7E0D039F5B762F85976A369652F3AB26B3861CF52C016EA57746E1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495625, "uuid": "f38c27b1-128f-4243-91f5-0e78d46eaf99", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495625, "uuid": "53d3abd6-3085-446e-bc84-3ebf3e196c11", "value": "12288:BB5VEnox07UqYrB0CCRmeLEPXwaoOeykASSJsH:BBDEnoxEy6G5PXCmkAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495625, "uuid": "f98d966c-a286-46de-a9dd-7f807c6c2fd1", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495625, "uuid": "bcf4dcfa-8236-4cc4-9ad1-811d0a2d7c46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495625, "uuid": "bdc5b7f1-e3dc-4bf2-8706-513114cef046", "value": "71c3480031525d1a60480d197c6bfe5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af43103c-5cc0-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639474318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474318, "uuid": "6ba326a2-9b28-46d0-b02e-04e2688c0f2d", "comment": "Malware payload (RedLineStealer)", "value": "dd6612902d83c405f2258b004fa4352e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474318, "uuid": "ea635800-bb31-492a-aa07-b784373338e0", "comment": "Malware payload (RedLineStealer)", "value": "6702acbdef7a321c2d82d8ba54430b77af8afd86eb09bfc69ea95950b4bb1ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474318, "uuid": "139a40a5-77e2-4a53-bbe2-1cc030485cc5", "comment": "Malware payload (RedLineStealer)", "value": "b5967ddc28184a73deb390036f20e2a8c62b732d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474318, "uuid": "ade96ee5-5d82-4caa-84f7-6f1e1110b6c3", "comment": "Malware payload (RedLineStealer)", "value": "1e011dba689d9a27378bce3188ac8b21d69a63039011b5ff48a2ffcf9907210e5c026267f14785aa55c610e59edbb963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474318, "uuid": "eb182db4-e0c6-47a1-8ad2-79333142bf35", "value": "T15594D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474318, "uuid": "ff521112-3d74-4086-9bf6-a4c419f49a9f", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474318, "uuid": "4c08f7c2-3489-4885-8580-63ad2d9c434c", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639474318, "uuid": "0051013a-2637-4b55-b3aa-e5d7a6e44f1e", "value": 419909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639474318, "uuid": "c9da573a-c63c-4311-be43-222607e39cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474318, "uuid": "df1a3e99-3557-42cb-b488-5f14085cb513", "value": "dd6612902d83c405f2258b004fa4352e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04dc668b-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444826, "uuid": "73e12937-f41a-497d-8c3c-10293086115c", "comment": "Malware payload (Mirai)", "value": "36e541b710e88ef078735ab92cb45e94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444826, "uuid": "85485ce4-ec5d-4029-b4bf-1e59eb8651f1", "comment": "Malware payload (Mirai)", "value": "672815d36158c42e1348e873409294e19628298d52d8256bb195e7585ef2e319", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444826, "uuid": "b5e544ed-a262-41f6-ba62-bd9bbabd43ce", "comment": "Malware payload (Mirai)", "value": "23c3937462f7f4d1ac2fa9996dce0cf381dbf9cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444826, "uuid": "193b846a-b2d3-4e3b-9523-0954553f9875", "comment": "Malware payload (Mirai)", "value": "09b8caaad40b606534c571e0e71bb3bab95376889c11e6f3366ded9cff4cfeff0730dd4677d6234e5912459af8f28fb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444826, "uuid": "08c073eb-527c-4c90-a434-f182cb178311", "value": "T1E0B2C0ED610A48ECC84590B94BB107816CF50EA3B493FC16988C87C3DF592B93D97BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444826, "uuid": "96f1ff26-44d3-48c5-a4b1-76a0eb0a22d2", "value": "384:QvgRaeoooNGRWrZrw9367o5/PfyXqImjsqghcWztla83/mT9Y4u6340GnKJgGlzb:xUvNGEdre6K/yXPu/g+Wztl3i9K63450", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444826, "uuid": "34b43490-3bfe-4117-bd09-e1300c885d39", "value": 23584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444826, "uuid": "73a6f7a2-6fc1-4004-a748-860fd15f0709", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444826, "uuid": "dea8b3cf-cb9d-4307-9f0d-42e651de5bd9", "value": "36e541b710e88ef078735ab92cb45e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43886515-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639498619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498619, "uuid": "4f9573e7-2eb3-49ed-a8ce-15583185a9a8", "comment": "Malware payload (RedLineStealer)", "value": "ea6e1408d673a07030b8b02be72d921b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498619, "uuid": "15f3b252-00d6-45c5-8286-38b104e7714e", "comment": "Malware payload (RedLineStealer)", "value": "679c568e02c17a8a089e449e1e3a4c5d2d5990aa7032636c69f100ac455eb057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498619, "uuid": "23c3303c-bf78-4528-a499-a1ea8300e8f1", "comment": "Malware payload (RedLineStealer)", "value": "f0196c60019a279ab83c4d6fd5c531eeb915e6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498619, "uuid": "077bd543-de8b-494d-a18a-4570773935b4", "comment": "Malware payload (RedLineStealer)", "value": "ba1afd5db30fdc1c9103907c66ba3181e76e06117ab88035e7aef637ed91736a4494f6da15e8a7cd2230c3ca667c9080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498619, "uuid": "a8ddf030-a880-4f36-be3c-57aab0643910", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498619, "uuid": "129f48e6-8482-4204-8473-6fff63a4db46", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498619, "uuid": "e3d7c93b-ef31-431b-8abe-eb92ed12d8ac", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498619, "uuid": "93a4adcd-c76e-45c3-b6f3-8f3e7d4724ee", "value": 442405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498619, "uuid": "e74bdbab-f888-4797-ab06-09a39bc8a75b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498619, "uuid": "add1f937-7aff-4a0a-a118-b23306c9cbbc", "value": "ea6e1408d673a07030b8b02be72d921b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba661f04-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639498818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498818, "uuid": "8c1d6f30-2d13-4016-901b-007b617d1eb6", "comment": "Malware payload (Loki)", "value": "d2c64fd1999702abe3b47b5f01064f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498818, "uuid": "09a4499f-19d0-490f-ae91-87771c95ff5a", "comment": "Malware payload (Loki)", "value": "67a8a96b422ff70fdbcbcdc73f9868d1ae4481ef3a017e073afbd65e5ed54c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498818, "uuid": "f90ae3cb-53fc-4332-b03b-178cdc13fbd5", "comment": "Malware payload (Loki)", "value": "d1f1d99183070eca12391ee0894968b65ecf4f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498818, "uuid": "d8df47fd-dd06-45ca-bf96-b699641ae034", "comment": "Malware payload (Loki)", "value": "de87f0271add61ca444146c09e1d0b043135cc9016f58fecb1dc3e0faa94b19333b450ff5a5eea2027ae39cbb0123039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498818, "uuid": "66af5878-e9a3-4cd6-89c5-a0c8544e8076", "value": "T13474DF0539D6E1E8F8BFEBB00CB036C54739F6D5E940F2DEE4C4249AE962B954E105B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498818, "uuid": "923d3e27-297e-4846-bc66-dc8fd76f739a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498818, "uuid": "0a6b369b-9019-4876-b460-274f4a07e337", "value": "6144:WUrBmWFRSWMCRFI5WCTs/oLdxw61vpX5Jl7VLpmHHzkF+37:WUBRK55dQSxRLpmHHwF+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498818, "uuid": "5f17ef89-f729-47e2-aad3-f40ae6a19f27", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498818, "uuid": "1fe41950-72a2-4ce2-b221-0d1676da4cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498818, "uuid": "9e7579f7-dc4c-4101-bfef-5aa9b6472db4", "value": "d2c64fd1999702abe3b47b5f01064f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83e2795-5d0f-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639508263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508263, "uuid": "128934af-4271-4acd-b4ad-2fecaaf94604", "comment": "Malware payload (njrat)", "value": "9982e2b78e3d3517193dbcac013f742a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508263, "uuid": "a5765186-d19c-4a3f-8334-55c7f46f4f33", "comment": "Malware payload (njrat)", "value": "67c8bc7c24e8e2345721f06ef96834e45a3e0f149083b774d435e8a7e925c37c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508263, "uuid": "86d9385f-8aa9-4730-ad1b-4a90194665aa", "comment": "Malware payload (njrat)", "value": "e86c8e8531a6514858b1e74f93323173e5aa591f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639508263, "uuid": "ae13a957-d8ee-4158-9d7f-a584858696d3", "comment": "Malware payload (njrat)", "value": "50eb4748765e50760d972b8ffd9cb4849d87239d4bca89da443f77c619353b2fadfda210c7b7de7f9b31fd480189c7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508263, "uuid": "c8b8b806-6986-4bdc-bc3f-fb4d81a88f8b", "value": "T19C54CF282BDC9952C6C9C37AE8E745A15AF19500B90BE36F210DBDAE5F033E54D2934F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508263, "uuid": "c29c0645-fa05-4a9d-a80a-ba9491514af3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508263, "uuid": "60c3468a-3872-4df4-b638-92b5d8a43353", "value": "6144:yH2RoG6It79GdsUW2PZ0e35rredilYeNjKAX5dctuo0mKMH2CzUY6d6JMnwiDVbF:yHjItUds32PZPjd6eVwgIqY24W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639508263, "uuid": "782ef9d8-2f72-43d4-a625-68ad565dd6a6", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639508263, "uuid": "96b5a310-01db-4d75-a98b-67c1f64a908e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639508263, "uuid": "3b74adb2-e175-41cc-8e30-80d26748dcef", "value": "67C8BC7C24E8E2345721F06EF96834E45A3E0F149083B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5f6362-5cb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639471011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471011, "uuid": "e2b88ed6-eeea-499d-b0ae-fe9e4b79d864", "comment": "Malware payload (Loki)", "value": "bf3a3debbec1bca5a6a6256a665711d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471011, "uuid": "6591206a-9e33-4d61-9e3b-eceb141b7cfb", "comment": "Malware payload (Loki)", "value": "686a4da886d771e51589d9833a440a2e54066dd95e688569dd3f89827fb89f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471011, "uuid": "b21977ca-abc0-4855-a350-f82c3090a3d7", "comment": "Malware payload (Loki)", "value": "a70c09aa4c2ddc5c210a1563cf9a6cfb0458cddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471011, "uuid": "e1b32717-656b-4806-b1be-bbe02e34ede2", "comment": "Malware payload (Loki)", "value": "baaa2c352c81ef26304df5a6a8165816fb6220e5f486d181f4c0e4b5582881469113f2c85398686cbe9ed39fb31c87cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471011, "uuid": "a3974be0-d6ec-44ea-b425-a50c25035908", "value": "T112C4D54A7ECEEE40FCE88AFE5DB21F35DF1E75EA491081B63188762A44263711FC4946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471011, "uuid": "abd479ac-484f-4b30-ae7c-7f32a0fc2408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471011, "uuid": "34e00c67-5b32-4140-9415-6afc41e0efe1", "value": "6144:+3bQ/o4y4qr13iq+iJ+LZQvN7Kkiho3ITZ/Y3MHicf1K/tsHR:+LyodzrtR+iFljihII1c/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639471011, "uuid": "2d92971a-ec6f-464b-808a-020421c3bc08", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639471011, "uuid": "fd1cb45c-b227-420a-9070-be491dfbbe31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471011, "uuid": "04635235-8242-4c0c-9e05-97dbef9136fb", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a0a35c-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497389, "uuid": "b2d87742-85d9-482c-bd0b-90cd6ea46e0b", "comment": "Malware payload (Loki)", "value": "384fe17729703e886f229535dda0cb57", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497389, "uuid": "d74f0cb5-b82c-4e18-8ea8-57d9e5c1d472", "comment": "Malware payload (Loki)", "value": "68787c37bf93031f2a527cd80dafc96cc5890acdf356bed5a1255db40f18b9a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497389, "uuid": "d4ecc180-5593-4e20-8a07-e4ff462ace7a", "comment": "Malware payload (Loki)", "value": "0d4b1b51a336049e3690972ceefdbefbc5bd6402", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497389, "uuid": "4d19a210-54ac-4abe-b91d-a0a89f61f3c5", "comment": "Malware payload (Loki)", "value": "ee864f456213587033b4b7c6276f11e081238e8c33e16d3d0aded5b051ef193ed9e55bdc7f338f0c58404a3c4a08cbab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497389, "uuid": "5c1db129-3ed9-4a19-b9d2-9cfa67bef9d6", "value": "T1EE611970AE7E0453CE5D9F3299A5FA2C03B1B5B2C5C34C42332EF6A60B6B7698707411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497389, "uuid": "732a0168-0321-471d-8292-9cdd649871bc", "value": "96:qb2y4ix6dT737wVsRbXKb9pt+GWjH/Ozqh:ql4iMdkHhp7G3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497389, "uuid": "16f7a9e1-559e-439b-8749-a32c3bed2e15", "value": 3243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497389, "uuid": "ecb138ee-f3c3-489b-ba35-a847719632c2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497389, "uuid": "7248323d-a14c-4c66-ac03-659ab521b6df", "value": "Proof of payment for overdue invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1436fd27-5cdd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639486513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486513, "uuid": "728b019c-7b8d-4e6c-940b-c93fc8a2854c", "comment": "Malware payload (Formbook)", "value": "f1d6c5f55de0ee37c26d5961a88938ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486513, "uuid": "d718891b-701c-497a-9831-6abeb2e8be3d", "comment": "Malware payload (Formbook)", "value": "68e59df86d888e1dc47c060c3a871ee1b075a2b7aa21e6319f065e435bf6dff5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486513, "uuid": "f7a8d390-5726-49d0-9480-05e52c514c93", "comment": "Malware payload (Formbook)", "value": "399283a13305e588566face62136afc74715d847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486513, "uuid": "606e0beb-3347-4e81-ad22-d6a389b77074", "comment": "Malware payload (Formbook)", "value": "3f7e0fd1943233d8013c3a0f0a1f9f722de3810900481871b8e1cf1b1c96323c829f83b75b0004463cd2d4c3be698fd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486513, "uuid": "337936c0-ef9f-4646-aac0-6ef1fbe380e1", "value": "T1A055236D1A9396CEC46657B537385038A3B56C31750BE2DCFCC6319B2D23BA8B823616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486513, "uuid": "2cf01405-4a76-4dd8-81dd-eb36ca3b5690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486513, "uuid": "ba1c22f9-b8be-4ab7-8002-64b3f9cc262a", "value": "24576:p8142B3p3GGHV3kqOtRzqhnnGXkV/v5elp0QACochkysDgj7BeZoTEhyAe4XXe2m:8rqGHR3/hGW/vQlp0QACochkysDgZP4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639486513, "uuid": "3bc7adeb-f4f5-4f07-9d6a-209bbb77107b", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639486513, "uuid": "d9cfefa9-e0c0-4b85-bda8-29f5ed704100", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486513, "uuid": "54114c51-f0a6-4bfa-9009-167c30e0377b", "value": "f1d6c5f55de0ee37c26d5961a88938ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9bd9db-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639465321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465321, "uuid": "38b2ffc9-3ff3-4fc2-ab21-d02eb9429e1e", "comment": "Malware payload (RedLineStealer)", "value": "7edf60b6ea6605278932218461dbfa9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465321, "uuid": "23bca9ea-9d75-4ddf-adea-4c67c5fe7d39", "comment": "Malware payload (RedLineStealer)", "value": "68ef9995dfed0701492c903841faab1abe610abc1bfad2408225dd54984761aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465321, "uuid": "d1f3b867-6c04-480d-9c46-f7e3da5fee68", "comment": "Malware payload (RedLineStealer)", "value": "0aa8db121b8f6b73a9f766283b49323e514ee7ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465321, "uuid": "a4f5d1b7-7eb4-4c78-93e6-2809808519fc", "comment": "Malware payload (RedLineStealer)", "value": "282dd2333c8eb02339eec11f51d6fc53b00c0b83c1132a14daacdcefeb3e688c5c9e2b5130f5077772930c4598b4119c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465321, "uuid": "06dff0c0-be4d-4e1f-8f84-011122d3f496", "value": "T1E994CF00A7A0C034F5F756F54DB693ACBA3F7DA16B6454CB22D126DA9A34AE0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465321, "uuid": "f9ae60d3-6885-4824-bbb8-6fbfae40b1f1", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465321, "uuid": "a7d28e80-2fb5-46fe-91c2-718a9171635b", "value": "6144:kMRBC/R6TE/iRAtvdnm4iYVC0dbflCZjmUdhTjMmhIkzHf0KRGGDkTB5wCuPG1:AW6tc4iGCyfIZjmFmikzHf0D0kTFiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465321, "uuid": "64ad3432-64e6-4c33-9832-9c7287ae48d8", "value": 419845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465321, "uuid": "bdbc95a7-d2e3-487e-bda8-2ba321a863a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465321, "uuid": "1602f31c-391f-408b-8a1f-370647b7218c", "value": "68ef9995dfed0701492c903841faab1abe610abc1bfad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b153412-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639497719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497719, "uuid": "f4377d48-fb28-40d8-946f-6ee4a2035d3d", "comment": "Malware payload (RedLineStealer)", "value": "897980726fd991612985eec4cb725b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497719, "uuid": "9753c15f-3fe2-44c6-9852-567360404ea6", "comment": "Malware payload (RedLineStealer)", "value": "692fe4a83ef6c15aa5204f58c6eee8a02a84b73bdc40f83d7099eb352d702571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497719, "uuid": "a8a78b74-43a6-4ea5-a432-f1fba02408eb", "comment": "Malware payload (RedLineStealer)", "value": "df3ab65a8bec73369e956aa4fd0774be546e7420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497719, "uuid": "cecf85e4-4ba6-4e3b-9b0c-6f96b9c770eb", "comment": "Malware payload (RedLineStealer)", "value": "9fea2ab0930f20d5ef3c1ab5a0f44aa4bd619e92fde18f42c0eca880ac9a7278741d17c5a2266699838de28eb09a0cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497719, "uuid": "507380ce-f659-45e3-ab30-35d381d70479", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497719, "uuid": "f2a8da28-1e64-4219-a2ea-ed91f7b2663f", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497719, "uuid": "5363d830-44a5-4c71-acd6-ff1bbb2a1d9a", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497719, "uuid": "9ac45778-d275-444a-80bd-d66e74691561", "value": 442395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497719, "uuid": "a7cfc1b9-0225-4e2d-982b-1b2772c21465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497719, "uuid": "fa5a1541-14ce-4b4f-8db3-18f4b7e81cc0", "value": "897980726fd991612985eec4cb725b62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850623bd-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500446, "uuid": "ba828cc9-8c45-48b8-81ec-ea091a66d604", "comment": "Malware payload (Formbook)", "value": "c18d17e306f88680c41675f7d72ede35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500446, "uuid": "ef334094-a902-41bb-89ab-28ca3a31b97d", "comment": "Malware payload (Formbook)", "value": "69713f8848927ec48d76fa26b2c64741b98ecfd7356a023e7bd5f2b193edc480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500446, "uuid": "237f57b3-afa2-42a7-b2c5-2a89588a48f6", "comment": "Malware payload (Formbook)", "value": "96954aa52f0faf7cab05b1977cad58dd65850c9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500446, "uuid": "2339b129-bbab-48f1-9070-8a6d3d4b4904", "comment": "Malware payload (Formbook)", "value": "0f30a146d542cf401098ee527c41f87570b301c554d62e4176968451e3721e4b4d1247c479ec1b3dd07e0a77caef202d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500446, "uuid": "aa2a5ba0-4af4-43c9-a130-98254d505b97", "value": "T1EC55236D1263DFDDE5B903FDB369602403A05C3A9947E385EDD772AB1933B24B923602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500446, "uuid": "4d672003-5016-4f07-adb6-7cf09e86f35f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500446, "uuid": "1172792c-e74b-4128-b148-3107ca9a01bc", "value": "24576:JRyWw4NuNZMBkSL7noquqfUUMC4I9UeHGzm5EfECHplFaZ1JyhzEkvp69R6:/NWZXO7noSfll12zyOlFaZWhRoR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500446, "uuid": "fa2716ec-7e96-4fb4-b661-2ab25ba51bcd", "value": 1366528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500446, "uuid": "76e12181-ec5e-4b66-aaae-00d0c2a021ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500446, "uuid": "6b9961db-02ee-4bcc-85da-cba4dd089f54", "value": "c18d17e306f88680c41675f7d72ede35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4a6fcf-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497694, "uuid": "3c34f8ca-58c5-4d42-a0fa-14d03fcd79b0", "comment": "Malware payload (Formbook)", "value": "607da30a66e5fb2ef5bf1938d5a34a2b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497694, "uuid": "0c30add6-c13b-44b7-ab87-f7d536a8ea40", "comment": "Malware payload (Formbook)", "value": "698f6787f4dd123d46ee4a815cb68ad7a430180e527716c1e7dd9c662a66f8bb", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497694, "uuid": "f33f7ca4-c2c5-4587-bc7b-7d20838c0e24", "comment": "Malware payload (Formbook)", "value": "d2a420f35cc05fd2bc190e6fe62cdcee0d3e2b18", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497694, "uuid": "88d62021-9827-4ea2-a478-740dabe44b9c", "comment": "Malware payload (Formbook)", "value": "152c4c5ef5c3b5624fbc6812e0d1d1e4afcc1aacbb9dbda1ed4862514277df88ae77d340320fdf043a15126979abf1c6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497694, "uuid": "253ac248-2c05-46db-837d-c2a8d48abb8f", "value": "T150450298A6286F36D97F5BF65870210A03FAAC0739A6D73B5CC4B4C51E37B808F11967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497694, "uuid": "0d682f9b-fb88-4648-be79-25f0628f2151", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497694, "uuid": "7fff5c70-5703-4f42-a7c3-bf0134d60483", "value": "24576:VYRyz2gOJpRky6dPRLtgw2ZID+xZ6Dzf3/YEOcA3nqQCvSX6TI2vwYQQn0:jJUkHdPRLtH2ZID+AfvYx3qQbqlvwYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497694, "uuid": "554a9534-e7a7-435d-893c-fc210b9d2921", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497694, "uuid": "c895cad7-7372-4ab2-abae-d1ff45424a7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497694, "uuid": "0158eb4a-a7ca-413a-84c2-6c57cf054cc9", "value": "DHL_119040 receipt document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd212d3-5ca5-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639462825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462825, "uuid": "cb10efda-11f9-47a9-94fa-a2b9bec846f1", "comment": "Malware payload (NanoCore)", "value": "4c137c7f1de69d02ad7b5125be409e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462825, "uuid": "ef37bf08-5884-400d-be48-6bbeca30457d", "comment": "Malware payload (NanoCore)", "value": "69c47c41277449a2f7b646d5de7ae5d51bf944844b48b9b0df998ff9b6d3a3c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462825, "uuid": "9279dac9-28d1-4e91-8887-97abba1db6e1", "comment": "Malware payload (NanoCore)", "value": "1a2b00dd750e87041b5235f60a064e5d1468f3a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462825, "uuid": "fecb2bcd-17e3-4ad9-82e0-c1dc44865974", "comment": "Malware payload (NanoCore)", "value": "c63a86a53104056f44b1ba565a43ba4c41ac579c22a78cf45c5da72cbd84220fa165ed20b950032cc8a3750c9680a1b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462825, "uuid": "1759399d-1a05-4e58-9209-a526c4d819f7", "value": "T1D055226D298BAACDD85843FDB32E90345339AD758647E198E9CA32EB0C373457D67203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462825, "uuid": "18c65a2d-6a43-47e2-bf75-6cb03d7638a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462825, "uuid": "c36e74a2-7331-4908-a10e-ec012ae51b4a", "value": "24576:DqZ7eGb/lRAGlTT9UXoof1TQzjXcasCPCERN3t+o8NMeau9:2d3/lRVR9fofRQnXcSzRN3th6BaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639462825, "uuid": "e1cb5f2d-b71d-4f55-995f-42208a4dd989", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639462825, "uuid": "9c4278bd-75f7-4513-b4ff-5a29558ddb46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462825, "uuid": "6eaa8a9a-f3db-4c55-ac54-5bcbcd981d50", "value": "DGD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b62412f-5d0e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639507651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507651, "uuid": "b4d8ff18-eb37-4c93-bfd0-76643f4af5bc", "comment": "Malware payload (Formbook)", "value": "69364aeb8d0d7494b2c57b15468d80da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507651, "uuid": "af0bc4a3-c644-49b8-b03b-04dfa89c54f4", "comment": "Malware payload (Formbook)", "value": "6a0e26086494a46e09c1ed630a51998f05dc8ea0ec1584d2d1775f0e40ef5869", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507651, "uuid": "015543f8-3bfa-4236-841f-6a5f42607388", "comment": "Malware payload (Formbook)", "value": "65c60986fa9b6fbe946acf6132d9a7bbaabe4fc2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507651, "uuid": "82521398-23b3-4c9e-86ef-97031c8729a6", "comment": "Malware payload (Formbook)", "value": "4b4be8531b50440d64e80204b0b0f4b0d36ee2eb7b929d91d503df4571d10bbab158ba265c23703cef7404ffd63c1a72", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507651, "uuid": "bd57fa76-49a3-44d3-abb8-5a2c4e9e9fee", "value": "T13B2533F72BC906E7792992E29A6680500FBD1AB05D5A5030BDD7AD1E0DC6CB4DFF0B24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507651, "uuid": "fca0a2d8-c6db-426b-a7f8-4e1d01de7a11", "value": "24576:HxvE9pyPLIQl/5BU+V44MKH+fwGkX52ADRuWxg/J:0OXl/3X1+ZkX/R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639507651, "uuid": "1474aac6-875a-4cf6-b097-dbebc54904eb", "value": 1001334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639507651, "uuid": "821ecfb6-1a47-4e3f-b62c-f856964f4bc4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507651, "uuid": "7b801135-f2d0-4d96-8ec8-ab070b0a383f", "value": "Quotation for Urgent PO 110921.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9be17a4-5cfc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639500105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "a76c5049-f2df-4c8e-9175-a3a62123d8f1", "comment": "Malware payload (AgentTesla)", "value": "1e7bcc575972b7d422aabda01d91d60b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "676559c9-20c1-45fc-b73c-44bee4aa6813", "comment": "Malware payload (AgentTesla)", "value": "6b999f2a2ffb29ab8f254b6454f49753fb1155bbb7414b0bde038ab74d5023ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "de5a18d1-9cd9-4daa-9557-d855369cdec3", "comment": "Malware payload (AgentTesla)", "value": "32d8abc8bf9dddb5a39a1272c677cb9de55f585d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "b597002f-3fdf-435e-988c-4cfc32310a28", "comment": "Malware payload (AgentTesla)", "value": "c86ea8d2a6e078c89ddf00525f8fe26a060cf4056bf2c9312ff9b0cb88f8663ab9737f28658c4fca5cbe902f8e01f21d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "2204fb5d-48c2-448d-bf94-e76fafcf0e80", "value": "T1A7A4E04429D6E1E8F9BFEBF00CB575C64739F2E5E840E2DDF484245AE962B854E009F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "0028f3a3-2d50-493b-a7dc-474285df1bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "c0a1a18a-58b7-4738-939b-b82158cb51a2", "value": "12288:SMhQveaqhxtRmnHhYN9Xwpa0aKUylJqWH:SoeqjTmCve/U0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500105, "uuid": "755913fe-6f0a-4ead-92bb-22f6992697f9", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500105, "uuid": "2dc0578c-f490-41ba-b794-afd5fb772896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "30106211-58ee-466c-8d29-81febcfbd9af", "value": "1e7bcc575972b7d422aabda01d91d60b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6a01ec-5cb6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639469832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469832, "uuid": "8bd0a7e5-20bc-4ed2-8728-fea710049241", "comment": "Malware payload (Formbook)", "value": "9baa5d8bd28337a61d07afb356a7445f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469832, "uuid": "c007e84e-ae90-49dd-aff6-b579cc91e500", "comment": "Malware payload (Formbook)", "value": "6c29a997d86a657fbfdcb783aeed76b2a82a4c9a503186d0f890ec22c6688183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469832, "uuid": "d3208ed0-a516-49e5-8992-5c51705b7134", "comment": "Malware payload (Formbook)", "value": "394176d3175a5f42267915386b0dc1f5873c8ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469832, "uuid": "774aec28-31bc-4cc7-9ecf-642a5f1cb8e5", "comment": "Malware payload (Formbook)", "value": "90af1a6d57eb79d8a376136f9b73bf06df85db3b3c05788f2aef9ce1afc5afbdc2fab67ef169a39e21fd60e3626287c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469832, "uuid": "97f301c4-3ec0-487a-8453-347428465e24", "value": "T146A4230B32C64D77E8E10F7694BAE97AC3AAC5AB19259B034F300E8D97396DF2515381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469832, "uuid": "9c16b3f5-67e4-478c-82ad-0d1df37c1b23", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469832, "uuid": "d8e8a023-995b-407d-abd0-16e3d6db042a", "value": "6144:rGieNYiMYh+Qfj/hBWn/0DgJ124GXelqxdpWWqZmERbsmcAmHbO07ncgiqgQQkvP:iNNhfja/KkqxdpTIYA4Ku+9jg36CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639469832, "uuid": "b4619be3-9601-4d0f-9113-b90f8be27da2", "value": 471525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639469832, "uuid": "522e70bb-4dcc-43d9-bfb7-0c070f2deea1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469832, "uuid": "2607e1aa-1344-4c5b-baa4-a1d257977d48", "value": "IRQ2107799_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c226399a-5ced-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639493677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493677, "uuid": "bc62ab3f-7893-4fcd-8b7c-c9ae17cabb5c", "comment": "Malware payload (AgentTesla)", "value": "789bf451549d68b1fc31f4875fb15df4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493677, "uuid": "2471c1a6-da2d-47da-89fa-a962a97ebc9a", "comment": "Malware payload (AgentTesla)", "value": "6d3d406d84c61856f092fb6a14caaa67495a48b48ab98a03a3970bf109aadc2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493677, "uuid": "dd5af1bd-172b-469c-ae56-9817975ce34b", "comment": "Malware payload (AgentTesla)", "value": "8517f1be8821b4b465abbd266ef4f2d5bf51d06a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493677, "uuid": "3b2ac6bd-6413-470f-9c69-6dae52c1682e", "comment": "Malware payload (AgentTesla)", "value": "b2aa64f90e39e57c964b718ffa25ed675fb92c70934bcbcb46f5819fd50faa1d970ee0027618cb96964c479854eaad13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493677, "uuid": "95e6fffb-716e-4911-8512-363cef9b713f", "value": "T1ED94D0452AC6D1E8F9BFEBF10CB139C60339F6E5E540F2DEE5C4245AE9A26414F106B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493677, "uuid": "5266f20c-403a-4135-b0e1-cd9f744cb528", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493677, "uuid": "5696bf2d-cf24-4d4a-a0cb-6e5b147b9aa5", "value": "6144:/CYWON8rmWFRSWJv2EtUnGt1t62nUV/qDyuFvGpYFEnjHfRD7izKhqpVNOn7eqzN:/gJveo1/UEusGpYFEj5/vhqpiqq0rQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639493677, "uuid": "09a633df-0219-4377-9f6f-780d72568cf3", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639493677, "uuid": "b7864723-3fa4-462d-a7df-40a53d0579fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493677, "uuid": "a9653119-49fa-4cc8-bb0b-4ce3b1c65f8b", "value": "REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ea1d93-5c77-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639443006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443006, "uuid": "565d91a6-7a8d-4a14-8caa-3400c4435fde", "comment": "Malware payload (Mirai)", "value": "7d67a992a7c10ebfd2e9dbce2ad951ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443006, "uuid": "ac9f39ef-b75a-410f-9b31-21a150aef90c", "comment": "Malware payload (Mirai)", "value": "6d4650e6fc11603c848ffb18233b13c6c4805518e1f093de896b5dd6979a8572", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443006, "uuid": "935f62c8-6134-41cc-b8e4-292c949d1942", "comment": "Malware payload (Mirai)", "value": "af8e4a0c1fb5647d372eb27ee1d8e822373eaad1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443006, "uuid": "c80ae8c5-ae26-468e-8911-76ff239000e8", "comment": "Malware payload (Mirai)", "value": "b583864825e1d404c14b3ce90891f20ccb684c51549ca5a7aab744f4a77d1489b21f8814f8ad0a65d790fcc4771df15f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443006, "uuid": "e9a5c1fc-a19b-4529-8e76-0b6540fc82fb", "value": "T17053027CA6C9C5A3C7144C7EE0184B5A738337F0B08D3C6155A465FC79AA106C7E86E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443006, "uuid": "61aa4658-bd94-4887-9c8f-df3ded89e128", "value": "1536:4gcam7eTWJILfiYZgrPMGcLgsLK/8w6nbf+9VLwOwOE6+YiLezoI:iaIeqJ63LzS8wmWvLwOEdYiLBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639443006, "uuid": "84750387-ce09-40ab-9798-e1e202ed8604", "value": 63144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639443006, "uuid": "ff2765ea-1485-4288-bfc0-a70544f8d3b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443006, "uuid": "5eb88ff3-7dab-442a-85ee-b4c554f0f8a2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6b6ce7-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510310, "uuid": "49f5e894-57d9-4065-999f-513e264db9a7", "comment": "Malware payload (RedLineStealer)", "value": "0f3fe0e07c04efd0c16cbcb446e49ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510310, "uuid": "32b86cbd-2027-43c5-b47b-7271afd15b68", "comment": "Malware payload (RedLineStealer)", "value": "6d70a6ef057c4372cf912b90ceada85024ca845ba21e6a99c611b6b1c8fa2fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510310, "uuid": "eea51664-201e-4cea-8fa1-707d4d2ea950", "comment": "Malware payload (RedLineStealer)", "value": "4eb9a456201f985d9190bad9f5ba3e83dd1a4b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510310, "uuid": "fb175e23-a701-42c5-81dd-8e7e2ff32a4f", "comment": "Malware payload (RedLineStealer)", "value": "69ad6e7b405988789655a8d13d201c726a5008b76c35f986b79e9d6977c45af89959b730dd643cb96388be04162a89e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510310, "uuid": "118bd988-b05d-4e37-ac02-4bab9ea55db1", "value": "T1B264AE0077E0D435F1B752F84AB693B9AA2F7AE16B24A1CF12D526EA56346D0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510310, "uuid": "4a59f328-4523-459f-a1f9-b23c51c304a2", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510310, "uuid": "a8124edc-bbfb-4c62-a09f-42a8f54d9e48", "value": "3072:lvXC08SKuSpZiexrdCHnqPvlHwJGynsAf3l+/r8GSX8UESJIDSo+zW7jtRQC4DUT:lupkexRCnJvnVf3CUsZSJmSCrQCKd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510310, "uuid": "2e1568cf-2b73-4be5-ad10-848aa902b3aa", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510310, "uuid": "899475f9-423f-4895-9279-af6513169f40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510310, "uuid": "3695c027-2e9d-4931-8e92-08b8d2807042", "value": "0f3fe0e07c04efd0c16cbcb446e49ebe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4659b7-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639504457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504457, "uuid": "f456447e-5ba6-4b32-b34e-6bfa325b886b", "comment": "Malware payload (Loki)", "value": "92535644ec82c785b8127add9459f8db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504457, "uuid": "da8aecf1-6763-471f-82e2-38ba43eccd89", "comment": "Malware payload (Loki)", "value": "6db415cbccf6a1a4969bad0e297e357aa5d89edfe6aa49e411c0bbd7cbe5aa94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504457, "uuid": "db5ecb4b-c2ff-470b-afce-9425253ab34c", "comment": "Malware payload (Loki)", "value": "0f0df4ee7ac2ce57b4e2981e6461597b6c433a49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504457, "uuid": "bf9bf492-027b-46d7-8cb4-1eab0675fcfe", "comment": "Malware payload (Loki)", "value": "1a2ef7710458b41cd3726463c0ab4c6cf98866d44b799b4b02c584107abc1feacae3cd0dd6afc5a3164c4149edf65737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504457, "uuid": "730a1b1a-685e-476d-bb54-7af4acdae19f", "value": "T198A4231667EA59F3E63369308A7BB721F2F7D0DE05B14F5717C81CE9990260F4908AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504457, "uuid": "f3969da8-8620-4677-9d0d-3edb2bfa2c4d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504457, "uuid": "6af4f577-fbfe-4dcf-a42f-d3fdee5e1363", "value": "12288:KBumemc0K4BCAUFWwFpF9xRrRqryld6aVHBdRhz:5meD+CAjwFfRrRqr+d6aVthz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504457, "uuid": "58e4384b-70d6-48ef-926b-4fcfa340f434", "value": 466247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504457, "uuid": "44ef4d11-6f4a-46ee-9d52-ea465c11c906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504457, "uuid": "ca17a770-120b-4047-ad5d-03aea3dc5b22", "value": "92535644ec82c785b8127add9459f8db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e91a07-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461607, "uuid": "5b76caf8-c897-4e46-b9c6-3c1eb8282e19", "comment": "Malware payload", "value": "e93b3d40c23186dcfeb8f1ae50ad2bc6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461607, "uuid": "00e91c72-1bdb-46ce-b5a5-2aad33d24958", "comment": "Malware payload", "value": "6e42bc0ee46abc126a1680572967269907ed8c119741519ee0a4d9d80f21e4f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461607, "uuid": "05593767-ee5a-4888-b22c-08c8af698924", "comment": "Malware payload", "value": "e5f3e812db429631d22fc56b98e80f48f478c77e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461607, "uuid": "5b8f8316-9caf-4289-89ed-ce4f93ca9ce6", "comment": "Malware payload", "value": "989488e61bcf805cf7f324c7d075879b65de937437606db46baefc14acf260eb74e7b4edb6a2596da6791e24817dd61f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461607, "uuid": "8ce49ca6-6da9-4cb0-b432-31e5e0df6461", "value": "T15E85330C62BD7CDCF9AE022D3B7289D0C2ED72E1E441A09676545CA95E3F1BE038F965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461607, "uuid": "a7d40a15-cbd9-486d-8364-e030563f8957", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdS:IDSTOhnXSI0Wk5jG2nfBtkaeytFOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461607, "uuid": "90b0e791-32bc-4d36-811c-f4d9b13f5e1a", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461607, "uuid": "b5dc5b25-972b-4527-932f-5a026b30e1b5", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461607, "uuid": "fdeac275-783a-4abf-b2bd-9e8508c2fa70", "value": "6e42bc0ee46abc126a1680572967269907ed8c119741519ee0a4d9d80f21e4f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c44ca68-5c76-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639442477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442477, "uuid": "eb6eaac0-ee65-4e15-bf39-3129cea9e3c0", "comment": "Malware payload (RedLineStealer)", "value": "bc5ec78323214836ceaa0ffb289540ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442477, "uuid": "ec06de79-e42c-4f93-af3a-8f6d8b6992e3", "comment": "Malware payload (RedLineStealer)", "value": "6ebbc560e337f0d6e821db476ecaa3f98fd52bd010c3a2ab85f8a4c7739eabb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442477, "uuid": "4a5c0bb7-2196-42de-b825-7c71f302cd86", "comment": "Malware payload (RedLineStealer)", "value": "528ef3f0e281fc1c443629071d47a7869857590d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442477, "uuid": "db598236-4a6d-4084-af3d-3bd2186cf25e", "comment": "Malware payload (RedLineStealer)", "value": "2b7ded1f16fd21b07aced11cef3048237b101e1c84b3a38e1ab66456475aae42ed1e0f73608d661ed15e5611e81aecb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442477, "uuid": "869bdf7a-dc10-4e11-acc6-d971bb565bb2", "value": "T1E764E101B6A0D873C5D709714434C6952E3BB9516A30510BFBE42BFEAF72390AAF6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442477, "uuid": "488d0f76-be1d-45a8-a552-68eeb95177ed", "value": "794b7cd20ec7276fc8d2300f9007d7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442477, "uuid": "2f9d8f0a-79c4-4ae6-95de-4cd228867999", "value": "3072:QYp57/oGSmjA+vwRtFfUzyBFbDl/NKt7u7CR+Qoe9EopJLzMeI08NIotcun5A1AJ:O7mdvwRtxUzyfjxE+QR0eI0vxD1rRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639442477, "uuid": "fc539360-6afa-4f7b-8d08-a58b78c18902", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639442477, "uuid": "18f92835-e74a-4e69-b4e8-ee9ff842025e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442477, "uuid": "f52e7332-c3a7-40a8-ab6e-0a486f39b282", "value": "bc5ec78323214836ceaa0ffb289540ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc21654-5d09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639505454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639505454, "uuid": "7d5ed2b7-6cbd-4dbf-9aee-37f5e0cb70a5", "comment": "Malware payload (Formbook)", "value": "20587e405bba213999654e7244fdfc7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639505454, "uuid": "12b6886d-0566-4c70-9e79-46f949ec708b", "comment": "Malware payload (Formbook)", "value": "6f7495ea749aac3582ea29a192a2c35e7c39194ae2d531f5452b2f27e5c2830a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639505454, "uuid": "d1406efe-9385-4250-851b-570897185d81", "comment": "Malware payload (Formbook)", "value": "b838f77d47319df9df1cb7ee3a2102c48aa95b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639505454, "uuid": "f38ea4a2-60d2-4558-a43e-e8b88735635d", "comment": "Malware payload (Formbook)", "value": "de3f49df8945f7ee6651205a74217e51a8c875f9b656599d2a6662ae5ad706a18b9c20d278d708c36596f2fcb4b9e8d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639505454, "uuid": "7c17154f-12c9-4500-9254-bb846cd227e8", "value": "T15335F258E3787F35D57FABF958A0620B83FEA50329E6D62A5C84B1C65D23780CF01963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639505454, "uuid": "8c6cca9d-400c-4c26-8328-f6de01c53bd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639505454, "uuid": "1037b048-a7e8-4870-b962-7a0fd8bac6ae", "value": "24576:FYRNlATO8Fmr5keVOheAgwI2rIrqxio6f+4aMbv6z/wRuMvYNjtFbp3:UGOSmr5ke4ebwIRpXf+4d6YZv0txp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639505454, "uuid": "6ae3d6ed-2c58-4951-a581-c8beae1fd585", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639505454, "uuid": "01ee09c7-6e24-4fc7-a36e-4ba4eb119ec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639505454, "uuid": "c96adebd-8e76-460b-a407-1a7a1e2557f7", "value": "NEW QUOTE 8902561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d043a64-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497722, "uuid": "e744e450-b274-4788-b9a2-c5f8981c9ba8", "comment": "Malware payload (Formbook)", "value": "abbbd8ade5d3bef1eaf2ca8945da9d4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497722, "uuid": "4ec48249-aa37-4650-8872-58e5902057e6", "comment": "Malware payload (Formbook)", "value": "7153013d7578222f3968cd387f215335e1fe4438a04bac26a33e6433cce92031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497722, "uuid": "db056750-6b9a-4d54-9731-f67894ab06b3", "comment": "Malware payload (Formbook)", "value": "690d1f743084da14242b4c2c7a4cd34e14bb0655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497722, "uuid": "4a4a60b4-faa5-4d4b-8570-09e2a8aae613", "comment": "Malware payload (Formbook)", "value": "fd14fc2020130fbaf13836b1119fca03384511b176b3777a17151ae0f3551cbf94ba0dd04687baa8c115aa9a3aee0523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497722, "uuid": "02e64686-3983-4f2c-a62c-2ddbfa67bfeb", "value": "T12BA42311B4F52AB3C1AC4C32B4778736A378751B91B42E278B846FA912521C6C70BFE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497722, "uuid": "90aa0198-ec1d-4518-891b-2fb53e90f9e0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497722, "uuid": "f8ed3b6b-47a2-4c69-a214-fbf358f69a11", "value": "6144:jGi+kAOhGFTkPsXNDPOFWHAxgnVHeIwRXGDlq0xPR2DfLS3xaSwCD07Hp+a2j1:eOhRU9DaWHAxyVHedWvZR2DDGqCQJqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497722, "uuid": "75dbb14d-6d2f-4f1f-8cb3-defb569954e9", "value": 451629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497722, "uuid": "c1891af2-7199-492b-9a5e-7e7bc395a12d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497722, "uuid": "e2ae0af4-61ed-4ae6-a498-f6e9c724d31d", "value": "Re Fwd TOP URGENTTNT E-Invoice No 11073490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87536eba-5cbc-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639472533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472533, "uuid": "e1bdcc8f-7eae-4800-8ca1-c182c47eceef", "comment": "Malware payload (STRRAT)", "value": "1884f1dd8bc296512bc4cc4fa0d1731f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472533, "uuid": "3ddefc2d-e6ea-4e77-bb0a-f1ec36be6449", "comment": "Malware payload (STRRAT)", "value": "7166e6707991af3e05e2a9f04aedf913c83ff5e21301ab595e0b04d0f960eb9f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472533, "uuid": "f6838f2f-ecb2-4b9d-9537-b73417b98dcf", "comment": "Malware payload (STRRAT)", "value": "7d00c02445094f044a64029a1105bedfe71c7d8d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472533, "uuid": "2a1e9ad3-f033-4a23-b6e4-0acaba99fc51", "comment": "Malware payload (STRRAT)", "value": "4aed66355e74fb361aca43cf8760ba56a3c9f818bcefad9ad0513bbd07c899f72ac8deb0b49df518ac5406352fed552a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472533, "uuid": "50a87fee-a7f1-47c3-9772-b164984f7296", "value": "T14FA3CF1F3DAAA1B9E15784729044D237AF1D92B8D0C9651B3EFD14870970DAE4B22ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472533, "uuid": "51c6f541-3159-4d93-9031-bdab6acab023", "value": "1536:dzJ24K7UvbQGaYk03AQJyCqY0X5vA2lxsJ5nukEjDTKks5xlgVtKXDdR:dzU6jFzAQQo0X5vnlWJ5uzvW35xiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639472533, "uuid": "0369e360-3288-4409-803b-474164d3953b", "value": 97751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639472533, "uuid": "99431a62-af6a-4b21-b310-d9344082d9c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472533, "uuid": "457a072a-fa9e-4803-8a85-d536674be56c", "value": "Remittance.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0cc761-5cbc-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639472405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472405, "uuid": "e14c2187-894c-4e01-95e4-7b2c09fa5d42", "comment": "Malware payload", "value": "f95b01a11f51dff7c7192843ac561072", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472405, "uuid": "cdd28b3c-37c9-447e-b16a-fe08ba6f2f23", "comment": "Malware payload", "value": "719340fe0fb1c66893674f7e3f82da7706d98cd356b188fb81fac04289c3c1f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472405, "uuid": "1a41722d-cf67-4c9f-9912-4500ba34d420", "comment": "Malware payload", "value": "52cee6cbad27660b99dd33479dc874ea88560922", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472405, "uuid": "1bca6a19-61e4-4414-bd45-018751bce566", "comment": "Malware payload", "value": "e09eca712f94e2140577c3a06b048bac061febfe9525eef8853468296bd3304672d8f4b9a0f56c726a559b2d66d75369", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472405, "uuid": "03ef9b76-6223-400b-817c-4023c5af6ef1", "value": "T13A55330821FB7CC4F9AB053926531C94C3B932F1D415B499368C08A656772FE63DEAF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472405, "uuid": "0ebe9ca3-5e9f-4bbb-8cfc-8e9e441613e1", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRf:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639472405, "uuid": "8b8b3a6c-f9f8-4d03-96c4-da8b612c38b0", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639472405, "uuid": "57fa3279-6f29-4f58-b7d6-7d2b5e141c52", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472405, "uuid": "df43941c-118d-48e1-a120-bbe3266ba3f7", "value": "719340fe0fb1c66893674f7e3f82da7706d98cd356b188fb81fac04289c3c1f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af29c05e-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639498370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498370, "uuid": "e791d7e5-e9f5-4ff5-a53b-4687dd3b8b68", "comment": "Malware payload (Gafgyt)", "value": "6e1f8eb49db3a9ea1b1fe76492a0dc63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498370, "uuid": "a84e8bdf-91c9-40e0-b68b-b2a4c7e497cf", "comment": "Malware payload (Gafgyt)", "value": "7508e436f07b1e45ccd930ffe98bcad1dd50791fec2ae826231f7baacb643a2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498370, "uuid": "95eca46f-ee01-4f5e-948c-eb46dce31b4e", "comment": "Malware payload (Gafgyt)", "value": "592e2c25a91f0cf7d9e014c01706d0de7b535b60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498370, "uuid": "4cdcb419-76d8-43fd-9432-e2457a67b1c3", "comment": "Malware payload (Gafgyt)", "value": "16dc0c97fcb8561986552b8758dfb4ed435737fd951bb5771a1e04df25e5d5bdb275fbfa8c6bbe289fa654530b1ce511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498370, "uuid": "96314ad3-69c4-4692-b25d-518699685ea3", "value": "T1D803F210C0119D50EAF7DDF0AEF187912FB58868B7855EA07962EA40A427DF2FB45FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498370, "uuid": "8d5f9cf9-5cc1-4149-a2e1-dd566914d96a", "value": "768:Xq+Wj3v13uQLY04A6SlNBexCF81GD4uVcqgw0z4DPWnCl9s:6VBjLY04hS4NkD4u+qgw0zyP2Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498370, "uuid": "362e4e83-8b05-46e5-b957-b25cdab3d69c", "value": 40116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498370, "uuid": "b33bfa98-28ec-4987-a38b-09b4d40c272f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498370, "uuid": "29faa9a1-00a4-4262-b71e-3e8e4dd15469", "value": "6e1f8eb49db3a9ea1b1fe76492a0dc63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620b80ee-5cdd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639486644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486644, "uuid": "1df2ce79-7ca3-461f-990a-3cd634bcde54", "comment": "Malware payload (Formbook)", "value": "3e1a42e4f2389ca5933d00cdfdf13f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486644, "uuid": "6a37679c-a927-4292-8588-456d7ea86313", "comment": "Malware payload (Formbook)", "value": "751b40d4db34b623d1b4f0be9dfbbcc243238e433ce67defc0e1ce65dd4288e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486644, "uuid": "d993cccb-5653-4fdb-97a8-b8aa3e1268bf", "comment": "Malware payload (Formbook)", "value": "f6759e7163990e28757f88d2469108a519f991b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486644, "uuid": "db3d7e96-6004-45de-8380-201ed8c65ade", "comment": "Malware payload (Formbook)", "value": "9e0fa3ecec63357c2319a188836e625532779735aad60ee72b070844292872b31eb336d7bdcaffe5a3858c432eb06257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486644, "uuid": "fd1ae37d-599a-4271-8eea-0663307d7df8", "value": "T11094239F1BC0DD7FDE5406B78E79AB71D3BBADD80283281393F13E1E24679860656182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486644, "uuid": "b771ccc0-7adb-490f-a0c0-ebf70851dec6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486644, "uuid": "7441ffdd-8c1a-4c98-a01e-9a3625db7252", "value": "6144:rGi5es7UOJauUaBtLTbDt+26Q2IfRpJLJq62SMYXMLELOTa5EYotycQ:x7tp3BFbDHZRpxp2J0sa5uMcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639486644, "uuid": "38366580-0de3-4a40-9294-0ec2f585b39e", "value": 438085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639486644, "uuid": "06e57863-de82-491f-84ea-34b56aa93c8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486644, "uuid": "1e75b83e-8ce4-4c86-abdc-589519c80bf7", "value": "NEW ORDER_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2b1aaa-5c75-11ec-96a4-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1639442050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442050, "uuid": "27fa8e40-83a6-4d3a-a3bf-fc617bd9f2e5", "comment": "Malware payload (BazaLoader)", "value": "981a5f3367a199c5b2714ccfa04a79f5", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442050, "uuid": "ba6bac7e-6670-4283-8712-6b3aae5af4e4", "comment": "Malware payload (BazaLoader)", "value": "752c45a146b9aeeacdf5dc26f03a05b6ddc8f7b788b363698bd9b4e9dcadf22e", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442050, "uuid": "1fdad46b-bcab-4397-90f5-838a4caeb6a6", "comment": "Malware payload (BazaLoader)", "value": "10edf16bd10461eab57740968ad2f4d19f7de21d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442050, "uuid": "0a1bc448-2661-4a13-8a5d-dc2efce9973a", "comment": "Malware payload (BazaLoader)", "value": "283eb86d3551625c2e14a950aa4b56f56e8ca20309c105dc518ca949fe078894574b8487d2d4ce3e25b645c714d0e478", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442050, "uuid": "8b407ddb-728a-4bd0-9d91-b83e36c854a3", "value": "T18B54AF786EA528EEFE1340B9C255168564F23A1707ACDEBF12E0DB3D1E134B15E32B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442050, "uuid": "f272be63-7935-45eb-acc1-ec49e64d776d", "value": "63a1e25ccb63258cc76f156e284f8cf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442050, "uuid": "4bb0127e-d775-4e25-8cad-60e4b49139af", "value": "6144:U7bPBd3dqDi2TUNbaQceBCY1oX+EjobMFg4kTl1XS2RDkPN2s:WfQg7yOEsbGDkTrXfRCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639442050, "uuid": "db40a2a6-a77c-4b09-a843-8b66631a71b5", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639442050, "uuid": "2be2fbdc-bb61-4e90-b72f-90cf1a637f04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442050, "uuid": "7a06d697-c695-4969-a0e6-06a1e099d07a", "value": "0x0005000000012636-65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e72083-5c7b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639444605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444605, "uuid": "b437f094-e9a5-43e5-ba6a-2839aa30fc2c", "comment": "Malware payload (AgentTesla)", "value": "ae2d75d7cf2eec60e289516dff63aecc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444605, "uuid": "327cb048-3d4d-45cc-9e4a-4376f73e8125", "comment": "Malware payload (AgentTesla)", "value": "7673e7b44adc89cf2781d16749b848a09fb71deadcc362380ad0d3a4266a64bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444605, "uuid": "1d32f2ab-b875-43b1-98df-70db32412611", "comment": "Malware payload (AgentTesla)", "value": "d8b653e2f833993e3359b315b6a53680688d6b1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444605, "uuid": "ade80338-b33d-402d-908e-cec9aadfc307", "comment": "Malware payload (AgentTesla)", "value": "cff28b734040c45cf0a1b6c135b7d0d43d6d797c817bd6ac90d493fd9845ce214ccbddbf7eecd811e9bf01588fbe64fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444605, "uuid": "9afc59be-5cd9-438d-af8e-7ba16bb99759", "value": "T1125523033068DB11E1A957FEE981118503B8B966E161EAF47DDB73EF21623E54902BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444605, "uuid": "2e27d94f-df85-477f-b847-043a6d47aa0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444605, "uuid": "101cde2d-19f5-44de-8a5c-908f2706f3f3", "value": "24576:8/19ECv+fGisfdw3Y9C2sWtRafZq4GB7Bit0XSUy5N4vYD:8/1xv+fGisfm2vfafEuqiKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444605, "uuid": "adfad141-e3f5-4c39-a0c0-9430e5461c8b", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444605, "uuid": "4b65d136-c05b-4fd8-b0c6-eb44805d8f4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444605, "uuid": "e39e237e-4083-4064-99ff-93c1103ca78e", "value": "SHIPPING ADV#ASEAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec34e2ed-5d05-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504056, "uuid": "c13746f4-dbc3-4131-aed4-a5ad2d88e5e4", "comment": "Malware payload (Mirai)", "value": "2a96df3e0322306f40c1d01f8e1ee75b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504056, "uuid": "18b19697-bc80-41f8-9918-3717f5c8749e", "comment": "Malware payload (Mirai)", "value": "76aa0e979736b2f4e65c2722b0b3cd9d497c97bb882becf561de005dad7bbd5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504056, "uuid": "ddcdd95d-1067-4f00-93f7-604e93a9926e", "comment": "Malware payload (Mirai)", "value": "b50ce46a75b66ff7e0586fc371d05c68f42a2fcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504056, "uuid": "c0b2efc0-0d7b-4ecc-bd5f-a70454f916e9", "comment": "Malware payload (Mirai)", "value": "a37de10278880a13b408eb67c0f76429938ac3b5c8324ae9634d1780ef9af73acdbf4b9745ffb682e75a883141aedf8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504056, "uuid": "dd2ee2f1-09cf-4ae2-8eb4-292c9bdff5bd", "value": "T159A2D01925CDE931D170903AE23CC347EAD747A652FE313A1E1C079DA05491AE7BE945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504056, "uuid": "d86051bf-7534-4643-968d-dab8b8f46847", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbpqhymdGUop5hXT:Ypoh/DxCvhdR4IjWVFbSMs3UozJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504056, "uuid": "4b4b982b-45cf-4a5d-b18f-21748608f28e", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504056, "uuid": "ed26d581-e5c1-4a2b-88ca-326a43518c87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504056, "uuid": "7485b154-6f1d-4b40-8fdd-220ff79005a3", "value": "2a96df3e0322306f40c1d01f8e1ee75b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c69cd1-5cdd-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639486602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486602, "uuid": "dfe29b14-491b-4ff6-8db3-eed3f9011ff6", "comment": "Malware payload", "value": "9f437dc21c4205fa924754a46d21fa9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486602, "uuid": "ea8a92b8-6981-4b4f-8866-99adc360fa2f", "comment": "Malware payload", "value": "7754dccace10a105ad41c7f9280173329fd02937dcc3cee737440e1bb799d8d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486602, "uuid": "d6d854ec-04d8-4084-988e-0ff108a91cd8", "comment": "Malware payload", "value": "e85ee454ba711b6d6ba4bb8562fa686e5b55ffaf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486602, "uuid": "df5485c1-92d1-4b68-8712-2c2dd21126ad", "comment": "Malware payload", "value": "dfc07cd11a3d8fa091058c2ab30f512ec542afd8dade5e2439e68535579465644bbde0dad53b2e8b07ad9bb1fd61a1a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486602, "uuid": "a6cc2eb8-a8a5-4fc7-affd-6980123c4946", "value": "T109544A6585D3003FCA91E5F1E6895586D2EB2D0C79CAEFDAE51E083FBC50162927EE0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486602, "uuid": "10c19b60-f638-43ea-80ca-aee810122d94", "value": "5fccf129e2ca936e97c7c0de1af97de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486602, "uuid": "c175f4aa-dfbe-460e-9b36-eefd7734850a", "value": "6144:RedqtLYwtSbECpFUe1z0lndR95tFWCQEiYkJ316G:VtLYwg/FsnDbtQTEiYkJF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639486602, "uuid": "635cdb73-1620-4d81-ab91-ee62a18ba435", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639486602, "uuid": "395cfde5-24e4-455a-bc9c-522f3510b5c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486602, "uuid": "869a5f88-b868-4956-8063-95e6f9dd9286", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.13065.8025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1dd1cd-5d13-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510013, "uuid": "c79ab17d-a8ce-4e65-b8db-b489714e4df6", "comment": "Malware payload (RedLineStealer)", "value": "2d231944449413411ba08ebcd78f8bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510013, "uuid": "b569209a-bdd3-460c-83eb-b9dda946c1d4", "comment": "Malware payload (RedLineStealer)", "value": "77814c14a7cb692f57ac0ec2d46071aad96e395486e577b86b9e8c3c5edf43fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510013, "uuid": "1131e099-998f-4c8c-ad0c-406053d73ecc", "comment": "Malware payload (RedLineStealer)", "value": "cc8cb518bee766ad7bff529e9e4f55e588e95da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510013, "uuid": "5b6850d6-a300-4819-89e5-cb6cf5e832b5", "comment": "Malware payload (RedLineStealer)", "value": "e575827774dc628356df2c9443812dabdeb7f69b3bc312f44af850187276ce61a809ecfa3c92c481eea088e3272b7584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510013, "uuid": "3d7cd306-a113-4dd2-8554-c46b2e3010c6", "value": "T1A794CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510013, "uuid": "93d76b48-d48b-4a68-9604-5bc8ae5ed7e8", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510013, "uuid": "52bac0be-46be-4162-bf55-f5cb70ee7a91", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510013, "uuid": "8170812c-f246-4929-8420-0976d4c81cf6", "value": 441870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510013, "uuid": "d6b8f92a-bf85-4b32-8e81-63013f4419c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510013, "uuid": "020d5de3-d777-4cf3-8c6a-052479669779", "value": "2d231944449413411ba08ebcd78f8bbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13a4c52-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497487, "uuid": "1003e944-2272-4c4d-8a77-b1380836afa3", "comment": "Malware payload", "value": "24ec4c448596758e951fb25c641c3ea0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497487, "uuid": "762b8aa8-e1d2-4679-ad35-c833b7b8ea27", "comment": "Malware payload", "value": "795d9353f1acd168055199f086ce6161ffa2243c2fdf47da7dc59d2a1cf665e0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497487, "uuid": "ba6feaba-417a-436b-ac51-ad290274681f", "comment": "Malware payload", "value": "6fd35673528e44c448d251d899c7de9a3851a46d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497487, "uuid": "0dda160b-3855-4536-b06e-e5d26f1b5626", "comment": "Malware payload", "value": "04297487edcb5905a01af193edf08ee01af332e5455b1677082d878d55795924f3e4edb1f2698ae15b65a6ee900cacc6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497487, "uuid": "c53a8131-1136-4086-8efb-f24b70e737d4", "value": "T15236AEF876047DE6266F576BDA96ACDD03B617239ACBA4CC8064B7C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497487, "uuid": "8a9b92ea-eeca-4f66-a3c4-90861eaa9f7e", "value": "24576:SykFo+nXVpGEe9r8Pmyy2lIJI2/70n7RCrmWdosHm+bQZdqLujE5DiAYzMT1dOcA:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497487, "uuid": "9f8a068e-5a22-4ebd-b17c-8942ba8380c5", "value": 4960842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497487, "uuid": "2b334164-c310-4cde-86cf-dda69f07198f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497487, "uuid": "e7233dd3-44b3-45e8-9960-26097d14c372", "value": "Cadbon - Inquiry MEI-301121.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be22b51d-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639465324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465324, "uuid": "392318f2-20e0-4dd6-8151-b4b4d0f42611", "comment": "Malware payload (RedLineStealer)", "value": "bd83ddf94edf53fc667f9e75d71462d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465324, "uuid": "cec41a9f-ef96-4956-9fd4-8082201d3e4a", "comment": "Malware payload (RedLineStealer)", "value": "7c33a78185abcea82a6d802e70ab548cd7c9a92624e1d36328d49fa86fed6167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465324, "uuid": "1fa1101d-6bdd-412e-a1a1-035fa9fed4d8", "comment": "Malware payload (RedLineStealer)", "value": "e3b5d90e84a619bcb2df911603df44d96f36db32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465324, "uuid": "d3679f82-52f5-4ac0-9e55-5dc3a42dd792", "comment": "Malware payload (RedLineStealer)", "value": "f19e675bd375dbe03e71acdfb37c38add29d25ee2438f0e930c29606beef12fe8ed2bc2eb13e2dd416eac57176b83d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465324, "uuid": "aad58946-aea4-4966-bd30-4377c237af41", "value": "T1E694CF00A7A0C034F5F756F54DB693ACBA3F7DA16B6454CB22D126DA9A34AE0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465324, "uuid": "d9051821-249d-4d6a-a0be-1b5211bff3a3", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465324, "uuid": "6c5da557-6b1f-437a-8535-cc05ee0b69c0", "value": "6144:kMRBC/R6TE/iRAtvdnm4iYVC0dbflCZjmUdhTjMmhIkzHf0KRGGDkTB5wCuPG1:AW6tc4iGCyfIZjmFmikzHf0D0kTFiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465324, "uuid": "a3838c47-826f-4bb1-8b80-fa49ea0004b2", "value": 419865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465324, "uuid": "02c4c80f-79c6-4ded-bd44-4c7f90142b6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465324, "uuid": "c0b893e6-4a14-4c85-8511-3cd600672a05", "value": "7c33a78185abcea82a6d802e70ab548cd7c9a92624e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d50a4fc-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639496380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496380, "uuid": "8ad0b226-8cd9-4a50-972c-d75fa26a268c", "comment": "Malware payload", "value": "55beab552faac1ca8fb8ce57fd27d112", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496380, "uuid": "e9304e9b-c034-4c86-9aad-b3f592b465f4", "comment": "Malware payload", "value": "7c37e20b6d547fa7b95a99b3053034ddefc0efde330a5432d5a6a2c43bd86ba9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496380, "uuid": "0d80e136-9e2f-4aca-a6e2-d8c1572e72e2", "comment": "Malware payload", "value": "28380d2e82c8c75825f85befd4e776482f6f69c7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496380, "uuid": "9c0be496-6786-4dae-b55a-cb5bb4e099e0", "comment": "Malware payload", "value": "d16330c781ce30afe0cb3aae921c1e0d5efcb791dec9cafeea6be274d6c8d2a1c8829f11f0742521789e62bd58e21a87", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496380, "uuid": "726f87b7-df29-4226-ab38-850b8db55473", "value": "T1CD4623237395812AC1FD8975573B7EA930B526244BA294FF16C81DCD2EB38D09723E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496380, "uuid": "42dbad65-3f19-460b-b61f-350a316e5e3d", "value": "98304:3YeewAfKzDylDG/Uq8z/Vs8gJrTyPtaszhCLxb+mvoIBJ8EHgqOfL2In+DM:oKqDB/vgJSo+mvoIBJVHgHzP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496380, "uuid": "51502069-9f43-4596-945c-9af494c39990", "value": 5847552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496380, "uuid": "18e8e991-f5ce-494e-80bc-0feb92971ddf", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496380, "uuid": "e0b797c0-b158-49fd-aa88-3a8b0b52eff4", "value": "55beab552faac1ca8fb8ce57fd27d112.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9200a5a-5d04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639503621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503621, "uuid": "765418fb-a0c1-40f8-bee5-fd9261abc5da", "comment": "Malware payload (Loki)", "value": "4a9de127291e0c2f5cc2cfd889178bf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503621, "uuid": "cf37ded1-67dd-46bc-856e-e047ce62fcf7", "comment": "Malware payload (Loki)", "value": "7c47af2cb3f897d3701c450e1d07f176186e633a41b3e962a2de7d56631144d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503621, "uuid": "19a21ac2-d87a-49aa-a59e-af1315386685", "comment": "Malware payload (Loki)", "value": "f18bdcbbd963ada1853bbe3b14ca608efd2a2ef0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503621, "uuid": "f49f42cd-4d6a-4731-bce4-374acb83e9df", "comment": "Malware payload (Loki)", "value": "727e3bb72f73100f7a10d597f2ca8ba08f0aa1a28866f88d53cdd80a000b2d741ccc493ff51a8e9f36f62a5f71f6b65a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503621, "uuid": "94289300-8bec-4c9c-906c-000a61d3644a", "value": "T18A45126E26A3DACFD82943BFB728906453765C326253E2C9CC9E72C729373217937506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503621, "uuid": "35819328-d896-46f3-be81-873c25d4af7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503621, "uuid": "88d361b7-09c9-4b04-8fae-4c4950a8b281", "value": "24576:x/l6+aNKPweRn4RIeJXpiSesD4TXS8B7HNiR46g+y:Bk+a0/62eJXzew4TXS6pi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639503621, "uuid": "3d416231-413c-4579-9b2d-b7ace3b17674", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639503621, "uuid": "cfd94358-bda6-4a74-a5c6-0e10ef52a34e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503621, "uuid": "42b5c86e-2322-45f9-b8fd-87e780d427fe", "value": "4a9de127291e0c2f5cc2cfd889178bf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c5f80f-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639504182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504182, "uuid": "9dc438c1-66fe-48a8-8d8f-27535547723c", "comment": "Malware payload (Quakbot)", "value": "62f20e4565b40b78c9b0c1c7f77c1f64", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504182, "uuid": "404d96a0-ec06-44af-b57e-665ce81d5078", "comment": "Malware payload (Quakbot)", "value": "7c549b6db99a8422b4e3c5a4d291057832ac5a36b6368a01052449b5eb2d9cf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504182, "uuid": "d0924898-c452-4729-857d-fc4664414da4", "comment": "Malware payload (Quakbot)", "value": "575f6e0a006bc19d5dfb5e5001f0b2b1a69cc0e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504182, "uuid": "e8935c7e-a496-4046-bb0e-aad140c97a84", "comment": "Malware payload (Quakbot)", "value": "1a037623ca562dadcfeec76a0304bfd5d0076c09b69e9076d717eea63aec475699a825157d7d4237b9bd7b7448f661aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504182, "uuid": "9ea5ad62-aa3b-4575-8096-81a8ecc43fe3", "value": "T1ECF49F22B1F18477C1B32A3D9C7B52A594297E113E38AC4E77E41D4C4F392917A392AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504182, "uuid": "0300781a-6586-4a23-ac82-b9c0afbe302b", "value": "c967abd8a4b2caed74d57814c5fadb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504182, "uuid": "058d1641-dfa3-467b-9872-c99ae841529e", "value": "12288:B03XYpmWl+zDTCWxLgXUlId1AMK++U4wvpAHXQDfwbmxL/NrKpE:ennvNxUVIaIHYfwbUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504182, "uuid": "9c730a85-74bc-4d71-aa9f-3731dd8f1975", "value": 782224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504182, "uuid": "d95e4d5a-1015-4e22-ab1b-d2427cac3de7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504182, "uuid": "9c54aeff-d70d-43bf-9e78-b67f3c93a4f9", "value": "Yukoste1.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedcafaf-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639465003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465003, "uuid": "0e46e992-1783-455a-ad72-0bf15f353881", "comment": "Malware payload (RedLineStealer)", "value": "a1ff4df504cb89651697ca1ecca6431a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465003, "uuid": "23fc4d0b-aa01-4c2c-a702-3b4d183409c7", "comment": "Malware payload (RedLineStealer)", "value": "7c599455d2f36975efa7356ce35ea96c44c30d9250d21b304c9da99be7300a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465003, "uuid": "94b3665e-890d-4ae6-ba53-8fd8cbdff876", "comment": "Malware payload (RedLineStealer)", "value": "72b55091ce88ab919823adface7bb6b018911694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465003, "uuid": "460c9a11-b99f-4d69-a6ee-828f6cfea974", "comment": "Malware payload (RedLineStealer)", "value": "48a59d79d6703166efe14b883fb20c6d962643732d53b04959b162fb81ef72da8b684ec77487e9419fbef9afc300673e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465003, "uuid": "b59f3c24-4b56-4ad8-b56c-70b9012e1af2", "value": "T16D94CF00A7A0C034F5F756F54DB693ACBA3F7DA16B6454CB22D126DA9A34AE0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465003, "uuid": "11ea244c-c656-440b-be35-5feb5a630293", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465003, "uuid": "13e7bc3e-c709-4613-a9bc-8fdb2fb63f26", "value": "6144:kMRBC/R6TE/iRAtvdnm4iYVC0dbflCZjmUdhTjMmhIkzHf0KRGGDkTB5wCuPG1:AW6tc4iGCyfIZjmFmikzHf0D0kTFiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465003, "uuid": "0327e821-1492-4c59-a11f-0ddb8bda4fa4", "value": 419891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465003, "uuid": "8d246fd5-7725-478d-b5eb-e5bf41b89e15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465003, "uuid": "f39725f4-ee65-4533-b8ce-87e1c6b15d48", "value": "7c599455d2f36975efa7356ce35ea96c44c30d9250d21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186608f8-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461610, "uuid": "cddd38cd-5ee9-41da-a198-7cf8dc8926d7", "comment": "Malware payload", "value": "0beff5020e3a7ddf6df52e874739f062", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461610, "uuid": "75d65c9f-91dd-4c3e-a881-89af033828cd", "comment": "Malware payload", "value": "7c5cc4fec5a7238cc5fcc1edf117d4d96faa4295bd45da531ff23b0d0e0f6362", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461610, "uuid": "cbc7aedd-04b5-40ff-9144-48a63cb3ba83", "comment": "Malware payload", "value": "331e05b1b9bcce02a79b50b51bb57446db8aa3a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461610, "uuid": "34d22b64-16e9-4bda-877e-c4066c6dd189", "comment": "Malware payload", "value": "066d7a14c8cd923fac8b1c805016e335a20c0fba64f34fd9cdc648e70bb75f7c119658a57d72629eb5f33c9783f74d8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461610, "uuid": "215ef737-1a8a-413e-bd4c-f55e6f776fc5", "value": "T1C575330822B97CD4F5EF0229376248D4C2ED32F1E441B49676985CA62A772FD039EDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461610, "uuid": "991327be-c924-415f-8773-561b250f0d08", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/80:IDSTOhnXSI0Wk5jG2nfBtk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461610, "uuid": "d2ba2f62-582d-42a3-83ef-cf05e338557f", "value": 1671168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461610, "uuid": "68b873a5-d114-426c-9661-da5e34cce1ee", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461610, "uuid": "f63985d7-135f-486c-aac2-f480dc3b6d5e", "value": "7c5cc4fec5a7238cc5fcc1edf117d4d96faa4295bd45da531ff23b0d0e0f6362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e200b3f-5cd7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639483926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483926, "uuid": "658c883e-3511-44b5-a754-9da097dbc189", "comment": "Malware payload (Loki)", "value": "3626366b2a090c146f798d6b606950f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483926, "uuid": "79c76ab2-9c86-431b-a7c1-bc907d19fdc0", "comment": "Malware payload (Loki)", "value": "7cab37fee52d4f93571fb3c06c07705c878c9582caba3333f917a3dde105373c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483926, "uuid": "626643c2-2a1e-401b-8d93-63bf42f86b65", "comment": "Malware payload (Loki)", "value": "125fb0970dc6e6b94b2dd4eb81de8ddc6bbee22f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483926, "uuid": "6018cb4a-26b2-4100-b2a4-6e4e5b7b31f8", "comment": "Malware payload (Loki)", "value": "ba3f4926b800384b5da0c14c4b6eb283d321a1ce7728527c1552bf29bf73b92fc0004e692d551d957e9759c751f181f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483926, "uuid": "68b20962-ab34-427d-b974-92a5803bd9ae", "value": "T15F25126C3E53D6CFC51A0EBA3BA5A0601275AC765607E287FCCC729F19177A83923706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483926, "uuid": "2120dd22-10df-4e7a-bbb1-76b7b158a2cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483926, "uuid": "29aed140-76e9-4d6d-bc52-238d0f3183e3", "value": "24576:C4L3OodeGARjbKCnNghYuy8nSuJIFftDX/dAhxRVInz:b3OoQGAp7uyMdJ41D6VIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639483926, "uuid": "a2fa1942-a643-4c93-9a29-0ad25cc057c9", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639483926, "uuid": "6b0623fe-e021-47d6-81e0-b2eb4ab3b0df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483926, "uuid": "fb91acd8-99f3-4331-8725-1fcc05969097", "value": "AC09475842.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344c77e7-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mercurial)", "timestamp": 1639498593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498593, "uuid": "7bb2ec5f-4eb3-4c10-9cd7-14dfdea2c080", "comment": "Malware payload (Mercurial)", "value": "a331901a04f5e4549d4d720279240610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498593, "uuid": "e2b7d3a6-0fd8-48fb-8cb8-1c44caeed89e", "comment": "Malware payload (Mercurial)", "value": "7ccf9c71166df6cabd5dfbdbbb78a3e9bda721c43dd4f882765f86e6838e3b75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498593, "uuid": "8bb44e13-d069-47e2-bf26-0dba7e35e359", "comment": "Malware payload (Mercurial)", "value": "6d260960d0c8e8447ac542c293596273b6abd17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498593, "uuid": "bb31661b-bd74-4179-85a7-9d55fccc417e", "comment": "Malware payload (Mercurial)", "value": "be833f3422e99e16f71269bf7b670b8bfd30eaecda38efcbc997fc72a6ffbbaf2b1a67ff11a9cba9ec3c2bb75e2df45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498593, "uuid": "e0770ac1-da2a-469d-b037-71df1db2462f", "value": "T1DE132949B7EC5608F3FE0BBA6DB1512846B6B466AC31DB4E1D84589D08B3B808D50FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498593, "uuid": "bdf138d1-172c-4e78-be7d-7365ef30b4b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498593, "uuid": "9640860d-f4b4-4921-a924-97167a36c40d", "value": "768:9D0qZiQOSZ2ctJuZaLOizTjFKZKfgm3Eh/OX:9Z2ctnLOizT5F7EkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498593, "uuid": "2af5b2b1-f702-4f76-a461-ed54ef21ac6f", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498593, "uuid": "351d1cd3-2338-4202-afb4-a51ae1409c35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498593, "uuid": "985e3dca-5d99-4db1-80d9-b044048b0e9f", "value": "a331901a04f5e4549d4d720279240610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e45cff-5d2b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639520210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639520210, "uuid": "2b4acba0-e5c8-45da-92ff-5108c65b6b0d", "comment": "Malware payload (AgentTesla)", "value": "903cc7f87e93da0374b0c2c30889745c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639520210, "uuid": "9407d932-111e-4c8a-ba84-9f7b8ae8be80", "comment": "Malware payload (AgentTesla)", "value": "7cefcac0ef654518dc49f439f3a2a7f0116c6c32bd6073ebaa9249784f18f4ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639520210, "uuid": "a44ff511-9385-482b-9585-6e7d44cf6886", "comment": "Malware payload (AgentTesla)", "value": "6072e11afba0c63d33aec6f43feb10da323c353e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639520210, "uuid": "ba1c2456-5730-4c49-89d2-5b4735293354", "comment": "Malware payload (AgentTesla)", "value": "2d14a4fb9949ed78bde816e9c018e957326cb714804ba6b4512e1494793915630b477d6ec660e8ac5dfce35acb741734", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639520210, "uuid": "a63f0223-fe69-46a2-b881-52a1ca09b4a3", "value": "T149A4D0734257EEDAEF3B5FF8981035804EE57C53AB3EC256EE9A01A221F6460CE50D91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639520210, "uuid": "f9754d1d-248c-435e-bc63-2804fc93ce4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639520210, "uuid": "da01e147-b87e-46ae-beaa-a3c5ed6a966a", "value": "12288:4oJqJFTPiaUHuiqXla1P4IuwtblL2YXwpZL:4oJq+RuiGoP4ml2YApZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639520210, "uuid": "aac2c19d-09e4-48e9-8ff1-53da6c0d426f", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639520210, "uuid": "702ceea4-52ca-47b6-9381-18cdbf05dbf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639520210, "uuid": "e829a400-9a13-47cf-a764-81384a4e4056", "value": "PO#84248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10593ea-5d1f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639515123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639515123, "uuid": "d77be4f0-3688-45dc-8f8c-47579112d51a", "comment": "Malware payload (Formbook)", "value": "d8c166b9e2ff6b06926f2e2c30618e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639515123, "uuid": "52a1b693-cf04-451c-aed8-fa4c973005f4", "comment": "Malware payload (Formbook)", "value": "7e482d6903d81acb4ca852e2b1d5e7a1b726660226b708210007d55a55eb7307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639515123, "uuid": "e45ef463-8443-4637-bd8e-650e11b4103a", "comment": "Malware payload (Formbook)", "value": "724b8e177bc0e6522ebb60aee1648a2be3365fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639515123, "uuid": "de2b29ca-8ae8-4c9a-82f7-1161fcb652e9", "comment": "Malware payload (Formbook)", "value": "2be0cde9c10a57bfa32506d443f88b6761e7f75c50e1168e8f8c7d1fb2c7fae8248d5b958572eb0084d3345d8bd20488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639515123, "uuid": "9e18cd80-5d94-4eb1-a87a-d32fe2bcfad3", "value": "T1CD35126E255396CEC01913B97738A03813B46C379A97E29AEDDAB1EB1D237513D23703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639515123, "uuid": "33fd0887-1927-4c18-b7b8-0fd8f4fec887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639515123, "uuid": "47148e5f-e459-4f62-971e-8f17a7b8ff8f", "value": "24576:DuzMk/WTKwEdgB6fYlhpFog+vkO5ljBh:DBR+TfYl5UvJ5pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639515123, "uuid": "c65a814e-e0b7-43d0-931e-04997013063c", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639515123, "uuid": "8c000096-ce1f-4bdc-bc65-84506de03f28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639515123, "uuid": "950820b1-fc30-4c29-92f1-5ff9605fd614", "value": "VAN89017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caaf03a-5cbc-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639472408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472408, "uuid": "1c3a07f9-035f-4344-931c-7dfd5ee10fb3", "comment": "Malware payload", "value": "1ac6d6a359c4656e865a76a29490d32c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472408, "uuid": "e759e617-2caf-4e8d-9303-cd6da1439d05", "comment": "Malware payload", "value": "80d3c10b5f169b6ba17c46b21408c5b8798352ae5246f1183c29e235a81c4a1a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472408, "uuid": "03d5a6a4-89f9-4af4-89d4-ceab84865f59", "comment": "Malware payload", "value": "d7f0d4296facc01a2e72233dbc634a3f355e5ec4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472408, "uuid": "ca585a30-0414-453a-b15d-75e0c336728c", "comment": "Malware payload", "value": "9809c6395f61f8d3fa82c8f96d2717656677abddcd35c92a98e189890243e94ac32b9756d2ae26b05a8e0a94a777f7ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472408, "uuid": "ce31e5f0-def6-4798-99d8-a6e06b01a2a3", "value": "T1F885330C21B97CECF9DE02293B7289D0C2ED32E1A441B1D676595CA55E3B1FE438E978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472408, "uuid": "4387f016-365a-4c86-829d-bca040ab84af", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYyF:IDSTOhnXSI0Wk5jG2nfBtkaeyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639472408, "uuid": "31a23306-3e4e-4aa5-906b-0882ec0e048d", "value": 1818624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639472408, "uuid": "d7060f7a-2dd2-41e7-bc3b-13554d2bca7f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472408, "uuid": "d6b4a4fd-0fab-4f2b-91a6-0e6540eb494b", "value": "80d3c10b5f169b6ba17c46b21408c5b8798352ae5246f1183c29e235a81c4a1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a1e888-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639504231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504231, "uuid": "cba862f9-89da-400f-98ba-d5b0ecf040d5", "comment": "Malware payload (Matanbuchus)", "value": "67d5dfcde8225a0cdf760d833ca44387", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504231, "uuid": "a64562b9-2924-428d-9980-9f2589759f1a", "comment": "Malware payload (Matanbuchus)", "value": "8140ac01ec377af7788eddd79d665d5000b34e7d064499b96c9d540582b28913", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504231, "uuid": "5ca3c2c2-f783-4714-ae38-bae0e01e4827", "comment": "Malware payload (Matanbuchus)", "value": "9db7b3f5c7cff58d8a06f2f4cc82d9f7339f49e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504231, "uuid": "11c78caa-8edb-4a90-b9ce-e7c94c218a67", "comment": "Malware payload (Matanbuchus)", "value": "9d84f799a52f3caaec504636c2720f6b38424f6b62b747125d5497494e19d80d734f6e81579733559fe75e5908de9860", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504231, "uuid": "067d9fa6-cc30-4ca3-8f28-5b32658d61b5", "value": "T1C4B47CB6B7DF8437D22315389C5B6F74A835FE502D289AA52BE49C4C4F393823526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504231, "uuid": "14877536-739d-4ff4-bc83-edbf6a973bb5", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504231, "uuid": "bee411ca-a01b-47ad-a719-6222fffcfac8", "value": "12288:OCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hMalfccHtMRjp132:OfcqtGWdZPuQIDHaOaRC32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504231, "uuid": "9026e8ce-938f-48ab-9b56-1bac89cd06fa", "value": 535440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504231, "uuid": "865679db-7a92-42bd-860f-044f27deead5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504231, "uuid": "61c89077-5864-40c8-9689-07026259a3dc", "value": "Yukoste3.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7477bbfe-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510297, "uuid": "93bf58e7-7e96-4fca-a9ad-9431275d6b9f", "comment": "Malware payload (RedLineStealer)", "value": "28582062b41c36a628ff18989b06277d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510297, "uuid": "0f72d0db-0f50-45da-91c2-256c569531d3", "comment": "Malware payload (RedLineStealer)", "value": "818276a0c077709569f433e5c712ae96d4424d4036dc41a9b70d39b69cdbf190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510297, "uuid": "f8c59b3f-7bcb-47a5-8674-8fe171611101", "comment": "Malware payload (RedLineStealer)", "value": "8b5f9d0df0e3d5010c9cab90c20143046d16d36a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510297, "uuid": "01cec1ca-22fb-4ed5-8f35-9de1b76ff433", "comment": "Malware payload (RedLineStealer)", "value": "d32410b62eb715530c22c7c37ee9a2606693dc921b4c07752830a9cb09c54406874eb6249c85d0e5c33f31972d06ba6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510297, "uuid": "7ef3afac-428b-4a57-a829-52cec42c7370", "value": "T12E94CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510297, "uuid": "61b6450d-2089-4585-90b8-284156ac2705", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510297, "uuid": "4f66fa06-80d0-414d-9461-73b027f7b038", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510297, "uuid": "a339f423-bba3-44ec-ab5a-1b674d9d60f4", "value": 441893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510297, "uuid": "267eabae-b4e8-4035-87f8-64583ab7e36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510297, "uuid": "bf3147e1-5b3c-4a04-990a-d2bbfc107973", "value": "28582062b41c36a628ff18989b06277d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b5cdc1-5ca9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639464180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464180, "uuid": "cb4a83e6-d52f-4185-860d-438edecf0aec", "comment": "Malware payload", "value": "f8ed43117dfb995f4b9d88f566394ba4", "object_relation": "md5", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464180, "uuid": "8ce0045b-cd1a-42ee-b003-5ea883f0c7a4", "comment": "Malware payload", "value": "81f288645cf2afaf018a7ac6363fee28888a9bfbfbfa842b904ed5b6c74cb47f", "object_relation": "sha256", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464180, "uuid": "3f43948b-3fad-4177-ab02-6103654cfe82", "comment": "Malware payload", "value": "dc7d2c3b0286b7d36a1382b6b4dca1afeb5448e2", "object_relation": "sha1", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464180, "uuid": "2a060bdd-dc4e-436b-a783-6fdef3ae4677", "comment": "Malware payload", "value": "c2ba9becf3555372fdffd800b95e330f8c0b8370cc67d7dceeb5ac822f52b5c471989e86a11f0756852a51752ac54adc", "object_relation": "sha3-384", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464180, "uuid": "9735e9c6-90c0-4f1e-93e5-b0a8c32c73c3", "value": "T1B351902FF438214BF1A0F17C4057031A06609836946EE968EF0EDA470CF696BAB973D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464180, "uuid": "a5278090-b865-4329-b099-bc21958abbe7", "value": "48:5E+tI9NByFl2MdHoWQa6MTPNHmJDZSqMFlpF3fqj1fshFkwQ53N+nB7kVq6gpUF5:e3KFl7tPNHmXS5frRvrW3InB4ngaF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464180, "uuid": "e2ad5717-78e2-4ed5-b943-6f7305154ced", "value": 3019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464180, "uuid": "b8c9c47d-3012-4b47-9688-48afcb45c55f", "value": "application/x-java-applet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464180, "uuid": "8b92de08-2ff8-425c-b8e6-79f5e36e0b57", "value": "Runner.class", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ceb72c-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639498968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498968, "uuid": "b25a7e03-e734-4857-9cbe-fa90f1ac22f1", "comment": "Malware payload (AgentTesla)", "value": "19c7d406ceda3ce0c3c5b80fca8789fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498968, "uuid": "1282a8db-8bd4-4a53-be39-e8988bf86a80", "comment": "Malware payload (AgentTesla)", "value": "8204419239c93019d42b550cd7d46159d54cb1e89ee84055c90b71688a6a5fc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498968, "uuid": "cd203bf1-e92f-4bcf-985f-73f18a908bc3", "comment": "Malware payload (AgentTesla)", "value": "a491da99c7211859b74053d275338ba19a84681b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498968, "uuid": "905b63dc-b100-424c-9226-4382c432152b", "comment": "Malware payload (AgentTesla)", "value": "9f69aaff3241c936ce238120389e014cc6e33c7211f928964ccad0d3322614e9ee0e27097d98e40bc7cc5e2f9f12b2f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498968, "uuid": "b57ac63f-7092-463f-ac75-2dac0f1bffa8", "value": "T1F46512BD2A835ECFC42542F93735907853B5AD76A943E3A2E895B2C729337943933213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498968, "uuid": "89b828fe-fce5-4ded-aa33-7384bae5df4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498968, "uuid": "ba2ac69b-16d7-46cb-98e3-4aa9a8404b1b", "value": "24576:7TfVPYmE/sUvUcDUDTb+gI502B9nFvP1oPV7oebBh86QxbSNP9IkdFNAnGG:/VP+/TUac2gI502nFvP1oPFBhtfxSAAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498968, "uuid": "c0395a52-6f84-4496-a8c2-21fb3ac28a27", "value": 1426432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498968, "uuid": "fa2bc971-0193-4a01-98e8-c3dd5ef452da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498968, "uuid": "0f65e0ea-8cb7-40be-84c4-95d92a21124f", "value": "19c7d406ceda3ce0c3c5b80fca8789fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6abe8e-5d25-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639517718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517718, "uuid": "82cd55d2-ce62-4181-b0ae-acfc6bb6d651", "comment": "Malware payload", "value": "5d91f693ae62123730e9b2df722f0653", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517718, "uuid": "7b61e8ac-0f1b-4bb4-943b-7682ee4fa5dd", "comment": "Malware payload", "value": "82401c527367babbab2dd52ae4e93b3d3085264a20c58a40c6d5ebfae4ff7a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517718, "uuid": "285c8a6c-d7c0-4224-a562-fca10a5a0ac7", "comment": "Malware payload", "value": "7ddefc546f90fb64b847b48f325b3a837bf44708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517718, "uuid": "1d72ce0e-70e9-4db6-8b1c-82eff999adc9", "comment": "Malware payload", "value": "cf08318bfa5baa03ee66c967f345596799182692d193ea97f50bc86d8c0333f60d68d645d290f0a7873f90f0176b089b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517718, "uuid": "45dd764b-3d08-42af-8134-c513468fdb1f", "value": "T1A8C49E8273634102EE82FDBF1D13746F4399369DF950F8A2F58E6A6A303E2B53165643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517718, "uuid": "47a897a8-16b5-4e45-9faa-ea56bc4a20f6", "value": "c9628a85525bfe945f5e36dd40536a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517718, "uuid": "88413e12-c209-4244-bd09-b68a10f19c08", "value": "6144:fDwhfXAyRXuYDXCmFXayrX4S7XKyfXEyRtUWxXwEhXE65XcyjXuq5XqyHXoQ5Xma:sF8uFvRiX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639517718, "uuid": "197162f8-da28-4d58-a4e1-4d904b53c506", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639517718, "uuid": "db50c679-bb28-4835-920f-b0b9ed02d8f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517718, "uuid": "6d2877de-2d78-4952-bd7b-ee4cad56e102", "value": "5d91f693ae62123730e9b2df722f0653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23ad826-5ceb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639492872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492872, "uuid": "2f20a335-00bc-40fd-b928-d88d5c8bf796", "comment": "Malware payload (RedLineStealer)", "value": "26ce4d4f375d8a6372aee2cca57f3243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492872, "uuid": "5bf2bc75-5ac6-44aa-843c-1c1f93051059", "comment": "Malware payload (RedLineStealer)", "value": "827fc88153dea50ea4a064dc00f4f509299a1a036590c19e2ac63aa7e39930e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492872, "uuid": "2b936008-5488-4b5a-bb03-c17601bd50dc", "comment": "Malware payload (RedLineStealer)", "value": "cf42c6392c985cf9ee875dcd4b618705939560f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492872, "uuid": "8ce13c5b-2e59-487d-abf8-5fccebbbc901", "comment": "Malware payload (RedLineStealer)", "value": "10cbe2a73304b519cb27dc529c2e5027ad2f878334c23c921930f8f5f3fd5b39ffffc7a2ca72ec2d22f9ee9a7b03a923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492872, "uuid": "e57c2882-c68a-41c7-b1dd-ade11c857074", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492872, "uuid": "a68a0a30-96e3-4159-aca3-23ed9c393f47", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492872, "uuid": "1547b874-424c-48be-a561-bb0df9239266", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639492872, "uuid": "2fa44dde-7cab-4b0b-8f78-b96407b84902", "value": 442416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639492872, "uuid": "2bf735d2-f0eb-4028-862e-464772959d01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492872, "uuid": "2f0e0a65-fd7a-43de-8ed8-c3b4307a00bc", "value": "26ce4d4f375d8a6372aee2cca57f3243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9298a2-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639495874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495874, "uuid": "b2672c5f-a746-42d9-a0e4-00752fb5e4be", "comment": "Malware payload (RedLineStealer)", "value": "2b0381e8404e1284dee6ee9677993550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495874, "uuid": "d926eda1-b9ce-4519-846e-f57d0e52e507", "comment": "Malware payload (RedLineStealer)", "value": "82affa5917fb6d52bf01cc15d04f3493aaf8dca21f70c260c99d07f50dee4984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495874, "uuid": "70cbceca-c0b5-44ff-97ab-eb0d5c83b521", "comment": "Malware payload (RedLineStealer)", "value": "e32430899886f39ee2677f55a1fc4af5a5c94e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495874, "uuid": "8b947d5a-498e-4d20-b7a9-2e2596b38ac0", "comment": "Malware payload (RedLineStealer)", "value": "d40485ddb250aee872ed0992c0457700e971a481a02d3adbb3f4f68a69ce0afeacc4450561a13e22b6b5445d8faff77f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495874, "uuid": "363bbf0b-21c6-49e1-9bbb-4f19b880da6b", "value": "T1FC64E00236E0CC71C9E20A764430CEA55D7FF951B964958F7AA42BEF6FB27905A32313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495874, "uuid": "6ab0a299-d137-496e-b268-c7ebb2cb2506", "value": "ce74c352c7a68a20cfb87163e6a8e0ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495874, "uuid": "03a5a3fb-b760-4d22-be5b-8adcd29f8cf4", "value": "6144:K9uef8Nc25VLOxHp1yRtmSZTaO9AZ4MkRdOktdhdY:wHt2PLqp1yHmSYqAJkptzdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495874, "uuid": "3fdb53c2-6410-4993-96d5-7dee08f3ba93", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495874, "uuid": "17571ce8-7e62-46b3-a519-08470c645deb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495874, "uuid": "91173d09-c795-4ca2-a023-68f9f64d9842", "value": "2b0381e8404e1284dee6ee9677993550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760527e8-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510300, "uuid": "363abba9-8897-469b-8270-db0ed90ce65f", "comment": "Malware payload (RedLineStealer)", "value": "d51b5f60de136ad420cfb62608f74a33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510300, "uuid": "28e5d3cb-d8f4-47b1-851b-907d381d6ee6", "comment": "Malware payload (RedLineStealer)", "value": "8327d1caeea5e9cb1350fb80541fbf8fcff6f88d0704c57c7541a028ab91a92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510300, "uuid": "3de88dd7-de55-4d1d-8e34-3bec404e4cf8", "comment": "Malware payload (RedLineStealer)", "value": "26fece8447f9c4a7b4ba8668dda0394df39f89ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510300, "uuid": "5f23e74d-7eae-42be-8ad5-ad309a33b0a1", "comment": "Malware payload (RedLineStealer)", "value": "f197137564634b462a2ca3187206e5664e0d5a63a48f23262e3bb3959073619ae9b6704b0590372dec2d8429bace8040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510300, "uuid": "ee83e926-399a-4148-850f-09f018fe227b", "value": "T14994CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510300, "uuid": "3f7aa291-4ad9-4967-8156-0509c2d2c990", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510300, "uuid": "c23e477f-514d-4a07-9164-2af80883a880", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510300, "uuid": "a39d4437-1bc1-40fd-8200-1d22f1efc379", "value": 441934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510300, "uuid": "2ba8f3e2-eab5-4133-9372-fc072a38c738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510300, "uuid": "e89d4c10-96d3-4635-a4a1-774413b2da75", "value": "d51b5f60de136ad420cfb62608f74a33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8bc9ad-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639498364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498364, "uuid": "12aa1fda-011d-44d1-8443-2810d1310bee", "comment": "Malware payload (Gafgyt)", "value": "bcb5e44fc35cfff83980efb88edbe3f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498364, "uuid": "955179a4-acb1-42a2-90b6-c7aabe0a7511", "comment": "Malware payload (Gafgyt)", "value": "842808dcba808e4c6f9d499065f0a72c524182f9a0511220e7d1bcedc3cdb003", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498364, "uuid": "f7bd59c1-57bf-45b0-b121-501d59a0dd40", "comment": "Malware payload (Gafgyt)", "value": "ca4337fd27aa0a65db17fad55474806ab6c8a5d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498364, "uuid": "6efc5a10-fb7a-44bd-aed3-5bd603331b1b", "comment": "Malware payload (Gafgyt)", "value": "a473d88bfaa433dbbe956c36d0d1d4975a6fd55870be2ad1efbd0d4be930d78666ff04308c38a32551410fa82cbe1c0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498364, "uuid": "ab9e6502-1983-46ed-81b4-d8400471514c", "value": "T123E34905D7408B57C1E2277AF6CB424933339B54A7EB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498364, "uuid": "30c91fc6-a1bd-498b-886c-3e920e613e42", "value": "3072:/e63VDzi+Xl6B7pafmkXjQ77TEH/WrLfEEdCmLwfCDQSAW:263VDG+IB7pajTQ77TEH/WrLMEcmLwfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498364, "uuid": "64bef851-d2aa-4cca-b310-e96642bfbc0e", "value": 149994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498364, "uuid": "dcddd3a8-a85e-4172-9f28-1ad4d87c042d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498364, "uuid": "13afd428-bc6b-4ca6-87a5-f45ff86afd5f", "value": "bcb5e44fc35cfff83980efb88edbe3f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faacb781-5d05-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504080, "uuid": "83067c45-2bf2-4f34-a55b-7c729a450206", "comment": "Malware payload (Mirai)", "value": "8d3727ae00f2a0b6be761655af2ff151", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504080, "uuid": "b8fc9d7d-c196-4ddd-8e1a-0b113b8f4fdc", "comment": "Malware payload (Mirai)", "value": "84c6bf0f2bd22fecaf373432d7bd6073139036649b1e4c10a66efaefe6aa3764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504080, "uuid": "07588478-871a-4560-94cf-8b61da5e1900", "comment": "Malware payload (Mirai)", "value": "a00a9d766c79ca12183e92799d5d3a6d869e81cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504080, "uuid": "bdb6784b-eee3-40d3-a418-48a6d6057d67", "comment": "Malware payload (Mirai)", "value": "1bec3fdede5b85597c5665a5864d2582e37c010793ba5555135a3d48406cf3126823e048b718f80925ccb4e07a2350da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504080, "uuid": "5ee8b681-d18e-4acc-bef9-3327fde20268", "value": "T1F6B2D0717011B8B7C7A500B79AEDCA83BB801EF8D0E873291469099DEAD5943BAF1107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504080, "uuid": "c19d8839-b1da-45ca-b1c1-168856d3b323", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pQvhymdGUop5h4:QX9nxn8o9wnBoWzEQf2EjKb3pMs3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504080, "uuid": "e81d1b4a-6e37-4444-b688-af6687fa62b7", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504080, "uuid": "f1678364-cdc8-464c-a652-0fc52ec30cdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504080, "uuid": "504e9169-e370-408f-8914-4017d6768fbd", "value": "8d3727ae00f2a0b6be761655af2ff151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bfffba-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639466190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466190, "uuid": "717e7ba3-fd02-4b7d-bd38-46a0f7bdb688", "comment": "Malware payload", "value": "fce4e9bf1b79c9344f0156e80876962f", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466190, "uuid": "f57e47ee-1e66-4af2-b130-87f6ff09d16c", "comment": "Malware payload", "value": "8587e22ee5ba8c7b55be29e8d3494afa049a2aaacb583a2c66f807090edf8bc3", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466190, "uuid": "d5e4a47e-92e3-4666-b1fe-90f7dfec1ee8", "comment": "Malware payload", "value": "03b539ff0d6e69b1768b38fb9bf881f560470d51", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466190, "uuid": "8547a499-ce63-4687-9e91-6340e1ba4d6c", "comment": "Malware payload", "value": "b25eb104bb3af10fafc0aa31cabdffa98de427b92b03209243e344612da82f7a7cc573f88b5d2f3830060654cf0e0276", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466190, "uuid": "36584b2b-aa6e-47b7-9724-9c1c3957ff6b", "value": "T1AE15AE56BEC6AEA2EF7F51B7C360AA3D1116736D03A09ACF760305993915FD2503EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466190, "uuid": "7ef77bda-0aea-48be-b5a3-56ae0deddade", "value": "8c8bba54a9dc287053536e212411cdac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466190, "uuid": "a3e40255-5057-4f0d-9085-bcb9c000adc5", "value": "12288:1HB8k2IlwP0iruRPlOF8bzbBSrefNlKVWf9WKpArABa/O+2WKKB0syam:/8mO2X1lsgYKGqadICx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466190, "uuid": "c3cdc79a-35f5-4ac1-a7cc-d7639f40c6a9", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466190, "uuid": "d7c8f3c7-4b7b-4c2d-8d17-a83aef4e313c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466190, "uuid": "0108abbd-66e0-4bef-b5a6-09e99b2f25bd", "value": "PO#201805131.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8e149b-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497885, "uuid": "ef963137-aa4e-4b6f-9426-31358b836f35", "comment": "Malware payload", "value": "3df4824d28492d8d552edd1b323a4c55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497885, "uuid": "db0e4445-2855-4ea1-88f2-0885e79279fd", "comment": "Malware payload", "value": "858c0aade3215846f216aa90cde6f4d770e477063956560dd302d372af804792", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497885, "uuid": "030e3934-5bc0-4203-b029-a80061e5c695", "comment": "Malware payload", "value": "cfb00ddac7c5ebb7a2425d0d99878f3bd68c3672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497885, "uuid": "66f20308-166c-403c-87fa-478957e41b60", "comment": "Malware payload", "value": "1c66109730af0fff9e58825274ba228968e860901572e34048f5a670e4310e306e6538e1c21d9107ac75a93e44c993cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497885, "uuid": "66c819f8-133b-4227-8ad2-e31b3a5f888b", "value": "T1A2E34A05D7408B57C1E2277AF7CB424A33339B54A7EB33059A28ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497885, "uuid": "2f153b22-2a84-41e5-b513-612d39c94531", "value": "3072:De63VDzi+Xl6B7pafmkXjQ7XFsM/9RfEEdCmLwfCDQSAW:S63VDG+IB7pajTQ7XuM/9RMEcmLwfCE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497885, "uuid": "64648bfe-fe4e-4bc7-889a-6c8026d4ec27", "value": 149966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497885, "uuid": "8b1911c4-15c1-4cb1-8bb0-a1eb8c0b9478", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497885, "uuid": "0b76b217-9e49-4953-a8d7-754b530c4824", "value": "3df4824d28492d8d552edd1b323a4c55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879c7f48-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497444, "uuid": "0a7b99d4-7550-435c-bc59-853f0d1d0796", "comment": "Malware payload (Formbook)", "value": "68b47ef4e368559e41f4a53cc63388c3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497444, "uuid": "6c837afe-6f13-4b4b-8dcb-aa2f04430187", "comment": "Malware payload (Formbook)", "value": "86438e192b00bdb942ee5459eec9f7fc663230ce79351d60c55a5b55bf89d1c3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497444, "uuid": "767aadc3-f38c-4f10-818f-9dbde0e5ae6f", "comment": "Malware payload (Formbook)", "value": "25e2648c572ffa16bef9431deddbb312a5a4210a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497444, "uuid": "7b4a1176-b304-4931-9da0-f41e927452f5", "comment": "Malware payload (Formbook)", "value": "f13f1702a02086cbed53762795b95446ff3c3b3fe93d2813b1bb4d83283092c217302f1e2e8236189a0d976fa1fc4780", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497444, "uuid": "6939ffd7-196d-4505-80da-eb9d2c1da7ce", "value": "T126641225780E550BC95DCF3C82DA9580A6CDDE1B9E23A5CD3BBAB7828C7C391B046357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497444, "uuid": "d33f8ed3-c0cd-47e1-b5ed-6311e820a390", "value": "6144:o5m9X3/9s9Ul9zWaCD3UAAwR3HgPLxojTe7uZ5jbDCFXZ24tMZFy:Um91sC/CD33AwlgPLxojTe7uZ5/Dgo4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497444, "uuid": "1f8fa1ff-81d3-45bd-8930-e14609beffb5", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497444, "uuid": "bea25a3c-6608-4a39-84fe-94e377feb5b9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497444, "uuid": "a3e59f9c-1e77-4d5b-9c31-c7da34e60960", "value": "10008.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d25c91c-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639497910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497910, "uuid": "2e4f485c-12a3-4299-bd34-c9ae25256750", "comment": "Malware payload (Mirai)", "value": "f6dfc07c8622af20a4e8b1d22196829d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497910, "uuid": "5ddf95fa-95f4-4002-bddf-da622d51f571", "comment": "Malware payload (Mirai)", "value": "86f99d0ed804984f4a21e5c0698a92e39fed98e6fe2e30f25419d7a5ac5e2cf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497910, "uuid": "b01fbc06-5598-42b5-b578-1c306a784b38", "comment": "Malware payload (Mirai)", "value": "b9c7597b2cd79485f76bc42e2601b93e8173d234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497910, "uuid": "0aecfabd-d21a-41b2-bfe1-86902199f607", "comment": "Malware payload (Mirai)", "value": "62f9db8708cc9f15675fcf0397fb1b279e73795faf3af96937cea3f81058661636270d4b1a47d164cff56059693c421f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497910, "uuid": "feba0acb-34b8-4e7f-9897-7e763f7c722d", "value": "T1BB13F1B0220AAF73DA640B3F823259841E545DBFD27A30A4146A1D4DD75FA1F3D6F642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497910, "uuid": "bb2176f4-e4ca-4163-bc7e-aebc3d484a88", "value": "768:MGHhD9hoIzYJpbhMKdEMWBWNUBUfsW3Q80pJAWs3UozhJ8sJv0IEr:MGBD9ZzYJREMWI0U73VuJKzEFIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497910, "uuid": "85daed74-c8e2-4595-8e55-f75702da3059", "value": 43980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497910, "uuid": "03ea1e83-cbac-4ecf-ba57-118acc15d3e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497910, "uuid": "acb62495-8d36-453e-a675-0d4dbd9ae093", "value": "f6dfc07c8622af20a4e8b1d22196829d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2bca45-5ce7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639490854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490854, "uuid": "6f69cd9e-b7c0-4a8b-a835-9fb53717a108", "comment": "Malware payload", "value": "a4fd4834ed65c7dfc6d02d2063c38e5b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490854, "uuid": "b753ce39-63fd-46e1-bc6f-1f335a2aa4eb", "comment": "Malware payload", "value": "87239e0105dfe7ba34c10894a9168c3470807c3fca9d909b998dd4ba07912bb0", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490854, "uuid": "daa4db57-d60c-42d2-b939-49b3f4366d8a", "comment": "Malware payload", "value": "3dbad08b542979d33c296174f5f083d2a04c5604", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490854, "uuid": "324d3714-c7c2-401c-b0bd-ff93fbf9d87c", "comment": "Malware payload", "value": "a3bc6dbc09f9950bcb71629009601f23b77b9829893762ff3c6077bd49ed4bf590994230db2c88757320961a7d187cfb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490854, "uuid": "8ec3e236-d9fc-4d72-82bb-0f9c1a982725", "value": "T18033F852BA56C94AE952173A4CE2C7EA7337FC50AF6747073244B32E1EB5290CA13747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490854, "uuid": "6ea978bd-b9f5-420a-a0a9-f6b48faf1cc8", "value": "1536:ksQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0ss4aXgJwm3abSz:khlYkEIuPm3fNRZmbaoFhZhR0cixIHmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639490854, "uuid": "b8979bdc-a18a-44b4-80bc-06a4d5b4332e", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639490854, "uuid": "205fb601-2039-4a59-bcfe-5dcade4f80ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490854, "uuid": "4769f506-94d4-484c-97bd-c0f2e98af483", "value": "XSG0611136.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b93f0b5-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465024, "uuid": "c9c1ffaa-42f7-4c59-94f6-1d14fe5abde4", "comment": "Malware payload (Matanbuchus)", "value": "dc60ccb608bca6342488cdfcb4944dd3", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465024, "uuid": "12958bf4-8965-4d58-8732-877fc85b6eeb", "comment": "Malware payload (Matanbuchus)", "value": "87c520074c92b94dc030d675a14ef5a8f06479a48ba460cc099a51ffeaf3916b", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465024, "uuid": "47d5c061-ea1d-41b6-9b37-470525842c43", "comment": "Malware payload (Matanbuchus)", "value": "58e59b2f988acead09da12a22c7ee6c49ac585cf", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465024, "uuid": "229eadbe-8bc9-498c-924a-7d3aa1378a3e", "comment": "Malware payload (Matanbuchus)", "value": "6006e116bc3a57c4fdabc51b0edcac1d30e3fad819fb6a309e77685d6bb44aa3116db2384633039ba551ea0c11213ee2", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465024, "uuid": "0fa67353-38ec-4771-93c2-f8ff9a5fb6ee", "value": "T18EB48DB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465024, "uuid": "3badfc6e-dc5d-4f68-9262-7833ad095311", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465024, "uuid": "303ab6df-ac2e-4fd5-bfce-9a298954ae11", "value": "12288:aCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp135:afcqtGWdZPuQIDHaxarC35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465024, "uuid": "91f173e0-14e4-402c-bf8c-11894d0e925f", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465024, "uuid": "d7be38d9-3a09-4b95-875c-b3fb9de9d372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465024, "uuid": "6dd488ef-a30c-44b7-a132-e2e204707b72", "value": "87c520074c92b94dc030d675a14ef5a8f06479a48ba460cc099a51ffeaf3916b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93bd310-5ce5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639490334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490334, "uuid": "5cd99a17-4514-42a1-b804-85950eeb9581", "comment": "Malware payload (AgentTesla)", "value": "0e786cd4982192d39789314206afd08c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490334, "uuid": "6432aa73-781e-497b-8e05-80a78f71e92f", "comment": "Malware payload (AgentTesla)", "value": "8881bae26f02b7469f8a57282f217671d8c66e98af135e3055de2d39418feeec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490334, "uuid": "9408bbdb-61bc-44b3-8d14-bcd0474e6857", "comment": "Malware payload (AgentTesla)", "value": "e8f5eef588f74986b6b8c1078a8e6c34bb49cb0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490334, "uuid": "93b83d80-8752-46c2-818c-80527bc85d60", "comment": "Malware payload (AgentTesla)", "value": "278cc51da2fc1a71d3c40bda364fbb9cdcff058c0d366a54ad87d0637108cce0cd4142f4c63838b64b475c33b65862ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490334, "uuid": "f737281c-963a-4be5-916c-110f5338140d", "value": "T1D0E401A3E2855DE2FD64037080778C6E6963BEBABC71E06D155EF53527B32C3102AD1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490334, "uuid": "d6a187cf-f4ab-4e36-809c-4f5b3a17bda1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490334, "uuid": "5ce3e081-e9a8-47a6-8345-5dfe51d01b08", "value": "6144:QGiihQLA9BvrFsbmUkncnQdGNTb0aNevgtIEFfWAbrNVFQkHGXXfDK2D5rfS8cya:4ADFsbXNigqKbrNVFQmGn3xS8cBLBjK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639490334, "uuid": "160e783e-9376-4586-a48b-f7dff4a49417", "value": 712394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639490334, "uuid": "0d36d955-5392-4d48-8875-5c814b769349", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490334, "uuid": "bea144db-a984-420b-9544-00bddf855b98", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0999beb1-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500239, "uuid": "387f4388-8e26-4412-aa15-72824357b9da", "comment": "Malware payload (Formbook)", "value": "1f683c725e1326af4ba6b15cb99dc05b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500239, "uuid": "fb7fe453-7ea3-479c-9bc5-3f89ac040675", "comment": "Malware payload (Formbook)", "value": "8a9e1d5a74f9b83b90dc64bb6a21fa8837f8ae355627c78698a6e077d6c7d284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500239, "uuid": "547df129-9de8-427b-abcb-1f24fd4379ce", "comment": "Malware payload (Formbook)", "value": "3b387d93e2f75b4aed1d8fc3a00ce5bb2fc76f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500239, "uuid": "4be7421f-50e2-436c-b5d4-6866934102e3", "comment": "Malware payload (Formbook)", "value": "1ca61b2179ae9488b836f1bedc69fab662672354f128e458e74b7cf76070a46d0d7dcf3d71203861bc5665e5203868d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500239, "uuid": "73ff50fa-f27f-40af-a001-b12488714867", "value": "T17D056C1136981B68F0FC8B759560480823F3BC17EB61FA4F7DA53DEE367AE834652612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500239, "uuid": "f0231f61-6f93-4bf6-ba3b-efac4dff5181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500239, "uuid": "759cf13d-b010-4ded-a14d-f0e7922bb787", "value": "12288:WYC7JAYHyxHykq0Ih/pv3Dy+/tSG6XqQUA2G0QNZhK:QAMirsRfDyMZN22GlNZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500239, "uuid": "a72c8f5d-cd28-45df-a049-fcbbdf50a79f", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500239, "uuid": "cd188f7f-fa66-464c-af7b-f2b9d8c60293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500239, "uuid": "558cca21-1776-4e65-9595-b85e33926e4a", "value": "1f683c725e1326af4ba6b15cb99dc05b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ad2809-5d0b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639506457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506457, "uuid": "1a688d17-6a87-412f-a22f-35619203b9c4", "comment": "Malware payload", "value": "fca8fd6f6a7a4b9f04f82e4c84228cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506457, "uuid": "70ae2f70-6664-4cde-91c5-0d8600bba90d", "comment": "Malware payload", "value": "8aded772f5733ae6cd66163868e0fc5dac4e3fe4cca89b3e539149615beaa1b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506457, "uuid": "d7570497-2383-4fe0-8dde-f6ef9258efa8", "comment": "Malware payload", "value": "5485a04de9011def69829c2c1b5033cfff3a1372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506457, "uuid": "b3f17d32-6c81-4e02-b402-b4b147e64480", "comment": "Malware payload", "value": "2b4a2f34d31355e30c06ae3db273a818e1e0cdc3d046488e5d89eec19c9c065387398a796574d2360788810342f412d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506457, "uuid": "baba367c-b54f-4e26-bef8-b0f90b4088fb", "value": "T17F350264923CAF31D97F1BFA54B0221B43FAA5033AA6E7795CC4A1C51E67780CF059A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506457, "uuid": "d317de39-9552-48ec-8257-ff8fc60eb27b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506457, "uuid": "f1f14943-08c8-40c1-8591-401bd72e4ad7", "value": "24576:XYRZSwVuLfI7XiiLXBihbAedy+mh0qfR/K6t5RUZp94RCASCTykM7wlNFcb:C9VuLoi0IVAekBhjfR1zuJuSCTPM7wlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639506457, "uuid": "48f74a44-1dfd-4f31-8026-dc239cb72692", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639506457, "uuid": "0423cdd6-ff90-4553-92ca-40b0f5a68898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506457, "uuid": "1bd2cc20-51ab-4bce-a4fc-7943f99d7034", "value": "SOF43581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfd8578-5ca9-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639464355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464355, "uuid": "f0e92e9b-b33a-4535-86a9-7d86460a4007", "comment": "Malware payload (ArkeiStealer)", "value": "4c3028e79a06aafd0f906185b62d3069", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464355, "uuid": "99f8bed8-3226-4e36-b587-a3f041730f1c", "comment": "Malware payload (ArkeiStealer)", "value": "8b8495184c930532a3f2ae9d85e75b4f58d5dc866a72b61462d4aea778d5891b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464355, "uuid": "912c4b2e-6043-4580-9b11-fe1031b1ccd0", "comment": "Malware payload (ArkeiStealer)", "value": "159efff08981eb4c8f05b9e0eac59d6fe6ca375c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464355, "uuid": "551735b5-2490-44eb-aa43-57a4607481c3", "comment": "Malware payload (ArkeiStealer)", "value": "a5d350b2aa79577cbef0342a2578b7cedec4c84ace788df9fd65e051ad61f7ad383e02f6c8ff447e21d1f8ca08f755c3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464355, "uuid": "11c602c4-ddf7-4185-b5fd-73a8ceb96968", "value": "T19EF4F110B7A0D031F1B356F54A7D93BAA53F79A2672490CFA2C163EA16356E0ED7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464355, "uuid": "8d6d21dd-a535-4589-abf0-1573010c5b47", "value": "fa0d97a230fe11fa07527833b096cd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464355, "uuid": "b6430176-781b-4916-993c-6ca6a39ef4c9", "value": "12288:oPVdH4alo1eIcPqFDD4OJkJmx9bfIY7DHl33TQwsWftDCHs0yAEqGBP20L6Ko7EV:UVdvo1RVD4Obx9zIY7DHCwsW0Hs0KXw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464355, "uuid": "230cdafb-72fd-4080-a4cf-8f248252181a", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464355, "uuid": "3db3a05a-eb0b-4dba-bdc7-e66b9097fb11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464355, "uuid": "e86e0230-183e-4b6b-8e91-03ea09c28aa4", "value": "4c3028e79a06aafd0f906185b62d3069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e05b330-5cb6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639469860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469860, "uuid": "32ac32c7-40c4-4315-aae3-42fa581ecdd3", "comment": "Malware payload (RemcosRAT)", "value": "12e6d1cc50d787ef911ca5c965453265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469860, "uuid": "1051b3d5-5c06-4d0b-a96e-523328c1bdb6", "comment": "Malware payload (RemcosRAT)", "value": "8b94dbe71305cc3e5a3963757e03e6344402b9f7babb373df3d80a90e0e4d1e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469860, "uuid": "79eb1022-dc33-42ad-89bf-d71c61353133", "comment": "Malware payload (RemcosRAT)", "value": "b599570425ff3e5c05250276803bd368b84b892e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469860, "uuid": "0a66d8af-25fc-495a-aa47-6a9dcf594374", "comment": "Malware payload (RemcosRAT)", "value": "685522583e57b6a60192da72e3387ee4c71c2131f69f15db8455b1dbd2f825aba85b31bd52f2c3b4af577357db074694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469860, "uuid": "c73afd5c-e01d-4499-be5b-9fccfc6c5103", "value": "T1C9158D5673D18CB7D1731E799C4A62A450267F822F98EECA27F42D4D0F39282793E187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469860, "uuid": "ff80704c-0a62-4088-ae36-3af202c3c540", "value": "9c69268b6f14ca3ec5cd67dcb7183a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469860, "uuid": "434936d3-810e-4a6b-a753-fe43514cb7f0", "value": "12288:LhymoPN6r5uCCboxjcSJax4PjDXx3odAxbjuZgiNvAZUcpF9M:NRoErhCboxASJ04d42xyXvA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639469860, "uuid": "dbd77f77-98cf-432f-a813-c7269222a92e", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639469860, "uuid": "ba1d30c9-61c8-4975-a12a-562d126f1541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469860, "uuid": "d605dc24-5577-4c23-8975-d593c3e5819c", "value": "\u00d6DEME BELGESi #0224684 #, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaab535-5cb9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639471334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471334, "uuid": "d3964bd5-9ba0-4c6a-b229-897cff8de0fb", "comment": "Malware payload (Amadey)", "value": "ab0ce9ee7a653500e1b140d5c0bfeae1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471334, "uuid": "f61e8149-ba0b-4fe3-bcad-2502fba8b60b", "comment": "Malware payload (Amadey)", "value": "8d6472d63a35e30db3dec108b237b5b3a3de728f376e9ae13aa261db1643ea52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471334, "uuid": "eca4c5fe-38a2-4eec-b13e-2024cb226f6e", "comment": "Malware payload (Amadey)", "value": "13a92d0bba213ab20b240d62719a3037b9433fe0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471334, "uuid": "cc061dda-9a16-470c-8dd2-b33d3a83fd2c", "comment": "Malware payload (Amadey)", "value": "b15f4baec529dc722d83586b41932379e58f9cdc017bd0f5119279deb4b6f8ad7086b4ebf32b01619fcb7cdd43d5e918", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471334, "uuid": "53e8efa9-b7b5-4174-86a7-75e8b5305497", "value": "T1412418653916C031D96065B619F4BFF6C19DAD15ABB049EF2B800F77C6222F37920E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471334, "uuid": "66070b95-3aab-4e2d-bed3-0e327568af0a", "value": "6b56eb425bb7dbd4f686b84bebc7ef49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471334, "uuid": "5146ad1f-fa86-4112-93a8-8299e473dda1", "value": "6144:jh/x1C6b9RoW+qljeHMtMcOy2zW+utMtNf/+:dzY1qlSsChy2W+utMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639471334, "uuid": "7e6a5ecc-af20-4f3b-b388-fcdc8c4bb5f4", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639471334, "uuid": "bda32d01-97f7-4d4a-a581-b5c6286c614c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471334, "uuid": "2dbed75c-6dbc-4f7a-a377-0790adc97bfc", "value": "ab0ce9ee7a653500e1b140d5c0bfeae1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b53bb1-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639467269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467269, "uuid": "a795fc56-19ee-4586-b072-0edfae31e8ed", "comment": "Malware payload", "value": "785113eef172becff478623c7836add5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467269, "uuid": "0ad1a0da-15ca-4d6f-bb43-8bed9b9037fa", "comment": "Malware payload", "value": "8da45fb977016d8b0d716c819a1fe8f8249eb7bf51c55e0648ad54f2e090102f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467269, "uuid": "949ebf3c-6456-4a3f-a909-9c3ba1a6cb34", "comment": "Malware payload", "value": "0d5020a8176a1130007f26fe12e7a30660b6a7e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467269, "uuid": "e39ba78c-cb73-4e12-b7a0-9afcf475e09d", "comment": "Malware payload", "value": "96e2a4dfae920060cedce7ad755bf706a2eb102c12480da1fbac95de3353787690e75955d96187fb292a50870769347e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467269, "uuid": "ae74febb-2892-4cbc-9864-be5d480cab07", "value": "T141B5330C437ABCFDF94D46292B634ED4C6F9A1E1F54260A2D27409A85D3F1BD039FA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467269, "uuid": "8896ebd1-f4cf-4e04-bbfb-ab4dc13b53ce", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58M:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467269, "uuid": "0a75f0e1-05fa-4ea9-803a-3bf02de52de5", "value": 2478080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467269, "uuid": "02848dee-4c49-4cd8-8691-12073d55b789", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467269, "uuid": "23feeb5c-8a94-456e-8482-cf9069e4d09f", "value": "8da45fb977016d8b0d716c819a1fe8f8249eb7bf51c55e0648ad54f2e090102f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1374ced0-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465467, "uuid": "c7389c8d-6479-422a-91d3-286cc598a5c0", "comment": "Malware payload (Matanbuchus)", "value": "d1f793800415a201822a8dc7597a96d7", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465467, "uuid": "3504480c-efcc-45f5-847a-488ccae858bd", "comment": "Malware payload (Matanbuchus)", "value": "8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465467, "uuid": "dabaee87-ed3d-4428-a8e9-54da475a81d9", "comment": "Malware payload (Matanbuchus)", "value": "f6fb94b9d316d57f088d48892c3815345104aefc", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465467, "uuid": "f56eceb2-ee54-4bd0-ae60-fe31be77c82c", "comment": "Malware payload (Matanbuchus)", "value": "acb433add6060c893c860a3f8fb2e8be6415b44c520a511a5b900dd0ba696a3fa8305cc6bae2187d08dd5cc0800b89c6", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465467, "uuid": "42edf0c3-9bb3-4652-ba28-1fe4fba59ce5", "value": "T1ACB48DB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465467, "uuid": "0076b9ee-0d5f-4267-a0d8-a247ead2f84a", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465467, "uuid": "0310a7da-9885-4870-a371-4de49c455324", "value": "12288:UCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp13z:UfcqtGWdZPuQIDHaxarC3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465467, "uuid": "4aa84bc7-be51-4e33-abc5-0079968e74f7", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465467, "uuid": "232e4e29-db29-4966-9414-1abe6febb5b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465467, "uuid": "71c917b9-98c3-47f3-87a8-6ea87cd0bf47", "value": "8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a8adcd-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639465918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465918, "uuid": "63a7e62a-6ad9-4eb5-b929-90ed35bf4c4f", "comment": "Malware payload (SnakeKeylogger)", "value": "9f4a7a5651b4ba04219beac38216937c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465918, "uuid": "efabee9b-19d6-453b-84a3-a7df434944ff", "comment": "Malware payload (SnakeKeylogger)", "value": "8e61f4e2f4a6922b8bd404b6d467a2e3cdf1c2191033a0379c06bc802b4cd585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465918, "uuid": "d5e7a79d-1b99-447a-9ebc-d8f8f854973c", "comment": "Malware payload (SnakeKeylogger)", "value": "6a435a48acee4be2db97d4300de1687515a8ccdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465918, "uuid": "26c10320-3e7e-4023-bd66-872b8dd129ad", "comment": "Malware payload (SnakeKeylogger)", "value": "35c223c57ec664549b874542b69d8a63098b52f03ff13b6f5cc4af8862742e34680e3aada196ee3a778d8562ee1d2618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465918, "uuid": "ce782a76-e682-4c48-a536-81be6560e45f", "value": "T1F355227C25A767DED82C02B93B39507863655C749447E298ECDA32BF2D337517A33422", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465918, "uuid": "c16fc2e4-b38d-450f-a323-c4a294afa3ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465918, "uuid": "30c58a97-41ff-4694-b251-12ca26df7892", "value": "24576:Xczi/tPNHTegMENZCNShTqYxWsS8nQXf7LKB5Sm8xBE:dFNHTeg7CsOsS8Qv380", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465918, "uuid": "e684712b-9533-4a28-ad67-6fd87d99fedb", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465918, "uuid": "5726bdce-6f3d-4a5c-acb1-e95e0d052138", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465918, "uuid": "173296cd-8cb7-4307-8e8f-a17a1f9e80be", "value": "h\u0131zl\u0131 \u00f6deme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e6cedd-5d17-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639511583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511583, "uuid": "922687de-1b6a-48bf-8a54-839b0c1aefc9", "comment": "Malware payload", "value": "2c0766574777d9defafa4df8bd0fd9b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511583, "uuid": "6e52f934-7a70-4d3a-b0a6-64402209ec6e", "comment": "Malware payload", "value": "8e7acc152682d46a2305e2f2aa2ae19b1871e85dd4ee19e3de5d773822648ff9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511583, "uuid": "e775d104-c069-4b9a-8cfa-45e474d253fd", "comment": "Malware payload", "value": "c7981bedac7e22fd5f3acd4f24faf04ee0d0b968", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511583, "uuid": "1efa61e4-186f-47ae-b656-e0e55d5fecda", "comment": "Malware payload", "value": "4665ba98d4b1c2a5545c7677d62260ec575558fadc124abe19d6256d96c09aa8dad1da44d543ef9b92e4051c8e6dfec7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511583, "uuid": "97bd8b23-e4fd-4675-a080-6b95a9ddf5d4", "value": "T1CDA4235876A5AC0BC36C18386B1DA8D67D07629EF400F61A529DB13D012B4DE47CBEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511583, "uuid": "15f86cad-909b-4f84-8263-a3a4dbbf2316", "value": "12288:TbZao+zcm0lTvLeK60sI+B/VONLb15i3amcYVspp3waIrWOOt5XaV:TBTvLeKoIK/VeLb3i3a8Vk9Bt5XaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639511583, "uuid": "ad96d998-6b51-4542-9137-2cea2cca5c8e", "value": 491603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639511583, "uuid": "5b694821-9149-4b03-a3ee-effb89adc2ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511583, "uuid": "fd3230d7-98e5-4df6-9deb-cf94bcf2c4c0", "value": "2905552638-12132021.xlsb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1f4b4f-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639504461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504461, "uuid": "634e71de-8e88-4b88-8ab3-3bae643afa0c", "comment": "Malware payload (Loki)", "value": "0a147a324d3420623a329b55d3389096", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504461, "uuid": "1973dfa7-b9a0-4ba1-bc89-c93bd5b35e3b", "comment": "Malware payload (Loki)", "value": "8ed1c215ff3b6376e8bd6caa9b67b8b63b9545d0895c6d3d221bcded292cf4c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504461, "uuid": "a9e3931a-bd2e-4042-b725-f82b85343cc0", "comment": "Malware payload (Loki)", "value": "97d49a6d8160e1ed52626928b8d7ae26f61caaee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504461, "uuid": "468072a6-5d32-4710-bb21-60bdf92acb9e", "comment": "Malware payload (Loki)", "value": "175394f58d7ae9655df61002aea89c73391461ea6f099a9f503937dc58c8eaa914f733bfda63954f2d64f8f6cfb226bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504461, "uuid": "11119a37-a17b-4173-82de-c008e2719247", "value": "T1F725121C3E83E5CFC1560FBA3724906851B5AC316A03E297F8DA379F1AAB3547923716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504461, "uuid": "df89bcf2-b602-4abf-8d84-e9a84bc6bf37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504461, "uuid": "97cfcf02-d7bc-4a68-ac85-fa8686f4cd2c", "value": "24576:35n62/tymYYBQLziA5605WAjsYdXPSJns7fF:35J/hKiA560VjpdXlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504461, "uuid": "de484db4-e882-4dfb-81b8-2e3c256c2d8f", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504461, "uuid": "106a3d04-dce3-4937-8014-b7b6c749517e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504461, "uuid": "7697b03d-cd24-4198-8399-05a357ec1e8f", "value": "0a147a324d3420623a329b55d3389096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0ec200-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639465080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465080, "uuid": "29bfe38a-cd90-4dbf-87e9-5089a9b0aa44", "comment": "Malware payload (Vjw0rm)", "value": "4071996d3dbb7b9be8e22a813fdef1a6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465080, "uuid": "3df4d295-6297-42da-9d71-576422c89c70", "comment": "Malware payload (Vjw0rm)", "value": "8eedb8f6d698589f1ce2e40ebae8b6804033ac909843f4ab2dda71dff231759e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465080, "uuid": "1cad10cf-a813-4d7b-a8ac-3e4fa902e873", "comment": "Malware payload (Vjw0rm)", "value": "af8d71513ff7f847158a3e17d6541268d89c4438", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465080, "uuid": "1da432f0-d7e8-4e7a-8e20-ec5d5bed853e", "comment": "Malware payload (Vjw0rm)", "value": "c0ffcc0afa2c55c981784ea76aaa9f031c2dd4da074d53b53badebd66afaffdd9c0bf3138efbb711b9f7d61e7c66ffc0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465080, "uuid": "5ccb536b-e1f0-4ee5-81ef-3f4ae77e5b82", "value": "T15FD3A4C06BC5F881C24767BBBB1A70E4EA1F5C9862D8486AF00CF454F3AEA59E5D4770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465080, "uuid": "4af39475-bbbb-4c44-8364-88d73c2102b0", "value": "1536:RGbp2mKBBI6R7bpBZK1p3q/WIEdwcEG80516R:RGd2mKzdpTMp3q/WIy+K1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465080, "uuid": "230d0255-7521-4cad-a889-0340bd0ba6b2", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465080, "uuid": "3d934172-9015-48be-a276-97b8239d9d95", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465080, "uuid": "6a663806-339c-4ec1-a465-256b72155492", "value": "#00958.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4535a4dd-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500339, "uuid": "164269ef-7f0d-437d-9a95-194b8a2fee31", "comment": "Malware payload (Formbook)", "value": "35d823aa53ca83f8b7bf9363f58c629b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500339, "uuid": "95b1ac28-8129-4094-becd-9477baa0ed21", "comment": "Malware payload (Formbook)", "value": "8f454860eb8461e6febf3a1977cc7a53733dd72960fec1a41d17ab4e03af6f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500339, "uuid": "85e321b5-50ef-49c8-a00f-e5fed72b8df8", "comment": "Malware payload (Formbook)", "value": "55fa62db4faa9274ff6d0cea423c030f314c5d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500339, "uuid": "6116fc4f-5cbf-476a-b89c-a093fe933f8e", "comment": "Malware payload (Formbook)", "value": "8d9cc71dc485563654401e1edf85277013f70c80fe50d2b2f1918cc22e8be7774c1584cc378f7cd74483958ab38b512d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500339, "uuid": "69650356-13ee-4041-898d-5b28219c4002", "value": "T16245126D3A8395CFD45A0F763BA590246261EC726A4BD3CBF8C9324F0A677143C73A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500339, "uuid": "6c2137e0-a7ee-45e8-b944-3e1a7b68103f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500339, "uuid": "a938a034-a001-43fc-aac7-31271e51150e", "value": "24576:Gjj8VLXVT7qzuQ4geMoxab5tO0sGSwlugn47qhxvP/miIUvVuU46gS+:GcVlqzuwjosOvu4g47exvP/4MQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500339, "uuid": "f871799f-7902-49b4-840f-7aaefb747346", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500339, "uuid": "506bb604-4ea5-4c38-9e3e-d54d0fc651e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500339, "uuid": "30748155-94ff-48bd-bc3e-f8950012c3de", "value": "35d823aa53ca83f8b7bf9363f58c629b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406cf3b8-5ccd-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639479716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479716, "uuid": "f9ec772b-45cb-4a99-92b8-225f3ec1b982", "comment": "Malware payload (RedLineStealer)", "value": "cd20fad969b1fa69385593fde7570b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479716, "uuid": "b9e1aa5e-b006-4797-bf0a-4e525deeea69", "comment": "Malware payload (RedLineStealer)", "value": "9124663ec5fd8d530446f6f018cc7615d6a7fe96a62bef163aa15fcf125a1f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479716, "uuid": "e196539a-af57-4f72-8fa3-94051ff8cc0b", "comment": "Malware payload (RedLineStealer)", "value": "f8c21046d24f1914e88c41833ce4585a49aba4d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639479716, "uuid": "2831e36d-486d-4b0b-b7cf-2a357caf7a66", "comment": "Malware payload (RedLineStealer)", "value": "b13eb94d2665a86a5bb7d5e07925f60c5ca164097f98e270a32c8513027dab5d8d660a3ad8557fc2fbb6be53f67b0c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479716, "uuid": "cee185e0-1f93-4410-8f41-3a44dbd6eac4", "value": "T1EA94CF00B7E0C034F6B352F549B9A3BDA93F7AE11B6895CB12C516EA5A746E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479716, "uuid": "5aabd171-2cd2-40c9-93e4-a4b3e4b4ade6", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479716, "uuid": "03fc164c-7432-41cc-a3d5-50a90899e1ab", "value": "6144:ej8hPMxoVOypQXfFgMrSnRWcMiKLliVXHKZ1F5B3tEdqV6CrwYpr:k8hkmbpQTORdMiWlmKZ1FvtEdqpMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639479716, "uuid": "c3eebbb8-096a-4869-8633-a96d02db2a66", "value": 420389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639479716, "uuid": "af9d9fec-b442-4e8b-97ff-f879801071b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639479716, "uuid": "27dc5c9e-9e9b-4402-a0c5-802af479b738", "value": "cd20fad969b1fa69385593fde7570b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c4a027-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639496391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496391, "uuid": "55a45c1e-1161-4a06-8268-ef0d979dfc5d", "comment": "Malware payload (Vjw0rm)", "value": "e09294b9ca51300793673da85e23fa34", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496391, "uuid": "ae5ed69c-1c3a-4027-a201-64d58bb6cac1", "comment": "Malware payload (Vjw0rm)", "value": "915ed58984f946bee7b46fd8d6a4cc81e4d7edbd6f2c52a7d0f0f0945140d23b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496391, "uuid": "75ee8bcf-b489-4740-8788-295901bfaf08", "comment": "Malware payload (Vjw0rm)", "value": "46715b9d35152983bd452eb6bf65c588b36a7ab1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496391, "uuid": "59599683-d977-4b56-89bb-4b1f4e2d859b", "comment": "Malware payload (Vjw0rm)", "value": "fc4f7a3474c5ac1c5ca8676b968ae5f95689546733a91ed8cbd7663683f981c01e386beb71a758bb37e9643b6ea202d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496391, "uuid": "033c9935-cfca-46ac-81cc-22d27a7f06c1", "value": "T1B4C46D10BFC0157D76890893E19EA90F77F66B05E49360CDF653B2272AEFF89621AD01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496391, "uuid": "01690221-4ec7-49b6-bbbe-e320c65ab095", "value": "6144:OaLfslZvvb4tNj0ncIQFZ2DWUoaUgscX/9XnXc7wb/4QRJ3Yzf/GAZQClgMaoXn:mB/RJCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496391, "uuid": "4101acb8-b6a4-4e94-b6c3-badefca8b5c4", "value": 549364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496391, "uuid": "51fea924-913c-4eef-a384-ef94b86b94d6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496391, "uuid": "ea618655-8780-40ef-afb4-08247777b737", "value": "PO2491039385.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97234ec-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639466228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466228, "uuid": "26a160e2-2d1b-4947-8cd8-0722dacb1d8d", "comment": "Malware payload (AgentTesla)", "value": "5de066d7efae5ff7cf8741714a46d199", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466228, "uuid": "ceb0e221-f37b-44c5-aa78-a8ce365242f0", "comment": "Malware payload (AgentTesla)", "value": "915f1ad11eb5ea4be828afae635c1a5583b93505d04f5cb29a6da8bced9bbb57", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466228, "uuid": "c96a3b3d-95a2-47b9-bc15-25013787e253", "comment": "Malware payload (AgentTesla)", "value": "0593956a194bc3495c7afcf45d5dd2b8c4e6b808", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466228, "uuid": "1fa82c2e-e9fe-4311-8458-11fc4fc8bd28", "comment": "Malware payload (AgentTesla)", "value": "0572f5f676206bb959c92c055fe9662d34635fb79777c3b5237b03b163effc6a40d21db60496da93bcaed6ed7c553817", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466228, "uuid": "dc652f4a-b37d-4b4d-955c-6bc323ca404a", "value": "T12434237F707F47524BDAC6B6C430F3EB3190669BD858ED0B2AAB246931AE240195B4CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466228, "uuid": "72bbd147-d156-4f5f-9b8e-d2a86585e656", "value": "6144:nYlURkpvjRajhrt0svK2NguEw53uKGlEj:Jc9aXTEwZuKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466228, "uuid": "de47a125-d87f-43e9-9758-ad7120a0a140", "value": 245976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466228, "uuid": "fba031bd-184b-4f36-9271-2a588add0287", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466228, "uuid": "028fca72-b074-47eb-b1d0-7cfc53e371ac", "value": "Payment Slip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6742a9fc-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497390, "uuid": "bd422dd3-76ad-41eb-9274-eada6f2b8fb7", "comment": "Malware payload (AgentTesla)", "value": "5388657c9dde1ce6f13f2e69b04d4b41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497390, "uuid": "10b3c85a-3dfa-4629-ae16-5f20abcbd1c6", "comment": "Malware payload (AgentTesla)", "value": "9241daf53fe86be7f738e43c07b6e7df92b8c804982eb6dcef55e19f81d1e85e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497390, "uuid": "75b2c541-472f-4779-beaa-1c4e76c18764", "comment": "Malware payload (AgentTesla)", "value": "519e949517087b132fe962d056331912085851c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497390, "uuid": "c04b67ec-67b9-42e5-b37b-2779aede4291", "comment": "Malware payload (AgentTesla)", "value": "5f5864b61c8f80384def513eb380f0babf42694649902fc95c93a7c29160add8b5352d8043a62a8907cdc3963a21ebeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497390, "uuid": "d3b83693-3a74-42fb-8ba7-c0e010eb529d", "value": "T1EB61E9611A8CD883DF8758E0A95E7E5E03A1F32686CF311431CCDAA1035B63D9D750C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497390, "uuid": "5afa38c7-9f10-4770-97df-2586e55eb506", "value": "48:fy3w6NgGtdyfQUGeshMwyQYwnJCmtNdTQQJI0dU5RjIpH2gtdcAoFLz8TIxZlq9Q:fkwhGtd/UGV/DJh7ULqcAoFn8TJFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497390, "uuid": "1855d801-9752-4c3e-b600-a65094ef49b7", "value": 3441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497390, "uuid": "5a08d59a-e2fc-4afa-bc49-5d1baacbe3cf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497390, "uuid": "094e9fb6-3d99-457d-8bc3-81e45f370425", "value": "NEW QUOTATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2608244-5cfc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639500147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500147, "uuid": "4ae7d9f7-3449-4f96-a9c9-b6ba1f3c8815", "comment": "Malware payload (AgentTesla)", "value": "07c75df5d60787ee1c3cc7ef12676ceb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500147, "uuid": "5181b62f-d114-4e40-a295-3b2db7294576", "comment": "Malware payload (AgentTesla)", "value": "9248eb1725fb65d0241e09cd98e5acf528cc762db36d5c127a4d93bd691f58e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500147, "uuid": "7f264bc5-6f58-4c2d-bda5-d88d18f39b28", "comment": "Malware payload (AgentTesla)", "value": "346d57077a2c42254a4516487a7531f19d636334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500147, "uuid": "d970dd48-6cd9-4e64-8191-f544e045ee8f", "comment": "Malware payload (AgentTesla)", "value": "d64c1223f1aad63811cd54585b129e4e9967385e7a801c5024e58625194bae88657f921bda34aa36d1bb9dc8c2cc2208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500147, "uuid": "f933f247-e59d-460d-93fe-8e272ad577de", "value": "T100057C1136985B68E0FC9B759510480863F3FC16EB61EA4F3CB53DEE367BE834662612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500147, "uuid": "9eb212c6-4e79-4d73-962f-bafdee341851", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500147, "uuid": "851ba380-4e2a-4a59-b3ad-283c3bd49061", "value": "12288:EyqC7JAYHyxHyKWvtL+xYshlpnPYbk1Gc4/uk4lVlA:EaAMiYtYRnABc4QlVlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500147, "uuid": "50bcd91d-87fe-43e6-b4df-85c7bcfc4ed4", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500147, "uuid": "eb01b4a8-b403-421c-b4c7-dfd4228a244c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500147, "uuid": "7618115c-c9bc-45c8-a79a-f301554fdbaf", "value": "07c75df5d60787ee1c3cc7ef12676ceb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2bb988-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639497959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497959, "uuid": "d8bad72e-c3a2-4d0a-bc6d-40b439eb487d", "comment": "Malware payload (QuasarRAT)", "value": "c5cf749ca39b5a7581ed30688dcf9c84", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497959, "uuid": "f22e1a9b-8aa7-4934-87ca-f1643b2785c0", "comment": "Malware payload (QuasarRAT)", "value": "9296f2fd6c9ff54bdc0239603238d89347ece6efd3fa75aa2b4baedac90c5f3a", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497959, "uuid": "349836df-3901-448c-acf7-56dc593e7aad", "comment": "Malware payload (QuasarRAT)", "value": "33961520e4875e7582d67b1036ffbb39983f9935", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497959, "uuid": "8eb06a33-0874-4892-9958-029cc1cb0de7", "comment": "Malware payload (QuasarRAT)", "value": "b41b7263e78daf0ca496ee2e8b007303c00a7ab11b916dbf2dcc25ceb79e7b98b007560df20998b83203e862f75774f0", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497959, "uuid": "70cfb58d-2e05-49a0-811d-3fc6b7654014", "value": "T1C414D049B251C008E51947394CDAD2EA373BFC551E7F8B033295F32E7EB3AA18983959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497959, "uuid": "7a523de9-eb0f-4842-86d0-2c008ca08a7d", "value": "3072:D6xEtjPOtioVjDGUU1qfDlaGGx+cL2QnAIzgMMn5/UkyLDiN6gXvHkZyZSXtgfOz:uxEtjPOtioVjDGUU1qfDlavx+W2QnAIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497959, "uuid": "94816e11-b546-45ee-854a-3bf96ef4fb8b", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497959, "uuid": "5f7b68be-0b86-4eb9-9184-86ad3f39ce64", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497959, "uuid": "2947ef61-ce2f-4697-bd62-79f02e40d567", "value": "Emir NO;200938.122022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc11796-5d0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639507063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507063, "uuid": "19def8fc-600b-4916-a157-e2411fce5ac1", "comment": "Malware payload (Loki)", "value": "811dd5ebc356eb9184def600dbfe1555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507063, "uuid": "edf7f863-d3c0-42d3-ad9e-c91521a338c5", "comment": "Malware payload (Loki)", "value": "93187ec7a41afaaf1462b6b01fd4c4b29fb1b7675dc08241d4111cc474850b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507063, "uuid": "32d229b1-2b52-455b-b43b-e8ef38c01af4", "comment": "Malware payload (Loki)", "value": "fcb0847c33548cd9789cc1a2cc115a764d38dac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639507063, "uuid": "e3c1e368-65b2-4883-ac75-04fac8de20da", "comment": "Malware payload (Loki)", "value": "959e9cec47cce703a6adea2d6214965aeb063b22a44778a1c60d5f9434ace05fb07aeaae50fcf76bdb3e9e1acd41095d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507063, "uuid": "2d5738e2-557e-4e3b-8361-24e566305081", "value": "T15AA31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507063, "uuid": "a1e5e418-bf94-44cb-9f71-bb559cf85962", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507063, "uuid": "8cbfe43d-d101-4df3-a23b-c1bd7f1a577c", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639507063, "uuid": "21a3aeb3-0d80-466b-b24b-a3851fcb74d5", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639507063, "uuid": "bf0665ac-e55c-44eb-9438-260710a78842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639507063, "uuid": "3c5de61a-7381-4a1a-a232-ca642f74e92a", "value": "811dd5ebc356eb9184def600dbfe1555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3730c452-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639464668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464668, "uuid": "b36086ca-eb9a-45e8-9da8-3f1f36df69ee", "comment": "Malware payload (OskiStealer)", "value": "8fba526b759a51885a2f1a0f26ae040f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464668, "uuid": "def4af0e-3ab4-4046-be75-9a74ad649a8a", "comment": "Malware payload (OskiStealer)", "value": "931f271552b5170cbcee380f9fc5742d890e9063181645f010cf0b942ea2787a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464668, "uuid": "f86e84a0-1e4e-48fb-bbfe-99b155882c48", "comment": "Malware payload (OskiStealer)", "value": "03961f74b258f17af2769d78a3c01a6acc7bda9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464668, "uuid": "ebd9c107-ddcd-4396-84ab-5401315a6ae1", "comment": "Malware payload (OskiStealer)", "value": "c2e959b81e82e74b2490f1e7803d303b351738dad6812c2d9aedf4989c9ec5f767f711febb769b5408de0dbb495bbf99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464668, "uuid": "ec939b6d-8cb9-46ce-9a7d-fbf0ed4b667b", "value": "T1B065226D3A679BCFC87A07B87328507423706E32660BE39CF89931DB19237493973956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464668, "uuid": "7cba09c8-6269-4706-9a80-cc2f937871a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464668, "uuid": "a80e84cb-439e-4dae-b8cf-761e841e8de2", "value": "24576:HYYjWdnynpP8k4pb0DK6nB6h5Cqk+ys+zQ2bN4V6pEanUoLVQQHwlYGG:HVWdyp/U4DKwi5lre4KjhuuGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464668, "uuid": "0a1f6887-e49b-404a-9d46-a12ef80ceff9", "value": 1459200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464668, "uuid": "2d99253c-ba29-4c96-8e97-59b10f453ee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464668, "uuid": "175680e1-66b3-4379-bfeb-3df879b905e7", "value": "8fba526b759a51885a2f1a0f26ae040f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d165bf5d-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639495850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495850, "uuid": "c21b3570-3a2d-45ce-b92f-f11693aa1f7b", "comment": "Malware payload (RaccoonStealer)", "value": "e8aeaeb95489329c4eb0e16fc52a6048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495850, "uuid": "8d8fe5d8-295f-4596-acec-38993b6252fb", "comment": "Malware payload (RaccoonStealer)", "value": "932c8b3ba3578063a51926fe1f34435afb522b9466e32ac1770afdb6645e15e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495850, "uuid": "478eb12d-0d6d-4dc8-8588-096dae329abc", "comment": "Malware payload (RaccoonStealer)", "value": "8a720a6dc48514afb1614c918fe0840367a6844c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495850, "uuid": "a09584b0-db6e-4d4b-9765-b9c94c7c9f43", "comment": "Malware payload (RaccoonStealer)", "value": "f9f8e1a887522bdba797faf26cd921980a1f2b5499a8264748bdc2dda5a363b2c2d19f963a5ce834241bdc6d0ac05054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495850, "uuid": "d715a2c3-0478-4983-824e-61f7e8accc15", "value": "T17DD402C276E2D072C2B27A354564C6A09E3B7961D634506F323727AE1FA33E19B75332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495850, "uuid": "da34fac6-8f62-4ba7-96b5-b43908cc4ad9", "value": "307bfa2331726fa806b2240a5641cf4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495850, "uuid": "037922cb-7bb6-4542-8b34-e3f294b5aaf5", "value": "12288:LYM/q6oqUv5ZmtmBZTT5zRvSB7FW/BJlgfhLT0qOyWXwBNE7:kvfmtyZT+DYdgf54qyXwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495850, "uuid": "50438e63-6f2c-4327-825a-b102b027b32f", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495850, "uuid": "537fcbf0-4fed-4d6f-9bbf-7d8bb0b73aec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495850, "uuid": "964e5e4b-24ee-4809-a596-8d86742407d1", "value": "e8aeaeb95489329c4eb0e16fc52a6048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a406e0-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497386, "uuid": "222fee7b-c0ee-4558-a61e-c22e3c142add", "comment": "Malware payload (AgentTesla)", "value": "fc43bce4c00f35fde54f2e29f1cd3f26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497386, "uuid": "ce1ff211-ea42-41fe-ba2b-4c6dcba26c2b", "comment": "Malware payload (AgentTesla)", "value": "9331d3ef43cad55733f656c1b6e406c156673261bca231d1ad5c2b0c3e7fde50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497386, "uuid": "48966cb0-0970-4a69-b7bc-a3438067eca0", "comment": "Malware payload (AgentTesla)", "value": "98525e74d8c58963171eb3994189c2875ab72e7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497386, "uuid": "03a73d0b-a6d5-4907-b5d8-7a7602f41c25", "comment": "Malware payload (AgentTesla)", "value": "d3f66af1c13108b5a848863124da50f07b773e1926cccd621867f6f2b5758764357e482d5d25b7900c319aebb60b26e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497386, "uuid": "8d70b62f-d847-474b-9a97-e15aca1cdc5e", "value": "T13191E9B8A7981E13DA13C6B2E0E5FE5602A2F23BC9CB1704732DF5F0572B5056761944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497386, "uuid": "a9aeb0b0-fe31-4a16-b89a-160f125cefdd", "value": "96:kHi6LiT9oqgVJ+vljNwXsf2VPkXCobKsqr7u8VC3w+kG:kHieNb+vljwX9kyrta8VCN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497386, "uuid": "33de399b-5ab8-4930-87db-8d55468445fd", "value": 4603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497386, "uuid": "53919272-de68-442e-8b52-f54120f5a32e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497386, "uuid": "bd1508f4-83af-48be-8792-d0f2f93cd892", "value": "Consulta de pedido PO-947-LSD-094753.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ce0ebf-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639467410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467410, "uuid": "3f812cad-9ec7-4b65-b144-3cf5ecaa2965", "comment": "Malware payload", "value": "24d49a844f73f22c176336a4c9cdf823", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467410, "uuid": "d9d9a807-68fe-4cd8-9565-f31306d837f4", "comment": "Malware payload", "value": "93dce7b0578b6e41850213bc7fd7aaa67a9a5ad5c0a67bdf43da75c132b462c4", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467410, "uuid": "29938a2d-b162-40a2-b86f-8fa997533d8e", "comment": "Malware payload", "value": "24e904028e40d1cca0ff3ab10bfa07ff0135aec7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467410, "uuid": "1bb2e7e0-5bc5-4d81-9d73-b0fe1337f18c", "comment": "Malware payload", "value": "096414ea5fdbdb23398175897efa3e7038ac3dfe7beb6296467c70e2e820daedcb32948a15172233f8e74bce6785ef85", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467410, "uuid": "73126066-002a-43a6-bae2-1a79539fa7d2", "value": "T1859401517240CB17C981433A0CD2D6EEB677FC219FB6831B7195F36EAA77690890362E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467410, "uuid": "4ccf0a6d-1d8e-469a-80c3-20f3549aa4ef", "value": "12288:p2zbKK20Mkkie3G9QTs2VGkWCC4LuRMrvuZ1Vx:Izb23G9b2VGHCC+RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467410, "uuid": "abb7ddfb-4c7f-4217-aa3b-53b0277967d8", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467410, "uuid": "b121012c-7c1b-4b67-9817-98305d52998a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467410, "uuid": "c23def17-a4ce-4e2d-891d-a55d2edd19a2", "value": "Kitap.2021.2022 .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c16d40-5ce9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639491933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491933, "uuid": "c7540226-ddd0-4fcc-871f-6fa9592f6c3f", "comment": "Malware payload (AgentTesla)", "value": "1574def68f4cc6603f8d8a56883b3d47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491933, "uuid": "7fc21290-94bb-4876-a1a8-74d5162e39fe", "comment": "Malware payload (AgentTesla)", "value": "94a4a84045dbbc2e2360651f8d0155f6034102605fbf12d797e26fc580a9aa4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491933, "uuid": "396d999a-ad0e-4ca8-8ef4-84ac4ea46b99", "comment": "Malware payload (AgentTesla)", "value": "ecb002678dd53295e9f88b031a7467c9c4083a51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491933, "uuid": "42f270e6-1bee-4050-b1df-e50ed4edaa7e", "comment": "Malware payload (AgentTesla)", "value": "2d8fe14cfd0a17fc249df33fae876eaedd01e0f6f4803bfbdddae9e1bc370b7cfd5b247dfdba1e1800979e555f3967d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491933, "uuid": "d4c11e92-5a62-42da-89a0-8cf179d0dc46", "value": "T10E45120D3A97D4CEC5860FB63B6560648272AD725607D2CFF8DA375F092B3A53823356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491933, "uuid": "e222a6f8-bee0-46be-bac1-9800d759403d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491933, "uuid": "442fac66-7255-4325-bbd2-e24a547598fb", "value": "24576:zSi0fv7GBseBt6jIm7zSrm6BDb+nYAH2uqrSVNyGB:z2iBDBtFm6B+WlrSVUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639491933, "uuid": "067f1631-ad66-4519-a322-62a21e4d6dfe", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639491933, "uuid": "89c5912d-a873-4290-9623-86ccfd083224", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491933, "uuid": "5a8693a5-9277-45c1-90de-17839080aec9", "value": "AWB_0000000000000000092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ef9669-5d1a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639512845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512845, "uuid": "806f9c1a-1814-4807-97a1-c7a33203c694", "comment": "Malware payload", "value": "518d125bb64a8f8dc8b94054daf5e6df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512845, "uuid": "244dca6d-2317-4e6e-8d2d-6c37b43a03bc", "comment": "Malware payload", "value": "950008035d225dd5f4c3a229082f1206eb9bce8c4aa4822b130db065da54e224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512845, "uuid": "a64f1b45-f867-4515-a7b5-0bc780e378da", "comment": "Malware payload", "value": "549735f585590452985451faf8ab1e6f22903abf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639512845, "uuid": "717c8023-b02b-4f80-890d-f3702accba47", "comment": "Malware payload", "value": "4b8b8ee5fb7ec68ed45733cecf92227dd74f170d5804c530b3a24de4cd1cf98c0a052d051c7fabf41f10fa81beb2c578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512845, "uuid": "ab1aab5f-e2d5-4cb4-a07e-5bf2a5da9435", "value": "T1FB84F361B2D6AF33F5135633C479AFB21E0BDDA802CEE62A4D76F10C85372DA0576522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512845, "uuid": "2f116290-0efd-4460-8d4f-bdb35e24cc74", "value": "1e8a809e0505b426516db96be454b4f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512845, "uuid": "07e18659-95ec-4d4c-88b8-c1fc8de1f0d0", "value": "6144:eum89DM6Wn26B/vLcTnR2PYbtw3nnhsW/WQkwy+qq4888888888888W88888888s:089DMx7NQXtweW/WPwYq48888888888v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639512845, "uuid": "dd4c4b4f-9275-4b89-b831-af40ae261261", "value": 375656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639512845, "uuid": "8d3d23b5-cb66-41e0-999e-9f1b3a945dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639512845, "uuid": "5ca53ca8-2a7f-4c48-b088-8913ac3ad5b8", "value": "518d125bb64a8f8dc8b94054daf5e6df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a736e8c1-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498356, "uuid": "b9400167-cefa-47e3-a82d-7f35db6c2970", "comment": "Malware payload (Mirai)", "value": "f4076b5c72c3a62c37d092668c2e0c40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498356, "uuid": "1ef36c15-6d6e-43fe-a8b1-24e0db3326d7", "comment": "Malware payload (Mirai)", "value": "95a1a6128406b0503fc1cf08d43a42fbf54b51718a5a2df3a4ca6a4c9d863eba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498356, "uuid": "55c0a69e-d266-4193-9d10-394a6d4dc3ad", "comment": "Malware payload (Mirai)", "value": "0a6f92ee1a092fa0792aaf856a32faf314988ce5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498356, "uuid": "5a58e920-fbb8-46ca-831f-aec6fc86806d", "comment": "Malware payload (Mirai)", "value": "4d53ac436b884d99281b854a2ba23e49989c5c9996aa11eacdf8bd01fbb6c31f5cc222b18eb8e1ce3d2c12bce443e806", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498356, "uuid": "9c6bec73-4604-4bd7-9d20-882842c31cc7", "value": "T11D13E1E99CA004EAC7B1543BE7FC928348EB48B8A357E5612579C120F787183CDF954B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498356, "uuid": "0b225250-8cf7-417b-952d-b635b948a1ca", "value": "768:OLugskpgLzbLnTj0O4OveIzjTlYFsE6RbtLs3UozY0DQO/Xcdt:OZfSLPLTj0OXvTzjRbkzYHOfUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498356, "uuid": "c5effd78-9c55-453c-8dbf-520f0100813e", "value": 41756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498356, "uuid": "8fe2c058-3352-4fc0-a777-b54cae9cea3f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498356, "uuid": "0d432bdc-f11a-4b73-a36f-a3b9f43b61c1", "value": "f4076b5c72c3a62c37d092668c2e0c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e00a455-5d1b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639513185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513185, "uuid": "2ce134ff-fd4e-4e33-8a6d-8f77d2d38688", "comment": "Malware payload", "value": "c8ee1f4c03948d9bfc7f15f2c3915b20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513185, "uuid": "6d7fe350-9e99-4fcf-bbd5-d995c362fd39", "comment": "Malware payload", "value": "98058909fe77d37d42c642f2dc103f417cff699c75b96aa829058cd286edcdef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513185, "uuid": "58cd1fcb-0ad5-40bd-985f-ba51e7f9f511", "comment": "Malware payload", "value": "8e7765acbd77a50282874c5d1117800cfb429a14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513185, "uuid": "0871fe4d-9329-4417-85f2-b02fa12bcda1", "comment": "Malware payload", "value": "5a727afbdaacf9a798e3c2f70efaf47b34674b727c8a384137e685e5801349944cadfc2297e2eaad3e140c0454039070", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513185, "uuid": "d502d68e-4419-4de1-8bcf-e5e83498b7dd", "value": "T1C7C49E8263634102EE82FDBF1D13746F4399369DF950F8B2F58E6A6A303E2B53165643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513185, "uuid": "9825aa0a-c4e8-441a-ac04-ba780f5a3410", "value": "c9628a85525bfe945f5e36dd40536a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513185, "uuid": "8fcfffd4-35ae-40bf-856f-161af52b9472", "value": "6144:+DwhfXAyRXuYDXCmFXayrX4S7XKyfXEyRtUWxXwEhXE65XcyjXuq5XqyHXoQ5Xmm:bF8uFvRiX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639513185, "uuid": "49f2b970-025a-4763-a9c4-06b6f360f5f7", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639513185, "uuid": "d92a71d7-40ee-47d6-bde5-e6adecfcd029", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513185, "uuid": "3c2b3bfd-f1b8-434a-a96e-0d438ca01774", "value": "c8ee1f4c03948d9bfc7f15f2c3915b20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520107c0-5ce8-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639491341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491341, "uuid": "be2ad432-1e09-4c97-b8a2-60703df9cd19", "comment": "Malware payload (IcedID)", "value": "928a5dc560be72390909c901df6a06e6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491341, "uuid": "189116d1-7de4-43bc-a96d-585b49f14087", "comment": "Malware payload (IcedID)", "value": "98beba560e5a553eeb3e5c72e01ea5525b18390221be0b58cbdab5b33c8080d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491341, "uuid": "4f8f9e9c-da18-435a-bce9-579bd0cb769e", "comment": "Malware payload (IcedID)", "value": "497e0a72cd3aceaa61de4dc96ef7de1b634a83e5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491341, "uuid": "5e3dbb0c-0e14-4a31-aeb1-70a0ed5bf567", "comment": "Malware payload (IcedID)", "value": "2751eae70239923a7b3cec81a2499773ec27845e5a5e2625fcbde41466e189d5359b9468e4358290906cc80861157888", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491341, "uuid": "f626cf69-63da-445d-8acb-0821b3b7da4c", "value": "T12D13CF14D421AE00C69D467E64EC11E0BFF3828792D59A039ED2EA0F4C511EEEA5F29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491341, "uuid": "15b24f29-d547-43b4-93aa-3a01dd79fdc7", "value": "768:K+L18n0BKW2rq/eEflhRSfwdDQWk/HQFYNTUrLfxl1Il:sn8KWG0lhRSfwd8WgZMLfxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639491341, "uuid": "4dfb37d1-b328-46a9-a775-5f20922b72a5", "value": 44253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639491341, "uuid": "70e0c29c-e390-4c21-8c32-399b91ee80d7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491341, "uuid": "f88be5f9-9e28-4936-8a0e-06fc5b66d4f6", "value": "figures.12.13.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c9e389-5cfc-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639500184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500184, "uuid": "16c1c44c-82f5-4604-91c9-821ef7bda91c", "comment": "Malware payload", "value": "925412d32980c6ede6140e576fda5753", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500184, "uuid": "79d3b4f6-98f0-4baf-8011-0d4b3e7bde9b", "comment": "Malware payload", "value": "99afafb9edf09d9430d229df428dd5532de770adbfdb5aa798574607cb6b15a2", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500184, "uuid": "4c38ddf3-474b-40c0-8755-88f1d49188c3", "comment": "Malware payload", "value": "bb575b5e829581a40cfdab385c52108f08bfd57b", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500184, "uuid": "079606db-24a0-4d92-b75c-b8f12c3c47d3", "comment": "Malware payload", "value": "a8317147404441339c0d03ec959bc6d383cc0dbc2d35aabfa9a47cf4b308491e4fc92573bcbcd7cf3f8a4010f62b35f0", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500184, "uuid": "5517d2f7-494e-4086-8e18-c64105154687", "value": "T1A1C49E57F6E77A65E6AFC2BAC6B1C92D66B3349202B0C3CE774055892913391483DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500184, "uuid": "b0fbe4cc-70ac-452b-91fc-7f0c6e83b6f3", "value": "de92ddb295132323885964c44ba1a4fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500184, "uuid": "06881e3a-6430-4a95-b063-b3d99a8a0ae0", "value": "12288:vHzhL3/Z3+AZXkOCH8bzbBSreg48kvN91KVWf9:vHzhz/ZOABkjcX1Q48kFmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500184, "uuid": "22002c11-7d5a-4551-aa1f-75d725c1faa6", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500184, "uuid": "812f369d-f1d7-4986-8d93-d1dddb039c8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500184, "uuid": "dc76efc7-4388-4ee2-b682-249daf22dd29", "value": "Statement_1321.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a45832b-5ce9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639491704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491704, "uuid": "96faa45a-e7c1-49df-b701-5fc48810ff85", "comment": "Malware payload (AgentTesla)", "value": "8c2908a25d3f123b236231e81235b553", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491704, "uuid": "cea7201f-a2ef-4e91-826f-4dc201dfcbb4", "comment": "Malware payload (AgentTesla)", "value": "9a44fc72921c1afb5bb90c067aff0173ae00f417e9fdacbeaebef13e9ae6c877", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491704, "uuid": "cc29a5e9-f1ad-41d3-9aa4-0a1342153866", "comment": "Malware payload (AgentTesla)", "value": "7713e1f33766aa05a661ee7dab596bdec22d6ac2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491704, "uuid": "ec3e6d77-607e-4f2a-bebd-ace48e985266", "comment": "Malware payload (AgentTesla)", "value": "14f40b1adcc8fb4be261308099402b6eb49d986cdf8714166308fbb28e38df23c477cdc7dd16a5abfc9bd83951318473", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491704, "uuid": "b1f11016-119e-46f5-a034-7dc0bb2c1635", "value": "T14135121D3683D9DEC1560E7A7B7990305234AC772907E382F9C932AF187BBA53863346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491704, "uuid": "53ad57c8-9c78-4732-af3f-e2fa4170a6b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491704, "uuid": "32aaf465-6cbe-4142-a16b-f6c8e0a08078", "value": "24576:hfI3A6BFbUVUpTBvSzQaFd3iiYrUAo0zKpHWW:edUqpFqXFoNRosAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639491704, "uuid": "50bb1234-3ec8-49cd-a6e3-e242a946f837", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639491704, "uuid": "8f7bf763-bffd-4107-8d32-79e716ad9a22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491704, "uuid": "5ecf00b5-77b6-42a7-9d87-dc4148f6f3d6", "value": "MATERIAL REQUISITON FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2c04c8-5cae-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639466448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466448, "uuid": "4982c998-31e3-4e5d-bb93-0caa484bdedb", "comment": "Malware payload (RemcosRAT)", "value": "3101496c44097ae9f0ca2df31a5d7bfc", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466448, "uuid": "a57a0cce-331f-4756-b872-ff31d7c6ae77", "comment": "Malware payload (RemcosRAT)", "value": "9aa08f13b82fc623a5df0d8e6af31801012b349eccd638cff9e3125a9ac0aa0b", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466448, "uuid": "68158515-c3cb-40c3-8261-b8f596ee5e9d", "comment": "Malware payload (RemcosRAT)", "value": "b2ec34c6ab967a598d83684cd34d52bd13446073", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466448, "uuid": "4706e422-3ffe-4a0f-b484-d202c59cdeaa", "comment": "Malware payload (RemcosRAT)", "value": "d596b70de2c0295af65c22e854013d4215aad1445fa2bc06a2ca2c4dbcb13d3624ec1c8cb2f503819adf6c6ba9ed5fcd", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466448, "uuid": "e94e43ef-3700-4e90-bc10-74426b4cb49b", "value": "T188D4237A88B930EA9741A27F7F66A894334D6F495122BD271506FAFCFC272C0F46058D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466448, "uuid": "1f8a4d73-4e54-4884-8964-3455b81cc21b", "value": "12288:0DoV/wnOEqKW102O/Rc3kchjd4ceigsXNId+v1QTG1q:W6UO3YRqOugeI4vKGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466448, "uuid": "47f516d7-ad4b-4e12-b7e6-d37bddd53b60", "value": 610419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466448, "uuid": "86582d9e-fd0f-4fe1-a5f4-e288ecb565f7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466448, "uuid": "fb2c2213-fc57-4167-856b-92b0317bed5d", "value": "INV and PL_ 8822.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7802faa3-5cc7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639477232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477232, "uuid": "42a606fa-0050-452d-b66b-67fb678e6935", "comment": "Malware payload (Formbook)", "value": "c520d0a0d5f638ed41596f9eb0d7f5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477232, "uuid": "462d96a2-8beb-47f7-a0fc-12ec9266469f", "comment": "Malware payload (Formbook)", "value": "9bdc0fa0a340aa9c621725a9e18bb9b878ad5cc1fe6f8a0a629a8b62c122113c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477232, "uuid": "1b7ca965-783d-40dc-a073-0902f31f5f5c", "comment": "Malware payload (Formbook)", "value": "1280e1958e431b426af9cd5a7db2d3b43f70b6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477232, "uuid": "79a37d15-6050-44ef-9b0b-1876b1327f82", "comment": "Malware payload (Formbook)", "value": "4de8776ad7190735311ee643112cc9beccbe29ce5b6b901484c7bb612637227b134b491087103109284e85288d13f175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477232, "uuid": "06ec2f6f-ec8c-445c-b4c9-f70eeaf0df46", "value": "T13255021C79E7E5CFC59A0E367B6580286074AC315807D6C7F8E9376F28BB3163C62296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477232, "uuid": "cb874db7-47b3-4c84-b6eb-0c5cab5255f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477232, "uuid": "a29cd93b-89ee-49c9-a2aa-df615fa0f2aa", "value": "24576:qyE9qs/uVmXZtaInPcJrHLAcn8RNFQL+leqVQABRUjB71Gmdn26:4ZtjPcJj/n8jiaeqmABujPlnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639477232, "uuid": "7a2ede7d-bb05-42c0-b1fc-ab7899815de4", "value": 1326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639477232, "uuid": "281f631d-1246-4d12-ac8b-8f82f6142680", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477232, "uuid": "7652a5ce-ceac-4b7d-818a-d9c169a58d09", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48e733a-5cb9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639471294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471294, "uuid": "ec43dd9a-1f5d-4d01-ba62-90978bccaf24", "comment": "Malware payload (RedLineStealer)", "value": "eb02f9e7735a4df9d7278facdb0e63aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471294, "uuid": "887668ff-1563-41a9-95c0-32ad8816509f", "comment": "Malware payload (RedLineStealer)", "value": "9c3b466a3b878805085dce939654dced5b7352f35593b3b9a91e5f5d4512f1d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471294, "uuid": "4c37ab00-b6b0-4562-b1f6-5560ed0f23cb", "comment": "Malware payload (RedLineStealer)", "value": "f3304aebd562c1bec51c6e2e4c837c147d07c810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639471294, "uuid": "caaf1f63-ef39-47c8-96f3-235557f079aa", "comment": "Malware payload (RedLineStealer)", "value": "40e81e79d62aef10c26d277bdd24eae726ade7224a9558a5e1c6a25c32a605c52402f78e1ede77bfb3a7a9ca36e9fd27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471294, "uuid": "38d26ea0-cd6f-44e1-816e-1c9a71aefe44", "value": "T1EF94D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471294, "uuid": "68bbfcdd-4f07-440f-b3d1-5c19808f668a", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471294, "uuid": "24f0cee1-8198-4757-a1b2-4afa363f4f6c", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639471294, "uuid": "1bd57eac-0243-4070-855d-be0d495a94cd", "value": 419939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639471294, "uuid": "7de59423-87a6-467e-8d3a-c05776e17114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639471294, "uuid": "35c99003-702a-45fe-b4f3-9a7a5ef95c43", "value": "eb02f9e7735a4df9d7278facdb0e63aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2e0be3-5ca8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639464060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464060, "uuid": "be0a3cdd-f56a-4a4d-8e7a-7e0479fdb88b", "comment": "Malware payload (AgentTesla)", "value": "b43384e65d6e4e600daf48e3afdf4935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464060, "uuid": "1c894fb0-c6db-4675-9400-137d049bd9bb", "comment": "Malware payload (AgentTesla)", "value": "9e02efdef11a04d001a22587afc579ae9c86d09d4864f4ac90ac4a0d337869ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464060, "uuid": "8610ee7e-a32d-4467-a43c-176eda54703f", "comment": "Malware payload (AgentTesla)", "value": "e34a8d170ecdeeaec76ed1bb8f16d115c3a688d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464060, "uuid": "49c715f5-9e23-4173-885b-708f6cdf5e2e", "comment": "Malware payload (AgentTesla)", "value": "3a6ee2a1aeab157a29866f49e4a71232e0a186abe4a760573847409f17375724fe243ed82dec337dec9a47ff7ba2037d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464060, "uuid": "e65a97f2-4ac6-47ec-90e5-57d99a1314d9", "value": "T102B4238EE15046F6F5F107730A712A38A6632C8839F5665A2F24B9773F73CE304A8567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464060, "uuid": "27ef57ac-3eff-4312-af0e-b2cebf1d1f3e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464060, "uuid": "54e5b6c0-21ac-40b4-b216-29dc47fb2f7b", "value": "12288:0uh3Nu5Oa41DMJWH6ukdRxz7WLRas5vfJcESyGs4nxc:0uh3NdaiDM0Xk17W1aEvw4ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464060, "uuid": "31bf7ce2-b2d5-46a2-9645-90a0a6871298", "value": 536726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464060, "uuid": "25421671-3b3a-42a0-a79b-2951991d2a39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464060, "uuid": "cd08a1ea-a912-4d38-abbf-d47a3721bfa8", "value": "Purchase Order 1212200205_PR21220055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71a32c5-5d0a-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639506168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506168, "uuid": "1f59b691-96a9-4a03-ad07-f1667ccf2f6b", "comment": "Malware payload (DCRat)", "value": "7101baa9566a3083a33182818a403729", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506168, "uuid": "b8dfbb87-678d-4da4-a59c-635dd0fc7d90", "comment": "Malware payload (DCRat)", "value": "9eb993a0a54cb16395aced5282b948d7d154722fe052e3f9cb139a34f063f04f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506168, "uuid": "7b5588db-7a4e-4008-a2e9-805ffe358330", "comment": "Malware payload (DCRat)", "value": "a8bc591709fb9cc115fe646ff72e3b9514d56c98", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639506168, "uuid": "a072f646-78a9-4aab-a0ad-c6ee83ba2a54", "comment": "Malware payload (DCRat)", "value": "fcbe4a9076bcc55f3de96e41fb94373167986270cebc8b3e10c38f9daa403716eb3a436ae056b9dbea827d73acdbb5f9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506168, "uuid": "177cfd9f-f752-4f32-809f-891d7e95d54a", "value": "T1CF5533DDCA2554E6D101F33EA0BA2DF99EE7D53B6472029F1DDC52A8002BF7222545F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506168, "uuid": "48714eb3-c163-4b4a-b4d3-097dca35bb32", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506168, "uuid": "5b96c318-1e06-4df1-9229-9a924c724719", "value": "24576:R1cKtXF3wMxJeBb30tFtLIONImGvKkjMHngElcYr4mc+6egZJSndbPX:gKtXFxq36tpNImIHjMAElcnDAgZknd7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639506168, "uuid": "1379d57f-c35e-4bb3-a8ec-c14e67c2a1c5", "value": 1312256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639506168, "uuid": "7dd495c0-8b12-47a0-9aa0-4d7fb336274c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639506168, "uuid": "4fa814a8-5bc4-4b8c-a86b-f573318154ef", "value": "9EB993A0A54CB16395ACED5282B948D7D154722FE052E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f3d086-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444909, "uuid": "5d343d42-c460-4eea-91c6-e8abcbc20b1f", "comment": "Malware payload (Mirai)", "value": "5559d713dcb123c2afdddc6a98207ff0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444909, "uuid": "cb702e48-5fb4-4d91-8259-b4088b71ae75", "comment": "Malware payload (Mirai)", "value": "9ee57866a3ad30161efb5a77f62e5cced29db24ab89909be0c47fb62049fa3fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444909, "uuid": "b53cac27-bfce-4f9c-94a2-9e797ac3c7d9", "comment": "Malware payload (Mirai)", "value": "52fd1eddbf261b6d54541e643e114930899f15d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444909, "uuid": "1717908c-24d3-440a-9152-2a8f5f8a24f3", "comment": "Malware payload (Mirai)", "value": "5be49211911d532585d0a7185294a99584aa0d2782257df516bea2f331da7286bffdde4d83a08abeb484f0fcde1279e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444909, "uuid": "8ac1e850-2d6f-4e95-8048-52f3438b15a9", "value": "T123C2D195AB0696A3CB301CF3E2E94EC62C80677A941E30D3F7E4A518749B4C168BB1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444909, "uuid": "ab09ff92-f161-45c4-a003-e7245a9acc0c", "value": "768:xE4mlJyFWawpnmQv/rI9vktdCQpJZxh2Iuc9q3UELWUR:C4ml88aw5marumHpJZLFoLWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444909, "uuid": "d8482971-80ad-4f9d-ba6f-c1cbea3f8301", "value": 26964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444909, "uuid": "2c2ff7bc-0809-4691-92da-2647d9e9ded5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444909, "uuid": "eb308628-29c2-4155-a934-14ae63a3a58f", "value": "5559d713dcb123c2afdddc6a98207ff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84899245-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497439, "uuid": "376c617c-3ed2-4b49-a1d5-6a7d78f108d3", "comment": "Malware payload (Formbook)", "value": "5ea9a54df6bf0928d589e6061a1a424a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497439, "uuid": "5ca6b9ff-abc1-41ae-8171-19d870c2e47a", "comment": "Malware payload (Formbook)", "value": "9f8906ad8010ef647b3efd1a27db09fb13f7e43261026d3ae4475740c5f1908a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497439, "uuid": "d1fd9b7c-e0f0-4de0-895e-7bc9c3296b7e", "comment": "Malware payload (Formbook)", "value": "dcce37653dfa705267dc580092fb37fbc7d8a608", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497439, "uuid": "097c683a-08c8-4f14-9662-d128e922b2c7", "comment": "Malware payload (Formbook)", "value": "c4b1d2f8c5529934dd14348d1cadaed233bd6189d5603c358ee570babcf5e23afd4e0f4a58cb4bb5db3458e9f3b4b284", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497439, "uuid": "a885b393-46fa-49b4-853b-381e1e586206", "value": "T1056412887BCB865FE6BEF23DB16884E0A0C0DE975F699415A484313C49B47A9CB717C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497439, "uuid": "5d3fe5b1-1be6-4c28-a128-e42bd6e8c141", "value": "6144:bdK//bZP6L9KRifRuDwRtxLbpt+z3bjnAtABpbLE3O0FsLpa2z8N8pc9we9N9lOV:bI/jRu9KRifYDwlbpt+zL7+UC3Dz2z71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497439, "uuid": "1d9b4b54-09ed-44ed-88ee-1ca3b3fc53d9", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497439, "uuid": "7fb63c23-5c8d-462e-9c1f-9f2b20921507", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497439, "uuid": "c15b6704-b626-4c26-91e4-2d7755cb6d21", "value": "10009.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5590d181-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639498649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498649, "uuid": "6d903682-5996-46ab-b61b-75c7e3b34396", "comment": "Malware payload", "value": "c8f2eea6a17bd22994f7ab25ed9384d8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498649, "uuid": "26166100-7fed-4367-b2da-924d7e3ef30b", "comment": "Malware payload", "value": "9faf6fef5c1c6411ef0ef7ef26b4907101174c2bdef9b83e5e0a6cf4e8d5cce9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498649, "uuid": "bd55e728-4190-4773-9bbf-479a4a4a56db", "comment": "Malware payload", "value": "252e6889ad9f6e05e24656afbadf1a9c59f87dc3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498649, "uuid": "3457cec8-8d73-4a68-b407-33c5d88664e3", "comment": "Malware payload", "value": "08a255e809a65cb1b5e00cf47b2da67a17d909325f8b96d4703eb55433ecc32bdf063a1aeff0730500c4d3ecc16feb5c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498649, "uuid": "6c2c79b9-5dde-4be0-a50e-c6b3bd1ae816", "value": "T11265F111B2C6CA3BD46E06B0361ED7AB45297D6447B284EB93DC2E1E1D729C04376FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498649, "uuid": "f06599c1-8efc-4725-aecc-b690bc891512", "value": "24576:YLbQ6T+QXle8AVLdPlABGKvbqhcmYsDbNgYEhX5UQ7toBRMeqajM4M5dY5A:sb7+QXllAVLdPl9KvaiHV7qjKbY5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498649, "uuid": "df47c4b9-ba11-4ed6-a4ca-92ace9c1f981", "value": 1428992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498649, "uuid": "b5509ab2-ae36-4858-8ff3-b7d0db0c1591", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498649, "uuid": "99a33ad2-3a14-4ed6-9c8e-89b2e2b0cff6", "value": "Deposito-Conta.pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f9a389-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639465947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465947, "uuid": "61efc1f4-ec26-48a6-992e-3d6cb7096eff", "comment": "Malware payload (Formbook)", "value": "96a18e4bc197a6e5570843f0ccc66968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465947, "uuid": "222eb416-33c8-44aa-82df-8a6ebfa3a05f", "comment": "Malware payload (Formbook)", "value": "a01fac63af4ec717a4a3473953e0e714b54a6daead8cac59c8f173d5860f07ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465947, "uuid": "3fc3ff11-fb5a-4ccf-857e-b3736ddf63a7", "comment": "Malware payload (Formbook)", "value": "c54dee48f43dd13698a9c6c9794f1dc615fffb84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465947, "uuid": "2f7613cb-631a-470a-afad-51cf9ff8daa8", "comment": "Malware payload (Formbook)", "value": "17ea8b270e7af497283a82fc250b3ad465ecafc1a5e28e71f3a427b58fbdfa44c9d78814bcdf4ad0c27650b9b11bd92d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465947, "uuid": "7783deae-7521-4e2e-abe0-3ab73079ce82", "value": "T1FFB4441CFEC13A66FD3D8130C9891A447B961FA722406B9713EB39CEB7AF0E65D45884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465947, "uuid": "a193a770-4285-4479-a90b-8e5468b679cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465947, "uuid": "6f3786db-9cbd-4019-8c9c-bb243b003c83", "value": "12288:VqYmrSbRpTJ0OMVGoQAePn4uylIztr9Pc:bPTJ03VGoQZnJtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465947, "uuid": "e615edba-4ca5-4ed5-aaaf-66735215e2f3", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465947, "uuid": "ad9e3356-9ade-440e-a2ed-d6124bbebac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465947, "uuid": "f456035e-365a-40e7-908c-974ec263e018", "value": "Product-7112203_IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3289e566-5d23-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639516629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639516629, "uuid": "08f7781f-bbe7-4c83-abd0-fc747c536f5a", "comment": "Malware payload", "value": "897b9bf001cf832673ce58090e28f1ac", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639516629, "uuid": "bf9b2a22-a6ae-46ef-ba89-c0d73e88df2f", "comment": "Malware payload", "value": "a0c7a560d6659170771ecdad2ee8b11602401ab5aae8ccd84deffb0119d6de44", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639516629, "uuid": "e98a9c5a-2586-42d9-8f06-66c545e3e4d4", "comment": "Malware payload", "value": "64e96203e6b9701dcb3310254c352947f2123dd9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639516629, "uuid": "1d0d2aed-c51d-4f35-9725-840cf8c1cae4", "comment": "Malware payload", "value": "3432179c90fed26cb3a187f0f2351fc880af2ba7b8764f19b3766f98087d61989e29d123b4a6a8237eafbba859bf7d2b", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639516629, "uuid": "99618f7b-043d-48d8-bb0b-e228631abc64", "value": "T13835334A3E9CD5473F5A9E865B8EEF003D5CA26659040114E3BFC6D81AD2DD93A22FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639516629, "uuid": "35191e2b-0862-4340-9572-f9cf61e9b5ed", "value": "24576:0BIurzrwkeMcgqqRa1VB060ZppSb4R605qJXdZck5a0soKvaC2:yhwkeUFUFwSb4jUqk01j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639516629, "uuid": "1de72879-129d-4b28-9940-e6c2783e4c1e", "value": 1086696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639516629, "uuid": "db779adf-40b9-4e79-9df6-0cb544f8001c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639516629, "uuid": "45a4a261-714d-468b-be5a-a388d58ee8f9", "value": "Invoice 3816 Outer Banks Report.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b225de-5c77-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639443002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443002, "uuid": "cc9b56f2-749d-4663-b69e-3415737c43d0", "comment": "Malware payload (Mirai)", "value": "aa644532398b17d1a884ed4f960adebd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443002, "uuid": "eeddb20a-0e0e-425c-96e6-60cf1dae5e42", "comment": "Malware payload (Mirai)", "value": "a19a5872ec517376dcb9df9b50d24ed7164aca44c4942f1ad8d47bb572fe98c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443002, "uuid": "b147ff4e-ab3f-457d-815e-6bfcc8bbc91f", "comment": "Malware payload (Mirai)", "value": "91d4a2a68dd5f8894147ffdaa0cc0d766671f550", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443002, "uuid": "5daf7c64-795f-448c-b6ae-298034cc69ed", "comment": "Malware payload (Mirai)", "value": "be53366daf2ea7eb615e55ebbda4932a6b9052f51c3923b6745cb2056005b73e2ccd593b88e9e27814a5410b3f048f1e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443002, "uuid": "0d654c7b-d326-41e1-a218-536089f7f7d4", "value": "T116D2E1F6C9884433DADD92782A6C9EDB9534ACC9479F85C328BEF45DB254730F22D082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443002, "uuid": "9234e0c7-255b-40e9-8b88-f1028aedf380", "value": "384:M0NyyqPqjQ3hAzBDhVeHjSZrujMSMKSbyCoD57aXtnFh9RHHAMHhaq3kVyLv1Rt:DAyqPZRAtfUHBMryCSlaXtkMH0q3kV+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639443002, "uuid": "88e5275c-de4e-49ad-9724-898179905c5b", "value": 28540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639443002, "uuid": "cb3f858d-a23e-4815-b843-821f628c0e1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443002, "uuid": "c9b35d94-7080-47fe-a967-93341329973c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dde13ca-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465511, "uuid": "fc7796f9-e5b7-4eb4-8d53-6533b4a01337", "comment": "Malware payload (Matanbuchus)", "value": "c0d8540e379db48d43dcbdb457a8bdec", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465511, "uuid": "b19fd983-e65d-46f5-8f1c-d0e556a62dcf", "comment": "Malware payload (Matanbuchus)", "value": "a1fbc175bac2c121b3e02e3de649af4bf7b5a0d23e50ddc000835f9bbe983422", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465511, "uuid": "f34a820b-ac19-480c-aebb-f55afe0be865", "comment": "Malware payload (Matanbuchus)", "value": "6e0e50c2a1dc1221d921f236fb4b86d242d8a2c2", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465511, "uuid": "fc577177-1fbb-4e93-8912-d28187eac60b", "comment": "Malware payload (Matanbuchus)", "value": "6c5e29608cea555ff89234a7e3a3ad116a2ab63953efb94d63e29a7a9636fd4fbb0f90267c8c1c4e1cb86f4dba77704a", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465511, "uuid": "0721d647-0c7f-4cf4-b470-9a9eca066313", "value": "T144B48CB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465511, "uuid": "f475aef9-1328-4606-b4f0-22d406acfd0d", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465511, "uuid": "cae16f5a-fc29-41b4-97d2-8b12578ebdcd", "value": "12288:hCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp13B:hfcqtGWdZPuQIDHaxarC3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465511, "uuid": "5bb4ed6a-88a7-4eed-b42b-d26448cd9672", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465511, "uuid": "fb7efce4-a1de-479e-9f4f-9604c9f4c24b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465511, "uuid": "2dc808ac-b83e-409d-863d-a26f1b542d73", "value": "a1fbc175bac2c121b3e02e3de649af4bf7b5a0d23e50ddc000835f9bbe983422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab4cbb2-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639464996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464996, "uuid": "da1133d1-4964-4a97-82b6-c8c9bb66b2df", "comment": "Malware payload (AgentTesla)", "value": "5c8e502ea0ffebd217157bb7b4b7d55d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464996, "uuid": "ed37b290-d689-4de5-8b34-497a7e4d25f5", "comment": "Malware payload (AgentTesla)", "value": "a3f9be99342c580b25c8e7ef82ce0d2fa224be7668a025eae8900950aa7e403e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464996, "uuid": "c105c033-7edd-4f4f-9020-d5582c99ca42", "comment": "Malware payload (AgentTesla)", "value": "9478533407ff0c8903c03efca65260288c5ae7d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464996, "uuid": "f270799f-619d-4538-9143-91413853553d", "comment": "Malware payload (AgentTesla)", "value": "5c3763488a1a7b709ca2e8333c0186b775e0c6f158353d25a4d83449f9c8c60fd74076a0cb6668998235eeb6cddd960f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464996, "uuid": "9c708ed8-592a-44aa-8ccf-937ccc54bc8b", "value": "T10F55236D3AE396CDD46543BA7B9C903C8371BE31520BD2A8F89A32E71937B547937042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464996, "uuid": "e2657b2e-73b8-476c-9feb-05d26baedda7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464996, "uuid": "77afa147-8f36-4589-818a-83135b0baecc", "value": "24576:eRDZYWForb+4ChVRYM4DrUHnHYZlO0VFvBIZpY/wbDtMDT1:eRDZYWov+4CtV4DrUHn+Qs/IZO4dMDT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464996, "uuid": "36fe34a0-b3e0-4085-b4bc-18407dc8ef7f", "value": 1377280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464996, "uuid": "059bb678-7cf2-49f8-b97b-8e198c146456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464996, "uuid": "83c01923-f169-46db-811a-0b745f3070ce", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e35e4e-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497470, "uuid": "3f8ff527-e44a-4408-a7a8-2f4b76be04f0", "comment": "Malware payload (Formbook)", "value": "3c1ff673e0dcacfbdd506d749ca666ab", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497470, "uuid": "52023542-b177-4137-b929-c66d16465119", "comment": "Malware payload (Formbook)", "value": "a4072a907dfa05812562aaa71ecf4e6aceedc0c7fcd9fe5507b3ae3fb6eb287a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497470, "uuid": "5608fef5-e0e9-459f-8dc8-e6eed44e7701", "comment": "Malware payload (Formbook)", "value": "36c09a25b3274cb504c7517deca8e8d722ac9149", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497470, "uuid": "29b79678-f8c9-4b12-a920-22bdaf13c52e", "comment": "Malware payload (Formbook)", "value": "04c2e3f63b5df8a5d1ac1ca832563d372f4d29e7f71b67b14ee86dc15bf123495fb948bafb169df1619c281b0e5e27c5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497470, "uuid": "76130160-f4c7-41d9-89af-2b37f64e9890", "value": "T1B764235EB02D7AB2FC1BAF756347A962472D9C76F50BD0C6B0BEB0DD43B42069A40784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497470, "uuid": "67ebe9e5-35e6-41a4-9b48-7e6a351b1a13", "value": "6144:AiFYW+fhgPqFjS1JmpZUq8tUr2gWLcWyFAmWufNeULfJBfG7sp5:AuTi9S1opZUZAP93FAmvFLfJ92sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497470, "uuid": "20f0058d-d82c-440a-b13e-746cd0363d17", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497470, "uuid": "b9218391-d952-4ea0-85bc-9bf90858a644", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497470, "uuid": "d8e2fdfa-e138-45cf-b04e-e99066bdaddc", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a139179-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639497905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497905, "uuid": "5d6bfb50-9bfd-49ae-86d0-888d666e2a52", "comment": "Malware payload (Mirai)", "value": "fb8e28d81f51abbeb8132ab0fae99889", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497905, "uuid": "587fad3c-2b5b-47b7-bcba-2547011eedca", "comment": "Malware payload (Mirai)", "value": "a464b82600a99a9b5084ff6c558970644fd425c40b14ebe899042376be761d60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497905, "uuid": "2b7275e5-e297-4297-b314-cda5cf4a6b99", "comment": "Malware payload (Mirai)", "value": "2510c6501bd970f7be7e075931414c9d3e3ce5f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497905, "uuid": "90aff3ae-8539-4763-9a5b-370dc6f806f1", "comment": "Malware payload (Mirai)", "value": "adcd92370b59443a0730e749441abd6220047583569c802473bcabac2586462f3ce326ff31d698876207e6dc1dea513a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497905, "uuid": "f6809e8d-2d49-43fe-b8b2-51b92f0b3f17", "value": "T14313F19C450801EEF72DF47E9E9467B51E2145937085BE0B52C7F26AAF481982073FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497905, "uuid": "b678df94-5140-45f6-a7a5-4047a61c32a0", "value": "768:LsTtzdAvAxhZvJQFGECgsVfPNAsfdjmsxt48SmN71KETJgGlzDpbuR1JZbzQ+BKP:LoUv0vJQFG9gQNpJSM11JVJu3Q+BgFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497905, "uuid": "39babd97-3407-405f-b049-d018bd864ee7", "value": 43948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497905, "uuid": "7fc37e66-41bd-4b22-9812-7e53c7b43f76", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497905, "uuid": "871f0a8c-c035-439d-9adb-e26dfad63fbd", "value": "fb8e28d81f51abbeb8132ab0fae99889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e916c4-5d26-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639518135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518135, "uuid": "f15c453a-0b7e-483e-aebe-83cbd4471995", "comment": "Malware payload", "value": "b83ea60088769df396e8483893994c77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518135, "uuid": "06afa0e3-f14b-43b0-a3ae-223e37c04247", "comment": "Malware payload", "value": "a5237c075063efcd0257ecfa5b2c88217668a0495bb5d857649c25679ee5972f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518135, "uuid": "a34bd78d-b56e-461b-9958-182fb4d6bd6d", "comment": "Malware payload", "value": "0e9c1d3c9b234af19cfe9fbb50351e982cae74c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518135, "uuid": "501a4d09-e46a-4641-8e48-0c210f4dc4b3", "comment": "Malware payload", "value": "e253dee306284cf58b81c3b8c38f730cdedb260b2e6c51bbf9382ae2d0d8b7fbc5f882415fe1f412a2bdb690a1548f2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518135, "uuid": "259ccecc-f100-40fa-8263-b347d0019456", "value": "T1ECC49E8273634102EE82FDBF1D13746F4399369DF950F8A2F58E6A6A303E2B53165643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518135, "uuid": "4bce1991-36b9-4059-8573-7204c4f47a24", "value": "c9628a85525bfe945f5e36dd40536a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518135, "uuid": "1be72adb-6ba4-404b-afce-0fbac24a7113", "value": "6144:kDwhfXAyRXuYDXCmFXayrX4S7XKyfXEyRtUWxXwEhXE65XcyjXuq5XqyHXoQ5XmO:hF8uFvRiXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639518135, "uuid": "7d01465f-f83f-4735-914b-cf88e654767a", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639518135, "uuid": "183939ea-6a80-40e9-9d5a-e4cc42921f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518135, "uuid": "50e24c18-6ec6-4d8f-9f14-c82a90cdd781", "value": "b83ea60088769df396e8483893994c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506a3f30-5c8c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639451825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451825, "uuid": "ec8b3277-59c1-4915-bdfa-048e62623cac", "comment": "Malware payload (AgentTesla)", "value": "a95913ce23d84f0674255991ce9bac5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451825, "uuid": "794e0712-6055-40a8-93ae-9e13c3c8fcae", "comment": "Malware payload (AgentTesla)", "value": "a62517b6bb39e465512ecbf97188c9209966b1cb919f9d6b70229d214d6330bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451825, "uuid": "3a4b7bb2-e946-4d2b-aab7-dc50cb76d530", "comment": "Malware payload (AgentTesla)", "value": "a07c5c3cd866779028260267b65b9fbf4a38ce7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639451825, "uuid": "059de183-a6cb-4de1-8c86-d4af4e1c6566", "comment": "Malware payload (AgentTesla)", "value": "18e849a3227e4e6524d0d3e768fbc9b7d6ee46fae5418ec16de842e367c3464aad9b81928729bde082cd82022496f80b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451825, "uuid": "96474ba9-1055-4f90-93e2-cbe7922ba17f", "value": "T1E765236C27579ADDC82902FD732C907843B9BD369503F288EC86B25B153778A7D73286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451825, "uuid": "53045053-96f7-4859-9593-b9d2f6c154b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451825, "uuid": "aa63cace-3159-4e0c-90d1-d2335665ab92", "value": "24576:YNyBDUt/plF5NiZ8JrITbkYdQRSYA4BC3BcPn//aB1eZpYNXIb+0rupDvIc/a:Y6U35Ng8JrITbGcZ4KBcPn//01cpYNX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639451825, "uuid": "8659a1f0-e9c5-44c1-8d13-14945c270e74", "value": 1422336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639451825, "uuid": "eccde46c-228f-49e4-b88d-a20a8383f082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639451825, "uuid": "4fe16127-410c-4846-ac92-a3dc2dae25f0", "value": "AY21USDKI02 DN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e161903b-5d04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639503608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503608, "uuid": "f4d8f6c6-a78a-4936-93cb-ac749f63f335", "comment": "Malware payload (Mirai)", "value": "72761d437b4b392ac1dd8b66fa888d8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503608, "uuid": "de993421-0ada-4355-ae07-45fa8833fa1f", "comment": "Malware payload (Mirai)", "value": "a6e2c1bbc852f68dd1c3f7befca34ca29005489913b5dd51861ffc7b98fd6524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503608, "uuid": "b9685edb-64fe-4dc9-b35b-2108085e3c68", "comment": "Malware payload (Mirai)", "value": "4c25ab05c9026de23f6c3f5c1eb05b63887b41c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639503608, "uuid": "adcfe633-b9a1-44b5-b110-38419ec69ac7", "comment": "Malware payload (Mirai)", "value": "8628aeee36811b90c68c4481b82a02d8990bd849ec49cecb2d1064dbe2b407dcf3cbbdd6b0deb7a146e79373cbf8271c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503608, "uuid": "fc239a82-2feb-4d50-ae6d-abaa92031845", "value": "T1EC23F1132493BA03E03058FA45628C8DB61AA7BDB1BF7BA725450E154C35D93ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503608, "uuid": "2098f484-e1d6-4c33-9ded-41090bc714e2", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iF99q3UELWt/iw+kvBGg6+fYtrBHa:E12O1LCNguovDPH7TcraLWhiw+kvBGg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639503608, "uuid": "f68cfbb9-01f6-4655-b2bf-f87d12d8163c", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639503608, "uuid": "5298fdfc-eee0-4731-a910-a82da56af61a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639503608, "uuid": "b4796248-0cfb-497f-a3c4-707d588d2b93", "value": "72761d437b4b392ac1dd8b66fa888d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42110d97-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639498616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498616, "uuid": "0faa5e37-346c-4a53-a22c-cceff9d66a4e", "comment": "Malware payload (Loki)", "value": "37a839ac72d2cdaa17ec15e45a3cd8c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498616, "uuid": "778a7afa-cf09-4f80-969f-fb9b5de8b7c2", "comment": "Malware payload (Loki)", "value": "a6fb347d6afd7da21673cd72dea473bf1a7133b0ac02a1ce75146644f781671e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498616, "uuid": "ac23d187-a185-48a7-baf1-2e9441434b12", "comment": "Malware payload (Loki)", "value": "30da39f56ec4284efbb9d24b74c5e1d7e4a2b7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498616, "uuid": "76650687-1c3f-4898-801a-9b0507cee839", "comment": "Malware payload (Loki)", "value": "a03d34da79f103fb20c543de4e436898702e81f9b050c5ce7e7198ece3f6d0155d498f9c912b752ad39e2aa0aa11b834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498616, "uuid": "65900036-5ed8-4806-8fc5-c5649db9c4bb", "value": "T1E6D40282B1D1C05AD8A41731AC69C8E801637C9CFDB17A0F7786BB9D69B22E3074F953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498616, "uuid": "457beaca-0fb9-43d0-8e30-d4f0fd12eb1b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498616, "uuid": "ca59e7e0-f565-4738-9f8f-b6e30b973d2f", "value": "12288:McSrYNQFUiMrJcF4N93XPgDORtEZPkEjvcqGG6CkhAt4ai:6mFiMVQ4LoaYZPkEjvN9rt4ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498616, "uuid": "c04bdae5-2b09-42a2-a45c-12a3dbd1946c", "value": 636364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498616, "uuid": "f2361821-7774-432d-b797-8165a0fd064c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498616, "uuid": "ff6fbe4b-cc39-4a3a-9b51-d1e94e10a63e", "value": "37a839ac72d2cdaa17ec15e45a3cd8c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189b7b56-5d36-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639524746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524746, "uuid": "14ca2088-d150-43a4-97fb-828ab97f1ad6", "comment": "Malware payload (Mirai)", "value": "e6015ad7c6c9d9f5b78c682c7188e213", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524746, "uuid": "3dfa4433-a83a-4a16-9226-5ca101a10307", "comment": "Malware payload (Mirai)", "value": "a70767db2c3b8129e7a789978c440467285787012c9753063d55f22f53d36b9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524746, "uuid": "b37d2be3-eba7-429c-a68c-b5211c3abee9", "comment": "Malware payload (Mirai)", "value": "f9cc0fd0b4f6a7b31969bc1f9ad03f322ab30ed4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524746, "uuid": "c4863812-1472-486e-aeb6-c1ec7e4ca468", "comment": "Malware payload (Mirai)", "value": "3d0621d173f7479023133539da60095869058e06dbbe4f21a8231eaec46df420a2c93da917be389e0b8ffe7a3df925b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524746, "uuid": "cd403273-8923-4d31-80c3-7692f5bd0dfd", "value": "T1F553E781BC41A629C7D11777FD9F559E3710A3C9D2EA32138C240BA07A8F94B0D67F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524746, "uuid": "51ed37c1-5bb3-4dab-b622-286ec804e2d3", "value": "1536:yrFgZtpnLNY/jImsCH7j5Vh/or33eZtoaUL:CFgZtpLNIx9foL3wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639524746, "uuid": "73c90739-85f3-484a-b34d-8e7d86af4a2c", "value": 62912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639524746, "uuid": "4a3ea7be-783f-44bb-83d2-da67dcc6cd47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524746, "uuid": "4420fe30-6a05-445d-82cf-c39b37f610af", "value": "e6015ad7c6c9d9f5b78c682c7188e213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e763e84-5cb5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639469377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469377, "uuid": "26db2567-f318-4821-8c9e-1eb3e669c6d0", "comment": "Malware payload (RedLineStealer)", "value": "8b9182e90d8320c54b1f281c040f246e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469377, "uuid": "aa19933e-ff80-4e48-b672-bf494f9d3e78", "comment": "Malware payload (RedLineStealer)", "value": "a7cdf8b7ac09ad07ce3b708d5c725150c74f29bc69b42c27b2be498b32c61a2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469377, "uuid": "cb1163ca-7195-492b-8d5e-14688e7515dc", "comment": "Malware payload (RedLineStealer)", "value": "95a5671bbae534d3dbd69e34a95bd7664318a236", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469377, "uuid": "d70750fc-8911-4c5a-8482-bf662bbfae2d", "comment": "Malware payload (RedLineStealer)", "value": "a99d7a20ae29f4a2b117f3cabef86f10003ea833d5bf8a3e5449b238b4ac96db563b691b46aa81179803187742e3f0a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469377, "uuid": "87b65a21-879b-402c-b923-2806c1544f07", "value": "T13B94D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469377, "uuid": "7b4458e6-4bf0-490e-bce5-2affb502d517", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469377, "uuid": "521f0e74-a0f3-4480-9ebd-00f33b2d769b", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639469377, "uuid": "5937cb73-e3f1-4059-a77d-c727585932e5", "value": 419863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639469377, "uuid": "c69d88ca-2b34-41cc-a1e4-2c6c46c932a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469377, "uuid": "9ed214db-012f-4b0f-b7e6-b2edadae05dc", "value": "8b9182e90d8320c54b1f281c040f246e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0f1a67-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639497960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497960, "uuid": "89c9d4b3-7f04-4fd9-a503-660762d2e5b4", "comment": "Malware payload (QuasarRAT)", "value": "f2ee53e7d74a14975f8a6b9cd728a156", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497960, "uuid": "e1e298fa-aeb7-4579-b0da-55a2fe14127f", "comment": "Malware payload (QuasarRAT)", "value": "a907be84fd31c3e486573199a29ebc2624310b18a4872ffe5ab9f45d74af58ec", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497960, "uuid": "2f92efad-877e-41b7-b83c-daac08ca5290", "comment": "Malware payload (QuasarRAT)", "value": "a6f6704592671ecd3aa231f5253174d350262795", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497960, "uuid": "2e28324f-8176-4d09-88ec-f8511fb2c1d5", "comment": "Malware payload (QuasarRAT)", "value": "a83a11fc7f37aa888cbd46645635d809fd74ecac8fd5cf3609f2be06358048fb02f09e5d9622ce746181ac7e6b2d79c1", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497960, "uuid": "6a703a0c-4e86-45ca-9890-75ad54152baf", "value": "T11904BF127694C946C95C43F50C92CAEE6E26FD399D9A479F31947F3E3F762A08C0360A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497960, "uuid": "2cc344e3-61e5-4263-80dc-f4992e397b33", "value": "3072:4RxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAfphqGswK/R3pCMxIJlUKl5tqhrenAjs:OxEtjPOtioVjDGUU1qfDlavx+W2QnAaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497960, "uuid": "b90b4ecc-864d-46ef-9a6d-7132c7a17228", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497960, "uuid": "c4298ce4-9a9c-45a0-a24b-3e93216cc58e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497960, "uuid": "d6c13e79-f583-408d-bcb3-c2ed70cc6bc0", "value": "Envio .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25597f52-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497709, "uuid": "486672e3-af32-4851-b68e-8576feb373b7", "comment": "Malware payload (AgentTesla)", "value": "1d4e4712244ce132f532c3e6df96427c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497709, "uuid": "32ba6afa-577c-4d3d-b6a5-2be21bc810da", "comment": "Malware payload (AgentTesla)", "value": "a919c876aad5b966d57262e0b0cec1053daf04adc8aba1ae6660948452b19519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497709, "uuid": "f2406c3c-46c5-4630-9f9f-2df2028dbbba", "comment": "Malware payload (AgentTesla)", "value": "eb0ab6f3b435095f222ed0d0a4174b42573769d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497709, "uuid": "4abbccbb-a262-4699-973f-c8454ad89002", "comment": "Malware payload (AgentTesla)", "value": "098729780347e233c7711ee86f4bf896b0d2396e8c47575f2a90eaf158daee1587d421eb33f6d623d941f01e0e0570f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497709, "uuid": "57cde73f-eacc-4e22-aadb-a7f877056517", "value": "T136E4021EBF8CBCBEC6CE88725D315369D23AFD39E2794242AE21BD4D447D2C1365A184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497709, "uuid": "5c2e0f60-103c-4d97-ba90-569b4594e4a6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497709, "uuid": "5dc8d24c-a461-4e13-bbf5-dc3c1001c6d2", "value": "12288:NutvkMq5ZSCd58o5aMH/bBbKVSiN1xDMqN94rloXNj0:NuhQr57LQ9N1JZi+Nj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497709, "uuid": "cfddbbf7-e206-43e3-8c7e-90d17ac06d6b", "value": 671068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497709, "uuid": "377044fd-4917-4cde-87a8-fc5ade446272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497709, "uuid": "91788c11-5252-4bd7-a7aa-e8223b88b1fd", "value": "DHL_AWB_NO#9078538809110022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c041ff-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497465, "uuid": "b8b80167-6c5c-4293-b1a1-a51f0ecebbb9", "comment": "Malware payload (Loki)", "value": "59f1e85f65d1db63b5559baf3b7036be", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497465, "uuid": "8ab2bca2-81ac-4d14-a0f8-a24565f799c6", "comment": "Malware payload (Loki)", "value": "a98aa853c49a492e7bc86080a00accc75e164230e3b3bb6080111865708acfb2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497465, "uuid": "88853fdb-9ce9-4b44-be7f-76192e3afaa3", "comment": "Malware payload (Loki)", "value": "d5c053fcb0b10fb522233b8257139594b27c9258", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497465, "uuid": "fbb309ee-0018-480a-88de-632e8acb41fd", "comment": "Malware payload (Loki)", "value": "4d2350b820bcef7401e31960bd13acaffa8cf7a78eae0b2fc929fe5eb9228b7222aeb301e589db83c158113294ea8d4b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497465, "uuid": "ae528127-698f-47a3-ae2b-1c6a0015d5a2", "value": "T1AA6412A67A6E84CECE2722BC83E5CB24015FFC12D32E147656BA760305707655F7ABB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497465, "uuid": "883162be-f0d4-469e-bf64-a8a3ffb7a019", "value": "6144:imKvBgq7n33QaPxicHpd/HVAUQ5mN/ablozqw52T8x0NtsJ:gvBgqT3VHXtAUQ5mJ8ozRINQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497465, "uuid": "5617fbb7-b4bd-450c-b415-eaf4978f1498", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497465, "uuid": "aa8991e9-a631-446f-ae0e-082c88e3c908", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497465, "uuid": "f9197bce-ff2a-4a71-980a-68bceb51a66a", "value": "P.I. 082-CTR345298.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709fe153-5ca5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639462617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462617, "uuid": "f24662c5-8cda-436a-8d45-1ab1aef6daa2", "comment": "Malware payload (AgentTesla)", "value": "0e539c67fe46656da23f39d88c0e5efc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462617, "uuid": "bef89cbb-fc4e-4313-9e64-f60d2f319bd8", "comment": "Malware payload (AgentTesla)", "value": "aa2e5f6e62ff33d42fe3392acb0cd941a83d84d7c0972f1b97b14baef7c7e7ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462617, "uuid": "a6a62f88-d4ba-46ae-948f-c6715f5e4917", "comment": "Malware payload (AgentTesla)", "value": "b03e8cd9682a203d2edc3c8333e51524bd9f1c30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639462617, "uuid": "da6e6a8f-39a1-4bf4-bcad-9c02c922b6de", "comment": "Malware payload (AgentTesla)", "value": "b0e801bef0cfce176ccb000b63f16bb0e3ebd27dee3c36e7bcbf6fc34d9785ad23147bb9e0b8035370e8e5c4abcb8b12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462617, "uuid": "717e5acc-b715-47ef-b8a7-4bed1d0c9642", "value": "T12575F18A3146DCDEE05325F2366ED03062B86DBE9027C60D7B86BB2B54E7302346775E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462617, "uuid": "6529597a-a03d-4ebf-86b2-d6c95ea46c4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462617, "uuid": "e9883299-c5b4-4aa3-ab93-f01c8460787c", "value": "24576:k04vu2TE/U962Sr3zEMglMIK8/hc9zPixqEluv8E/8seycAE4id8:t422T3QjDEX2PMhiDTEluv8reiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639462617, "uuid": "ab2961f1-ed97-4b61-a1d4-113a5f18bb24", "value": 1586176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639462617, "uuid": "fc65445c-cb69-4f27-9e17-5267434c9400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639462617, "uuid": "e2bbe6f4-b79e-45f5-805a-ae21a7c47d29", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c61119-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1639496450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496450, "uuid": "b12111c0-4da5-4207-8ea1-0493bfc88e7a", "comment": "Malware payload (Gozi)", "value": "ea96ae41f6dec70ce9f72ae9ef783c52", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496450, "uuid": "08de589c-8470-4d2c-9e52-7632a2ac68dc", "comment": "Malware payload (Gozi)", "value": "aa4d5569f00d3fed84a25b4a1adcf28e55150e01cd5917082fa9569f774b984e", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496450, "uuid": "7962bd6e-1b82-4524-89a3-7a776ddfa3b0", "comment": "Malware payload (Gozi)", "value": "a8782fb8f277df06c3d18aa3ed1eee9280bd096e", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496450, "uuid": "7f2c2d24-f877-4bf3-9450-c5144c1ad883", "comment": "Malware payload (Gozi)", "value": "dc2589a6bd426ff48058a3c88622cf24520b9ab771d6046d7a25247ecab3daeb6d208f0affc1e52509b154ae1f827547", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496450, "uuid": "6ad6b1e0-66c1-41a9-b45a-c09cd24c817a", "value": "T15985F6CD62C1870BE825627C3829D6B697156D472B71413E2E473EFF3A32746A68DE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496450, "uuid": "b689d4b3-eb66-4e3c-9278-80eaee474def", "value": "05e4e1045777d757fa17eaf53eecd299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496450, "uuid": "4993e4a2-8bd5-42d6-b635-fac27f7fc6a8", "value": "49152:t1w8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MO:ty8UQw8MT8UQw8MT8UQw8MT8UQw8MT8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496450, "uuid": "bad301e2-4f47-48ee-aa83-fc591f81a50c", "value": 1776800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496450, "uuid": "84e99e30-9bb9-485e-bc1d-f2b652e7ba60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496450, "uuid": "2f73211b-e843-43bc-8a38-4d360876c5e0", "value": "ea96ae41f6dec70ce9f72ae9ef783c52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fdb419-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639499030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499030, "uuid": "74528c57-c0e7-4596-9907-21d447f31331", "comment": "Malware payload", "value": "0865175e49c2828e0a84ea2d80a17334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499030, "uuid": "1a07974b-6250-4a9f-aea7-adea93ad44f2", "comment": "Malware payload", "value": "aaae3c6270dd40dea9bb17e13036ddb13f820c4e3ca44a9304a5d04237fa9bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499030, "uuid": "6b34452a-d80a-45f8-af38-c8395f613719", "comment": "Malware payload", "value": "f517b1b958a74a5bfec7c4ee133d6c3ca3a1cb04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499030, "uuid": "035807fb-3db4-4591-b231-34a8e80f87c5", "comment": "Malware payload", "value": "4faee481093657ad94d0ccda00f03516de87e4f95af47dd58e30a82f2e0fc8e4138b130711c32a3ecc87868cea8fcf97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499030, "uuid": "84456952-e6b7-4a10-ba37-2ed591ef7929", "value": "T17A64122A6734C462EAD30E310EB04FE69BE5EF5614A6434B73253B9C717A8897B0F741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499030, "uuid": "544c0f40-526c-4036-9f8d-df7a5dc52fdc", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499030, "uuid": "87d9c4f2-d233-418b-9740-681544a6b33c", "value": "6144:XgORacGGGJzm8Ul/lx4RBQjp7NXFRlvDunnwsq8xW0NyejKMU:XgxJXAKBQjxNflv8wsq880NLWMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499030, "uuid": "8c284255-a660-43d8-8d6c-9297ddf62a15", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499030, "uuid": "dae15be8-0457-49ce-a90c-5b4f573d9459", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499030, "uuid": "201e4bea-9c45-480f-b03f-caea05a76180", "value": "0865175e49c2828e0a84ea2d80a17334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a771f5-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639466089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466089, "uuid": "94be12a6-bf3f-43d1-b7c7-786a694e977c", "comment": "Malware payload (Formbook)", "value": "afa5d72011cc0ece88b5749654249945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466089, "uuid": "e969f3e3-af1b-481b-97ca-cab250798bba", "comment": "Malware payload (Formbook)", "value": "ab2034c05d8b6a3e415255b20630ffc31e681edde7514fcf38293185c44c47d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466089, "uuid": "b1d7e0a4-8f7d-4035-a23e-bf709cd7d061", "comment": "Malware payload (Formbook)", "value": "59c6bb47d638b2c122b94aa9ebb6577f71e08896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466089, "uuid": "08378553-1cf3-4acf-a799-7db9ddce9bc2", "comment": "Malware payload (Formbook)", "value": "22fe1eda4333fedfb6252531b52903ab94724b712463bbdea853e525128f38ee2666e5375ab60b03b26efcdd7ee9fb22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466089, "uuid": "f445aeb8-d511-4e28-acac-2d28e1b7a06b", "value": "T18845230376C9E526C539A7BAFCE2A02403BA76027512DE4E5CCBB7CAD524BE34D161C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466089, "uuid": "6eba6b7d-0bde-4954-8ae3-db0877854cdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466089, "uuid": "3ce5fdae-f280-470d-8a30-5b85df856024", "value": "24576:xLfCMER18SlIfXIeNoKWDr9ITgTXV8zjHl0IIjBm2IfyJCGFu7UzE01vntne:pfUzG1WDr9bTXS2IINmDfECG47ULXne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466089, "uuid": "3e0643aa-47e4-413f-8ff0-37c4cdc52cdc", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466089, "uuid": "75e69096-1825-4607-834f-58095d1b7c35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466089, "uuid": "7da437c9-c0ec-4e41-9ec3-f378e51ccaa7", "value": "purchase_order_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9a7449-5cc3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639475602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475602, "uuid": "d6932dbf-a78f-4f50-afe4-8e2fb6c91110", "comment": "Malware payload", "value": "adcaf3f9be39d9759a1da871251788a4", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475602, "uuid": "23b47b59-a85f-4f02-8d8a-f0e4534e4c59", "comment": "Malware payload", "value": "ab563d317842f89ea678c1fa6f25c9f0c871123527b35d6f0467860e70360825", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475602, "uuid": "3475b35c-f5eb-4259-a43c-a77d77c3e653", "comment": "Malware payload", "value": "fe8b5f040b4c6281458123b7ecb8550e18aedca3", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475602, "uuid": "b30a1d0c-5d06-49ea-979e-26a43335bd86", "comment": "Malware payload", "value": "b58cbae2f9ed174a88162ff7d7c4aae182ab00513c27019f4c9a82366c8bb8cdcbe22609eb8e7634fb9ab9e204f603e9", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475602, "uuid": "042d9afb-613a-4947-b52c-d7229560537e", "value": "T1F3828D396748A83EC71F9AB0D62EC188F50F41C3A38174AF791147A0DE4752B7AB1F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475602, "uuid": "fcd78d93-7af8-4870-925d-6237e4e345cd", "value": "384:lswGr9mwgmcc76c1bo8gTPyZotDFZdwBJwNeyOT4TO3wkzeK8KUF:eq0H1bgPyZODndKJOXOkTC9zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639475602, "uuid": "82b2fc84-cdc3-488e-a5b7-868dfb3cdf16", "value": 19154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639475602, "uuid": "23180cc3-1f0d-4b67-9cab-c18fe5621095", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475602, "uuid": "30ebb2d7-71cd-4c39-81e5-0aeab1a54113", "value": "Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189ec603-5cc9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639477931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477931, "uuid": "48b71097-e6a1-4fb9-9fa6-b01faa7ad385", "comment": "Malware payload (RemcosRAT)", "value": "90bc3ae48e8d67c598cd73dcbb4d01b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477931, "uuid": "28fea2d2-391d-4932-99fb-d82740e93552", "comment": "Malware payload (RemcosRAT)", "value": "ab7afaef1907cf72be47573572c6836923a3f336fa4d9607c00080f4241cbeb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477931, "uuid": "ff15b56f-f078-4458-869c-40d5761b08ec", "comment": "Malware payload (RemcosRAT)", "value": "eaf2eaa0f8bbe9761c17e49ebff5f81cf2bb7bd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477931, "uuid": "5c5c4d89-0735-4a01-a58d-c66cda91bdcd", "comment": "Malware payload (RemcosRAT)", "value": "1d3716899a806d23573448ce28c91e9dbca2b53942cb5d2498945d8e6ceb41ce39772142397e3235572316c353e1d6bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477931, "uuid": "42cccd87-3e63-4ac8-9c99-d6bac0fa7c73", "value": "T16D4523BC226395DEE83642F873AD507843609C726A0BD398ECC971EF19337A47923567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477931, "uuid": "5f3dda82-0f0e-4f87-be94-b770a712877b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477931, "uuid": "52288548-b712-479b-ad7d-7f04af509acc", "value": "24576:NrIxVynoCH1/R2QIOb1xH3QhUFt3ZR6dRvXgWPEnY3:6VynT/R2QIUnAC4VXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639477931, "uuid": "d5aa9403-5568-4163-b530-f9ed286a866d", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639477931, "uuid": "9b2b122c-7e07-42b6-ad51-34b53c29d485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477931, "uuid": "5277e342-ab15-4b9f-8bbf-78366c759b2f", "value": "90bc3ae48e8d67c598cd73dcbb4d01b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a41d72-5cbb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639472292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472292, "uuid": "f1e1fe10-0098-4b1c-b5e3-8d9fc79036a5", "comment": "Malware payload (RedLineStealer)", "value": "78b83d8da9273d6d39a4d419296df1ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472292, "uuid": "85e536a6-d46d-41fe-afb4-efd626bc88b2", "comment": "Malware payload (RedLineStealer)", "value": "ac30759bb6db02424de46e97faae66924a81b4972893fce91f81b6f3232936c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472292, "uuid": "9922cebd-b2be-4611-9116-df6307946350", "comment": "Malware payload (RedLineStealer)", "value": "bdeb862c9dfd8c326ea6b52c340bdec35725f325", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472292, "uuid": "2ec7de48-133a-4f56-a130-72be9f462e5c", "comment": "Malware payload (RedLineStealer)", "value": "173c354496ca74ebc38468ef5e7d4d15f30760b8cf3e33431dd5c1d7c543042782c7336a83274c307ab9d6fc1383c170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472292, "uuid": "e8329caa-c31f-4349-ad90-9b708a507599", "value": "T1A845D1319971A017D88B41F6FBAF4AACE54E5C40C78851D7AA38A9BB10351F0DEF3E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472292, "uuid": "601efe44-6ea9-494f-8872-3c349a0cdf85", "value": "5094bd6be83536db48f1eec7300c4330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472292, "uuid": "c457b0b1-9fe8-44ea-b04d-e8276fbd6383", "value": "12288:h5U7CPHikr9CwV3int6yWdO8Rxyk8k8k8kG:DUSH19CwV3it6BO8RxrFFFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639472292, "uuid": "65fa0c38-4610-41a7-a9b7-cb7bf70efcbb", "value": 1247661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639472292, "uuid": "f8e0ab79-104b-41d4-bb90-7b6a4afc126c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472292, "uuid": "2aadb345-1327-4cd3-b590-babe8a1c3692", "value": "78b83d8da9273d6d39a4d419296df1ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b35332-5ce6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639490487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490487, "uuid": "7df0dc67-cf2e-4929-b0b2-b5dd351d205e", "comment": "Malware payload (RedLineStealer)", "value": "b907023281025278fbaf0e493d21a60a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490487, "uuid": "93f0504f-3803-433a-9ce9-28ecd8b43053", "comment": "Malware payload (RedLineStealer)", "value": "ad60d2f981c4e43cdb5d7cf0c9831ddf77e4affd8e0e476be84f81b4b26b18e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490487, "uuid": "626cf380-fb05-4320-947e-e8abb9916519", "comment": "Malware payload (RedLineStealer)", "value": "6db50f354db19879050d178ed46a9c27db682728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490487, "uuid": "14730021-ca0e-4e2b-92b4-2671288a3e90", "comment": "Malware payload (RedLineStealer)", "value": "0efac73feaa3457d154f4b81c5cbbe2f7ed6cd3cbbaf980a7758ebbb46119436e9e44d2cdea1f3c3b937e50f64293c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490487, "uuid": "66902e77-cfe3-46e4-828d-433d45e09e10", "value": "T19394BF10F6E0D035F6B356F44ABAA378A53F7AA06B3850CF12C516EA4675AE1DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490487, "uuid": "28a42ee4-cde4-4d05-ab6b-022fc933dbbb", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490487, "uuid": "40830d63-2193-47ad-9cdd-4c61604b5d78", "value": "6144:I/zeCuXRBJU5o3hw/82JZzsBzKgoKAhvRMXcrmG7fRa1cYr9vvwCaDS:hC2BQ0qNsBzQvyXcSGrWcYr9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639490487, "uuid": "d0440b2c-ea6c-42d2-ab1d-edd35c3c63ef", "value": 443420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639490487, "uuid": "4ee5c890-3eae-4f0b-a3bf-8b387d76f449", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490487, "uuid": "5e7fb830-32d7-460e-9f01-492c60f6f843", "value": "b907023281025278fbaf0e493d21a60a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7926ccc8-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639500427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500427, "uuid": "9c21460c-539f-4be2-9667-550d2a4950ea", "comment": "Malware payload", "value": "43b41e5b5eb3b226f92df33288220444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500427, "uuid": "76082e17-91b4-47e1-a2ad-474fa7c78428", "comment": "Malware payload", "value": "ade0dff1752dae69f664f07bbb2c0892fabc9b35a33d13a63ec76943757d1613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500427, "uuid": "10ea64af-22b3-4699-a73b-bba499889702", "comment": "Malware payload", "value": "ca850294f0bde191e92645674f4f748d2b530178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500427, "uuid": "e85378d4-ce0d-4997-837d-a8ad379ca2f9", "comment": "Malware payload", "value": "c91e478e08d5f9b9b51261fa71448827b332594a114f1a8788baaa4bac501cbcd903233564f5522f383b79a0587e4035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500427, "uuid": "e37d918e-ca83-486f-b23f-21b04195bf1d", "value": "T190442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500427, "uuid": "6dff1521-a18d-443a-8c1a-a68c497c8f88", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500427, "uuid": "ea9987e1-bc59-4abf-82cf-d440eb08d52b", "value": "6144:8BABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:8mB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500427, "uuid": "eb3fd663-930d-4397-af57-d8ba7d013ff9", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500427, "uuid": "a8510e1e-c8b3-4c2b-adce-998aa4453ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500427, "uuid": "df38d7f9-3fc1-48a4-93c4-88bffe39083c", "value": "43b41e5b5eb3b226f92df33288220444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228d26db-5cf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639495986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495986, "uuid": "a829a4c5-be43-4f39-b92f-18571f42ec81", "comment": "Malware payload (SnakeKeylogger)", "value": "36a9c60b3b2728d23b7054f8f8eab57d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495986, "uuid": "dbd0464b-bb9d-4e36-86f0-7e1de9ad0fd5", "comment": "Malware payload (SnakeKeylogger)", "value": "ae6c7c929fa4b64f9c9aed256ccd9c07a2fa14640c51e5f1fcc7bf562c74be0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495986, "uuid": "75b97ce9-9663-4d03-b1c2-a83821f1cdc9", "comment": "Malware payload (SnakeKeylogger)", "value": "875b9886045d0055542ba284c3e9545ea07acd80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495986, "uuid": "6d41aab6-7fa3-4505-9cab-5492e83fade1", "comment": "Malware payload (SnakeKeylogger)", "value": "b9b8e8b130cc073480c79c25fd3bc1a4d171ef9920e3e1ff5ca3e75d8bd87d0391c4386608906dbf7b083e80831c6a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495986, "uuid": "4bef2887-354a-474a-9781-7d7ab5799c57", "value": "T1CC25226E26AB86CEC02A57B5333DA43853225D709A0BD388DD9A71EB2C377147D33653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495986, "uuid": "1c1d0c4c-ad58-417b-b9f2-3a502bec0b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495986, "uuid": "ae578db4-d03d-46f2-a8da-17ab8450c07f", "value": "12288:2Rly6R+r5HR5L1dMlF0K0kQ0BElLd7BbGIAa4U9xm7lcGDka1gT8C2hV3+Q236ym:whI5HR5L1dm9E0BqBbGIVi7aG4b3KQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495986, "uuid": "33a9e571-deb6-4204-87b0-830c1eb1acc8", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495986, "uuid": "f6902ee7-3578-44d3-bd95-46b10eec1f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495986, "uuid": "0dd21b60-c5b6-47bd-8637-745e22264227", "value": "l2XU5RkNeIc8UQf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d7e123-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639499027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499027, "uuid": "0f775c7d-e8a8-45f9-9ce6-bd2179c01317", "comment": "Malware payload (RedLineStealer)", "value": "1ba5ba04d0f9fafe6e8502223dcc7f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499027, "uuid": "2b78a693-133f-46f3-9cab-94a979f1f625", "comment": "Malware payload (RedLineStealer)", "value": "aed58975d52cdc147a6a09c6fbc17cb7be100e6ecd066c6c49ec75e6e1ed9011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499027, "uuid": "ec5108ce-4dd5-46b4-a5d0-556cdb54c78d", "comment": "Malware payload (RedLineStealer)", "value": "526b209ea7e035eeb4ae04afd1d5fc9ee16a2feb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499027, "uuid": "45b09621-77ef-4b23-8557-6646e1805b0c", "comment": "Malware payload (RedLineStealer)", "value": "b0ca9085727968c11aed9478b425f0b323ade50260ef8e86fa63ee3d9a6f4c86f70d0f935f87b05f11989ab7878bb6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499027, "uuid": "f12db563-4df6-4492-ba6f-328a11c34c79", "value": "T10994CF00E7E0D035F1F716F84A7693ADA92E7AA16B3490CF12D926EE5635AD1EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499027, "uuid": "99c9fa8c-093d-4cf1-a9ff-29cfeeb51c3d", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499027, "uuid": "8a7cfdee-42f4-48cd-9066-af8e527ac716", "value": "6144:QbCQ64VKPVtHAJ0MQmuQC9rrABBykitCaMW45S/NuF+QC+M2:TGctHAVuQq4BBykitCP5SgFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499027, "uuid": "ec628d63-1c3f-4a3b-912b-e2a003766914", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499027, "uuid": "d89595f8-c0c4-412d-a3f3-f5fd84478764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499027, "uuid": "f67eeb1b-bd91-4036-82db-8d74aa66908f", "value": "1ba5ba04d0f9fafe6e8502223dcc7f0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b816c830-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510411, "uuid": "554789eb-98ae-41c0-bc53-917bec8aefa0", "comment": "Malware payload (RedLineStealer)", "value": "dc587895f5a7128ff692be5a44ecde8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510411, "uuid": "8698bcb6-dfe8-4fa0-9b9d-86f6659fe0d8", "comment": "Malware payload (RedLineStealer)", "value": "aef765b0a188ccf547e620748caa34f33f455efc0ebc13d3e3e948a87c635c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510411, "uuid": "454ce782-61c8-44af-b90b-3f3dbd6d351f", "comment": "Malware payload (RedLineStealer)", "value": "6462341fe51c6676d2a6f901e85043e856cacad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510411, "uuid": "9bc9c86b-7147-4575-8ef5-85b85515c9fc", "comment": "Malware payload (RedLineStealer)", "value": "2ca767c666aefa98090e066711c50815be82ecc3deb6271173f396a2f2956d6bb86565b8cdceef45afcc764e3db2216d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510411, "uuid": "289673f3-b921-4cd1-a217-6f420c8648ad", "value": "T18625B80BFDC28A94EB76077A45F7A7144B6550D90F3B13C8A304A7EC4EC92AE1FC8965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510411, "uuid": "9b3fb4b3-d03a-4672-a2d5-91c51167161a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510411, "uuid": "4929aec1-b6b3-4742-bd68-4bb3098b0ace", "value": "12288:bLWetVA656h8VrvZj9W4zbck9pnXYdx21h:GCVA693WshY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510411, "uuid": "9ce1ec14-5a65-4474-8dde-ac77018b4bdf", "value": 987528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510411, "uuid": "a3ebef43-8867-4a40-9fa1-68755ff67543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510411, "uuid": "c6fd14fb-b8e9-4edf-a5d1-c2b9366ce2a6", "value": "dc587895f5a7128ff692be5a44ecde8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243084cf-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639498566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498566, "uuid": "17c8b32a-b7b5-46af-a369-4225d4614c20", "comment": "Malware payload (RemcosRAT)", "value": "2d65d1bb95a2a5f9d59040f6977db880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498566, "uuid": "edb30a33-36d3-490e-ab25-5d6db00a7dd1", "comment": "Malware payload (RemcosRAT)", "value": "b01817ff6de34c0c16eff5a320e1a30a6cfd77c751d698c1828e5b986e69ac83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498566, "uuid": "1501f570-0fd1-42bb-8e8c-d00cb10c8194", "comment": "Malware payload (RemcosRAT)", "value": "811797b49155247d1786dc52e5c74fcbe1cc9aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498566, "uuid": "3f23ace8-45d5-4ec7-a668-5f2be3cd838c", "comment": "Malware payload (RemcosRAT)", "value": "4defe691d5337836e9007fe1d587607c198c471d661080103f3fccdd82b67cfac1c69987a30337fbe32a66ff8e21cf12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498566, "uuid": "cb1bbb0d-5918-4231-9e09-52e3ed675fe6", "value": "T13DA49D11B9C1C032D17252700D29FB759ABCBC302935597BB3DA5D9BBE700C1BB2A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498566, "uuid": "e188b748-4014-4a82-80e5-6a37c1bc22e9", "value": "1f15bed3346039b42bc33c9080047f8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498566, "uuid": "7a0c8020-1ac6-4ebc-8a6d-9d9dc33b131e", "value": "12288:CegN0jfYLclGb0bVT6e+MT2MffZS/ghSYo:kNywLclGIeMT2MXZRhSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498566, "uuid": "0d6b431e-30fa-44bb-ad9b-905996df2483", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498566, "uuid": "a4ef396d-ab57-491c-8595-2d54d202c52c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498566, "uuid": "a0224427-bc1b-4b73-8e48-f4fc5a8bf354", "value": "2d65d1bb95a2a5f9d59040f6977db880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b1f9e2-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500422, "uuid": "ccb05f29-7e7b-42c9-98e9-662321a66512", "comment": "Malware payload (Formbook)", "value": "7a892ee7fe49ccceb9d173d9d0b70b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500422, "uuid": "13d6b2dc-b927-4b65-94d9-7eb5e4a27e90", "comment": "Malware payload (Formbook)", "value": "b05301021a46ef289074de0c30a8219e9240bc5a034b718406c9346bd50fe557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500422, "uuid": "22c9373a-53f9-449d-b69c-45f87a285c7a", "comment": "Malware payload (Formbook)", "value": "64a4a6d88ec9bf6066b2878cc41235f47e32bc45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500422, "uuid": "092dec0f-ffce-4c93-8874-20e909ec97a0", "comment": "Malware payload (Formbook)", "value": "e6d62807126dd574c03d1e549ed5484f58b9eb197fdbc847b190bc5057cc2f48a8714e63daf648eea68c6987ad74a05c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500422, "uuid": "0d691231-6076-4e80-a550-8c57a86a0b4b", "value": "T147A423A12BD9E0DBC2C6AB30463A4678E12E5735C05049CB1BF52DAE2E0E4D3573ED5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500422, "uuid": "101f9499-f84b-49e5-ae6d-7fd1c198cb33", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500422, "uuid": "faf849da-b354-4e2a-b797-fb3dafdad2c4", "value": "12288:lp5BBJbA0k2A2T+P9iZAVU3Q1C/+wD7VCzGaaTPlbXcRd:lp5BTbpy2ygZAVUAC/xQzGa6Plbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500422, "uuid": "666fb761-879c-459f-88b7-f2a404956bc2", "value": 469231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500422, "uuid": "5bc1efc0-7f71-4185-b6eb-bbdb92680e92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500422, "uuid": "6d4d1792-3c19-4705-9a9c-59a88f9bf36a", "value": "7a892ee7fe49ccceb9d173d9d0b70b48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91f322d-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500561, "uuid": "e39386c0-812e-435e-92fd-2381825fee7c", "comment": "Malware payload (Formbook)", "value": "728a5de7d05759a5a6540783bc5a9d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500561, "uuid": "3886280a-434f-41c9-ab7c-6b3a1f269823", "comment": "Malware payload (Formbook)", "value": "b08566ce39dbea0844687536343181f23e0095b066d6b31d32e651d18f2c9bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500561, "uuid": "67b4af56-1eaf-4a6d-af25-e39e2ef1de2c", "comment": "Malware payload (Formbook)", "value": "0af0ce607e1f2f9b00d8460ae6339abcbc9779dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500561, "uuid": "71cf9434-fa45-4984-aa9a-b338c6c5b3e7", "comment": "Malware payload (Formbook)", "value": "3e39cd989ac3c1e1fb34b6d864969fee86520039fed8cbb8ded8bcc9b01b59a836968b13ed0fbe33ab13abd40fd61bf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500561, "uuid": "d2f200b4-5e04-446d-90e7-b4211e268ecb", "value": "T1DB45D0407E95C907C21E0FBA58929040AB70E866BF47F3877DC973EE159BBE90841B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500561, "uuid": "1e7a7941-3e63-4084-87d4-961d05ac97bd", "value": "6144:TK6LwjaIPwVs8BTl0w2qj1SZSwkCm1VJFq2WnV54qbCiXKo0LkS:TKjjavVs8XVMZXkCm1VJFqzVTCmhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500561, "uuid": "ddf98556-02e9-41be-90d3-2705c9476fc8", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500561, "uuid": "23d174be-bf3d-46f4-a952-b29e0fdc09fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500561, "uuid": "329307a3-ccba-4764-bfd8-3445288f6541", "value": "728a5de7d05759a5a6540783bc5a9d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e51453d-5ca9-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639464358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464358, "uuid": "76141731-dfa4-44e1-872d-48303fb2ffcb", "comment": "Malware payload (ArkeiStealer)", "value": "6a867d3f9f9b64aa6de13ae6aa4bcf6f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464358, "uuid": "17bb502b-89af-481d-ab14-5a93102ac256", "comment": "Malware payload (ArkeiStealer)", "value": "b10629d72dbb4a8ee27c2bb4f0343e241bda9c8fe740cd0eecd4888fa67fb5f0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464358, "uuid": "4c717e90-2547-47b9-ab3b-3c7f64f06609", "comment": "Malware payload (ArkeiStealer)", "value": "76f8355eefb4ff8cfff98f6523f012d389037d0a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464358, "uuid": "0eeb0125-7246-4eae-88ad-28046c8efaf2", "comment": "Malware payload (ArkeiStealer)", "value": "02c3c3cdc028573d559059075fafbecc1989fdb5c15273f0e0141a1e0b69581aa7f734143b4c2a9e7fbde3ecefc6cabf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464358, "uuid": "3b19b4e4-784d-4e98-891b-de0832dcdfdd", "value": "T1F3F4010077E0C034F6B786F4597997BDA93F7DA26B24A1CB62E556EA0A346D4CC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464358, "uuid": "4e77b0d9-2165-4b93-b6ac-3670bcba7f89", "value": "fa0d97a230fe11fa07527833b096cd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464358, "uuid": "52e28492-d988-4a1a-8a04-01d0f2c06d85", "value": "12288:J3oFlUhWMuo8yLJXprHLNAHFQkCiBWfAIapf2CIl2L3GhukD4:JmUhzuoFNHLNAlQkLwfAIal2VeGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464358, "uuid": "087f2583-b739-483f-9b61-c3b31891f7f8", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464358, "uuid": "8e85373e-b00e-4ddd-b3d4-7f33c5c85c12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464358, "uuid": "0732048c-8d6a-47f1-82dd-3ff02bdb1d2c", "value": "6a867d3f9f9b64aa6de13ae6aa4bcf6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4df2a77-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639500500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500500, "uuid": "665e0bcc-47d6-40c3-bc91-266f445e3d56", "comment": "Malware payload", "value": "3ea7a411aa5c00361ca8f9cc14c8de47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500500, "uuid": "ae086ab1-0799-4c0b-89e3-4dafe81c79e3", "comment": "Malware payload", "value": "b150db70cb7a9278879c1056502d4153b9585e0fe322e33e56d94d86608e25fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500500, "uuid": "8117e0a9-a725-4dbd-a8ac-f1ec9e47ccb3", "comment": "Malware payload", "value": "1aff55cc82749fbae02787ee2dff457acf435d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500500, "uuid": "5c043063-06c1-425b-a7ba-b476041c991e", "comment": "Malware payload", "value": "adcb07f6342462c2577050c4b7dbcd3e0eb969dc58ef2f075aedcf6204944e8bb51c7fea1e5c3e45b873d7cee33929bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500500, "uuid": "72fd6580-df9d-4dbc-ae01-579be2ece967", "value": "T1BA529F22D155A1E3CC97423418CACADCC1D0127B59F3A26FBE13C9B0BE4835AB5965CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500500, "uuid": "7e745e0c-a72f-4b1e-a54a-fe45c097a882", "value": "384:6a65ki8C1ZI/drGxpRqJTinYut177BRwwfzo4Td:6z56C1S/drPToYunwQDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500500, "uuid": "dd0892b6-9525-4415-a446-62033e7f5cb8", "value": 14343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500500, "uuid": "4530239a-e0ae-4f9e-9727-430a1c496755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500500, "uuid": "2d2b8158-16ff-4350-95c9-7a1e964fec86", "value": "3ea7a411aa5c00361ca8f9cc14c8de47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a22177-5c7a-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639444068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444068, "uuid": "66212ef6-35ba-4953-b814-9ed7dcb7cc1a", "comment": "Malware payload (ArkeiStealer)", "value": "4a6e6e132252a4954a2739278303d144", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444068, "uuid": "b2a47376-6a6b-449e-82e5-5b6003c8c38d", "comment": "Malware payload (ArkeiStealer)", "value": "b1fa6b38fea30230e53050f59599d3789582423035f71cd0a85d3f6f87520f3e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444068, "uuid": "8138e066-5306-4336-9ea4-dd64c68b7fca", "comment": "Malware payload (ArkeiStealer)", "value": "a277f649027e34ac18aef5a5609642220beb10f3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444068, "uuid": "ddf29a2d-8375-4cad-a753-c891fc9f0dc8", "comment": "Malware payload (ArkeiStealer)", "value": "c8565c14753e390cfd436a841d153621ef401846230796a8ed5b9e9b68ca343c49c2f583b55f9c52c4eca2158925adf8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444068, "uuid": "af13d1ee-7b2a-4211-a55b-6233594dc457", "value": "T153D4121134D2D436C1BA0A31DC68C3B56F3FB551A938410F3BA42BEF6FA32916A15B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444068, "uuid": "1bf96ff1-370c-40ed-86dc-c54800153cd5", "value": "794b7cd20ec7276fc8d2300f9007d7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444068, "uuid": "5e43cb66-c0de-41ef-8d5c-a2e11c61f6b8", "value": "12288:B8WrVO8nU0fuNHYgI7FFvQJUxCIMWhrVjhPgL8eV8id3Ji5Y8Vo38c:mWh7U0uHxgvhrVZgL88R3JiyF8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444068, "uuid": "bd939100-940a-4474-9b1b-eaa4ae3ea652", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444068, "uuid": "5a2f322b-de24-43df-bb8e-0c6f66a6f720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444068, "uuid": "5aad2b64-1687-48f8-9a66-f20b2d544442", "value": "4a6e6e132252a4954a2739278303d144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319589f8-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639499018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499018, "uuid": "077cb23d-093f-4449-afb2-c72ce326a293", "comment": "Malware payload (Mirai)", "value": "60dac62f2b1e8cc0174e266aaee9ebb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499018, "uuid": "2623eade-50f6-4307-baaf-405c5f1f06fd", "comment": "Malware payload (Mirai)", "value": "b2ff075a53b9544e6674f0bafd20cb795dc5f20d45738b73a1c66d2f42a1cb68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499018, "uuid": "b941fe7b-60c3-4dd1-9b2a-bd06240a9a6a", "comment": "Malware payload (Mirai)", "value": "a708da192b5a23d220c0d0b0f6f89a357de058c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499018, "uuid": "cce4d6a6-c345-4cbc-b383-ac6448291df8", "comment": "Malware payload (Mirai)", "value": "8bed0991e11c9e70ae4a7df90c28117110bc68515a3186f7caccb7cbf79b8266d20bb893553b67f3f400d345d8aa2f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499018, "uuid": "5a80e769-67bb-4dfe-8965-d05dc526a2cc", "value": "T13703E1E7C522BB51C978E13B71FF38830528D56EE1438EF7AA845138AA05E0C7A5C79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499018, "uuid": "467ef479-b51e-42b3-9582-7294ee1fd0fd", "value": "768:D4QnL8q7HOtmhhfQEFH7fP5BRFpB6ByC9+p3Lf/EwiJronbcuyD7UHQRjqDmGeSs:cQnL8mcmhtbfPFrEByC0pD/Kronouy8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499018, "uuid": "70e78b02-47c7-4469-bf9e-9441f92ac42c", "value": 40560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499018, "uuid": "cc2567d3-2564-421d-90f4-96f3f6c3be97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499018, "uuid": "43505868-5cbe-4eb3-bde4-a4db31fcba3b", "value": "60dac62f2b1e8cc0174e266aaee9ebb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4ab70a-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639504485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504485, "uuid": "76887d21-4b6e-4502-b499-a078dc1ef7f1", "comment": "Malware payload", "value": "94674ddcbb18564ae83e7f88954a76d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504485, "uuid": "81e03c28-aaa8-41c7-b58c-0ebe0e95dcec", "comment": "Malware payload", "value": "b5334d7f1855536729093e624f9a5b548cdf0c74db12aba62280f7064090e4a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504485, "uuid": "a751663b-7628-4ae9-9a11-d9e64a9b32d9", "comment": "Malware payload", "value": "35436129c1ec328ec9cc4d33691704d2b7405357", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504485, "uuid": "7cea9e55-5e21-4af4-a9b6-7532ee52b0fe", "comment": "Malware payload", "value": "2db82605ad54c3f09921ec55b80c8c6b717b848474c76ee34aa790d2c45a27655bf37b640e5555928fd704674c7795f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504485, "uuid": "082fa62e-b8cb-428b-aa43-c351bba7c667", "value": "T12855236E2A63CACED06102F9B33E606893625C319107D5CEEDD972FB1D23B657933A05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504485, "uuid": "40f78592-5b3c-4456-afc5-bdac98504b48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504485, "uuid": "decb724c-2fa8-4be4-98f1-aa2568f604c7", "value": "24576:EilMB9DDGxNlKuucNik6KrNdTp1C1bjR1W3gsL+6V:EigGxNQuVNRrTCgPCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504485, "uuid": "dc3d902b-a0a0-49f6-86a5-0f0ebaace6f8", "value": 1344512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504485, "uuid": "770523d9-4596-4b40-9d37-1c7ce74eaa22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504485, "uuid": "434bce81-fc8c-4d14-b936-90d6c3026981", "value": "94674ddcbb18564ae83e7f88954a76d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f816f3d-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497699, "uuid": "11d38d9a-dd66-493f-84cc-48a47499459c", "comment": "Malware payload", "value": "bb965eb19f496582f09495058b283233", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497699, "uuid": "1de95af4-695b-4e6f-9590-b63442bc67a2", "comment": "Malware payload", "value": "b56a013ad8d81fecd22776f22af4fa928867a8fe6c33a626362f850d61f6a014", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497699, "uuid": "343746d5-8062-4f71-a000-1488f084053a", "comment": "Malware payload", "value": "904f5e9af714a247c4fefcafea9c450c5801883b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497699, "uuid": "cdcfad47-61de-4350-a7d1-1525470fe8a4", "comment": "Malware payload", "value": "774baf24459914c47333c0b5b11bf4bd1a9b2363229de4562b0500409b5c5d1390432416ff2daa297d749d88f0b0a335", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497699, "uuid": "92c777f7-87fc-4509-b4fb-5bf3d4f2bd49", "value": "T18935127C3A979ACEC42953FE3329902853A22C36460BD399FCCB32D71923B557937616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497699, "uuid": "f8cc6693-ad23-4ced-9fa0-4d115bd043c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497699, "uuid": "29f5563c-b4aa-47cb-bc79-b8859186f9af", "value": "24576:B2Kb2XifuLmTUUQX3lnnqg4mBiiBbDsz4w11cVTBWUXrmxL:R2ivTAqgNBXtDs/1cLWUXix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497699, "uuid": "4248acdd-2190-4f0c-9d0b-dd5470dfdf51", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497699, "uuid": "dc4b5316-a2ae-4675-9045-cdbb18fe0bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497699, "uuid": "84040b8e-52a5-4311-8d80-de139d0fd781", "value": "DHL VN PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9dd02f-5cbb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639472275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472275, "uuid": "cbc85a80-955e-4a35-8b02-6bb61774eb84", "comment": "Malware payload (RedLineStealer)", "value": "a33d56d125b2eada0d027498a59bac7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472275, "uuid": "3d2258ac-3d6f-4c82-a512-4c2c45f65c44", "comment": "Malware payload (RedLineStealer)", "value": "b5c5a619893322e0672ca2b514b749a08d33c1d0652ae6afad31955d804ac479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472275, "uuid": "d78cf2e9-0b4a-4f0c-9c82-598cab4029de", "comment": "Malware payload (RedLineStealer)", "value": "e7f23e5c434c6790a976a54de314937ddd642fa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472275, "uuid": "d2246cdb-6134-485f-946a-c1c376671e99", "comment": "Malware payload (RedLineStealer)", "value": "dfede92189141ef78d12a7d8c0462834f2a24646b5e54145277e7954d0a60d89fa1f9f4dd016ee6679197d56a84027f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472275, "uuid": "51e96118-1cd6-4266-9f62-7e71c00e182c", "value": "T1B494D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472275, "uuid": "0573f92c-4042-4aa0-a0fc-071a12b94778", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472275, "uuid": "33adf9fd-600d-4cff-b582-e077da4289ad", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639472275, "uuid": "160f9f09-d6bd-413c-8853-c236189f34e3", "value": 419884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639472275, "uuid": "d0e6a75f-8ac7-4bf9-a641-31ed6645c4a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472275, "uuid": "6ad77ec5-9c04-4cf5-affe-4f3b927dca93", "value": "a33d56d125b2eada0d027498a59bac7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ca76d7-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639465086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465086, "uuid": "3217f67b-650c-4be5-8271-6fd1b7ac38e4", "comment": "Malware payload (Vjw0rm)", "value": "abc0656ab4c966d440a154fd0174684f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465086, "uuid": "57e04b77-be06-4296-824b-eab9921e6a9c", "comment": "Malware payload (Vjw0rm)", "value": "b6977bce6d9b944310f27e7febb8dfb8315ab7b589181d05a46c86ad6793fb18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465086, "uuid": "5a1980e9-f129-4f26-8468-9b94ede3d1c2", "comment": "Malware payload (Vjw0rm)", "value": "d8a46b049aaf91a52871b9b63317502948c3840c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465086, "uuid": "ba7a7daa-6d87-448c-bab5-401ec297bfc5", "comment": "Malware payload (Vjw0rm)", "value": "5340f8eb7ab7a492ccda7d3dcd25a740f6502661eb83ff38bf94bfb9f94701fb8d41e4d5c487c5f5b2887ec77d1cada7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465086, "uuid": "da16b240-a851-4123-8ed9-62d5108ee31f", "value": "T19463C7C06BC6F8C1024767BBBB1A70E5EA1E5CD872CC487EE044F854F0ADA59E5D5A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465086, "uuid": "3edbae95-8000-4037-8868-3323b7f52cd8", "value": "1536:SGbp2mKBBI6R7bpBZK1p3q/WIEdwcEG80516RO:SGd2mKzdpTMp3q/WIy+K1UO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465086, "uuid": "c1583744-4581-40cf-bf95-5d5cbeece937", "value": 67813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465086, "uuid": "7ada9ab0-ef35-480b-bd8f-0f9b16f23f40", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465086, "uuid": "248f4d10-1cb3-429c-b31a-1537cc0ff8c9", "value": "#00958.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05ee2db-5d05-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639504063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504063, "uuid": "dbae9e12-dc6d-459a-9740-3f3120bb4bcd", "comment": "Malware payload", "value": "c7921fc31d76845c0f69e6046b19a54b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504063, "uuid": "5742388d-e488-49a1-bb34-555b63df4f9c", "comment": "Malware payload", "value": "b70c26b8d08a6a17aed3e8372c24281f0efbd185592143d48bfbb38281688990", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504063, "uuid": "830b1a2f-bb98-42f0-8586-4d8880676570", "comment": "Malware payload", "value": "a190a9479a11ea44312b4e63bba99810ba467db8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504063, "uuid": "77c2810c-658c-4c47-876d-6d257af27e25", "comment": "Malware payload", "value": "962c56185dce31c26e5c5224c142c8fcd934c0e5fa59b0e3a00e0d6bb046867477bdc51d81e14250e7adfdcf6ca186a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504063, "uuid": "f810c89d-9dc7-4ace-bc2c-8807b349ab49", "value": "T16D9423EA1AD68A77EEA347B290B353ADF676F9D001154C1B17F5AE79BC70AD30E08140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504063, "uuid": "4db60371-b5fa-41a2-a5ea-de8e07d2bf4e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504063, "uuid": "1f87689a-56cf-4d3f-9686-80f4501cbdb7", "value": "6144:rGi82rIdeq1Q4NZups9IpF5BdIAWUR3rsThKJ4uXSgGKUZK1pq9I4ZaP2g6xXpyr:CcRX3wd8pSgGKUE1pqRZaugwxqnkqJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504063, "uuid": "f2c31b69-48e5-4df6-a2ba-524755b7cdd0", "value": 439807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504063, "uuid": "412b1f7d-aebf-4632-849a-0d77a2fa483c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504063, "uuid": "49558d7a-1970-4ddf-87bd-84c486e064ce", "value": "c7921fc31d76845c0f69e6046b19a54b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6be6c5-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461613, "uuid": "d98f6143-78af-498c-a467-71736335ad68", "comment": "Malware payload", "value": "4939d1a6b56a67fbf224611d74779fc3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461613, "uuid": "4664313f-a7db-41d1-aed8-345c13de8b08", "comment": "Malware payload", "value": "b7599ca19a30f8e095954f88acf5a623ef86bb2e5b1c8d0befc2ed680576c48b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461613, "uuid": "79b57625-3294-4268-aabf-3dca57fe9a68", "comment": "Malware payload", "value": "4cc07317e896da36bf0a5bdbd711e6281ee57685", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461613, "uuid": "0dc99210-f7b2-4146-a884-3b4c4600e373", "comment": "Malware payload", "value": "c1ff1dcbd18f4cf2d34183183e862eb09afba7309dc25800674c579f5cddb56a906ecf6efbbf80bbdfc668c403736bb1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461613, "uuid": "c3e0b883-b477-48fc-8ab9-7ef27fe591b0", "value": "T15D65330822BB7CD4F9EB053937621894C3B932F1C045B09577981CA656772FE538EEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461613, "uuid": "7af0b8e2-2b1f-4a6a-8f7f-4937dde0eee5", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflri+O:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461613, "uuid": "4fdbcaaa-a067-4ced-9358-118e91bbc3a6", "value": 1482752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461613, "uuid": "d789d40c-2065-4eca-8b9e-2c84fdc8378d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461613, "uuid": "7582c43f-6a9c-49ff-8de1-e86b1b0ab8b7", "value": "b7599ca19a30f8e095954f88acf5a623ef86bb2e5b1c8d0befc2ed680576c48b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f439fa5d-5d05-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504069, "uuid": "aee4f51a-196c-40b9-b5c3-bed3b34fa4d2", "comment": "Malware payload (Mirai)", "value": "9603ce689ab84577c14de61d6c1eb386", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504069, "uuid": "6479c387-b7ac-4192-b237-79e30e8e4338", "comment": "Malware payload (Mirai)", "value": "b7ccf6d0de63c4d93acdc1bf13721a32668820c44d8fe8c03bcd9f5700ac0f21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504069, "uuid": "805f78fa-3cc2-41e3-b8f5-eaa2b4bf2f33", "comment": "Malware payload (Mirai)", "value": "e9f6e5978315a0cc00cc1026bd6f3963b03409d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504069, "uuid": "9047aea9-4d95-4343-905c-4d1c9fa15f63", "comment": "Malware payload (Mirai)", "value": "fad8bc636fda106a7388fb4db005fa3a65e33db5ac867ee491dbf1640b437f34bc2ea681da06fd437020d743f0c46565", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504069, "uuid": "7c9b1a0d-9112-4824-b7a6-fbf4ba94e696", "value": "T187B2F1D5D6FB17C3C3918336E0BC9A0ED6721AC10346451A1109728EA6A764E9BFB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504069, "uuid": "ec788b08-c599-43d2-a6ef-1233f6b6a893", "value": "384:MCDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPLj:P/QOC0Yhn6ROHWFGrcwNVFCnNBxcgic6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504069, "uuid": "e891c0aa-4199-4e38-879a-7a89e06a199d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504069, "uuid": "3b14119c-2cfa-468a-8cfe-28848050becf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504069, "uuid": "ac62792b-ff86-41b4-9d13-6f3141be39df", "value": "9603ce689ab84577c14de61d6c1eb386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894619bc-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639500454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500454, "uuid": "8f9720bf-fc3d-42a8-8a92-39533f75f48f", "comment": "Malware payload (ArkeiStealer)", "value": "65e46fe2c56497223a71ad4a9c9b1ec4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500454, "uuid": "ad3a46b0-4d11-4a70-9f4c-51a228a8d6d7", "comment": "Malware payload (ArkeiStealer)", "value": "b88aad1338febc8d57e4ca2c1ad019db43001ba3ce2eb7c65bc207a3cf775d3c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500454, "uuid": "f39ffc9f-2aba-4b46-9da1-5971509f0549", "comment": "Malware payload (ArkeiStealer)", "value": "f3e8a850df7550bdabbc6d47db9dff38d47ba5de", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500454, "uuid": "ef1f86cf-e754-42f8-8bf6-a171d376fb6e", "comment": "Malware payload (ArkeiStealer)", "value": "b3c9b8be2ab95bf14f113fbc930d6163884d5b5beb2616a350688c28e8dee877dfca161ebb17743dbfe38a4a4d5fdefb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500454, "uuid": "461e2d5b-2b39-4a0c-b70d-96029cb81f11", "value": "T1FE14BE12FDE1D472EAA7493084B4D7A42DBBB8616760514B73982BEF2F333904A35372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500454, "uuid": "5bb8abf6-370e-4856-911f-a3cda4e7dffc", "value": "ce74c352c7a68a20cfb87163e6a8e0ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500454, "uuid": "d1d0e73a-9e0f-4a90-a109-18dfcf18b8c1", "value": "3072:iGA8fdcIsVQDPXLgqJRdSupLuyoqoX8CB65O8hsRUp4wkv8XG:xsAPXLTJbSs4XNvPwkvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500454, "uuid": "9924313d-c1cd-480e-926a-21daacd73d40", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500454, "uuid": "c3485778-4ada-47e4-9b7d-42a205f5a0d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500454, "uuid": "e34afff0-a04d-4d49-978a-5b74c46bb249", "value": "65e46fe2c56497223a71ad4a9c9b1ec4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a43c922-5ce0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639487812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487812, "uuid": "2ff7d764-d8b0-4e1b-b26b-364ce208e02c", "comment": "Malware payload (AgentTesla)", "value": "3855ae7751f30daaa97839045b27dd23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487812, "uuid": "701f8acd-a8d1-4b43-9d9a-cc09d2adbebe", "comment": "Malware payload (AgentTesla)", "value": "b8cf5aa5caf04ec3bcd4016961e6a163b36cf8fd13824e9ee1a99546b6d9b4d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487812, "uuid": "21c9359e-9662-482b-8d61-449d42d9dc45", "comment": "Malware payload (AgentTesla)", "value": "0d0ddb254ef15ee5561a7366f2c1dfeffc29b2c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639487812, "uuid": "f520b7ad-47ce-4efe-aad5-a7476c143d69", "comment": "Malware payload (AgentTesla)", "value": "9ed1293ef84416984a19aeca040cc4b77495ac3f0df3cb2624573cc6537b95f2851bb035a04a3e49b0e8236396b9adc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487812, "uuid": "8accea5f-5e11-47ff-8713-a2233f31f713", "value": "T15435227D2A239ADEC46507B833B9806843715D766807D399DECA72EB1C337897873227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487812, "uuid": "f39fa28c-6fe2-492d-8d25-1de72aabf06d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487812, "uuid": "d16d1a12-3df6-47fb-8a22-bd04048fd129", "value": "24576:IRuB2/vKUqb29yx0YxT1czUKTNxco8pqGuDuGddPmMIMnTuCb:IP/sboGxT1czxZ18IGu64eMLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639487812, "uuid": "0d72c141-2801-4801-90b1-fa88869f3ce0", "value": 1141248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639487812, "uuid": "894bc456-7dec-48fc-8577-32bbfb8adb49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639487812, "uuid": "4fd97bb4-dab3-4a18-84b2-e548f51b6590", "value": "Transferencia_pdf_______________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d731da72-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500584, "uuid": "31149a35-9c19-487c-8399-6000e2de06b2", "comment": "Malware payload (Formbook)", "value": "a73d6ce97ea7a3474fa89ab2616af9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500584, "uuid": "04eb092c-68a8-4fc5-832b-bf7c752f2481", "comment": "Malware payload (Formbook)", "value": "b94f37134c31d499c2e8e3d952cb81c1453d211d1ecdfc2eaa32cc8f6b5c5604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500584, "uuid": "091b0662-57eb-4fe2-98d6-8506f3846ec1", "comment": "Malware payload (Formbook)", "value": "a4d7bad44c7d2d783e864433abb09aa5ccb531be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500584, "uuid": "e24ccd97-d682-4122-a5e2-98c6f4460e7f", "comment": "Malware payload (Formbook)", "value": "4e6a878786f6a87cdd066473d933e623a504805444fbda63c0fe8f30d4e60707af85bcacefca4cabffe3943c4be02530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500584, "uuid": "8dbc0102-ac80-4203-ba5f-7ac07db7eca8", "value": "T11CA4231F3ACA8E73EF864A7014B4BFEAC37594EB8671DE17075C0F4A860ED8B5225245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500584, "uuid": "d501ede6-3994-4109-b15d-53b36cffdcdb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500584, "uuid": "0b3a4d63-8edc-42e2-8b9d-eff790762fb4", "value": "12288:yUCHXoxIBgVFBSkvP3RO3OA4KufTjg3DB:1IXoxAgV3Nr5PsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500584, "uuid": "d486e7a0-1b08-48e1-b747-d7e4869a84c1", "value": 471139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500584, "uuid": "f08a608a-9c26-4388-9183-6ab0e404a39b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500584, "uuid": "1f52f5ba-9cbb-4990-a00d-f3f746fff7a4", "value": "a73d6ce97ea7a3474fa89ab2616af9a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a69663-5d30-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639522216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522216, "uuid": "7d760b15-ee67-427e-9806-af5f1358de7a", "comment": "Malware payload (Mirai)", "value": "c56c2637c26242ba745e4783d8004dff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522216, "uuid": "9c4062bf-0566-4b12-bd9f-d119726a93f9", "comment": "Malware payload (Mirai)", "value": "b9642b1ce7baf2d5be48aa582dbc9c016ff71ab1a2c4d9956b339af2f9effcb6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522216, "uuid": "260db12f-df2b-42fb-9394-a4c6c0122288", "comment": "Malware payload (Mirai)", "value": "6dff06cf5da79d26f12d984d7d1000945af48686", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522216, "uuid": "c99e8c18-fdc7-44bc-b910-d0cb1683ecad", "comment": "Malware payload (Mirai)", "value": "e18991eddc980043004ff8e9fd364230e753f31c80cbfe8e14951cc9911f9f6c83aa9cb223546b26a3739e741c87394b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522216, "uuid": "63ce8ec1-3906-4276-870f-74284011b865", "value": "T1B4735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522216, "uuid": "79a55f24-dd1b-4c5b-9006-d0c3f89f12fa", "value": "1536:b/DYQYs1ZokODichWf15UzOHIt09lfsH18ruUGDKVQSi:zDhzUkODichWXUzk40D0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639522216, "uuid": "4e42b6e9-ddb4-4d8d-b501-76f450adf264", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639522216, "uuid": "b48195f4-38b2-46d5-b183-5bbdfcea437f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522216, "uuid": "3810bb77-b4e5-4e7b-b8b5-150b99c02b31", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c46e888-5cdb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639485748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485748, "uuid": "298b382f-1653-4df2-9ee9-3ed1aae781f1", "comment": "Malware payload (Moobot)", "value": "2db3c96d7b24ffd4f9faeaad72129398", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485748, "uuid": "7bb754c9-8464-4db7-86ee-c4a7a266df3e", "comment": "Malware payload (Moobot)", "value": "b9cd5ac2e90d0e0cfd8a1b51a2b0bc44d09a90d8f0c8460b000beabc973217f8", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485748, "uuid": "15d896c8-ae86-4d94-9b09-8e32f8520115", "comment": "Malware payload (Moobot)", "value": "4271e76e8066d4690b4153b6d5b06baceffe1553", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485748, "uuid": "72528d34-ef66-44af-a270-732c3bd4f63e", "comment": "Malware payload (Moobot)", "value": "62537513485dac2644f7f9299e65d20ce330a821e6983f9f7ee7ff03ed5bfe9a8516bf3b2b8b9eaadd34e804be0f1e70", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485748, "uuid": "3f2116e5-a53b-4b99-aeef-329339acd2ae", "value": "T15443E80AFD81AF01D4D822BAFF4E114933935B98E3FEB1129D116F15A7CA91B0F7A452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485748, "uuid": "19b0db29-a7b0-4007-a2f7-4bf0d00f7de0", "value": "1536:h2nfLb+3OD0QDKoDKNsJwlz6kmxdlImiLsp8/FwbZn5d:kn+MeoQsJwlz6AzspeFwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639485748, "uuid": "f3b72970-0b23-45c2-93bb-e4a088fd9fa0", "value": 55600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639485748, "uuid": "aa25c2d9-21ab-4ec9-8c66-8c5358ca875f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485748, "uuid": "33333bd8-e9d2-449f-a519-31b1cff753e9", "value": "la.bot.arm7-20211214-1242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515a0d9b-5cdd-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639486616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486616, "uuid": "4453f483-aa32-480c-af2a-3861fd44ea4c", "comment": "Malware payload (RedLineStealer)", "value": "aea82234b25b35274211d1cd02e7d40b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486616, "uuid": "dceeff08-ed12-463b-ada6-632472170a6e", "comment": "Malware payload (RedLineStealer)", "value": "bacc1efc1d9c207d8540688bf8146e531883a9525a6fbf3514d00ec942d648dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486616, "uuid": "b585e519-b1b7-41b6-9fb4-a6cd98a2c2c9", "comment": "Malware payload (RedLineStealer)", "value": "b678bbc84fee0363e14ee0e8863cb9f1ca45b1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639486616, "uuid": "778583e6-be7d-4514-b6b2-dc31167c49b9", "comment": "Malware payload (RedLineStealer)", "value": "48c11671de30d447a0bafa9d08fda9bdb39c3dd365b3711479d8c954ef1870351fe6343a5be41ba0ca253f35f8ee1730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486616, "uuid": "25d71115-d1ee-4e8a-94db-c6b9b3cc6cc6", "value": "T11494BF10F6E0D035F6B356F44ABAA378A53F7AA06B3850CF12C516EA4675AE1DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486616, "uuid": "1cfb7016-d4dd-4552-97d3-930fd80636df", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486616, "uuid": "c173a90b-fd19-448b-8a2c-f1bd2b4e3072", "value": "6144:I/zeCuXRBJU5o3hw/82JZzsBzKgoKAhvRMXcrmG7fRa1cYr9vvwCaDS:hC2BQ0qNsBzQvyXcSGrWcYr9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639486616, "uuid": "378ff4fd-fc8e-4b4a-89d3-16e3a35b6f38", "value": 443450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639486616, "uuid": "dc55636c-b96f-40a7-a3f2-0a1b9f14e54b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639486616, "uuid": "b9e65770-c93f-4778-996e-a77fdc0ace29", "value": "aea82234b25b35274211d1cd02e7d40b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ecd4bf-5cb6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639469814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469814, "uuid": "198e77e1-946c-4bed-aac1-5853a2ae6f89", "comment": "Malware payload (AgentTesla)", "value": "7a295fbfa8c323bad21c4e6e274e0e81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469814, "uuid": "e003e496-ab38-4a09-b8f3-7409db38a9f2", "comment": "Malware payload (AgentTesla)", "value": "bb60b94304b58edd460a43682ed89e19d21fdd38138e7980051f72bf9718a420", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469814, "uuid": "94324780-9e5a-4fb2-a618-8f10babe4f44", "comment": "Malware payload (AgentTesla)", "value": "990aba12276a68562960c94928790140a4aa36ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469814, "uuid": "2bb337a8-fc4a-42e3-81ce-f65207d07d2f", "comment": "Malware payload (AgentTesla)", "value": "73304986541067a23d120bbc56b3b9fe5c80cd62c5f5ac750ce8dc5c8ed320cf2b176dfb92e116a75a14fefa37b4accc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469814, "uuid": "bca438e5-31ef-471b-8062-ba6846b4480a", "value": "T13D4512AC3943EACED9510E763B5A80206165EC766603D387FCCD32AF286B7993913357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469814, "uuid": "a5b381cd-0e4e-44e6-a81a-d15807744081", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469814, "uuid": "5762e1d2-311e-41f7-8327-f0f72af09817", "value": "24576:+3Oik2oTGtAIkQe5Cce5rcmqkO5vwNfIXNsiKQ3Agb:qCSwQkKxcmqkYvKiS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639469814, "uuid": "28119087-b6f6-48b9-922f-91ed48c4274f", "value": 1203712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639469814, "uuid": "480c8cb5-f76f-4003-a4dc-76808de9347b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469814, "uuid": "3c38ada2-6519-4fb2-85f2-c4d3845599ae", "value": "PO-I20100309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ccc8ae-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639495644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495644, "uuid": "feee1a32-a8c7-44bf-b9a0-5b5fd4a64f5b", "comment": "Malware payload (Smoke Loader)", "value": "e55f5b2140e7c407b601e4209b26c98b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495644, "uuid": "8611512c-49b7-42df-9959-eec4a5ba32b2", "comment": "Malware payload (Smoke Loader)", "value": "bcb678c7e63c738d09ababd33e601269d32973ba2a0938bae7ec1f8773419e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495644, "uuid": "822758ba-ece1-4681-8c78-e84c2944791f", "comment": "Malware payload (Smoke Loader)", "value": "e0b83aec53ba7cc69a2661c76498d0bd3ef03f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495644, "uuid": "c00c007c-9185-4e2a-8258-4c2f34d986c8", "comment": "Malware payload (Smoke Loader)", "value": "fe49b0953ba6e84719217e0115da8b6167fff61c63ad7fb19d81581abb1923559650b5af0485e1969c19e2e90d7531cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495644, "uuid": "3d518605-1cde-4408-9c51-64ffa18069a5", "value": "T1A8649E0077E0D435F1B752F85AB693B9BA2F7AE15B2490CF12D526EA1A346D1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495644, "uuid": "c13af6ec-077d-4f4b-a4c0-c4fdef7029f0", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495644, "uuid": "50425b30-b039-41c8-94c3-f907e07c9390", "value": "6144:ZSpoiHXwTaM5F3mka8QwGdsXrILNJ+HpNJ89J/hQCKG1e6:ZcoiHXGska8Md4roApNAJ/TDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495644, "uuid": "e7669e21-228f-4d12-bb84-35e276dd3941", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495644, "uuid": "6bd50d0d-c0e3-4683-befa-4ebf60df6152", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495644, "uuid": "a033f957-92a7-44ca-b389-d135eb80c761", "value": "e55f5b2140e7c407b601e4209b26c98b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6995686d-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639464752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464752, "uuid": "917b8c7c-de36-4f11-b0e8-f486d02c0f07", "comment": "Malware payload (Formbook)", "value": "a12a0a824c7dc16da6bf6b207a66ba02", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464752, "uuid": "1d0534f1-abb7-4288-b2d3-166c14aa7047", "comment": "Malware payload (Formbook)", "value": "bcdbef6304823efb53fc024bd5f2915702ec5e5d73aefe23901ad1b30a005beb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464752, "uuid": "8d4e0b22-65cf-4d40-b8e0-32d7abb52888", "comment": "Malware payload (Formbook)", "value": "ffb5b6270d470ea9a50f8bebd8ce8f7e5146632c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464752, "uuid": "95b6dd39-b48f-4750-88ae-e6b9d4ca2b00", "comment": "Malware payload (Formbook)", "value": "fc7f0ecd10c6284564d5bf7fd52a46571ac42523917134bf39fa9cde8f3d0464a339075dd3e3815517200ed0954283c7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464752, "uuid": "405d6e88-cda9-4b9b-99d3-b082789515ed", "value": "T12645332C0BD4D2469AC1EE8EF90D40696F962D07D717429082B3EE9D367259C2E3E2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464752, "uuid": "8f5d4719-d807-4038-a4cb-6e6b3b52f7e5", "value": "24576:zF/Mm8u2DCv5Bn5tAfm9RJcodPXit/ILPLkSFsTvY2I8ncCrEoa:zlMmf2qBnbCm9do5IrL7sTv9/rEoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464752, "uuid": "bf209c5b-1150-4870-ac25-c60b496b3dc1", "value": 1236463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464752, "uuid": "4a003b09-a2b5-4378-a30e-eab10bdab5c4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464752, "uuid": "f51ea07c-2e77-45cd-b88b-813036fd5f2e", "value": "Nueva cotizaci\ufffdn.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fbd248-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497385, "uuid": "bcc6e482-2926-483f-b4bb-01f313067e18", "comment": "Malware payload (Loki)", "value": "8710cdf4bdd549570e73749a0071db74", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497385, "uuid": "c7166b4d-ab5f-4ea5-beee-f8b1ab1c1a51", "comment": "Malware payload (Loki)", "value": "bce532cb1fc1759b8886ed2e80ab315bd4270032276687ca492e01c5f83809bf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497385, "uuid": "ab8dba7b-b53a-4d67-ad09-4364c2e63916", "comment": "Malware payload (Loki)", "value": "9c75ad162d2a737b016c862286cfee1579cb149d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497385, "uuid": "53122841-6a4f-4309-ad48-e28ff9ecd5f7", "comment": "Malware payload (Loki)", "value": "ad4a82f5d41b9e6cda6a3cfbd373a5d21aa3e3f67db90f742e8954af60e262ae6a227e3b11d262b7e9fd26394e918cff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497385, "uuid": "6e8eaaed-9fbf-48bc-8a19-bab9438581a7", "value": "T13E711A94554C560BC543E8F8E9687E270393F34686DB5AC0777CDAB1072B3717A23E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497385, "uuid": "c87ede47-29ee-4db5-95ca-4a64dc70d209", "value": "96://0v78i1Nz8kn5EUSCQ4WUHsFx1EyDCAmub://izzr5EUa4IFDEnAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497385, "uuid": "c8bd8497-95c4-4d76-b6cb-5489bcfdcada", "value": 3688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497385, "uuid": "7ed74a5f-5c78-480f-8744-1ad318fff049", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497385, "uuid": "97874a9a-8a15-4f27-bfc0-bc41929e285a", "value": "cat\u00e1logo de nuevos productos con la mejor oferta.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db21c9ac-5c9a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639458071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458071, "uuid": "d82ec20f-9d4a-454e-abc3-9e8c65396159", "comment": "Malware payload (Formbook)", "value": "20006004966fb9a5dedd0d40570569b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458071, "uuid": "f6121dc3-50be-436c-9d5d-26b1e90b30b7", "comment": "Malware payload (Formbook)", "value": "be36f7b67439a45588b41b9c19a15bfde3545ddd5eef1366d2610831260d40fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458071, "uuid": "bed88ef8-d27c-4abd-8d45-884161a553fb", "comment": "Malware payload (Formbook)", "value": "9266770ef06d324994a44b4a453d958291de509b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458071, "uuid": "9795c403-78ad-441c-9eee-b3fcaff59df0", "comment": "Malware payload (Formbook)", "value": "0bc360938b35c345e9f531225be45ee70df7beedb7f0425e813bc9cb4c8a1c574c33e0370c6a3e9314766e62cdb21dae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458071, "uuid": "d7e16945-e101-462c-9dea-4c2982ae8489", "value": "T19255236D2A97E6CFC46503BE73BDA06893B56C35910BF38AEED4728728337547923121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458071, "uuid": "22447905-12bf-4cb8-9c5d-3408fa7cc20c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458071, "uuid": "469497e0-2c0c-483e-b44d-b9b5a547366e", "value": "24576:jY52jLAW9VOkLYLZeDh4Fsuvvb/5GtLrZl9joRgR75M:jIsAWjOnF6WWavFGtfJoR075", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639458071, "uuid": "7e4ab7d1-85f0-4c80-9f9a-cb1316fa98af", "value": 1351168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639458071, "uuid": "ffa68053-6ed9-47ca-8c62-22550835c4ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458071, "uuid": "9cad42ef-74eb-418a-a6b4-6e5a6db326df", "value": "20006004966fb9a5dedd0d40570569b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353489f2-5d30-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639522217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522217, "uuid": "b102f0d0-38e4-4999-95a3-9fcbc1616cc4", "comment": "Malware payload (Mirai)", "value": "8dbaa4a09d6f29b92a45245288d33435", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522217, "uuid": "58e6ad61-d14d-4425-8d5f-5bc92ff101b7", "comment": "Malware payload (Mirai)", "value": "be63bf934cfea5d3daa255abda114e961cdabf36f13baba11bfc63a0b39058fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522217, "uuid": "cea339f0-5536-486c-891f-11fd02ecc6e3", "comment": "Malware payload (Mirai)", "value": "93d898626cc69c83e0acebfc02e6927537eea7c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522217, "uuid": "cfabe5d0-6b39-4f44-9c70-4302106926cf", "comment": "Malware payload (Mirai)", "value": "60f0b1be499126abb3f62fedbcf79ac4775ed0890e7e6f8bac8521001c74e171ed33863f2ec35fac185729d80b39001a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522217, "uuid": "3e569ddd-4d48-49bf-843c-49be28798867", "value": "T128833981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03ADB95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522217, "uuid": "47761382-f020-4282-a834-b9780343ef09", "value": "1536:JOOFQKx7ghLCMw9/eQdu33eZtXpFN1W5lqlx131vn:JOOWKx7rzde3wfg503bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639522217, "uuid": "6f2ef4ef-c50d-431b-932e-c29402a5813a", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639522217, "uuid": "b1c58eb5-b7f5-476f-97c5-c93238f9567b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522217, "uuid": "4fe8c879-001a-4aa4-8bdb-2859098d7e84", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30badbde-5d15-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510613, "uuid": "1a29b10d-cdf8-459e-9631-4caa4430c1de", "comment": "Malware payload (RedLineStealer)", "value": "fe28bac5766443d3b3c1cf4df82adb40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510613, "uuid": "6f2578c0-255f-4e18-821b-fefcb045aaae", "comment": "Malware payload (RedLineStealer)", "value": "bf911847aa3801ecda557e720347cf7910248d352f5ad8c19f20693c627984c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510613, "uuid": "0b4dd6d3-536b-4efe-ad69-109be186d495", "comment": "Malware payload (RedLineStealer)", "value": "ca5ea7e863ffaf825c9ba9951f03ee372d7b1030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510613, "uuid": "7d8c826f-8f69-4dcd-a2d8-e188dcd851fe", "comment": "Malware payload (RedLineStealer)", "value": "8b2b08b2ee8f8c8f6379c8926bd813bbe69321f9dc3d6ada2ac769f1e4c922894eb83141ab5c39dc09647fd7808cc308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510613, "uuid": "29499911-c58e-439c-b031-e4ec5c7fc524", "value": "T10394CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510613, "uuid": "4c69b466-c740-4b1f-84eb-d3bffea2ce9a", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510613, "uuid": "5aaec9a3-f930-42fc-b1fd-f19cfe15a8de", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510613, "uuid": "28f3ddfc-9578-4259-bfb7-8c0cf4ee4638", "value": 441874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510613, "uuid": "1d6c42fc-582c-473e-85af-1b7bff5c2293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510613, "uuid": "132dd8b9-3773-4289-a00c-0a3757c58724", "value": "bf911847aa3801ecda557e720347cf7910248d352f5ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad494f3-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639497745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497745, "uuid": "6b974cfb-d6bd-4000-a0f2-bffec049b414", "comment": "Malware payload", "value": "b77bc84169c165e809ce0108d3f6c369", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497745, "uuid": "c3450fd7-5da6-4be6-b390-942dc1b5169d", "comment": "Malware payload", "value": "bfd583ee858a42df8683f6fc4f5c0b12ce5bdbd6c9a830033a89bf0e6c58fedf", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497745, "uuid": "13b80ec0-2001-4411-bec2-702be3604906", "comment": "Malware payload", "value": "03fbe703b3bce44850352e63ad5527a640cd0601", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497745, "uuid": "4bf82f01-0e72-4803-937d-5f939fa11f90", "comment": "Malware payload", "value": "e69622938ed8488c73f598d95f44859bdbb4c2f1d561b213a618785899ee6bdb2df71a48d4a862e926c9d5647d59a002", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497745, "uuid": "0fca8413-e33b-437b-8fd7-a47b2c00eaa2", "value": "T134217C015BFC4224E6B78E72287BA3508772B915AD67D66D4198D39C1CB0A18FE35B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497745, "uuid": "1394ea6e-8822-4e70-99e9-d340349c4c71", "value": "24:8MJVbzLWesDA3OZ1+/5XjCpk+/Clk3MZp7o0aPfkWBpAXD/zusmv:8sb9sk3TjCpkNlk3MZ1o9BqXjzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497745, "uuid": "8b862af5-d12a-4993-a750-71b88c151a51", "value": 1382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497745, "uuid": "62101586-5502-4cca-80d3-73a78015a407", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497745, "uuid": "88a19336-4aae-4111-a9c7-adbb84924b34", "value": "Documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33caae60-5cc7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639477117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477117, "uuid": "c7c631bd-1b58-4c6b-9472-2b4b4e66e023", "comment": "Malware payload (Formbook)", "value": "d2c8dbbc092dc700b258cbdbfba44089", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477117, "uuid": "f9f597d9-039d-46e3-998a-fb1062cf2be7", "comment": "Malware payload (Formbook)", "value": "c25c97fee3ba247571b1eb3f6779d0c36f5cdd17acff05d914a0da80cc585996", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477117, "uuid": "f3456a45-23fc-47e7-9fc3-7ec2737e9479", "comment": "Malware payload (Formbook)", "value": "6317594db47bcfbc1c722b10474d32750c7eb23e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639477117, "uuid": "3af72f98-1b11-4ff5-8022-62bf63a92ba6", "comment": "Malware payload (Formbook)", "value": "acf018cd88d5cd20e84c4c3ce7396f3029b43f4828be17b02261413ab19ce5f96377e021765ea78d906dbf494b39e58e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477117, "uuid": "5320868c-a0c6-44fe-ba7f-21a09a85653d", "value": "T1B462ECACD46706E48F86ABB82B1B5F55018CBA2EF348A533357C67396BC5D7E501283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477117, "uuid": "cdeb1109-dbda-4ad0-aa47-4548c936d7b9", "value": "384:vxLVpBQpXwAxcUn9CJDEqFCneIqg/CdatS4QeXE:v/p2eAxb9GEgzaCdatSdeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639477117, "uuid": "a76d9406-a59b-4716-8e62-ee882ddc01b5", "value": 15662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639477117, "uuid": "9ea92094-eada-4f8d-96ac-1e4425062949", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639477117, "uuid": "c8c59db7-53b6-4403-a2cf-6d31b8d20ab1", "value": "BANK PAYMENT INSTRUCTION COPY 13-12.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd712f3-5cbe-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639473428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473428, "uuid": "d1aee1cd-39ec-4743-97b5-c068656f998c", "comment": "Malware payload (AgentTesla)", "value": "4b49816ec64a9f6c6454756960d1dce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473428, "uuid": "ede7b6aa-40e3-4c62-94ae-22cd5ee2e934", "comment": "Malware payload (AgentTesla)", "value": "c260567270e7add4738ae104d4e84b68f5968e81efdce33f4c5721b3622bd774", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473428, "uuid": "f0ac8523-4d46-480c-a201-c4333bfa0de4", "comment": "Malware payload (AgentTesla)", "value": "04a0457439d1e660d7fd2e6db10b30e32fb88b30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473428, "uuid": "7c5c9d6f-fbd2-4b4d-817f-05ce17e2e796", "comment": "Malware payload (AgentTesla)", "value": "b41e354727c70bbf0e6088822cd311ac5261443a3206037bdadee6bbede111201fb47080ced2cf5c35899af66953df76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473428, "uuid": "9689b4dd-56e7-424d-b8f7-402aba7b70ac", "value": "T1FD65236C395BAACCD89283F9373D803853795C39980BE299EC8932D71837B567937613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473428, "uuid": "de9b992e-6a96-40cc-a8f0-1d61f6248637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473428, "uuid": "6aab1af5-37ae-43b5-b622-d9b9290c6e50", "value": "24576:AGHeJstO7O9/7KjKKX4SReSUnINdOWMBz48M7AX+kA2Mlr+Glw:BHeat2a7KjKW4LSqIJtl7M+cmrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639473428, "uuid": "7a8879c6-e297-4d1a-83a1-14a8b069a727", "value": 1435648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639473428, "uuid": "feb238a9-c494-4966-84ab-2868fd8d3d14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473428, "uuid": "a0682ba9-9c79-4f98-be0d-eb376ecd4afa", "value": "scan.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb5cee9-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639496384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496384, "uuid": "8fbbca1d-becb-4389-b869-aa140bb99a1d", "comment": "Malware payload (SnakeKeylogger)", "value": "8ce3ae26724444462fafd8103131fd4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496384, "uuid": "fa48b456-dd4f-4137-98ea-c65988472529", "comment": "Malware payload (SnakeKeylogger)", "value": "c3188c88377634d5d9238b22e44fd351b798c1015ad6c4057b8fa14b26993395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496384, "uuid": "62ffc593-fd0d-4e99-80bb-dd67e157d7c4", "comment": "Malware payload (SnakeKeylogger)", "value": "62447ee52f9234f6ad6754ed69f05a8ac9c62463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496384, "uuid": "f0766c35-21f9-42e3-9337-84691c74a249", "comment": "Malware payload (SnakeKeylogger)", "value": "9ff4343ebcc0c619f21792af4a736121a48a3f0f6a85c0b55c1613bc0a2b96fabc53ae05c223dbb0d4f3b146504fb65a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496384, "uuid": "2bfacfee-dc52-4bc6-9fc1-7a5fe2d9e8e0", "value": "T18C55237D36939BDEC46107B6332D502883B96E36A10BE369FD4572A70823BA5BF13513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496384, "uuid": "0fc97dfd-7ddd-448a-8438-722f1e8e885e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496384, "uuid": "f34e6b1b-3cb9-470e-a5aa-891d794fd9c1", "value": "24576:tN2FC9Y/+LvNYSNn1XNASkwrVIJWBa6ZHLSp+M9I2:tN6MY/ylTXNKQyqzZup+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496384, "uuid": "d4b2b445-0fa9-4024-b188-701637f214d9", "value": 1311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496384, "uuid": "8403fa80-e7ad-4e2a-8fd9-0d172e464547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496384, "uuid": "feb03e07-ccd6-4ef6-91a2-f4772e128307", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46357c2-5c7b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639444665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444665, "uuid": "96957449-ab74-4816-ab8e-00224d5b4266", "comment": "Malware payload (RedLineStealer)", "value": "5bbe1f6d6c69b3aea9d1499d4f9e5a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444665, "uuid": "12579673-d4a8-408a-b271-18b8c6a4dc30", "comment": "Malware payload (RedLineStealer)", "value": "c37e991dcd60bc24e9254c19de8c32404b24bae312d412835b95366f707a5546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444665, "uuid": "80ed8788-6a75-4f7f-a676-531b3e209ab9", "comment": "Malware payload (RedLineStealer)", "value": "6e14f27fee25998d553012355de3aa9207fab438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444665, "uuid": "dfc370fa-375f-4440-8f9c-aac14b2a08d3", "comment": "Malware payload (RedLineStealer)", "value": "45cb58ba748b8e6fe57567eeced3f16fce49ac6d7ed8380fb2c83c54f2eded8ac206ee15caf7b20c2362eddc795e6c62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444665, "uuid": "023fb84c-834b-4862-831b-8043761da8be", "value": "T1385533EF19857C28CAED7DB22A8A83B554D7DE85C4F15044ED9F44807E2B825EFBE810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444665, "uuid": "5ec169e5-a14f-4cb2-8d4a-b00ca8ee6463", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444665, "uuid": "99562eac-fa8a-465c-a681-c1aebaffff6b", "value": "24576:of4ITexbD1VZATrVqqikW4Ic8nYvdDEmrkvqrm6Rldhmgi9vkEaHNYK3ikkbJ5B:GU1VArA/kWnodEmprm6RVmgi9vNavkFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444665, "uuid": "20abf245-0586-454a-b12f-3c7d8aca438c", "value": 1406464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444665, "uuid": "21acc021-4900-48ff-aa2f-073d2a12b916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444665, "uuid": "a83234f8-87ef-4ff5-a493-fb7b0b7771fa", "value": "5bbe1f6d6c69b3aea9d1499d4f9e5a7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc2e849-5cc2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639474906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474906, "uuid": "53df195f-ab61-435e-bafa-f6c6d341ed61", "comment": "Malware payload", "value": "8712c2a07d280ff5c3b4394699056c31", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474906, "uuid": "2552cfcb-c1b0-4fa9-8bf1-46a75fc4bc48", "comment": "Malware payload", "value": "c385291a39f3516d6d573b724923b5017d0adf1dc1defec939a5b5597d0fca38", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474906, "uuid": "55f98095-1d4b-4e61-a020-523cab9e4835", "comment": "Malware payload", "value": "b50669db6ca41eb591170c9a0ebcb60937b10a24", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474906, "uuid": "2a9307cf-beb6-4e95-a075-3eb5e9a06e79", "comment": "Malware payload", "value": "d217234f7f71a8cc52e1c8950653e08b7a11bf8d672f0dd0ccc590236104c333f8d816a92f7887724fb5bfb16947bdb1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474906, "uuid": "65a0f372-b16a-4499-a20d-16fb19db89e8", "value": "T158A2BF953FAAB99C2B2C4812D648B82A3B047156031B54D6F76E7FD5FF243D7D049602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474906, "uuid": "22a77915-d636-4d03-9b6c-3b3532a43cee", "value": "384:eQA1z9+7BV08VDMPD8sEdMOhnBd5z9Z0fg22N:eQA1zeB1Mu+OFB7zL0fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639474906, "uuid": "86f6a755-12af-4659-a41d-d84ba030c782", "value": 23091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639474906, "uuid": "2e665363-4716-42fc-9c22-a94503eac3c3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474906, "uuid": "40515a85-1ef2-4cf7-8e8c-2d5f011577ed", "value": "bts.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217ac0bd-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444874, "uuid": "617e7cb8-601e-4e2b-8d88-8485f932adb6", "comment": "Malware payload (Mirai)", "value": "710ae9f10b0e70d54c7cfec8788a6bc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444874, "uuid": "cadcc71d-57f8-45f9-a9d1-3d2ef5c526eb", "comment": "Malware payload (Mirai)", "value": "c3be19315dbae105444cceafef7f883a09fc6aa5483525d0ba9fa1a9815dcee5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444874, "uuid": "6db976be-f49a-448a-b519-6069bdacd2b3", "comment": "Malware payload (Mirai)", "value": "7416a5af93f7bbc3ae0bfab7b5e6638c9cc6c18c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444874, "uuid": "ff824520-cf7f-4050-a5e0-8c1ecde4eab5", "comment": "Malware payload (Mirai)", "value": "807ef5e7755afcfea97ec5aea4cb5692dae6619623c34d88a03f4d6038f4db86f69c07bb471154e7c4aa296c57faeb5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444874, "uuid": "dccfcb0a-2fad-435b-aaa3-e129c011b662", "value": "T1C753017D90C498A38F1604BAB018425B7B932BF065DD3D3065766BF874E640B9BFC26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444874, "uuid": "a015acd0-9f18-4b21-b1c3-fbf2aaa15308", "value": "1536:4gcam7eTWJILfiYZgrPMGcLgsLK/8w6nbf+9VLYxNWaNMAcK38B:iaIeqJ63LzS8wmWvLYTNvVMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444874, "uuid": "d78ff68d-ca84-4608-be2b-112c7078a363", "value": 63208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444874, "uuid": "acd23092-7315-44c7-861b-a924c5b901b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444874, "uuid": "40292510-962b-4658-8376-b06ec2c81c45", "value": "710ae9f10b0e70d54c7cfec8788a6bc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81646d0-5c80-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639446926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446926, "uuid": "0c575f9d-486d-44a8-85e4-1afe0908deef", "comment": "Malware payload", "value": "c12f5fbe7004167433f5d692e811973c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446926, "uuid": "bc2aacd0-7a15-4b89-b2f2-557a7f61838e", "comment": "Malware payload", "value": "c3d8969c6a50906f5a4a6dfa5a24196fe02ccf7ed920bfdbb67804b5a1cfefa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446926, "uuid": "da0e638f-796f-4ba8-8822-e07f4d1e1b1b", "comment": "Malware payload", "value": "5e5072596cc030bc01e487ad8a271d64d9a94d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446926, "uuid": "68a739b2-2e89-474c-a6ec-d3bc2055d476", "comment": "Malware payload", "value": "5ac6dc6cd18c04091d11f48378b6030d63ecfc34c98ccf392e0c1ecf19856cefc027e15548771731afd6822c9cf0caf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639446926, "uuid": "3a237661-0ff5-47f9-a3ab-ad99bf98d828", "value": "T1C3C4AE227AD487A4F97FE7750CB0718003F5F9DBE261E19DFD98148D9872B808AA1772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639446926, "uuid": "fb5f5be5-7533-41cb-b5a6-625a045c38dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639446926, "uuid": "22edc548-b8e0-44f8-bc51-1e7c862c9921", "value": "12288:bWqRX3JGUFTjbiPQnbc/kc0FMFeefwWWDlHK:SorFHbiYbc/k2IWWhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639446926, "uuid": "9da2485e-c18f-4818-aeff-ab299439a1d8", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639446926, "uuid": "e369f8c8-70eb-4658-addd-62979f47d9c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639446926, "uuid": "61795031-b376-4ca2-b720-c8c5258bd1d8", "value": "REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dd95f2-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639500394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500394, "uuid": "504ee8fe-864c-44c2-9e1c-9b3771ff471d", "comment": "Malware payload (AveMariaRAT)", "value": "c0a50a3132b078e9a63e7adc18108441", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500394, "uuid": "96a770af-a3e5-4342-a3f7-9bafc6848789", "comment": "Malware payload (AveMariaRAT)", "value": "c413deb89e6f934e7f6dd9458ae2b624330b5f928692e5c8e212e5ecc166c7c0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500394, "uuid": "68258983-5044-44aa-bcaa-f3c623baab27", "comment": "Malware payload (AveMariaRAT)", "value": "34746eb0a4477285a2e92839e9810261bdef0848", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500394, "uuid": "51084196-c749-4c45-b8ff-25d863dc2f79", "comment": "Malware payload (AveMariaRAT)", "value": "65036319fb974130c6f7e540adea9f251351a0bd109b51576a8d83f63391abc05943a7cf77c209e669321c574f84b802", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500394, "uuid": "02ab330b-5b0a-4f83-8a67-dabc1db337aa", "value": "T1E045226D2A97ABDEC42503B97F7990281374EC765007D7A6DEE6329B2C333823933506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500394, "uuid": "ddb6927c-0041-4775-ba26-3e03207e34fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500394, "uuid": "f2cf0bc0-42cd-457a-b89c-28f39abe7ca4", "value": "24576:dEZnR8y1Tcp28xsW/uQ9QaYi8JVXhUyekVnokTa5Y9SeL:dkP1T+xZptYXRUyeRUgY9Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500394, "uuid": "802cdea5-2942-4b7f-abf9-23cf3d98f0dd", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500394, "uuid": "47a4ddb1-322f-4992-a62b-1891dcc4d434", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500394, "uuid": "a41fa191-28b7-4fe6-82bc-3c48336d4dd7", "value": "c0a50a3132b078e9a63e7adc18108441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0587935d-5cf5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639496797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496797, "uuid": "3da92585-cfb9-4982-948d-c7d866a989d5", "comment": "Malware payload (RedLineStealer)", "value": "afd0dbcd58dfd20fb39be337ae70a3c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496797, "uuid": "02e1ea2d-fb3f-4a9a-a896-8d08488e1195", "comment": "Malware payload (RedLineStealer)", "value": "c4c55676707f7b4690862ae5d33c43f4b327fb2c09daed8c69309ae2533f88e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496797, "uuid": "5e4fe666-3673-4f7d-8837-a4f826c09dce", "comment": "Malware payload (RedLineStealer)", "value": "313db723eb84ffa7139a71771b2837ef4da3666c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496797, "uuid": "f685aab8-351f-4134-9a1b-c74514f2d986", "comment": "Malware payload (RedLineStealer)", "value": "1e3d092ee54d749e6b81aa7fced44793056e5fa2a6c7ec20bcad8b544ad7696f8c519a69f135c63fd26f11647a2786a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496797, "uuid": "e2d92f79-723c-40c6-8183-3600d75488f2", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496797, "uuid": "6c1abf22-f1f5-4d98-bae8-eb417852d47b", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496797, "uuid": "9033ac17-4117-40f7-b52e-4bf115ba76f0", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496797, "uuid": "db676d0d-6bd4-4d98-9bce-f4cfe35f27b9", "value": 442473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496797, "uuid": "8849bec3-3d26-4ca4-8122-310ea8befd20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496797, "uuid": "ca3258b3-5e9f-4b9a-af57-8bcefe7f3e83", "value": "afd0dbcd58dfd20fb39be337ae70a3c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adae879-5cb0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639467412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467412, "uuid": "05c8518c-a0df-4c65-8829-462bdb0d21ce", "comment": "Malware payload", "value": "8458c6120247b910d152c42e9388a938", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467412, "uuid": "79c1a755-937a-489d-b5ea-d5113a57536b", "comment": "Malware payload", "value": "c5105439e83ff0de3c73532383349070c7fcedb4a5355aa9db395eee9b6cc333", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467412, "uuid": "66eceefe-f2db-4b64-8c68-aa5e699fbe86", "comment": "Malware payload", "value": "3d74a865c8353d000e8722c3e9ba9957187f8b68", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467412, "uuid": "110db173-2ad6-4179-8218-9dac1b9b6f37", "comment": "Malware payload", "value": "39e530560831205057e63de4df0740bc8c73d98468d04d75924c6f579363946161130a1c8e7bc9eeb0398e926a0e5e79", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467412, "uuid": "21c2e700-0dc1-48ba-adc9-acf8aba4db9c", "value": "T1C813D004E822AE04C79D577921FD01B07BF343869391825B9ED2DA4F8C122FDDB6F699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467412, "uuid": "7d806ee1-4011-4754-8067-85d01ca7dfe3", "value": "768:8MhflTTQ85uAOn0BKW2rq/eEflhRSfwdDQWk/HQFfNrLfxl1IS:8k03n8KWG0lhRSfwd8WgWLfxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467412, "uuid": "ba86cc89-efdc-4248-b713-08d885a6ddb7", "value": 43473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467412, "uuid": "e072872e-fc5e-4d2b-95ad-67c483486a62", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467412, "uuid": "978264ae-d9c8-46e1-9d68-1f4338109532", "value": "legal agreement-12.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2495d65-5d1c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639513810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513810, "uuid": "9d3176d7-c0af-40bb-a161-47b98392586f", "comment": "Malware payload", "value": "812c962217d9061fab3c4519d97e8922", "object_relation": "md5", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513810, "uuid": "ff5c38e8-76ed-4f25-a3d0-3bd4c24b0fbd", "comment": "Malware payload", "value": "c543826f2e00a91b32710b946a6abc55d1cfbdac5c32a626e01a2072650c4d77", "object_relation": "sha256", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513810, "uuid": "fcad2c93-9c21-4f40-b55a-4379f461cb2a", "comment": "Malware payload", "value": "1c5d1dfe6a362749238b030d9b10b3c07844c852", "object_relation": "sha1", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513810, "uuid": "561f1a52-850e-4c1e-907c-4a7ee51cd5d3", "comment": "Malware payload", "value": "133b7a24187001efb58987ffba0d7298985c71c68970a8721172f5f58c0921db411684f0bf8cc2d8a72e0eef02f01c0e", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513810, "uuid": "62491235-d118-449d-a6f7-45f1c05de073", "value": "T13462D746ED1D10932FA8F46ED4749D143F08833150590979B2AE5EAB22ECE2B611FADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513810, "uuid": "7fe0f98b-0d32-4328-86f4-b4dbf1701c16", "value": "192:FMofzik/qcRr54E2E4iKDWKQMM41k1LlOqcRr54E2E4iKDWKQMM41foV:FMofzik3/4dKKQ74C5k/4dKKQ74M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639513810, "uuid": "8715fe6d-aa72-435e-b8ea-ef0e84240d93", "value": 14819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639513810, "uuid": "dcf01b4a-ec9e-4115-8ba9-d29c3cb31288", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513810, "uuid": "9a94ea9d-d9bd-4180-8de7-3c081ca9ea12", "value": "1une7L1W.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b42ffa-5cad-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639465982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465982, "uuid": "02e2b610-56e3-472a-9432-49fdad3f7d6d", "comment": "Malware payload (Loki)", "value": "9e37169a4af485b3b6ecc24737ddb081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465982, "uuid": "eb441672-d72b-4ed8-ae95-8a233adfec31", "comment": "Malware payload (Loki)", "value": "c54a4b0489350a980ae766a963852d2c5798c671d887a2f3454cb45c1f15b4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465982, "uuid": "047b2d87-c5f9-480f-bf95-d04b070da8e7", "comment": "Malware payload (Loki)", "value": "0271bd5bd97f4468130531dfee963a87e51f505b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465982, "uuid": "757dfa8b-8da2-42cf-b3d9-b0a95137fd08", "comment": "Malware payload (Loki)", "value": "b3faf4bb5604020613c3d8d30f58c221eea5bb3e508da2d99a32ba0164ae3fee4b021b68cfe56391425e585e6365d846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465982, "uuid": "b3e8c025-5751-4449-b6dd-30ef1c9e8a9a", "value": "T15C348DE2A1C6FEC7D6BB62352EE0361007235B49281646409BDC391F7722ADF3781B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465982, "uuid": "42934ce8-fbac-4c8f-9446-7ded5641c4a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465982, "uuid": "7569924f-bf47-4f26-ac88-8087c93c0bc0", "value": "3072:sQE74wTxQILEgbpyt/MsSSqVkfbmU0B+Im7Um53rQ1m0ZTBTcwzk:N4UpfbcBtmlh8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465982, "uuid": "b676e208-1a10-4932-a2b2-8b3b27db7dac", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465982, "uuid": "52ee3203-f445-4eca-acb7-5e6aae333cca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465982, "uuid": "81c7369f-c605-487b-a337-a3c68bb5d0b1", "value": "P.O_70432-402_(Sat\u0131n_alma_sipari\u015fi_listesi).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aab5aa8-5c9b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639458365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458365, "uuid": "0a525de4-604e-4ca3-b043-c7a9b66590a4", "comment": "Malware payload", "value": "a93e1133bf96fabe168942778dc32d36", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458365, "uuid": "8d12afe0-8116-48f8-b7bb-c00505bd0e04", "comment": "Malware payload", "value": "c5eb2c76236c1ea07c98c16beac5f853497d0ff063b75f3c502917bb0456e5a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458365, "uuid": "64740b62-2ee9-4bf7-958f-622d78166407", "comment": "Malware payload", "value": "a4b42d6fc46d5d9c0d578e0bc133790cb553788a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458365, "uuid": "12b9a848-f8d8-407b-b948-98a7a9cf2425", "comment": "Malware payload", "value": "1af9a57529362220903dd179603f9d67edcb46cdf38b2879ab0e2b529bd14248af0d43041b952e14ff79ebc945dac3ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458365, "uuid": "1429f725-21e6-44ba-acb0-9051a3c9bf51", "value": "T1DF449E5236C680B6DAB321B18A46A33EB3E597004B3B6ECB5BD50C245B355C3D73DB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458365, "uuid": "9026c0c0-bd2c-4c11-90ba-e3fce06ec032", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3rN+:WKEUkuAOLka1miSmuY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639458365, "uuid": "1e406ee6-53e0-4475-bdce-d538639e015b", "value": 261656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639458365, "uuid": "77019188-85a3-4c89-85bc-350a5b1d43ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458365, "uuid": "f6a6aa1c-f338-4fd0-b519-d455a677d858", "value": "emotet_exe_e4_c5eb2c76236c1ea07c98c16beac5f853497d0ff063b75f3c502917bb0456e5a5_2021-12-14__050601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72da3cfa-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510294, "uuid": "b18f52bc-7a5c-4a90-8968-e18d614e2d20", "comment": "Malware payload (RedLineStealer)", "value": "19ed5a1f7973dc03a02ef91f937e145e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510294, "uuid": "4bdd8c34-7dc8-420c-9606-a44072588f85", "comment": "Malware payload (RedLineStealer)", "value": "c7722d4cc255706d11428a140b5e80b245e9d35d5a8af0a54ef8a31ec51e0596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510294, "uuid": "f16199eb-a354-4f21-8732-593be914f2a3", "comment": "Malware payload (RedLineStealer)", "value": "0e9e9900545dd4edbae2e016b9ac13c03a1ec520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510294, "uuid": "00e90630-b676-49fd-82e0-20846d21e6e1", "comment": "Malware payload (RedLineStealer)", "value": "0c988e21df45b5be40dc2f20d4680176d157f05551a46234d68f938ffce3a183eada79bb1a87495c5850c25e711f3bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510294, "uuid": "4233a72d-e5cf-4fd1-8cd3-7e8aa2d1ba1e", "value": "T127649E10B7F0D435F1B752F846B697BDA92E7AE16B2890CF12D526EA16346D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510294, "uuid": "c9278a4b-f8d5-4eb3-9cf8-874d2e2f355e", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510294, "uuid": "7920fd63-5f5b-420f-9d0b-f6552c805c81", "value": "6144:7Sj9GiD3Un/MlTJYntY0q03x/0GOFTpAxyJQCKR0ua:OjMixQntnq0uGOrCy70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510294, "uuid": "334c19fc-a6d1-453d-b6aa-cb70f89e6afe", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510294, "uuid": "6d727dc4-26d9-4fe7-8780-11c987166f55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510294, "uuid": "67b71e06-0da9-4dce-9202-e1b8f20b28c3", "value": "19ed5a1f7973dc03a02ef91f937e145e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce931c7-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444840, "uuid": "f868baea-dc8f-4771-9752-36cc2762d90d", "comment": "Malware payload (Mirai)", "value": "3cdab5effc860d4bf34c55b196b37c4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444840, "uuid": "789ba783-f08f-47a5-ac87-89c0c972423a", "comment": "Malware payload (Mirai)", "value": "c7e6f8e5788abc2cf14bcafec5d0fefa8f7c529a59f8dd09394a119a7730c78e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444840, "uuid": "2ed4f32f-01ea-48de-a117-00993c9aee11", "comment": "Malware payload (Mirai)", "value": "9dcf3813262a16a6010829503a3dbffbc9302f22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444840, "uuid": "57dbf990-3cb2-4fb7-9581-fcf7730e3f90", "comment": "Malware payload (Mirai)", "value": "29ffcbe660b4715671af023c91f7f6da525c7fb798610ebeb1d11447b22dc70c16b68d15f2f8d8b0b93be3603e892db9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444840, "uuid": "a481d404-dcff-4a3a-8bd1-07a04f7eba14", "value": "T17BB2C0EDE9E0798BCE6C8D7EE2CD1B449D9071A7329B078E96714CC4715A44FB41F860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444840, "uuid": "8ffa9392-7f15-4aa4-99c6-b5bbe68554e8", "value": "384:SHGZ/3l07qBqYAGZRfPPfDpHFxpAEDgAnqVwrxcv1e7RWGVCz0NvE5:SHG/18qgOZR/fDpTVktIxblWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444840, "uuid": "a7f983c8-76d9-4d0f-8844-709e540534be", "value": 24360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444840, "uuid": "99484889-a2d5-4cbb-81ff-6c7c6618bf51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444840, "uuid": "34ef889e-9d8a-4d1b-acfd-cf871eb3d79a", "value": "3cdab5effc860d4bf34c55b196b37c4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8a406d-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639498122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498122, "uuid": "8157a91d-9fed-40d8-bcbc-2e1da3a322f6", "comment": "Malware payload (IcedID)", "value": "52378395beb30604ddd4aa62cf66fb34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498122, "uuid": "81247f4b-7301-4093-ab40-caf5a3ba464a", "comment": "Malware payload (IcedID)", "value": "c8025bf8f537c9fd454c5d097bdb908ea58076b509aa09149f01ceb321c2ed4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498122, "uuid": "52afaf90-3234-4a18-9443-d686d8fdd349", "comment": "Malware payload (IcedID)", "value": "ecae3faa75a7dc001f330c58902ae0ec8d76cf7f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498122, "uuid": "89ed9d76-dceb-4820-a26a-47e8438076f3", "comment": "Malware payload (IcedID)", "value": "dc22461ad0aa07a6631f31140c54ff9b1c3d1bab1c64e998d74fd7b6cce431541150a7527d40c2cd1198c6fa944aa346", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498122, "uuid": "2d699931-c88f-4da9-aeb6-4353674f9480", "value": "T155D36D0272E88031F4AF063908A59A5D177E7C6DDB78DCEB3BC41A4E69742D0EE71762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498122, "uuid": "2329d69d-0a69-4a39-9cba-20331c825083", "value": "56ad080af38e8b20c4e2fc3686900779", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498122, "uuid": "a4c22230-f0eb-4082-a706-deea6853efaf", "value": "3072:OtuL0JQoDe58VCNM9fnMaKhZAbjYfX+jbnQGI+ZIKbbfW:sl9s8JnpKhmvYfXpG1ZIKbbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498122, "uuid": "30a33502-1a95-41b6-a201-194354e7c68b", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498122, "uuid": "248a717b-982e-4466-8890-8a712d4f8771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498122, "uuid": "c6c45c8a-ed9b-4c32-ba27-2930726b3951", "value": "c8025bf8f537c9fd454c5d097bdb908ea58076b509aa09149f01ceb321c2ed4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be31e66-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497854, "uuid": "eb466b85-2af1-4b2d-9cc9-35ed7e482dbf", "comment": "Malware payload (AgentTesla)", "value": "2b003cd701b9d978d9d4045a26558a3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497854, "uuid": "9a51b882-5008-425e-98a7-5b18fba7d2e4", "comment": "Malware payload (AgentTesla)", "value": "c9d19163041ec9297c1d4f06bd9a4d7e9ac545c05c4513d1f509fa8216dc4332", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497854, "uuid": "9ed7a4e2-7adc-4935-b746-004253ed690b", "comment": "Malware payload (AgentTesla)", "value": "de17233ede7fc850382c960139e3582f9f357945", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497854, "uuid": "07a6c2fb-9333-4ef3-95cf-3c4dcd395717", "comment": "Malware payload (AgentTesla)", "value": "e473694f633060d3f6f5ab243c75e7b5666302a60c5d2b1a0507c654c97478270ba6f41209dd9d9ea49f8d4cd5a3f8aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497854, "uuid": "570d5dd9-fb01-4049-9a10-f82b36a56ad7", "value": "T1E77512335162FFD36F3A1C88500839D91C557BAB511AB0A8E3F092D691AE934DE7DCB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497854, "uuid": "0ba8405d-2a8c-484c-a20e-a0c3be388f7a", "value": "24576:XoeliJV/sD2GOT1dYXlZ94vbjUljltPGTmQYvwOvvcC:Xu1TfvbotbfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497854, "uuid": "88028cd2-393a-4a34-accc-9d0fab16d245", "value": 1602759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497854, "uuid": "dcca882f-bfcd-4b1c-aae2-686bb9b8d8f7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497854, "uuid": "f49dc751-1954-4f6d-bf93-386243f2405b", "value": "908jhnj.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ccafd5-5cd6-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639483704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483704, "uuid": "db6c74c9-72e5-4abd-a08c-5bb82fc55ee9", "comment": "Malware payload (DCRat)", "value": "10f61c96f112ffe8905c1ce3f8fce378", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483704, "uuid": "764dcb25-7dc5-4b32-8fa2-35388fc38a33", "comment": "Malware payload (DCRat)", "value": "cad58f8aa2659239f1aa355813c0c92a5ffc39fa1c7f763723d83aa69341067a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483704, "uuid": "c3c68b75-89da-4a56-be86-cbcf49f60c54", "comment": "Malware payload (DCRat)", "value": "dd54fa3f0c0d637df38a6bca2e1d4d2b3a40b458", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639483704, "uuid": "6b206132-db20-43a4-87b2-87c558d9c173", "comment": "Malware payload (DCRat)", "value": "7e8012749ccb7ae55a1e96ebb18ec03273804c42d9ca640559118132a555aaef5f4267d98dac7941baf49aecf6809ede", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483704, "uuid": "fdeffb42-ba0b-4d2d-8d57-643d088cd164", "value": "T121F39EE253437B96A4EAA2CBA56C77B7C1E173E72482818675400252CE35C7DC609EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483704, "uuid": "66e6d411-5876-4d6f-a438-46f4005fcd32", "value": "384:awGdpldp5yo3yokyoCyoPyoUyovyoayoLyoqWyot:qyo3yokyoCyoPyoUyovyoayoLyoqWyot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639483704, "uuid": "e43b4c7b-3d53-461a-baf5-cdc84c73b051", "value": 171667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639483704, "uuid": "dcfa8d49-308f-40ab-85ec-e59eaf1caad2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639483704, "uuid": "cc8ddfd7-ea62-4aa2-9c9e-fc7b2b217401", "value": "Description Qty Details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a7b554-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639496641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496641, "uuid": "b20dd72f-361d-4e65-b01b-a3b92bac1225", "comment": "Malware payload (Formbook)", "value": "9f31051dd992feee202e0e1337fabbff", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496641, "uuid": "14dcbf9a-02ba-4472-9f00-0b3b62105eac", "comment": "Malware payload (Formbook)", "value": "cb12e77313f8ee2e81f01e8808a2ecb3116797e8dc988a97c74cc0d7b2ee9fcd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496641, "uuid": "eb0c21a5-d3f8-4c20-93d8-70b8c2e4bb9f", "comment": "Malware payload (Formbook)", "value": "820d8c33360128994fd9f33d1b09a250a68942cc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496641, "uuid": "aed76000-7f57-4ef1-b66f-7cb6cd19791a", "comment": "Malware payload (Formbook)", "value": "a5c70ac43c6e929369865b9065f5fff4f8f98aa26882e237ef0f671ac75ef0d79695f7653368b4ce2770779c6751b870", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496641, "uuid": "6c7e2e6e-96fa-476e-bf76-371d622d198e", "value": "T1E1A423B3954FE1B115EA7CBA3934BFB405B681AEEE01E5E6503C04CE25B56CBFA015C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496641, "uuid": "ea7d01eb-91df-45ec-bdab-d41eda4b835b", "value": "12288:Gs6rocctGlwvIXH3Hr9qXCXqPe5+1Af8AU61:2i9I33LYXmTI1AfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496641, "uuid": "b0a1c90d-c004-412e-9c77-387d53192f13", "value": 458979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496641, "uuid": "15acf8ff-eaf5-4461-91e8-aec3820f5fad", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496641, "uuid": "dc23f7f3-b203-4ce2-8642-579feb2586f4", "value": "IRQ2107799_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520d8b69-5ced-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639493489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493489, "uuid": "97cc4570-37ec-494b-8496-eb61c665d838", "comment": "Malware payload (RedLineStealer)", "value": "334595311dc97ea6ad6c67cd6af5b2cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493489, "uuid": "9d8b408f-5a63-40ee-a601-eb3331e87142", "comment": "Malware payload (RedLineStealer)", "value": "cb17dc692830162448c831b2fd6a6b60fe5b6f85a6e603f732f883825ef8d928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493489, "uuid": "caf6d65e-a857-4b2d-a6cd-9d3ee823227e", "comment": "Malware payload (RedLineStealer)", "value": "c624550eb27500b421d846d3e83a01b99feffd3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493489, "uuid": "9ac927bc-56ae-4f0d-8ebd-5daab6223168", "comment": "Malware payload (RedLineStealer)", "value": "e5a53726b28f9163a23732e267c98daba1b436365c94a6e77758d737938ce40824f1b1eea0c2ad8f9ee651fc9671351f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493489, "uuid": "687c6dc3-4bc7-4b50-85b1-a12ad6528ef5", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493489, "uuid": "361ca976-bea4-4755-8df2-99c188d548fc", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493489, "uuid": "87f9556a-cc85-4e48-ab27-ad9193337abd", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639493489, "uuid": "55c4ac12-3c91-4be2-9584-5f21ce71cbff", "value": 442390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639493489, "uuid": "b4e51d5b-b23a-4e0d-82f4-49ff300f3e6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493489, "uuid": "779f84da-9394-4a9a-8b61-7af8c5dcb351", "value": "334595311dc97ea6ad6c67cd6af5b2cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b67551e-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497451, "uuid": "273447a5-9948-4f5d-ad78-8f6919d56ee4", "comment": "Malware payload (Loki)", "value": "88d826c3ee21e673f537183ae6810873", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497451, "uuid": "4483473d-5b77-4909-855c-e7403a6fbd02", "comment": "Malware payload (Loki)", "value": "cb4d7017e335641c60a9e95537c07615cb26e6d3e73b02431d80f726ad023df2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497451, "uuid": "4458a9ba-f67d-41d4-82e5-95443b7cb448", "comment": "Malware payload (Loki)", "value": "bbad91407bfab763b0445f34e20bac00c2703024", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497451, "uuid": "47dae24b-ca80-4edd-b752-5adc9a1f4f89", "comment": "Malware payload (Loki)", "value": "4375ee0f89c3e21b5d70be2a9d0793d38f5ac504dedfd18c7684c4cfa0357cf85c032fa8ca94a84418e8ef26b5c01b3a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497451, "uuid": "844e5f27-c1d3-41fd-a535-ba3f63698a4c", "value": "T1BD6412D73277A0ABC3D36A3E42878C5D7075DE3A9B3580BB3814BA1604B578683793E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497451, "uuid": "a20cf7e8-af78-4977-8cdc-5b6b50ab9524", "value": "6144:6jedGn2YFhCv6UYgmGvQlPWsxqEABq+ecYobUqKl/lIegmcb7FXPOonV:3Qn2Im6QjQKEABRTMl/CDzdXPOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497451, "uuid": "6c603ec2-ade2-4583-856a-fbcdef1e608d", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497451, "uuid": "2b33363f-a2bf-4ead-8717-4b79d38b2162", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497451, "uuid": "475956cc-d663-43ac-8e87-9a3edd4957f0", "value": "payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296b6bc2-5c7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639444888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444888, "uuid": "3f398a6f-4517-4f4e-8b86-0a60edb93b75", "comment": "Malware payload (Mirai)", "value": "1db9f3c1729d2c7ed2e25f85a414d355", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444888, "uuid": "69fa9293-c25b-46a8-af34-5926c3e3c758", "comment": "Malware payload (Mirai)", "value": "cb79250a07a8d3dde7e213e6b29e983d5e46a3bcfa1e214895b8f94a1fe4225b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444888, "uuid": "8f64a1c9-4f19-486f-a5ab-6f8cf019190e", "comment": "Malware payload (Mirai)", "value": "f84b41c4cd1d08903f465430b5d2301b430dc22d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639444888, "uuid": "dcc5522b-4852-49aa-bcc9-40857a45fde9", "comment": "Malware payload (Mirai)", "value": "0d779c98a92815b86ddcbbd4b39e31f6d6e2d5163eee2c45989d702aeac83ab0b64d8ed38e0756ed61b94d9ee95959d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444888, "uuid": "69bb8869-1201-4879-a8fb-1a2ea61e6d00", "value": "T1A633F2DD2210A5F1F4EEC4B12AB103562D7009F4406EAF65FC80559AF90DAF4BEF26D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444888, "uuid": "ed04ab85-f7c1-4462-976b-ddbf0ef15869", "value": "1536:/oAFqtw/RjhjIpsRUE6heKIzMsqscnnsVJu5:lfptjIpqCMKIzDknsVQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639444888, "uuid": "b378f520-6587-46e7-bef5-411a23b9d07e", "value": 53268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639444888, "uuid": "29edd694-5cab-4f79-baca-deda960179ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639444888, "uuid": "6f61275a-7a12-41c9-8edd-724b1ad0195b", "value": "1db9f3c1729d2c7ed2e25f85a414d355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f56186f-5cf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639496196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496196, "uuid": "500093cd-5c32-4847-ae30-8fbbbc30c41d", "comment": "Malware payload (RedLineStealer)", "value": "d11c63c5c6c170b00ceb9bf96aa25491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496196, "uuid": "240675af-12bc-40df-bdfc-dbb6e356ba94", "comment": "Malware payload (RedLineStealer)", "value": "cbda18498af08eedcc8755cba324e194b892e18bcfca02830814aeccf41b63d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496196, "uuid": "649a4ded-475e-42c0-b77a-91507d375f29", "comment": "Malware payload (RedLineStealer)", "value": "d81861680663e5806b5cb2238d007f4cb2251773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496196, "uuid": "545f281b-9b44-49af-9604-041e5050cf10", "comment": "Malware payload (RedLineStealer)", "value": "f6c0793ea2fd7b6c0c0ec2299808350a0432a6eb797b800dd17b686d6f45f40d6c8e557cb8124a39d09b8f5f6a89d342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496196, "uuid": "4ed09880-5010-4099-8a1d-25581f380263", "value": "T14094CF00F7E0D039F2B752F84A7693ADB52E3AA16B3490CF22D526EA4635AD1DC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496196, "uuid": "ab36ffac-bcb7-40b9-bba8-f4a3d6241270", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496196, "uuid": "875905d4-ef3a-4bb1-b1f9-7b276a7d1e37", "value": "6144:pVAo9d9C3vvpLH67eNVJJNOZ5hdGqu3dx/jtlYM5idDsf/zvQC+hjLgs:jlDAHE7KSndGqu3dx/jtlidDqzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496196, "uuid": "47f20864-2362-4380-b5ed-f8a5d5c94b1b", "value": 442420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496196, "uuid": "ecd5fa1f-4620-48fc-81b2-6b157f720346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496196, "uuid": "f893f309-6094-49e5-ad50-cf38e7ae7737", "value": "d11c63c5c6c170b00ceb9bf96aa25491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddbb282-5c88-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639450344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639450344, "uuid": "fb73abab-4c62-4135-9754-cfa5aa5df2fa", "comment": "Malware payload (AgentTesla)", "value": "e4fee7a91444a920f06de0a3c780d9c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639450344, "uuid": "43bf3aa9-3482-4148-a411-e44588728035", "comment": "Malware payload (AgentTesla)", "value": "cc0b60c7808034e9e1803362dbf08dbc769a68300c32d87fc80d99641c0578c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639450344, "uuid": "ca20318b-0ea1-4ae2-bf25-4c4ac43b076e", "comment": "Malware payload (AgentTesla)", "value": "ad9f2d4c2fac62ee25c615b9352b105e4575506c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639450344, "uuid": "a6707960-51fd-4ebb-9361-a9a947a10958", "comment": "Malware payload (AgentTesla)", "value": "1200aeee7bcceca762a3b02d4bd92290293169f4dc02f02ad4daf942405bd5c80fb2087ba0ab9113471394b6303c6a56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639450344, "uuid": "96ed63df-1f76-4a08-87a8-f80e8b6c3ffb", "value": "T1BD65126D3623D6CED165D6BC3368922853347CF2641FE28AEC8972AB2C3375539E7046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639450344, "uuid": "797275bd-2f64-4253-821d-ba0f5dc46991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639450344, "uuid": "80418ade-8d28-4114-839b-e33119e0d94b", "value": "24576:Fr8wcd1Fd4uvYP3rAv6KmeaOVlq2/2On5WSwX+nXJwiR0WP1xwVT:Fr8DpZYkxpaOVlq29n9wXQ9RF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639450344, "uuid": "10830e70-1883-413d-8b0a-2c5520bce9a2", "value": 1432064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639450344, "uuid": "3ec2e3c1-1cb6-494f-9fbc-0064e47ce890", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639450344, "uuid": "b4d5ec7d-2a7d-4827-b9c2-900322da1e1d", "value": "11E67FEY1bDTKlr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e66963b-5ce9-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639491684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491684, "uuid": "50975c6d-6208-45d7-b7a4-4e2b6cccd50d", "comment": "Malware payload (IcedID)", "value": "d11b38066c75f5936d686a7deca9d7af", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491684, "uuid": "e403a038-3fb4-4b2f-ac6d-dcdcbbd0cd73", "comment": "Malware payload (IcedID)", "value": "cc3921e361fec8e8ee0e8939206a2da62e92b7cef506cd8c2d832b29783f2e33", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491684, "uuid": "32f2c5a3-d069-4653-8613-88662d1cb593", "comment": "Malware payload (IcedID)", "value": "2dcb91a9f7c73cefd244d4508a5a7a7c6c618dc8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639491684, "uuid": "1414b4a2-7a94-4c82-986d-93469809aa96", "comment": "Malware payload (IcedID)", "value": "60f40e0109370d9435da5cb3b9eff888ab1e4a4394a2d28a2873e22b643763ccf2061c14487388aad7ca47b490241351", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491684, "uuid": "6c7a3cf6-7596-4763-9f25-1e13e3799ca9", "value": "T16D61D54ABA63B1501D4C04B731FF1AD9C11EAB1752A59094E1C7A9003F35CA06FE23BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491684, "uuid": "d69d89ce-1201-4f30-bf49-8bfe4fbd817c", "value": "48:q+KPVzbrm9T0fpOJKGtFfR8T1CT45rDYMHcoKA5buCa8g8k+cSrC9MKknJ38P7eR:ytPrHx/GjZ8xa4yOSCa8rhUG8DJPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639491684, "uuid": "c03a1cda-6ebe-4205-9572-d85164ca573d", "value": 3337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639491684, "uuid": "9b84df2c-57bc-47c2-b0e7-83674b49b47b", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639491684, "uuid": "1ec9ceb6-9f00-4b71-831c-1effdc4c7294", "value": "likeGirlLoad.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d41ebb-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639464686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464686, "uuid": "ab06f007-b0d4-49f2-9dc3-f5bfc3eec5cb", "comment": "Malware payload (Loki)", "value": "2c2f067cf67a619fbaeb620fc44fb366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464686, "uuid": "4e22546e-f281-4d58-8450-99f6a54561d6", "comment": "Malware payload (Loki)", "value": "cdd6bc9e92e45034a69a0a02cad8876b4330187a6b2cdc807f1d003c833580ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464686, "uuid": "ebf6fceb-2a9c-4cbf-83d7-157cc064ead9", "comment": "Malware payload (Loki)", "value": "97fff24dbe6e2f881d4a2060f14149c142cbb005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464686, "uuid": "e67efd7a-a833-4e68-9c5d-ddd83e2817f1", "comment": "Malware payload (Loki)", "value": "a04ec61eb512d8f076cadb18f33b13db3d6626c2813a179511d999e579a8b8bc100ea8fbc1796c5ca9ec48d72012699a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464686, "uuid": "918aa47b-4f69-443a-bae2-d29e948ae2bf", "value": "T1A4D40282F182C19ADDA81631AC3AD9D411937D6DFDB0254F7A92B7DD29733A3024EE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464686, "uuid": "f7a4a3f6-0f24-4576-ad40-78a4c4b71ec5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464686, "uuid": "60d16746-a1b1-4146-abaa-58725e383495", "value": "12288:McgrYp8NTRQHbL2YMjS3PmS58r4EdOLJ8qGs3VZ6+brieLC:is8NcWYMomSm8LL6qGyPbrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464686, "uuid": "feea5f4b-3b0e-4d23-8178-de6c5d4b6327", "value": 635482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464686, "uuid": "b52a0554-8ee9-4d73-9045-2e48e7b2f75b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464686, "uuid": "1c0993f0-7a45-4c5f-94d0-77e2c9585f0d", "value": "2c2f067cf67a619fbaeb620fc44fb366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05216aae-5cb2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639468020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468020, "uuid": "78ceff2e-4461-4dc4-9384-7847c807f610", "comment": "Malware payload (RedLineStealer)", "value": "a9a2a96d55958b92e514064c172869bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468020, "uuid": "458ddeb5-cab7-47da-a122-691514db26a2", "comment": "Malware payload (RedLineStealer)", "value": "cece570d4775fc6943ee9ec5ee6224bacb61d2a735a1162d99038714feface87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468020, "uuid": "310c1e22-683e-4ef3-84ec-26f2542513e4", "comment": "Malware payload (RedLineStealer)", "value": "1605d4a3e4c7b74c4afa436c5415236bf0429bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639468020, "uuid": "a7b93d97-6151-4ce5-a7b0-86c5ee13cbb3", "comment": "Malware payload (RedLineStealer)", "value": "73b9a163bce51b2b78a06341fab82d6cbe0b85c6375e74d5537ead1e2e92099de5c31e1aaa8a8d7fc563ea7a1f5f7b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639468020, "uuid": "718ce69c-16fa-4a98-bbf2-1d2160c748a7", "value": "T195452B8FB5348D6ACD808336264E1F77AA475EA0C11FE7CA582CE3229C55F798D15E32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639468020, "uuid": "43df42cb-c88f-4956-8d62-377aa8550516", "value": "3213ee13811e469e4ad62d7db0d4ff1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639468020, "uuid": "9fb94036-b06c-4953-a3bb-1ab397587771", "value": "24576:SACilDsS3I95pp1zFMknZPXYlXSjzTIy3OB9fw8M4E+N3zOpKMfnTd5DG99Jy3ZL:SACilDsS3I95pp1zFMknZPXYlXSjzU3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639468020, "uuid": "52625bf6-68be-4edc-81ef-e8f689f13131", "value": 1270624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639468020, "uuid": "b1960d7f-edb0-4374-aee2-4f2ad8e1fbfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639468020, "uuid": "0373ca74-5fd4-4598-bbce-8e8b96ed1cdb", "value": "a9a2a96d55958b92e514064c172869bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119d6532-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639498535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498535, "uuid": "660a489e-3e76-4448-8651-741a66ba8de6", "comment": "Malware payload (RemcosRAT)", "value": "cec899da8b9a765c80f6abd34b9a8a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498535, "uuid": "e75a4d65-7a30-4725-9857-2bf0283d9452", "comment": "Malware payload (RemcosRAT)", "value": "cf0e8fb30fec443d523eb8c666a541a4695ad286030f5faa5dfc5760df98962d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498535, "uuid": "4cc5d0d1-b3de-47a6-b4a0-111236c3fc71", "comment": "Malware payload (RemcosRAT)", "value": "e1e9f721b33a757ffd10395d3dce504366e36aa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498535, "uuid": "ea21b751-8c21-41c1-9e2e-a29db9075c45", "comment": "Malware payload (RemcosRAT)", "value": "fc79ac77656269169b641757d151369c3b2656c3cee3aac8ab36bab7166dff6197126b21d032e96012da205e6eb56567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498535, "uuid": "f71af5a3-bf25-4255-8a80-ac41a0dc752d", "value": "T14F651259A27CBF25C47FABFA58B4214B43FEB50725A2D72AAD84B0C54D527C0DF018A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498535, "uuid": "c4626c83-0729-4429-916e-6cb3753084d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498535, "uuid": "ad595afd-c3a3-4b98-9f90-9a4353e66a7e", "value": "24576:oYRuksamMGPQeFW11ZGxUkFpXTT2bY42PzuVeU7pCzHHHQnCIf9TU6mk:lsamM6QcWxGx1FpXXhlPseU7p0HWCeKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498535, "uuid": "90c27473-6f7b-4f31-9713-1d4fb66f08ff", "value": 1512448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498535, "uuid": "acc7b7a5-7fd6-4140-ae1a-b2641b18b43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498535, "uuid": "dd585202-c60d-4a73-9fbc-5da629a6714d", "value": "cec899da8b9a765c80f6abd34b9a8a5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d841c3af-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639504452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504452, "uuid": "8a405fa8-643f-476a-bad7-3763e2dc3510", "comment": "Malware payload (AgentTesla)", "value": "92bd604d29142f67b48d3f46c9a752be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504452, "uuid": "1fe5d500-abf1-413e-9377-9c1b86c29ea8", "comment": "Malware payload (AgentTesla)", "value": "cf3f565adf7a9dc89288a2b46726507b84d4978b17facec8b1e684d7de98649d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504452, "uuid": "e5ba4560-3df2-4119-b397-35e78ce3bf2b", "comment": "Malware payload (AgentTesla)", "value": "42ab3740b172d621adf9edb3fbd6d128048304a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504452, "uuid": "e6127ea8-ce39-4535-8152-f4bfadf7b389", "comment": "Malware payload (AgentTesla)", "value": "fe7e6d22d1cf9e964eb235b5ccc8c8779e3429b56c21028a36c3a9b09dd31d2b6ac80fd12b0388d75e759925945ebad9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504452, "uuid": "fa957b76-fe82-4eeb-a9d2-4d9798e1ae6f", "value": "T1D4450258972C6F36D57F5BF694B0221A43FAA00339A6D77A4C85B1CA6D53780CF01AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504452, "uuid": "000efebb-6935-4fc6-890a-e24e332736c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504452, "uuid": "85927875-ad82-4e05-bfcb-44bd2e877e44", "value": "24576:KYR9GmyqX1AwmTU2PpUIpyAotrRPwF/KU2cFk+VCeGG:QmxGwm4smIp1aG/KU2cFHVCeGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504452, "uuid": "de3ee1c4-28c4-40ac-b1d7-67421363d1da", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504452, "uuid": "54f92ac9-13eb-4193-9e8d-d96f0dd69d10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504452, "uuid": "6d96b418-3c67-486b-a7b0-3cc329256d3c", "value": "92bd604d29142f67b48d3f46c9a752be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11ccd87-5cd2-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639482079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482079, "uuid": "159455a3-f158-48b7-9c40-c8cd61e21d62", "comment": "Malware payload (AgentTesla)", "value": "b9c7eeece561324f9ab27370eea2d0f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482079, "uuid": "553564b9-799e-40a6-b645-1fc799111f56", "comment": "Malware payload (AgentTesla)", "value": "cf84f4e671264251141a71c1a2a5d29b7f0ba51659f66de6af423854fd00f5d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482079, "uuid": "9f2c2b86-5fa0-425f-a650-870a5d448500", "comment": "Malware payload (AgentTesla)", "value": "d33951a5ce3aca4386ee81f7938be9fbd1638091", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482079, "uuid": "70a815d8-2a11-4f4e-bdfe-b5431e485594", "comment": "Malware payload (AgentTesla)", "value": "79135a0f20640b51b699be76b563585eb89432f3fb55427b504c0732cc6cf906f317ba14b880256894925404613d738f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482079, "uuid": "54eeda12-c1f6-4d63-97e1-341fcae02dc7", "value": "T149A4230D71F42BB7D6858D78007FEBBEF7B46AA603512255CB496FBA873105A01DA8E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482079, "uuid": "e3fb6499-665a-4722-9a83-cc43b0ecaa21", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482079, "uuid": "f3a5013f-e79e-4005-a063-c75dc7839fee", "value": "12288:pS9zNaSSaPusODDwAOVVdy2FU96v2VsW3rpdLyUCKv:pS2KeYvfFU4ezVd2UC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639482079, "uuid": "360e35c3-502b-46f8-b02a-68aef3868a40", "value": 488598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639482079, "uuid": "6a952f21-5153-402e-a920-bc4ebd8444bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482079, "uuid": "2d654259-19d6-4965-a029-9bd1902b7d5a", "value": "Bank Fund Transfer8300006139 2021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96767707-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639497899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497899, "uuid": "f3e8c436-fa52-4f10-9ec0-bc121b6f2da4", "comment": "Malware payload (Gafgyt)", "value": "aa610f4a32c7bd4969944f8685dacca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497899, "uuid": "bcdceb83-4ffd-41a8-9729-1f7444922ce9", "comment": "Malware payload (Gafgyt)", "value": "d005db339ebddd1cd3fb34163f90087bc7fe60a33e120385f77f9115921b8523", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497899, "uuid": "f5cb21c1-bd8a-4969-934c-ff09f0af8285", "comment": "Malware payload (Gafgyt)", "value": "3a05060c81838615b2900d727ef90ff336f70130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497899, "uuid": "5cf4f636-c67c-4e4c-8792-51b9ef191d29", "comment": "Malware payload (Gafgyt)", "value": "c5df195924590105e502c76d8021a5ee90981e2555cfae80cd4a9e1dc1b464dee47439c61ced18a75428be3ba30b6bbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497899, "uuid": "ed1dd830-8240-435a-bdef-7774ab487eb2", "value": "T122832B46E3A2C1B3C4871BB902F7976B0231F9164B6A5F09E35D6EF46B02488719B716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497899, "uuid": "d873de63-de90-4364-8b47-33ee6531dc71", "value": "1536:yAnJ5bFt0zRTqji44sZQFY4hylww4QWI/cmnRkm5BsNFP4Y7x0:DnzToRT3vkSY9lFTV9SmrsN14Y7x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497899, "uuid": "8612bb5b-4cc5-465e-842a-5724d6977ea6", "value": 87466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497899, "uuid": "16cc58c3-cf6d-44b3-8f79-4ff103607f16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497899, "uuid": "84edc3f3-d1fd-49a4-96ad-d69d4a84f767", "value": "aa610f4a32c7bd4969944f8685dacca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793b7a05-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510305, "uuid": "210e4082-2b21-4580-aeb1-de4fa8c371f7", "comment": "Malware payload (RedLineStealer)", "value": "bb9ff9174afca99728c9944e23942613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510305, "uuid": "38affa8d-d9ab-4010-9c53-987aa655d303", "comment": "Malware payload (RedLineStealer)", "value": "d025b54af468bca500f3e264be33e520e45eda00aa1d6cbac413324344354a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510305, "uuid": "523ef3e1-f0da-4fc9-955f-29cb49c779c7", "comment": "Malware payload (RedLineStealer)", "value": "e23e0da71a6fa1689403c72348e022a72ccb3c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510305, "uuid": "60a224d1-d392-472b-b5f5-fedc2793cbbc", "comment": "Malware payload (RedLineStealer)", "value": "3b1ce07adbda7091c747d7148488f7a04a3474fcd818389279847f1726b2833c7a36612f56d00e23d4120148ae260f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510305, "uuid": "fc413d07-9264-4abf-9b7d-077198ab4011", "value": "T13494CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510305, "uuid": "3ba4a369-865e-4783-8ebd-93ff703a2fb9", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510305, "uuid": "107d1e5c-3788-433b-a906-e1652290adba", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510305, "uuid": "72b19478-cf8c-42ab-9508-8b01defc7a79", "value": 441937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510305, "uuid": "538ad9f3-5f75-426e-ac98-f8f71bb02c70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510305, "uuid": "b9d096b1-3e0d-4cb6-b32b-822006d6603c", "value": "bb9ff9174afca99728c9944e23942613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1e1f33-5d13-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639510016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510016, "uuid": "9c4a4cd2-8805-4b28-8239-53d2fe86821a", "comment": "Malware payload (RedLineStealer)", "value": "0ba05e3c24a638b5233b24243400865a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510016, "uuid": "9743935b-8e75-4e5d-b724-a899b70686ee", "comment": "Malware payload (RedLineStealer)", "value": "d062742f3807c2aea5e3e8ce2aad4a5b84abb04000459b9f7db3a76e9fa5f6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510016, "uuid": "0351d08b-a7ca-43af-833b-f0c30b55c661", "comment": "Malware payload (RedLineStealer)", "value": "20bd2b7f1c4ee96201808db8ba744f9cd9d19c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510016, "uuid": "51d28197-98b6-4bf0-bf27-64dc0b71de3b", "comment": "Malware payload (RedLineStealer)", "value": "95f51ba81c96284cf8ecfd87a892c2abf8ea4c03fa1b66b66470a96d66a8e8cd07a5440ee730ee537eee48cf7e37d5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510016, "uuid": "20bc212b-5bf3-48d7-a1eb-125fd8f713d1", "value": "T14C94CF00E7A0C039F2B712F449BA9379B92E7AE25B3451CF12D526EE4675AE1DC7070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510016, "uuid": "04ce4004-e463-4a45-8b02-86e6e13a0c29", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510016, "uuid": "f65eeb32-92c4-47d0-908a-f0787ca3449e", "value": "6144:+P++P8QkuaH/lH54AxXxYTx+cXfrXSBRHwB2tjCY71O8nptaQC++:sPHqH5BxO+cXTiBRHwB2gY7Rnpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510016, "uuid": "b7ce09e0-c4b6-4b54-85f8-c9fdf06c1fe4", "value": 441944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510016, "uuid": "6034b5a2-ae7d-4011-a7fe-846510617f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510016, "uuid": "bd008d3c-f6a8-47d4-b108-c46d025cb9c7", "value": "0ba05e3c24a638b5233b24243400865a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7a4508-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639497422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497422, "uuid": "de99689a-d63d-4e8a-8084-30c76337cffd", "comment": "Malware payload (SnakeKeylogger)", "value": "807b4de71e74d318dae0f80097a95cf2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497422, "uuid": "adfb1534-3f79-4c3f-8fa6-773fb8a1c600", "comment": "Malware payload (SnakeKeylogger)", "value": "d1905cf2fc0947e19e0898e1c844059dcd8dce0547b607d88e253cb3c7969876", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497422, "uuid": "1cb578b6-46d1-4750-802f-c4d4324f286d", "comment": "Malware payload (SnakeKeylogger)", "value": "ae4cc1b547d6fa1fac9a00a5ef04197d4fd2e349", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497422, "uuid": "eaa5ffb3-9384-46df-98f0-28590d5dc439", "comment": "Malware payload (SnakeKeylogger)", "value": "946290c21ee76894e1b27a9ec89293f5aace167bd658a96bad966f135780818dcb3fdda07b684ef3ed51ef6c114be06d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497422, "uuid": "f1e06996-b3b8-4af2-b30e-5d97950ddd97", "value": "T1D892A46CC46741D88F896BB86B2BAF4904CD76AEF7859132323C5B7127D2E79901383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497422, "uuid": "3080a605-20b8-4e93-bb0a-2e69667d57f1", "value": "384:DaqWGlgVm2pBXbB9PrpT77thq9949o2NqUi6FIU83Caag:SmcBbbPrpT3by49oqcdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497422, "uuid": "9f788edc-b744-48ea-a177-ead5ad8131f1", "value": 19792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497422, "uuid": "7cbca719-bce4-44b2-bfc7-af54f138df34", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497422, "uuid": "3492b89a-92e4-4ed3-abce-bf4ec87c02b8", "value": "Bank Guarantee Draft .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdb6804-5d2d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639521127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521127, "uuid": "baa1289b-cb91-4431-8c9e-7a0126077100", "comment": "Malware payload", "value": "3c5bfe346e1bf0777e6df02980994475", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521127, "uuid": "e584a564-2e12-4aab-b2c6-9aeb6ca36c68", "comment": "Malware payload", "value": "d24cd1ed31b131031af428598b3f85d285005b3eac5ba8b78d5b6c1ca78fed97", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521127, "uuid": "b97d985a-7a72-4f51-b3ae-8cb5c3320709", "comment": "Malware payload", "value": "ad6ecef0c4c23ad3007c988fa2c540cba9929a04", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639521127, "uuid": "b9bb3225-def6-41cb-a200-e50d96bbb264", "comment": "Malware payload", "value": "8b792c1bd32a11bede1eaa1b8cfc4f4794bfd8f6a0ba60e367523851f41c7a5d5b57fd1e72628464f68b4bc7c2626b3f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639521127, "uuid": "6a8a55d8-d741-44cf-89e0-360f59c1a75c", "value": "T12C73F11A3258C487E082D5B6BAD2D5D373A53C61EE5293173380BB1F6EFF191590B319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639521127, "uuid": "faf6a431-b6a7-45d4-9f18-755d9c3a84c4", "value": "1536:KWfmnkgBUloy8yegJi6Qel7rC6MPRpJKB1VDV9zmez1lN6LgSmWoN:lUkOU2g/l7rCF5pm3x9yezF6Lg1Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639521127, "uuid": "55a4d5d7-8172-4d6f-bb76-5467d6f00643", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639521127, "uuid": "6bc7b0f7-bc45-4d8d-bd42-fdc80043a270", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639521127, "uuid": "94791916-8191-4b83-bb94-a4692404d10f", "value": "SecuriteInfo.com.Heur.26983.8237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fbac0e-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498376, "uuid": "f0bf1471-1915-4fd9-875c-268d0d1bf132", "comment": "Malware payload (Mirai)", "value": "ddfb3ded5c454f755fdf8f9a3d69ab4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498376, "uuid": "cbb36d82-4b36-4fbb-93b2-ec856d2e8cb5", "comment": "Malware payload (Mirai)", "value": "d28709d43a595a6dc04eb124209bcc033c4620ba24ed0539356860eb6dfdec2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498376, "uuid": "c10859e2-2383-4c66-bb77-f5e69812a5f7", "comment": "Malware payload (Mirai)", "value": "abcff5efff3e8eeafb3c54d2bfe6574aff792b9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498376, "uuid": "30d814d3-2a4f-4d3b-9b64-e79ab604986c", "comment": "Malware payload (Mirai)", "value": "548a5dfbfdc2f5bdb3d5ec734d2a53b06a7f91cf85d9b8077696632f0653859b2d888301345f2ff23ce31f1264dfe0f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498376, "uuid": "7b77d016-b466-45ec-b577-37f6ff2ce627", "value": "T1D6530260D9EBF177C795A9F0B894808961E40A2FFF62D6F2533702240BC354A34ED95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498376, "uuid": "3d32aa49-4899-48db-94d7-cdc937f5b720", "value": "1536:+czz0oqzBohZquCWb7+1oVvTXus969LgV+C3r+/:Pkoz9CgReLUL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498376, "uuid": "4dd83ba7-ca14-4027-bc6f-c57c61194e81", "value": 63780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498376, "uuid": "29f2b612-2a69-49d3-af60-e5d0a95a5cb6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498376, "uuid": "b1246e13-a84e-440a-abed-aa2199226520", "value": "ddfb3ded5c454f755fdf8f9a3d69ab4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa5c59a-5cec-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639493262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493262, "uuid": "59667a6d-aed2-48cd-b39d-d2de25c76ff6", "comment": "Malware payload", "value": "400f597df7415580be843940bb37bc01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493262, "uuid": "57b31bbb-9a2c-4a97-bac0-af1587341518", "comment": "Malware payload", "value": "d2bb70c2ccb90f41987dc7895f3c924a4a21a5b4dc8f56d3706c37dabd7630ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493262, "uuid": "751f729a-0910-49da-8f8b-82140a616c42", "comment": "Malware payload", "value": "4c8fa35623689b9123e4449f9757201ba840a6c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639493262, "uuid": "364a6fc8-3d3c-4439-9d81-512cb7b5415a", "comment": "Malware payload", "value": "9f30f0dd166277a1824dd76d6caabad062370ca8e9cdf25f0da1d1176f6fd4b1d8cee02900768a6c7d6e05bf66ce3bcd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493262, "uuid": "1b27c6b4-36f4-42f9-a667-527175fc81ba", "value": "T14F544A6585D3003FDA91E5F1E6895582D2EB2D0C79CAEFDAE91E083FBC50161927EE0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493262, "uuid": "5472b36d-7c8f-4b58-a442-80aee2827fef", "value": "bd454ac20ca49f2400b5a01fcbcb04c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493262, "uuid": "8ae196bd-6943-4adb-a2bb-6e04bca3b9d8", "value": "6144:EedqtLYwtSbECpFUe1z0lndR95tFWCQEiYkJ316:MtLYwg/FsnDbtQTEiYkJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639493262, "uuid": "ae0cb990-e90d-40c8-90ce-a82d20eb13e9", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639493262, "uuid": "161444a3-43ff-48d1-9a8b-b017bcb2e969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639493262, "uuid": "36a231bc-3e89-4803-ab3d-e7d80fadece9", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.31207.13906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4861cee2-5cbe-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1639473286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473286, "uuid": "eb671dae-8513-4ad8-9507-d67cfa946bdf", "comment": "Malware payload (Gozi)", "value": "bb5f2b798381cddc1217970139ebf534", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473286, "uuid": "cb56d29f-1978-4461-aa06-f59a8403beb2", "comment": "Malware payload (Gozi)", "value": "d2cabc8f6c991af9e19502355e0d5975ca15099e6cec0da0bd6a8e5510253a2b", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473286, "uuid": "d69aee20-3c87-4d0b-9ae7-baa54baffff9", "comment": "Malware payload (Gozi)", "value": "b03d6f0690781341dc6ae05d4861687b970b02b3", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473286, "uuid": "f912a39f-2f21-4172-aeee-16583f3821ba", "comment": "Malware payload (Gozi)", "value": "ccf485229ce378c28ad985c86e960666b5f8f9083dc659bd9f530b1658f06f191df5011aba192655748b973b1a5fc9f3", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473286, "uuid": "b4c178fc-39e3-4202-b088-14263af79729", "value": "T10F33F722BA56C95AE95617364CE2C6EA7337FC509F6B47073244B32E1EB62D0C913B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473286, "uuid": "a97cda52-afb1-49ff-9b01-6ba351091270", "value": "1536:JsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0Ks4aIajL+msiV2:JhlYkEIuPm3fNRZmbaoFhZhR0cixIHm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639473286, "uuid": "c845473b-ed5c-4919-8755-779efad13b24", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639473286, "uuid": "45a255a5-6bc8-4506-ba7d-96de399fa17c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473286, "uuid": "cc4a9288-1311-4a00-a951-03aff41486e6", "value": "brt.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd759ca9-5cc3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639475657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475657, "uuid": "2b46296c-5b4b-4257-8b85-83bc0d48d151", "comment": "Malware payload", "value": "cf6c78e60e03f1b564f7598689c517c0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475657, "uuid": "a5717b5e-5810-4307-8ba5-e44894d63af6", "comment": "Malware payload", "value": "d2e8c5bc5b1e37c9483e07a6ee52de264c433c48ea7dd4eb6bdf46072a1cc672", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475657, "uuid": "a24c90b0-9e4a-4319-a118-b1855105c520", "comment": "Malware payload", "value": "4933fe2ccebba324d0807242fc4dc15376ee7aaa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475657, "uuid": "72dcc606-f859-4820-bc54-c3d5cd6025ea", "comment": "Malware payload", "value": "8d7a1cf2bdc7806ef494ec081a4b19725d02db7837467481836c95a94d8470230e04765d72e62859055816c8763f0bc7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475657, "uuid": "2c47be43-32a7-4782-85b5-9107cec5d23f", "value": "T186E068107FAFF6EC3915C107C174C82A4DD21008A5806A947BD5DEA88A21AE8F26B12E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475657, "uuid": "3bf077cf-b11a-41e8-8cbc-cc75d34fc128", "value": "6:jtiGNbHloUFe0nyeINKbTZzV7Q1KRAuaHbneRMqSnnRNKbWaHbtYEJvwWA:ciloUFe0noIbTX7Q172L8nRIbNdJvwWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639475657, "uuid": "c3656a35-2647-4097-8eca-1a12904dbf8c", "value": 380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639475657, "uuid": "7cc26b23-a5da-4c60-8365-2c48d504e28f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475657, "uuid": "cda905e5-e971-40c0-a9e6-67287fae5983", "value": "ab.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c020559-5d36-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639524725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524725, "uuid": "57110db9-668a-4755-b71d-c7ce2ef2e0f4", "comment": "Malware payload (Mirai)", "value": "f02128ac5baefb72c2243597af956278", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524725, "uuid": "78dc410f-dcfc-4714-955a-92dead81e2d7", "comment": "Malware payload (Mirai)", "value": "d2f579d37e681476a6e4f8e50df04567aaf88e83c0df767a07639649973ba273", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524725, "uuid": "550a1c92-b71c-41b9-a169-bf58d10560f8", "comment": "Malware payload (Mirai)", "value": "5ca7568f5848d6c19c08d99cacd1b0c0da68691a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524725, "uuid": "e26d8be4-9062-439e-8040-469915f452d8", "comment": "Malware payload (Mirai)", "value": "2731a4a37b8347c4f69a590c12c9448480c6b3830ef4d9f4cf2f2ba40682bddebc7f4b8766605d9dc225672e9faf9c3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524725, "uuid": "2b1a764b-3ab2-42b1-92bf-e6f9e45d7486", "value": "T1B3B3C40ABF610FF7E8ABEC3745A92B05249D550B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524725, "uuid": "ef0a8de5-ff77-4e74-8740-b59183536666", "value": "1536:g9DYWFx+xx+AaEPiRMR2jk2EkZ+BzYCjKoOvDBgplbngVZ14hvG:gqWFx+xUA0yR2hEkZ+BrpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639524725, "uuid": "ca85aa62-5bbc-47c1-b2c0-deb65b06b472", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639524725, "uuid": "ab73f857-28bc-4cef-a052-13a6240818c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524725, "uuid": "93897d92-e292-447a-926a-f77017271417", "value": "f02128ac5baefb72c2243597af956278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72a5425-5c75-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639442092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442092, "uuid": "c2dca096-74d1-42cb-9247-df620e5e1aaa", "comment": "Malware payload (Heodo)", "value": "976fc4a17bf4a9a045d0bbd4d3988412", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442092, "uuid": "506eda93-6552-44e9-9cb3-6627a74f2f59", "comment": "Malware payload (Heodo)", "value": "d3e387c2a70a72ef96c5ba2a8f377b5fb94914bacc0ea6a7374f079ba132f5c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442092, "uuid": "b2b82a47-2e1e-4f57-acb6-268a2a68b73e", "comment": "Malware payload (Heodo)", "value": "d0c884a6690ad90263299db847f83afcf8e4ecc9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639442092, "uuid": "21b223e1-a35e-40d1-bfb2-246529caec7b", "comment": "Malware payload (Heodo)", "value": "a2001acabdacdce4d1df388bd2245aef2742af26c73125f7faeb919c8e483dd366c24a2ac3dbd5c44f1591f6ae3e27dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442092, "uuid": "cd049d81-46cb-41cf-9b2f-abfb5eb341ea", "value": "T18444BF10B181A032E8FF057A85FAD5695A7C7A100B90EDDF93C8187D4F776D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442092, "uuid": "4f95d640-a70f-40c8-bc4a-6a038856d0a9", "value": "71ce66c8bba9a47db5e9322b567b56d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442092, "uuid": "f5fd5507-c602-4b8e-b06e-6ff77c29daec", "value": "6144:GPMd2FdFQ+PMRm/Z8ezVSbpz6LcZ5Fl9EppXxqJVHWTBeVpv:WQ2d86q0VSN6LcZ5Fl9EAWTApv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639442092, "uuid": "86d254fe-f610-488c-a5c3-2df4049e7ae3", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639442092, "uuid": "08dde18c-75c4-4dbe-ab84-e85c9ed0d38f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639442092, "uuid": "7277406a-bce8-4faa-b597-eb9e9feae2ed", "value": "emotet_exe_e5_c2232916b9d097fc64955e092f44840708f66d484a409da3389ba5f2dc079eb2_2021-12-14__003415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72d2f34-5d26-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639518140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518140, "uuid": "7f5bc41b-9b87-48dd-a4ad-ff884b70da76", "comment": "Malware payload (RedLineStealer)", "value": "77ce7ab11225c5e723b7b1be0308e8c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518140, "uuid": "8326d594-bd64-46ed-9b97-c09a506e5465", "comment": "Malware payload (RedLineStealer)", "value": "d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518140, "uuid": "c9b5aa13-2c9c-473d-b0cd-ab28f051694f", "comment": "Malware payload (RedLineStealer)", "value": "709a8df1d49f28cf8c293694bbbbd0f07735829b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639518140, "uuid": "e78b230f-4d58-4a5c-9846-8783814a9dd5", "comment": "Malware payload (RedLineStealer)", "value": "da2576e9041ad85a52c76327c7b42ac9e54d6cf46b3f868e0b7575ed193f2d05a5f7157b0f439ae4e32c006a56da5596", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518140, "uuid": "70854ebb-2fd4-435e-8006-d6bd998e2a06", "value": "T1AFA4F0F76A782702E9314D7B91DEB47B811EAD53830384E9ABB62D4924B6714C3B0D3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518140, "uuid": "022d8975-a48d-4040-8e92-6983f871a006", "value": "a3aa1d50d30db434a8611804f8c96d63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518140, "uuid": "ceeda9e6-ed43-486d-b711-cab724ff587e", "value": "6144:iYootrDGcecqFGlRbcT6ZcCyK/8Z/SVlMxFwJh2OzAxnFo2Uix7kZsEj9kZex:iroVnTHgjCf8ZY+xUh2OUtM9jTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639518140, "uuid": "0a3181b2-d3d8-470a-9cac-a93bd2a379dd", "value": 467984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639518140, "uuid": "e58c3a26-6c3e-47e7-940f-f460c3303db5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639518140, "uuid": "dcfac9ad-bdd3-4226-90c2-313516d47671", "value": "77ce7ab11225c5e723b7b1be0308e8c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8699a5ee-5ce3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639489282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489282, "uuid": "8dcc15ce-6214-4e73-8897-d8515a32850a", "comment": "Malware payload (RedLineStealer)", "value": "2d8762a8d52d4392840a2edb490ecfd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489282, "uuid": "271eea3a-b9f6-42c9-bd89-37c3e6ae137a", "comment": "Malware payload (RedLineStealer)", "value": "d414e88efaf651c38fe78a43a2582a34b98e5eead5cc9a23f3d7a66ad839740e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489282, "uuid": "346d8ed8-8778-4d8f-9556-09e3dc94a7ec", "comment": "Malware payload (RedLineStealer)", "value": "d3f336121066170f1c06246f8e47262060d925e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489282, "uuid": "3eb42581-7ac0-4d86-87d8-dfb3775b1792", "comment": "Malware payload (RedLineStealer)", "value": "aece94bec7a41ffc7d520203914e42cd63ebecf058886d5a4ae8487b6bd514f525d5dac5d42c9741c769df03345a8b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489282, "uuid": "2b28044f-ebaf-43d9-a8b7-661f258228ee", "value": "T15894BF10F6E0D035F6B356F44ABAA378A53F7AA06B3850CF12C516EA4675AE1DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489282, "uuid": "65f07969-0cfc-4edc-b40e-3babf32f8dae", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489282, "uuid": "14fa3c54-0d3a-44c9-aac8-9b5061fc1ba0", "value": "6144:I/zeCuXRBJU5o3hw/82JZzsBzKgoKAhvRMXcrmG7fRa1cYr9vvwCaDS:hC2BQ0qNsBzQvyXcSGrWcYr9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639489282, "uuid": "86e26188-b478-490c-9c29-ac59b17d2856", "value": 443396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639489282, "uuid": "b6f12565-472d-403a-96cf-553a191de86d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489282, "uuid": "53dd5688-bbf9-478f-9b51-ce6ddc4b83fc", "value": "2d8762a8d52d4392840a2edb490ecfd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5b77ba-5d14-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639510226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510226, "uuid": "7ae3d558-b023-49ad-bc6b-42c8ebac0494", "comment": "Malware payload (ArkeiStealer)", "value": "636e09ac8df17c9704958d35c4f3f161", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510226, "uuid": "6468046f-d784-4f6d-ba1a-d4def1fdc366", "comment": "Malware payload (ArkeiStealer)", "value": "d51d87ce93b1f39f87f0debd1122aa7721e5e4fa9f7f615c4c17bd90f12da71d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510226, "uuid": "eb0fa7b1-d776-4278-9c30-045fc082dd9e", "comment": "Malware payload (ArkeiStealer)", "value": "464172ca4e9cd756a3232249dafa528e2d8a2c09", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510226, "uuid": "b3711ec6-3865-4a86-8b72-8c123b845221", "comment": "Malware payload (ArkeiStealer)", "value": "c1551671e2cedd5193352094d9934035c63b4f786164647555705177885b4d9a7e4495ff428507e515fbbebb2b4b94bd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510226, "uuid": "ed1a046a-dc93-4e50-a27e-731e47519682", "value": "T177F40110BBE0C035F2B752F9097A93ACAA2F7AB25B34A0CF52D556D956345E0EC7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510226, "uuid": "a1f6dd1a-7d5d-4680-ad71-b64bc7399fab", "value": "263a0dd44f757a6292f05df0efca9b1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510226, "uuid": "d8d7153d-36be-45f7-81e0-ccdd11bf7575", "value": "12288:P6eAyGozHZc5TrOgeFDqldf6CBd+gAH+vzeuSUQqA5MZYqZNJJFGEX9afu3U+3on:EyLZc5Trsql4CBc+vxyqIINJ3GyaWDok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510226, "uuid": "55b5ecbf-9911-42c8-b79c-2d43d0c94a19", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510226, "uuid": "e94dfad1-8d31-40bb-be52-af438d67e934", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510226, "uuid": "d3c9f898-8897-4450-825a-654f9a168941", "value": "636e09ac8df17c9704958d35c4f3f161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f525aeae-5caf-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639467134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467134, "uuid": "b6f4caa4-22a2-463c-898c-4fb41c426b58", "comment": "Malware payload (AgentTesla)", "value": "3e74e07bac450e61f75b4cdcc088ed42", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467134, "uuid": "5456cc4d-3c82-4108-adb6-32c94e7d0248", "comment": "Malware payload (AgentTesla)", "value": "d5578f2bc2a1b53b6d71aa92005df73552ec0f1f58e2e71d32b00efd59e14446", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467134, "uuid": "bfab86b8-ac77-4bce-bac9-6f2af9c23b17", "comment": "Malware payload (AgentTesla)", "value": "e703efa4556d0b32ec8864b63e10b32b148b8f7d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639467134, "uuid": "22ef8070-f010-44bb-ad51-68f9a3f9ecd5", "comment": "Malware payload (AgentTesla)", "value": "3544292bf2c22b5b8d570936ac7a24e4f1f338d3bcba03715dcf2d58396cdd33618356587192d9d2e45aae9a45b7efb7", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467134, "uuid": "e1b1cefc-45f4-401c-89e2-ebcca5774ce0", "value": "T1AC34237F707F47524BDAC6B6C430F3EB31D0669BD858EE0B2AAB246931AE24019574CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467134, "uuid": "0c50ab0f-d822-4e04-87bc-7d01d1279410", "value": "6144:JYlURkpvjRajhrt0svK2NguEw53uKGlEj:jc9aXTEwZuKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639467134, "uuid": "4faf87e2-b83b-4938-878f-bb145bf26d81", "value": 245984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639467134, "uuid": "ba340f61-ab2b-40b3-aaa1-a0b9ecfa1a6d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639467134, "uuid": "d8bff5f8-3801-470d-962c-bc8d3a70703e", "value": "TNT Original Invoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a17afd-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639499025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499025, "uuid": "9a24dea0-db94-4275-8e26-22c2f6180eb4", "comment": "Malware payload (Mirai)", "value": "ae99794cf6e78ca936c571230188d7bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499025, "uuid": "671fd659-2070-46d6-9006-f05ad8270872", "comment": "Malware payload (Mirai)", "value": "d5cdf8432e61d737d6ec452bfb7b12b114e6337eb41802db41bec8f05ff233e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499025, "uuid": "630e6532-b817-4b22-9da6-f4fabbd706b9", "comment": "Malware payload (Mirai)", "value": "0abdc50c766b8a5c247d61a3d75215895bbfabcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499025, "uuid": "290477b6-97f7-4441-8c15-dd6dbc302571", "comment": "Malware payload (Mirai)", "value": "fe51f16cd774c24696287c70b5077ede94428cf0e3046f07d3a9c378f25c722211e797afd61913e9be179bf95abfbceb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499025, "uuid": "c68de8eb-eb95-4387-8b1f-8dd9057540d5", "value": "T170B31993B800EF76F40BEA7604D34B25B630BFA60E535626731739AB9E761D42827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499025, "uuid": "933004e8-e4a6-4627-960a-2937d49eb31e", "value": "3072:pKkjsTpygJOCZks5GjbyhwmueZmtf0qEwxOrPp:pK0tgJOCZkdyh5ueZmtf0qEwxOrPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499025, "uuid": "aff4bd48-e468-4ef1-81bf-6bc7edf735ba", "value": 116758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499025, "uuid": "3172fd3b-f609-4014-80ac-df688359dac3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499025, "uuid": "53f68419-97f9-4d62-86fb-3ba3acb98ca4", "value": "ae99794cf6e78ca936c571230188d7bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e92d978-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639464761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464761, "uuid": "7d4dd899-7da6-4755-b7a4-c53af8d5488d", "comment": "Malware payload (Formbook)", "value": "8d2a0206624185317656432dacd54315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464761, "uuid": "5412aff7-d5df-4cc4-8e84-56508a36c8aa", "comment": "Malware payload (Formbook)", "value": "d5eb3dacf12a57af15bd365be08817b05f63c045953f776a1746ada0e73134dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464761, "uuid": "9a2c5559-104e-4827-9f4c-6147cdfe8972", "comment": "Malware payload (Formbook)", "value": "c00d201c0e6d053ffc7bc8d8c90bec7e64ab7f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464761, "uuid": "e8bf9d0f-4fb7-48ba-9f8e-dbcce14edb8b", "comment": "Malware payload (Formbook)", "value": "93b0bb0f336677b8a1671f1d8788a18a525e579282851296d5f3e99c08968d2df6ea27bc0f2840e59256ed64eec8afe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464761, "uuid": "2b677391-f731-4825-a571-3dfcbd06b576", "value": "T1DA4523077A68D911D06AD7B8F657910403F4BE1AF2A2D79B3CCE37D46292BE507422CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464761, "uuid": "796b2388-1044-44a9-9d22-e7ee80eb2443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464761, "uuid": "617cbcbd-b177-4fba-9761-2da283e241eb", "value": "24576:lOyp3H+wUPvuNHozANhzFyr5TNt0Hw1l9GYv34G17ApP/Aop:08uINIzANhWTL0sl8Mn17ApHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464761, "uuid": "04196558-b24d-4ad5-baaa-1e0d4c066cf8", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464761, "uuid": "5c8838eb-3184-4f9c-b67e-7b02488f4321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464761, "uuid": "0cb3b02a-83cf-436a-a9db-f409aa0f62ff", "value": "Nueva cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2707164b-5cd2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639481820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481820, "uuid": "70874df0-3b1b-4a01-964a-0da934b0ea2d", "comment": "Malware payload (RedLineStealer)", "value": "17447771c2fcf40766ca06575aca5ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481820, "uuid": "e016c99d-630b-4f28-af52-a24ece12dc2f", "comment": "Malware payload (RedLineStealer)", "value": "d7d0e1bfe505a50f8b73b2da9a2203169d7614894efd7d708a952fe9d82e06f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481820, "uuid": "294ee97a-9c45-46c0-afc6-358cddbd3de8", "comment": "Malware payload (RedLineStealer)", "value": "6775a85e410d7f9b76b0ced7623c33bb15c234ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639481820, "uuid": "f0a9fb5e-6321-443e-aa81-10ea3b33fac5", "comment": "Malware payload (RedLineStealer)", "value": "abd2b8dd19be7b86dfecc2a5fcd08fe25f5c14b4ed37a99e74833a15914aa44bb760b0fb4b2c348b4acd784bcae2152f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481820, "uuid": "e30ca94c-6a94-43a9-9ee9-ebb93399c4a3", "value": "T1D194CF00B7E0C034F6B352F549B9A3BDA93F7AE11B6895CB12C516EA5A746E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481820, "uuid": "6a181be0-bc50-409d-881e-1843bece26be", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481820, "uuid": "2fa01eeb-fa9d-4f7e-9d53-f00241bc3b80", "value": "6144:ej8hPMxoVOypQXfFgMrSnRWcMiKLliVXHKZ1F5B3tEdqV6CrwYpr:k8hkmbpQTORdMiWlmKZ1FvtEdqpMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639481820, "uuid": "2b172cc2-222b-4909-90db-235d3fd0b0d2", "value": 420370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639481820, "uuid": "714dbc0b-5867-401c-be88-9411d0622c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639481820, "uuid": "1a0a7a43-d45f-4141-b137-903455ac0c66", "value": "17447771c2fcf40766ca06575aca5ab0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1b4bb6-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461616, "uuid": "472ed6ee-6157-4f65-857a-c91c02508910", "comment": "Malware payload", "value": "d6f4b4d0642c4d606fea3a4b46b2c127", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461616, "uuid": "9d27c1a7-f092-4e74-8a93-8451a789e8df", "comment": "Malware payload", "value": "d841a05c95d0b65e2ceb2dbcf55f3d7aa50acf7e4835d93dbce123986e0d68fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461616, "uuid": "a3825b4c-bad4-49ca-9205-7337848fe889", "comment": "Malware payload", "value": "465e70a83321b399e38c958719c1a63986e58dd0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461616, "uuid": "e80e8f54-eea0-4633-95a3-9a0c03be3874", "comment": "Malware payload", "value": "3cd384a44ff3a886a2fe442281cf1eab48c3a862f0f445e2e85bea7f474b64886b934809fbbc8399c083305193b97735", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461616, "uuid": "6071f0ee-e605-45ad-be6f-cd93ed973d07", "value": "T1F2A5330C43B9B9ECF95F06282B538DD0C5ED72E4F94161E2A2641DA85C3F1BE039F966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461616, "uuid": "4a6d7414-06af-4bce-b6f2-ede1bcf9ef0e", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfR:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461616, "uuid": "c7bda1f7-7600-40f9-a185-840c2094fff0", "value": 2170880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461616, "uuid": "d528e039-b965-4b24-a7e4-93a484fe815c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461616, "uuid": "ca857e89-2758-40e9-a1b2-da84f8fc9d8f", "value": "d841a05c95d0b65e2ceb2dbcf55f3d7aa50acf7e4835d93dbce123986e0d68fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0680c3-5d17-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639511414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511414, "uuid": "cd21c928-5522-41f7-a29e-b37ea48df411", "comment": "Malware payload (Mirai)", "value": "0b70e59e69edafbd1e522846ae7ce3de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511414, "uuid": "31ad7bdc-2cd6-4288-9971-00eea458a2d3", "comment": "Malware payload (Mirai)", "value": "d8438bae7fa8166fe88c595fd8e87e3a2286e63bd60b47eda7f358853cb486fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511414, "uuid": "4bdfdb4e-a3d1-4414-bdb3-2b1b60c9cea1", "comment": "Malware payload (Mirai)", "value": "5111e26d8db826f0131ad4264af6cb7af9787161", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511414, "uuid": "8b844e4b-6626-4796-aa1b-292434872239", "comment": "Malware payload (Mirai)", "value": "82d8a29835d19c362900cbcb271480f53613ec5ea7cc11af92efd3dea02ea3e05536feef89ee44bdd9e6dbe3e852e34f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511414, "uuid": "fe61d6c2-77af-4548-a43f-2411f7a10f29", "value": "T134730885BC419626C7D11777FD6F118E3715A3C9E2EA32039C241FA07A9FC4B0D2BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511414, "uuid": "ac61bdcd-db8e-4444-b0a2-cd19671196b1", "value": "1536:iGFyei43hAxQt8bGTUP+rnnsueZti5aAy9vJMH:iGFydIhiG4csuw19vJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639511414, "uuid": "65a9e1d6-a1b4-4cb6-a536-f8acf56d68cd", "value": 75660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639511414, "uuid": "2c76a993-6af1-48d3-9e80-0b03fa60f16e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511414, "uuid": "d721a13a-870f-4155-adff-3a175fa2489e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccb2cff-5c9d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639459013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639459013, "uuid": "4318e4f4-dbe4-413d-9be8-6c041bd67597", "comment": "Malware payload (AveMariaRAT)", "value": "aa6d3b9dd03e4049cec6a028e21c315e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639459013, "uuid": "f85b682e-ab57-4962-b2f9-47d3a44b74a3", "comment": "Malware payload (AveMariaRAT)", "value": "d9facba4b482279132e5906f6afa9ea40b62cedfaae1a9a48e3b0b54c819277c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639459013, "uuid": "6d6dddc1-0b8b-4bbb-9b3c-2dadee60a087", "comment": "Malware payload (AveMariaRAT)", "value": "62720d97a2fe9f44d2768224055fccc2d5cfcad6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639459013, "uuid": "e19b627e-a81b-4b5d-b6f4-ec1932abcd9a", "comment": "Malware payload (AveMariaRAT)", "value": "c2d9856a9facbdc93d0d5c28f174cda699afdbe39c384e1c5ea34a9829c329bb253ee3fbe8dd18a617df0fb9511d46ca", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639459013, "uuid": "0e3d4860-62e6-4372-b121-b0983325a4bf", "value": "T19935336638589B0AE179D2F839D19A8103731DA87560E6CC5CDDB0E738FEBD12A493C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639459013, "uuid": "0e05fe21-7cd1-4b18-9c55-56d5c9261bb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639459013, "uuid": "015de295-3bad-4bdf-9f63-7d742eccddb3", "value": "24576:i/AY2EQ5lvfD8KkJEFQxZRV0rWjbmZeZL9gzCrImQ7rVlean/WupreKRRjVCb:lY2EQ5NfDCEFQM4vt9CCWean/Wuprzj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639459013, "uuid": "86305ff8-e3ba-4a85-84dd-5aa786ba0fee", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639459013, "uuid": "7cadf69a-bc0f-4010-b3c0-c90abb7b85f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639459013, "uuid": "39b0867f-2560-4a73-b490-12ea29909c31", "value": "AWB#BL576945509.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff1b68b-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639495794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495794, "uuid": "e5acc441-3a9e-4dee-94f8-f7c37818f273", "comment": "Malware payload (Smoke Loader)", "value": "d73f34b996ae17fccd40efa88f5cb445", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495794, "uuid": "984a7a5a-42f9-49ed-a650-148de5e8edc0", "comment": "Malware payload (Smoke Loader)", "value": "da349d9400e3b69866b5bd6523f6ae85271c90f536c9a1240835997361c5a9ef", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495794, "uuid": "dedb5ecd-8aca-43f8-b6db-8b8ee4007ec9", "comment": "Malware payload (Smoke Loader)", "value": "f32f734607759536f9e6997b14b0aa233ff815bf", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495794, "uuid": "40fa3f63-0fb7-4207-9424-ce58cb6e7460", "comment": "Malware payload (Smoke Loader)", "value": "371edbccda3f2167d49584eac4e09e5cfb5ab54151841153eb2419800824ff696dcf84ba398a33de06082002b38dd965", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495794, "uuid": "d1a9c62d-4111-4689-bc9e-7e9e9005ae19", "value": "T193F3AD1235D0D472C6E259708C7CDAE42E7BF8B12964454F73983FEE2F623815A7A362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495794, "uuid": "000f4765-1796-4d6b-a4e5-b4f5466f1b09", "value": "ce74c352c7a68a20cfb87163e6a8e0ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495794, "uuid": "40939408-438c-41f2-9e8e-ef1ddda811c7", "value": "3072:Y+cl3dIbkF7AnHdqaeJY65OjphsCAyhwT:L4/h4H5IM+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495794, "uuid": "e0922534-6e55-488d-b2d0-198e9d75e0df", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495794, "uuid": "3b40c013-0850-49a6-981e-fddeae2413e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495794, "uuid": "4c4ceebe-6460-4d8f-9dd2-08df39308fa6", "value": "d73f34b996ae17fccd40efa88f5cb445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870c1685-5cd3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639482411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482411, "uuid": "69a3576c-8a82-4898-a96a-b5ca83c57bc2", "comment": "Malware payload (RedLineStealer)", "value": "dd48e890835832f76b7be5aeae35a6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482411, "uuid": "6964f8b2-22ce-498e-b502-fbdb2ec25e19", "comment": "Malware payload (RedLineStealer)", "value": "da9b83ec2e55bae67d99bdf21bdb6070f5e3c22aac79ad117357f8afac9ad4ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482411, "uuid": "bef8a4b0-ec93-404b-a1c4-9d8f0fc62a31", "comment": "Malware payload (RedLineStealer)", "value": "f82906847e603b7e2b833ea6f6655da323c7ef91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482411, "uuid": "83ecd1d5-1902-4605-aac0-4a31a1a7810f", "comment": "Malware payload (RedLineStealer)", "value": "efc8914828725be3139034e1859c54074d6dec23cef52340b4b841d4a56ab89abb3e283f230a42bc4e930cb413470750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482411, "uuid": "bd77462f-3d50-4eab-9351-8e37ba692c77", "value": "T15594CF00B7E0C034F6B352F549B9A3BDA93F7AE11B6895CB12C516EA5A746E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482411, "uuid": "0ecc05b1-f567-40f5-a719-e35981618204", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482411, "uuid": "3ddf226f-92e5-41d9-a138-07ffc9443bac", "value": "6144:ej8hPMxoVOypQXfFgMrSnRWcMiKLliVXHKZ1F5B3tEdqV6CrwYpr:k8hkmbpQTORdMiWlmKZ1FvtEdqpMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639482411, "uuid": "29e79f2c-05ec-459e-882c-7d291accce08", "value": 420382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639482411, "uuid": "e51052a2-df5d-46da-b07f-dc423c4eea92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482411, "uuid": "8ff80c37-b733-40bd-928f-971083610d53", "value": "dd48e890835832f76b7be5aeae35a6ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7530e583-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497413, "uuid": "26a9d906-5c42-4f40-a5c1-676a34c431d4", "comment": "Malware payload (Loki)", "value": "d1d7e571b9c2ad2bd0f9ce094ca23fa6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497413, "uuid": "506a8c10-63ff-437c-9fff-b1834240c7da", "comment": "Malware payload (Loki)", "value": "dafaef346b518722b852611fef9ae74c8242985813255528fb5a8d1465e15d9f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497413, "uuid": "dcff63da-84f4-4438-ac7d-323f07593d2b", "comment": "Malware payload (Loki)", "value": "063bdae1139f1699396020621727343641fcb823", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497413, "uuid": "40af3a64-1fca-4513-85fc-aeb522ce01ac", "comment": "Malware payload (Loki)", "value": "78f38d71f71ec4ff155e3cb424f2c1f782a77dcab16cf8d89e33d5dc7abed6140cb1c255850162a9db4321313be4a26f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497413, "uuid": "7785d7ec-0d97-4ccf-a071-fad67450ec15", "value": "T10764122E31F46256D881AF364F9A8C56B398FE1E3CF2459D7D94302CB23B5EB10C6952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497413, "uuid": "230fc7f4-2e63-4926-bd3b-1cedfd7c050c", "value": "6144:m7p9ZOQuWSW0Utp/WBpyVa6eI8+CnHw6uMlbXSAUnswuPkWMKZKM6DuTuM1mB:UxOgS4puBp2eACnHwy9iAUsznxuM1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497413, "uuid": "7448bb40-d279-48ce-b3c6-510400239801", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497413, "uuid": "6d9170f2-31a6-4cdd-8834-384af4c4349f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497413, "uuid": "b0bb5cf1-d4dc-4f8e-8114-a34ff6978d69", "value": "updated_soa_2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df7f469-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498958, "uuid": "5fac67ad-810e-4e1a-af8b-2a939b31cb90", "comment": "Malware payload (Mirai)", "value": "4d90e10dbedabf9e77bc7694588a18b5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498958, "uuid": "7a644845-cd9c-46c9-93c6-2192475930f4", "comment": "Malware payload (Mirai)", "value": "dc46ac37fbfc93c716ccb894d64161432104adeed3343abb7c63f66dd1be7b40", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498958, "uuid": "dcd0495b-b139-4313-940f-b4bc0a33842f", "comment": "Malware payload (Mirai)", "value": "9bc1bf0160aa9364f3c3531ae8ff5db002538433", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498958, "uuid": "f2c2bae9-91c2-4910-abe4-b5eec00b291b", "comment": "Malware payload (Mirai)", "value": "a4088c5e3db82fc0b0729b46f76fb9ed0b6d1efd2556ea321cec32bd0ce9b2b2ee194b660d8cfcbec25af03e084f670b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498958, "uuid": "8bf3d342-2cab-44a7-83e2-91f6df2ba0f5", "value": "T18C13F1D53A7EDA79C13A61B6E0075F60AAB6FC1B458E1BCB102DC06E05C72532B33B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498958, "uuid": "4c394a15-fb0d-4adb-8d17-ddadda536852", "value": "768:iaH9LGm6eZ8WyBDpwTHWEKcbbpiZmmVOTWlgJg50HNx0+nBN09oQO:xdLFCWyhU/oneaagcpBNYoQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498958, "uuid": "9394af9f-8e65-46c0-8136-6cb0462bd678", "value": 43720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498958, "uuid": "1b416e64-03ff-4598-bc26-d502ab924dab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498958, "uuid": "d0a5ae4a-d304-4646-a846-fec1a249a669", "value": "4d90e10dbedabf9e77bc7694588a18b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdb84eb-5d17-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639511412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511412, "uuid": "2a07d98f-6803-4bf4-9960-8d182fbdf3a8", "comment": "Malware payload (Mirai)", "value": "05c474f5d7cbc548055652015b734a18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511412, "uuid": "4f459ec4-46ec-4c10-b352-4c72dd74fa34", "comment": "Malware payload (Mirai)", "value": "dc72f120351c4ef99715b4448dc37a4892a4e03494a68075208f8bab8c12698d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511412, "uuid": "7705cf26-0ad4-4511-8004-c9b93920171e", "comment": "Malware payload (Mirai)", "value": "97711d880e18b83a2955ddc5c80bbc41958bc8e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639511412, "uuid": "bf6de6e9-5301-4359-ae41-274e23062ca6", "comment": "Malware payload (Mirai)", "value": "ef02a0969c042326e00bf0640ad477fea023f8671fcd6974fa3c8d81df4c725fe2d80a2227c277f3d5df094a35875601", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511412, "uuid": "ce917c43-4f4c-4401-9ed9-c70cabae1af2", "value": "T116E34B46FA408A13C4D21776FAAF414A3322D795E3DB730689285FF43F8BA5E4E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511412, "uuid": "40fffca2-2b38-4370-902e-3c32e34fbfa4", "value": "3072:L+GXaup6+phMPW1cdaOsFpoGAZ8PP+ObeM/9idjP2:L+Oppce1maOsFporZq+OKM/9MP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639511412, "uuid": "d2afeb58-06f5-4965-bb30-06262fde4ff5", "value": 148984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639511412, "uuid": "231fa640-3bd4-4a4e-a59d-d02ecf332b2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639511412, "uuid": "3ccd9cf3-8162-4c71-92e4-6e261fda8266", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ef5ebe-5caa-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639464664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464664, "uuid": "e9c03ff1-a904-4e98-bf23-dc601748ad76", "comment": "Malware payload (RedLineStealer)", "value": "e43a50290024d151601dd24df7b1b391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464664, "uuid": "2e227c56-dda5-42ee-b104-6475e9a8acaa", "comment": "Malware payload (RedLineStealer)", "value": "dca9efddaccd0afe0031563efbccb6fba62ea7c1d633483930cf9ebf4a1d1648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464664, "uuid": "cdae8ff2-9d57-4846-ac62-1769047e9dce", "comment": "Malware payload (RedLineStealer)", "value": "8264b8dc1719ae4da64a5f8047b7b2a1bac8a146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464664, "uuid": "3e5bca2d-e54b-4c1c-893f-d52116796559", "comment": "Malware payload (RedLineStealer)", "value": "47f9593ce5a5f8c5664303562e5f0bedfcfc9c10dc1bca2f670476f520c15988f21228378988c014c334562e73b22190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464664, "uuid": "54ae7120-f669-4d72-a901-cc32d51c14c4", "value": "T1DA649D14A7A0D435F2B712F859B993ADB93F79B2AB3490CF12D216EA56346D0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464664, "uuid": "cedb959f-aeab-48c5-9873-f9d54a823e91", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464664, "uuid": "a98a9005-dc72-4f4b-8a72-323239090356", "value": "6144:xkPCqf1foj2QeJFn5T5Oza49MBD5n+bwCTzzu:KhojFAFn5T5OzaTV5na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464664, "uuid": "b846c2ff-bf2d-4b54-8e9e-d3637b2e85bf", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464664, "uuid": "892f6659-cb3f-4179-b255-dbc7d00ddf1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464664, "uuid": "2bd38f99-4650-4d99-a8bb-f08f852cef5c", "value": "e43a50290024d151601dd24df7b1b391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b56c1c-5cbd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639473124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "7f791d27-95e1-48d8-be1d-9fd80cc85017", "comment": "Malware payload (Formbook)", "value": "3d059df1a6a9edc0e20241113bd21c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "75cad42b-fa0f-4453-bf55-ad5f6fe4468d", "comment": "Malware payload (Formbook)", "value": "dde5521f4b34414e6850fc869de027df46f3e4d5a1cb3cbb483c2900abe49c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "2c6ced57-287e-4d67-aaaf-96f382b82fa7", "comment": "Malware payload (Formbook)", "value": "e8bcc9b32d15d45d1341f3589478ba87c2fd976d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639473124, "uuid": "37482a2a-c0a4-4602-8497-c75d914884d2", "comment": "Malware payload (Formbook)", "value": "8c6805a12e0b0ead2bead2821222eb1e61378d74e90cfe9ea89e8b8d4beaaad58f600f76c0c24567a28df6c00f1fcc15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "2828744c-59ad-4ee1-9972-44b918f82c44", "value": "T15F35122C3D93D5CEC6254B763BA580281275AC735A07E38BF988338F186B7987D63716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "e6df6f16-c89c-478a-a42f-0be0bc1b5f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "fef19163-0686-4495-ba83-0dbf2c76227d", "value": "24576:E/BHljB2B2H7QSRiSacZepfU0Ol84Wntdbc:C2kH0SRBaoexsl84Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639473124, "uuid": "98f68945-0c74-469e-adb8-caa1c793a0f6", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639473124, "uuid": "95fddd65-edfd-40c0-ad3a-2e60a8b33020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639473124, "uuid": "aab228c2-0d02-45e8-9fe7-3841823f042b", "value": "SecuriteInfo.com.Trojan.PackedNET.1128.5876.4979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aefb58d-5cdb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639485746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485746, "uuid": "92294019-4a54-4d18-ad4d-68b157fb6e67", "comment": "Malware payload (Moobot)", "value": "6b5d9f54e5eec5c3d99d320818410241", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485746, "uuid": "10dbb9fa-f8a2-4343-bda4-e47ccb2ad71b", "comment": "Malware payload (Moobot)", "value": "df260ce6e67d815c69261ca4e72647cdef42acbd2c6a59de18533aa1c2fb4103", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485746, "uuid": "a4eae7b4-c1fd-48e1-b01a-c0ad279baff3", "comment": "Malware payload (Moobot)", "value": "0561490ef7e01817fa8ac7b66e860b98ee4eb458", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639485746, "uuid": "1a071adc-76a4-4134-993a-da60e8cc26b1", "comment": "Malware payload (Moobot)", "value": "ea74a8ca9d7e069c64907b4ea164c06c5fda064d1f1954f15798b17b65906e5cbd086fa4601d7efc78e60569cd47a001", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485746, "uuid": "1b9487c4-ef41-4b17-8b8f-7348ca25baec", "value": "T148D2E844BE869D07C5C94377FB0E028D376523C8F2EEB213DD163F56E68E527099A0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485746, "uuid": "c0517ac0-f8b1-4d5d-9e85-2399a44e8c0f", "value": "384:fju9yliPJpzXqS+YyBfZvgTuQqXnPTEvcp4aZybRi3PvIzuICv7PsfaBIXMIcPTz:fjixza7fZLBTzpbzwRw1Ikt4LnwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639485746, "uuid": "3d5a0b4b-95bb-4a4d-8a38-5787109bf262", "value": 30420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639485746, "uuid": "0e6fba98-b7fb-4bb9-8a86-76bc7090e479", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639485746, "uuid": "668c2948-724c-4097-8c54-7b6febfa6a92", "value": "la.bot.arm5-20211214-1242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba29315d-5d31-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639522869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522869, "uuid": "ef18480c-5f75-4ccc-9ae7-37fb7650050c", "comment": "Malware payload", "value": "2b33b701bf2fb1f77d9a283b0608f70a", "object_relation": "md5", "Tag": [ { "name": "12345", "colour": "#4C1E5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522869, "uuid": "be0f5ec5-4688-4973-8d79-700434420d43", "comment": "Malware payload", "value": "df7534f59a37d692d3ba6c0364b8472c2e386f94ae3ac1d81fa99692804b5845", "object_relation": "sha256", "Tag": [ { "name": "12345", "colour": "#4C1E5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522869, "uuid": "7b4f64dd-30dd-498f-bb2d-0eaad31e426e", "comment": "Malware payload", "value": "f4eb5cae89e65bfd26d4f8845880013250d9f403", "object_relation": "sha1", "Tag": [ { "name": "12345", "colour": "#4C1E5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522869, "uuid": "d75864c7-6bd2-4b32-bd2f-2d104c79cfc9", "comment": "Malware payload", "value": "24edff67d1900543f68dacccb9c7fa3bdcd1e4252806d0361a1134861330988b8dc7f6f9856ae4de6f108b24ccb1723a", "object_relation": "sha3-384", "Tag": [ { "name": "12345", "colour": "#4C1E5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522869, "uuid": "bdba5a76-52a0-4ddb-ad9e-b735381cdc87", "value": "T101254E1858BFE01961E3EE916DDC98BADA9A51E3240D783B1075733B4F22B41DE8F439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522869, "uuid": "bed11f39-da6d-435b-b370-7c1a1c890e9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522869, "uuid": "b1938af9-7d6b-4136-855e-817802fcab88", "value": "12288:BE2iwBNrnNy0EkueUDptkNzdX4QXJQYLw5eJvROzIdOS5F/2MNdEmXPk9Yt4G3cb:DiR6Fj2MNNMqffETH9vWcxHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639522869, "uuid": "2102defb-93a9-46b9-9819-727ad6c4e3b8", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639522869, "uuid": "d6331cc4-2065-44ac-a8ca-0172dea81250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522869, "uuid": "74a26608-9ddf-4744-811f-32bdb89c7bba", "value": "Setup_32x_64x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5baa4b0-5c71-11ec-96a4-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1639440452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639440452, "uuid": "3d66a557-be83-4efd-becc-5dfa352d7e0b", "comment": "Malware payload (BazaLoader)", "value": "9da434878983cb4b9ea5840db8f19c67", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639440452, "uuid": "b20e08cc-90c0-4577-b6b0-150e440c186e", "comment": "Malware payload (BazaLoader)", "value": "df9b0956f7c6fae82c190f73bc70039d019acff0ce302928e9b66b599e8bde75", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639440452, "uuid": "2587bff4-4728-43f7-9d5a-6799ebe9d997", "comment": "Malware payload (BazaLoader)", "value": "b9c60d4fd9e8f750745a5dc1ecf470b70a3fd17b", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639440452, "uuid": "b24ef3f7-62d9-4989-9d40-191d511f0af6", "comment": "Malware payload (BazaLoader)", "value": "a07b37bc806dd3c7c8b7f1f0d76da381121f20e0b53480ab4c18f53c0b6b3ca9aba34653e7a7222a6c46e32c78e79cb1", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639440452, "uuid": "b93b35cc-6aea-4619-8472-7bbd7a45a692", "value": "T160C43BB464885981E217A676B58C7CD0133A3D27DEF99ED0C3B8DF902A9FA71F90254C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639440452, "uuid": "aabd125f-1dab-467b-b368-d7678479326f", "value": "12288:T1IMcT1Oc5rPaTVTolW8XASUPJ6NM7KJ0P/3PqrN:T1IMcROclPauUSKsNMU0P/3PqrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639440452, "uuid": "8b7d3f79-54a2-478d-8266-0a961d4dc062", "value": 590428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639440452, "uuid": "2360537e-b015-45f1-a0e2-f81c23bb1339", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639440452, "uuid": "3dc8d407-0dfd-45e0-b58e-e69784d59edf", "value": "Insurance_template.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4938426-5ca8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639464073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464073, "uuid": "5f80bc60-6dba-4767-88b7-4b7ae32fd481", "comment": "Malware payload (RedLineStealer)", "value": "3478eb2d136fc06a7c0563b34e7b69cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464073, "uuid": "fbfbffc3-b4da-447f-a3d8-a437771b6d4a", "comment": "Malware payload (RedLineStealer)", "value": "dfc31239023f5d15ee0f9dce61a25659a5ccc7bd7dce20c34d0c48f99b230848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464073, "uuid": "1184c12a-aa47-41df-a507-6f0468e22d39", "comment": "Malware payload (RedLineStealer)", "value": "b88099874756bc4e66b1c6627086ccec859e876f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639464073, "uuid": "5335c0f8-e981-4a45-9874-6b7713dda66d", "comment": "Malware payload (RedLineStealer)", "value": "9ee8ad035234b8845b8aaddb9ab461114e7f783c8bc3517d08f6a05dd3eecc9f2b3f2db13fe6592e974fe23e38d16708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464073, "uuid": "9841909c-81ad-4f1b-8dd4-6cb21f3d2a1c", "value": "T190648D00ABA0D435F6B716F849B993ADB53F79A26B3490CF61D126EA17346E0DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464073, "uuid": "dcb716a3-c0d4-484d-9022-e9d638e83953", "value": "fa0d97a230fe11fa07527833b096cd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464073, "uuid": "8b16fd51-95ff-425e-9387-314e9da13ecd", "value": "6144:/zolEmeEniADt1czYnLzFR1MCxIcbwCTFRC:0ociADt1cMLzFg+Icp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639464073, "uuid": "44816694-cfe9-4032-b418-dc23c4ed8722", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639464073, "uuid": "b7e0066a-8985-4a1c-92bb-976603ea5d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639464073, "uuid": "756aa2ae-3742-4322-b4e3-23253391383c", "value": "3478eb2d136fc06a7c0563b34e7b69cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb734321-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639500565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500565, "uuid": "aabe01ee-6acc-41c2-80f1-b68946fc5560", "comment": "Malware payload (CoinMiner)", "value": "10eb1924b6397b13b7e7b4a670c6fa59", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500565, "uuid": "705f3076-b57c-45c4-b57d-1fd76514c9e9", "comment": "Malware payload (CoinMiner)", "value": "dff8b47d7290a0502a4c5ee183b85ea28a9ab501d93b7c1a11c9592e544d1fe7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500565, "uuid": "ba71d987-1bcc-41b3-b722-b3e291a41bc4", "comment": "Malware payload (CoinMiner)", "value": "5fe7758e32f00cae07da6ad9b64db7f09074b9fb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500565, "uuid": "95552f24-cd8d-4e9a-bfab-2292c1f547cb", "comment": "Malware payload (CoinMiner)", "value": "dbc24140d16ae4452a8ea36eadc0bf9ec86305f96887618adc55b0cc6f904ec18368956730bade671b94c82725973d7c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500565, "uuid": "49f24c3f-33de-4ef0-a957-a937a11832d4", "value": "T128E402D274EED072E5A72A319420C3E55D37B983DE34519F36342BAE6FB23E01A21716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500565, "uuid": "da4e99de-6d09-434e-ac70-983363faa9ff", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500565, "uuid": "b2dcff80-7346-42d2-8cf0-0c5b69aa0a99", "value": "12288:OgS4kYP5COrh+Q+eUCOthn/Q0OwJ8/Q1NKhlmHhkcd7w:OLYPkOrh+Q+JCM9Kvoahl+1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500565, "uuid": "c492bae2-cee9-4570-b944-13d6a2aabf1e", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500565, "uuid": "b06789e1-b367-4ba7-ac6a-17e2fc6f5957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500565, "uuid": "dcc2e22f-432d-452b-9688-0a31cddd47a1", "value": "10eb1924b6397b13b7e7b4a670c6fa59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19571bc-5cbb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639472282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472282, "uuid": "131a313f-0f93-4e2e-86aa-9dbea0c0b7db", "comment": "Malware payload (RemcosRAT)", "value": "c7644837c1033b73e22074ddb65fbdf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472282, "uuid": "3ab638c4-1aeb-4759-8e08-e10d81cad695", "comment": "Malware payload (RemcosRAT)", "value": "e05a3ed46d18c39464fd1e47bcea0055e56bd2788eeda09cbd8f5d07fea0e236", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472282, "uuid": "ae54cc44-74cc-4f5d-a9cb-8937a515ad40", "comment": "Malware payload (RemcosRAT)", "value": "b835b685e8b63848e57078cabf2e81a28211498c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472282, "uuid": "e14b049d-ebcd-4b7a-b95d-33a3436299cc", "comment": "Malware payload (RemcosRAT)", "value": "918ae571d06929c89b4cc3ba1db71175752761396a5b7fd85535bc939995fe4294da254914bdec9a6e33fbcbeea5fa59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472282, "uuid": "73f781dd-acb9-45b5-b050-75d12a9ab410", "value": "T1BC85237C2B6396CEC42503B9B778903863B16C766A47D294ECDA71EF68237613C33652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472282, "uuid": "c830b0ca-7b14-486d-a235-31da1a9be31f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472282, "uuid": "ee5b5beb-33ed-4a69-8ae6-c64e2d4afafc", "value": "49152:o38aNy8NPN/AUCHWYB1+PyZvuDmR3JnHh:o38aNy8Nl/NSB6yZ9R3JnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639472282, "uuid": "2e7e583e-73f2-4c2d-bfe0-ab634bb176f5", "value": 1735168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639472282, "uuid": "c0db47d8-b9ea-4259-b488-1e11db338058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472282, "uuid": "28a63e08-202a-41dc-9e07-6d7e6d11e2fe", "value": "c7644837c1033b73e22074ddb65fbdf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8670f49-5d33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639523779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523779, "uuid": "efd829ad-071b-458f-a309-146bb8c3517a", "comment": "Malware payload (Mirai)", "value": "ec02a9bb54b1422336a67f8731ca2d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523779, "uuid": "47e6007e-ed19-4a0c-aba3-99a74701008b", "comment": "Malware payload (Mirai)", "value": "e0b3ea460339efe4f1033a54d0801797445120236f6d2688b9cc145851ebb131", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523779, "uuid": "ca1457b8-0296-4247-8dd2-02efe1dbc262", "comment": "Malware payload (Mirai)", "value": "1529c7d80fde2aa578c73adba46da9dcce9d2f51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639523779, "uuid": "343e40be-a2ac-48c8-865c-55bf6b5b49ff", "comment": "Malware payload (Mirai)", "value": "8ee2990309e5a221ec062528bd76db76032e3ef8d62d35554be1df03d0b66b028fb675cdb28c1bcd28a6fc006f3e43a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523779, "uuid": "2c928150-c2ae-4f73-971c-8a8ed140eef5", "value": "T11A735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523779, "uuid": "f0beb216-606a-4081-bed0-6addc1417b65", "value": "1536:DNpp9RXI1vgi0uvA8zomzNKRyxOReqpNiSejOjNfXM:Xp9djC3omzNE2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639523779, "uuid": "27391194-7f80-4663-97d5-c3c76fb2ccf1", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639523779, "uuid": "66cd89db-d831-437b-83fc-dc4eb0ae586a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639523779, "uuid": "0d6a0500-d573-43bd-9255-5ccdc503a146", "value": "ec02a9bb54b1422336a67f8731ca2d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfed822f-5cb5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Numando)", "timestamp": 1639469675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469675, "uuid": "898c4ad9-5eaf-4063-8c44-fae0f2026936", "comment": "Malware payload (Numando)", "value": "96e5dabb986d4a653ba7382f14e9f4af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469675, "uuid": "3e8a83a4-00c7-4114-890f-1c84d129fd52", "comment": "Malware payload (Numando)", "value": "e116a603ceb5d60463f54ad79b31b9a04a21b2c8afea1fb72149db2805a4d4d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469675, "uuid": "18a5d2f5-27ce-46ba-a72b-622c1c15b1f4", "comment": "Malware payload (Numando)", "value": "2af9c00f61fd821f7dbdbd222e2ca2b1652ecca7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639469675, "uuid": "9d1ebbba-7ff0-4517-ad14-7dbf7ade2e16", "comment": "Malware payload (Numando)", "value": "41da7131f16d3e2cee86442ffeedc8b2bd7feb614c115c245b7f0497036902509a27c510484691166e32693d2f8cd0ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469675, "uuid": "1ecc25d7-0224-4cb6-abd9-44dea1e96a19", "value": "T14296E113B2C4653FF06B0B3A9837D66459BF77E2361A8C2B57F4095C8F365402E2AA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469675, "uuid": "8e20b31a-bfb0-4b2f-b745-317496f7a9d6", "value": "ac84fa3fa4935e25e46da0d6c45e9d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469675, "uuid": "327fc0c0-9aed-4bd5-a818-7ed3d5175393", "value": "196608:y5aHjDTqp9NcR8st+HolJnboxqpgaVJVvSoB:y2DwN+WI3oxq5JVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639469675, "uuid": "49cb1158-ce1a-4e52-8f4f-4ec4a0ac14f0", "value": 9444864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639469675, "uuid": "5e5083a8-243d-4d04-a97d-02911787653b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639469675, "uuid": "fbf3fe6c-b2ea-409a-ba1d-41d76fd6ef3b", "value": "Oleacc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112446c-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639498588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498588, "uuid": "232d3ac1-0c7f-4ed8-9ee1-1350208f9e46", "comment": "Malware payload (AgentTesla)", "value": "eb1d06353fab49b92375b9c9dea478d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498588, "uuid": "478b7aa6-4253-493f-ae56-b28c579877bd", "comment": "Malware payload (AgentTesla)", "value": "e11aa7d33cbd28cc5567eaf664abcdc17425f6e12f86d868847cb9f69eb9eb4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498588, "uuid": "28d1bc0c-e5b0-4dc5-9b3a-d3944889f347", "comment": "Malware payload (AgentTesla)", "value": "e4a759ec45ee0ea31919a433be4ba31b7b9d75e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498588, "uuid": "07f9ed1c-140a-47ee-a088-63786d3d4c36", "comment": "Malware payload (AgentTesla)", "value": "e6e99bdb9df371fd2fb0a5729cb995181816b91142d788dd357fd26e6ad0016c106883f2b96ebfbe0cd090ea0a945e74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498588, "uuid": "1841716f-5154-49fd-963e-5bdd4af87e1c", "value": "T1C0253398C9C4AD350DFEB37C0B0484832D8F57885075E5EAF995E8AA39C3B0E6935936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498588, "uuid": "c18f9b65-95bd-4853-bea3-1b56f8272a3f", "value": "24576:ePsgWKPSsMamzpcd7Aj6kNSzvj6VLoQndSJDMlc:EsgTZ0aUjFSzL6kDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498588, "uuid": "aa9bd08e-e99f-4157-b335-d6a9902813c0", "value": 1047231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498588, "uuid": "46603b58-fa6a-48eb-b300-6423e54bcf7d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498588, "uuid": "1bfc1b03-c803-481f-96dd-5f364ac7ce7e", "value": "COPY-Telegraphic Transfer TT copy hefco USD 242,357.59 overdue payment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db5ef0a-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461618, "uuid": "e858219f-6f49-492b-895a-4054f608f1e8", "comment": "Malware payload", "value": "72fed99a0208afaf313c6bf3ce7899e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461618, "uuid": "e278b743-3129-4eda-a8b8-65f6bd9a5cbc", "comment": "Malware payload", "value": "e16940dae73a49668216fc8bb0bec421dd502313d57b272b973ab6709db66d13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461618, "uuid": "3a8c3243-94e6-4ea6-96ba-ee4dbd0f6d6a", "comment": "Malware payload", "value": "beaf5b7dec4c709eaedcf1bf57084dd23bc22e9f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461618, "uuid": "76373050-16ea-471f-88f5-92074acabf19", "comment": "Malware payload", "value": "678f2fae59ce12dede15075d054aa32ef33e9fa0451a63e55950ebc5c4b0daeb590a19b489da327f258c2370588d999f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461618, "uuid": "faaa91e9-b098-441c-9211-58ff547aafe4", "value": "T19185330C52B97CD4F9EE0229366248D4C2BD32E1A441B096B6995C651E7B2FE43CFDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461618, "uuid": "a5e0d5bf-00ed-4f41-a12a-1074e4bf345b", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8aO:IDSTOhnXSI0Wk5jG2nfBtkaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461618, "uuid": "62c3bdbe-83e5-487f-9d3e-cab3433ec24d", "value": 1720320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461618, "uuid": "d6e612f2-4c51-4185-a49e-3b9154175ad2", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461618, "uuid": "27d3a922-a540-4283-9b2b-88153d4a9635", "value": "e16940dae73a49668216fc8bb0bec421dd502313d57b272b973ab6709db66d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9afe948-5cfc-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639500105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "2bcd9c18-62ec-4661-86ce-7745c74c59c6", "comment": "Malware payload", "value": "831bbabfcd2487c10c13fbdd6ab35641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "97dab026-c3dc-4a7e-b1f7-726503c6822b", "comment": "Malware payload", "value": "e245603d93bc6a65e4ffe1a4ce8f9c0a9d500fa2fc0ceea85de8216a0b4b140d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "cb4a460b-c225-42c1-bc27-86bced572492", "comment": "Malware payload", "value": "ec05c8dd0ffb1aae26557a47a0ab552f966fcadf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500105, "uuid": "3d861937-b11c-43f1-b1e6-ef14458519b3", "comment": "Malware payload", "value": "4899df30ac67b3783f645b8c66c13073844169dc1abf21417a9fdcfc3bde7299d45845d8baead607fd0e7d84131cec00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "eef1d058-7962-43db-aa7d-7fde431da992", "value": "T121451232FAC584B1D5732C3559F8C731AA3C7C202F648F5EA7E43A1EAE705814625BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "709a7ade-870d-464c-b369-d3d6212730a5", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "cc79ecff-8fe4-4fd3-99e2-25f4f1ae21ee", "value": "24576:hZ7Xar2VsBq/OebtXkkyvxjXx7uGebB92G44f/czKenXI1xyKnC:NsGzSjX1uN9T4nZY1xyKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500105, "uuid": "abfacb46-494c-420e-9085-618d7352cfb6", "value": 1237089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500105, "uuid": "063186c9-b3de-4d81-a387-fec25a31622b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500105, "uuid": "00130328-08fb-494e-b3c1-cdd64d593432", "value": "BBIOHV.eXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29622120-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639498575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498575, "uuid": "89a22765-7526-4f77-a4fb-1ebca990e736", "comment": "Malware payload (RemcosRAT)", "value": "01d94306c6c07aba415d7ebd9a419127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498575, "uuid": "d82455da-d860-4d02-bb10-d7f364fe5653", "comment": "Malware payload (RemcosRAT)", "value": "e2f465de68cddb43806cb2f3f73cf9b151a56cc4f51cb256cb763b81c30b234b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498575, "uuid": "af4db9e6-9ea0-43ba-a13b-5baea268cfe1", "comment": "Malware payload (RemcosRAT)", "value": "04b2b87d025d7b72fa1cdbbc652d27f072430d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498575, "uuid": "c4436588-d7f2-4360-9d4a-98858bd56f14", "comment": "Malware payload (RemcosRAT)", "value": "16ff72627809aee190c465e3a9c054ea4951a1ce1d136290422cefb65d6cd4bfc162739acfe1808f706998a3eda58b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498575, "uuid": "f5091327-3f87-4a83-8ba8-b5c29e97c03d", "value": "T152A49D12B991C032C17212700D69FB759ABCBD212D3549BB73E92D5BFE710C1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498575, "uuid": "4c69a019-e25d-48c9-99f1-47d5fb77d74f", "value": "ec8ea73e2aa6f868311acc5b792bc222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498575, "uuid": "48515ac9-ea22-40ce-9e0a-147e29d45f77", "value": "12288:yYe6UWhaT5xnDdLv9rX+1jZJqxE/ZjEJyib:k6UWUT5xDN9IjZJsCZCyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498575, "uuid": "19b70766-209a-43a7-a3db-1cdbdc9d9e25", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498575, "uuid": "d914a768-372d-4961-9aa0-9c20ebc78503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498575, "uuid": "3fe21356-7286-424b-afcc-906f46d251cc", "value": "01d94306c6c07aba415d7ebd9a419127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffef8c7-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497727, "uuid": "f010fe9f-a75e-454c-a78f-2596538eb1c8", "comment": "Malware payload (AgentTesla)", "value": "bc147e84eba06bdca53f57c50043d3f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497727, "uuid": "1625807d-2a80-4506-b1e3-ac06e0ae9f4f", "comment": "Malware payload (AgentTesla)", "value": "e30fcccb3539c0df7725525f5e09402a2cf5a1088b784de122821ed2008dbd91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497727, "uuid": "61484c9a-cd16-4440-ada9-a8419d23d66d", "comment": "Malware payload (AgentTesla)", "value": "06580074121f740c0eadb2899cef1b602ba06dc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497727, "uuid": "faec087d-8e60-42b2-b572-2bf98dc21fd5", "comment": "Malware payload (AgentTesla)", "value": "ddb5eef07764e315c5ed5ccf420de9e7f77ae48b33269c52875af2e7a845a6312dfc729c41b147c3343ce5959b8abf9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497727, "uuid": "e13906ad-6a92-4d37-a603-fe88fb96447e", "value": "T15D5523933498CA15C235ABFEEAE75B6003B874496151EB0DAEC960D86375FE34F109CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497727, "uuid": "91ba237a-7897-4d4e-8c28-9b5c29e15c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497727, "uuid": "19afbaa7-59ed-4f18-ab7d-9e0347feb5fa", "value": "24576:xTJcTKlFnyfpgUzG639BYKGvnjwT+KYq9V0cnP1+WaP//PTMXLLVOj/x5:xTJc2lFnyxlzG639CKGvjwT+VqcAMz/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497727, "uuid": "676625ab-6e9a-4c41-b29b-827577b5e8a7", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497727, "uuid": "083a93d2-9df3-4462-b417-bbfd6f84c9c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497727, "uuid": "0fd23cbd-02ef-4310-97d3-65eb6ebcfa51", "value": "Notification_TNT AWB_IMAGE CI_IMAGE from TNT AWB# 167095453.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4fcbae-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639465211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465211, "uuid": "db20aa99-bfdf-4d29-8855-6b9a2df4c7bd", "comment": "Malware payload (Formbook)", "value": "aedb135d026e7a3bb8c633e6ddc2e184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465211, "uuid": "e8920b1a-e89b-48a1-b4ee-8aa4010bcf42", "comment": "Malware payload (Formbook)", "value": "e350e3f474086a0680149de2a3819eb9368fdda75507f06104dfedaca763722d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465211, "uuid": "443b48ee-bd33-4c1f-9360-0e857589ebd7", "comment": "Malware payload (Formbook)", "value": "1c51837d8ec44a8d671d030346d2ff0f100de412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465211, "uuid": "135b9b17-ac08-458f-977a-27db729ee744", "comment": "Malware payload (Formbook)", "value": "dbce751082f51cb5aa21aee194405433425007a44f1416507b3e3caacd103a5a5b3c6204637dd105113c15f9d41e8919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465211, "uuid": "4e923bcb-ee8a-4522-a400-69ab1c431406", "value": "T1C2E4AC5977304B55C8326E30E4185E1E5E167F2C2CBE743EB66CFA44E27B68308A9DC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465211, "uuid": "e7fd5f4d-77ee-458f-bdf9-eb64fad03507", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465211, "uuid": "cbb6ce4e-f2af-466d-af6b-77a8a038fc08", "value": "6144:eGiWnzGk0O2d0VAhaV01baeD4gqfp/jn/E/5l1Fstp6+AAiUNGWKEocA+JaCx4vu:lnZ0PC0inGl19ZNUcWK5cDaSt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465211, "uuid": "395f694c-dfec-498f-ade4-e17e75abe640", "value": 659324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465211, "uuid": "f7c7b3d7-3796-41b4-ad27-9376ef476179", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465211, "uuid": "e31a8731-4d52-43cd-86c0-e31b13cf86c5", "value": "Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f82ab0-5ceb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639492776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492776, "uuid": "b6e0fd8d-52fc-415e-bd58-dca36a83b0be", "comment": "Malware payload (Quakbot)", "value": "1df784134421f477e749355185eeaf6d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama145", "colour": "#8BAF47", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492776, "uuid": "0c61a342-d25f-4c08-b176-c79525c75faf", "comment": "Malware payload (Quakbot)", "value": "e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama145", "colour": "#8BAF47", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492776, "uuid": "9b80fbb2-a92a-4049-bbd6-794debfab7d9", "comment": "Malware payload (Quakbot)", "value": "821cc1d1b6fcb7220bc7c00780fc188613fa7d95", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama145", "colour": "#8BAF47", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639492776, "uuid": "4d7e5078-0699-4bfb-9aa9-2db5dc3ab2b1", "comment": "Malware payload (Quakbot)", "value": "a869c34c9d5c6be3f80c4692bc01e307d937f64551d5217d88397869959384976aded7298cbee466ffa3fddb525fd901", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama145", "colour": "#8BAF47", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492776, "uuid": "66641338-55c9-4c10-8f54-aefe9cd2b5e6", "value": "T17ED56D15FA934CF2DAE712314046F23F56306B2DC263AAB7FF4469BCBA726404D1B259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492776, "uuid": "0dc0ee89-b8b4-4b98-9652-aec7a5cd1270", "value": "2ac7a340a3aa040cc3a8e404720833a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492776, "uuid": "63ffe8e4-9621-453b-808f-d1a39035696c", "value": "49152:EVUZMcNCu/aXwvg7CfUCOyzw4LxNPpOcQdRckhdIfTRfWG/PB:EVgMsD+woufx1fWG/PB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639492776, "uuid": "48171066-ced8-4cd4-9f7d-8f037ead7f51", "value": 2952168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639492776, "uuid": "bdaaac43-83bb-4e55-9616-4005a4b24b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639492776, "uuid": "df084376-0610-48bf-8c72-5eb2fd10bb47", "value": "e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2f88f5-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639499006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499006, "uuid": "19b904ca-19f7-463a-878a-90487fece6ca", "comment": "Malware payload (Gafgyt)", "value": "3c388cfcafd8fb444a0c2ca434a54960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499006, "uuid": "524abd32-2d07-48ec-9b6e-4873c127411b", "comment": "Malware payload (Gafgyt)", "value": "e40e338859e1a64b67b061a89ec5548361932570a27f1b5c3ef6dd7770f4aa20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499006, "uuid": "01fde06a-5d0d-4683-93dd-8d940cf05f82", "comment": "Malware payload (Gafgyt)", "value": "60e6f85dfa6512c7f418d9875b472755952ca9b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639499006, "uuid": "b7ba23ac-bb1a-46db-b5c9-47826f875e89", "comment": "Malware payload (Gafgyt)", "value": "92af8f99d3027d283636aff207d6cd1244cc7a776ec1aa3f6d460f7a4ee82e2ab94904ad6b23a2a29b54d6dbde2ddf8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499006, "uuid": "acebb8ba-4fcf-43ed-99fa-46f2333dbee8", "value": "T1FFC32A2737270B23C0EA543441E35337B7B5CB943978924BAAD0AE9C2F1AAD435573E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499006, "uuid": "14a474c1-05ea-40c4-91cd-e147fff8eb0f", "value": "1536:5biKQ6flMUNeOK7jutMxmyQ/BWV++pFtADZqui2EGmuwA/nivYaW:vbGUNpKWyQpYxGfvEGmuwAfKYaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639499006, "uuid": "536cbc6f-41c9-4694-95ff-ceedbc6cd4f5", "value": 119869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639499006, "uuid": "5066b0fd-0d08-4c02-af72-c9c5ebac223a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639499006, "uuid": "9f05f100-1381-4a0a-a546-2e08184a6f5d", "value": "3c388cfcafd8fb444a0c2ca434a54960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc9ee06-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497777, "uuid": "e037bd13-c7db-4903-87a4-26fcd30dab04", "comment": "Malware payload (AgentTesla)", "value": "f2658a1fb477742310630f94bdde5fe9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497777, "uuid": "af3cc802-e26c-47e1-936a-2e66286c9005", "comment": "Malware payload (AgentTesla)", "value": "e413c2f3ae67cb1b1dcf5c51f7e50b3163b46dff2e5b9778d6eba77b0dbea244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497777, "uuid": "09c83025-5512-47ef-b78f-861c70dae109", "comment": "Malware payload (AgentTesla)", "value": "415cf4be329df105c9bbd4e2042f8a0bdd351c79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497777, "uuid": "96a9672e-fc39-45b0-b9f9-54cb290be414", "comment": "Malware payload (AgentTesla)", "value": "97fb43dfc63effa0dad9f4aff0aaa1450f383971aeae015c839018f6f153687aab21fb019698e0a2059b65661807081e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497777, "uuid": "b099b776-a8cb-46a0-80c4-652b75040169", "value": "T18C35335F25A7C2D661FBBD042CDE10AF63DD7277456C12D0548C63BA8F8E8EAE5248B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497777, "uuid": "8bf65b4b-727a-4097-8017-d1a4735920a4", "value": "24576:gRkcEaju2p5pJcvA+sx0kkMsfrA2SwTn6BQi6wdi:dc8C9c4xeMsDekow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497777, "uuid": "9c2bfada-48cf-4071-837e-a752085b4b54", "value": 1118998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497777, "uuid": "cc8ccedf-cfb1-4653-a5df-5f5e84cacbce", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497777, "uuid": "5592e1e4-4756-4a2e-88a0-15b7ddbda4c8", "value": "PROFORMA INVOICE.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37120fa-5d31-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639522858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522858, "uuid": "40253ef8-c211-4045-a9f4-05c954909ef2", "comment": "Malware payload", "value": "ade5b3a352bd689b9b89c05dd9f07805", "object_relation": "md5", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522858, "uuid": "2c08ffa7-e820-47a9-aec2-de0c73589d3d", "comment": "Malware payload", "value": "e44ee702e250c1796e4b3545729181e86f790143ce5f29be84061b3d0466bd25", "object_relation": "sha256", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522858, "uuid": "79149d83-e3d7-483f-8392-aab1b81f0dc9", "comment": "Malware payload", "value": "f9e879579f34c28b9251def1646f70d7750a6681", "object_relation": "sha1", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639522858, "uuid": "1d02a610-2304-4767-abe5-0ffd7549397d", "comment": "Malware payload", "value": "03e634604a6d86ace1f21ff330e75ac46b830dc0e4c394a95590d16328e8f3610aef7566e011c29d95b57d920b5963ca", "object_relation": "sha3-384", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522858, "uuid": "2ee1842e-8d86-4092-b4ec-d2d58519dc9a", "value": "T17135334A3E9CD5473F5A9E865B8EEF003D5CA26659040114E3FFC6D81AD2DD93A22FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522858, "uuid": "0546ab15-57f6-4f52-8824-c3f5e351e899", "value": "24576:mBIurzrwkeMcgqqRa1VB060ZppSb4R605qJXdZck5a0soKvaC2:QhwkeUFUFwSb4jUqk01j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639522858, "uuid": "3a10d024-4b5e-4258-a81f-db296906b56e", "value": 1086677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639522858, "uuid": "5b55d15e-3c12-4bc0-933b-be5edb4ef684", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639522858, "uuid": "9b364e72-b95b-4112-832e-160f650ae0b5", "value": "factura 3816.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a556b2-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639498063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498063, "uuid": "625cdd36-7406-4a02-940b-110679a7abae", "comment": "Malware payload (Formbook)", "value": "5310dc1f90bbe87341e1eb0d7780d2b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498063, "uuid": "5a453e92-c6c0-4243-a0d9-9d581a0caf39", "comment": "Malware payload (Formbook)", "value": "e65620ba68acba4fb0d76ad8f490cd708a1de947772de6d1e6ae851e1775d71b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498063, "uuid": "183799b7-13fa-4690-bc47-639dd2aa59c8", "comment": "Malware payload (Formbook)", "value": "86f51f07b3e98fcc1cd2bb715752aa38030d1408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498063, "uuid": "f58d6cd5-daa6-4648-a2cd-238158717148", "comment": "Malware payload (Formbook)", "value": "372041386d5e01375adb730f7947244b6c4cc93f608b8c843592a9eb3c0029d0457b7acf4f3436353f4563b600f1883d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498063, "uuid": "9c49816e-6ead-4464-8669-2b3bd12d28f0", "value": "T12C350194A2686F31D97F1BFA94B0621643FEAD0739A6EB3A5D84B0C51E33781CF01953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498063, "uuid": "b518076d-dcd6-45cf-82fb-cd8617a9a382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498063, "uuid": "7ec190c8-1a8c-41e1-af33-1e9aa3e64eba", "value": "24576:8YRkFju+u4N/UYPVgA3Sn9+Uo9g9NGapG8gjy5ZXDj4:qFjt/VPVg8SnpiapGFy5ZXDj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498063, "uuid": "b5c29fc3-03dd-4f28-bda5-85898155a797", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498063, "uuid": "26296dda-f63c-4de0-82d5-571cbd029444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498063, "uuid": "ae94a904-29a6-4328-a2d6-130bfe6057a6", "value": "Cotizar Orden de Compra Urgente,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34825b3-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639465305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465305, "uuid": "f20a58bb-1327-4b4f-bcb3-6b82fcae6921", "comment": "Malware payload (ArkeiStealer)", "value": "b1aa8ead1f756e1bc6bdd1dcf64f070d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465305, "uuid": "5fc9f349-e64f-4b5b-85d0-afc0fb39fbe6", "comment": "Malware payload (ArkeiStealer)", "value": "e712b1b6ea37890ab7a310f969eb95be24e28bfcc26bb908147a0bc676d4169d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465305, "uuid": "c303d0da-6a75-4a1e-a6b5-a81d138e45e2", "comment": "Malware payload (ArkeiStealer)", "value": "182f9d9e6c3c90fa24e9deb81e7fb9f6f17144c0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465305, "uuid": "4e0478a9-33e8-408d-b864-634932aec709", "comment": "Malware payload (ArkeiStealer)", "value": "d769e1879fe4a46ba1de6b02ccb6e9ddb5a1f499d6ea605340ca9589f53e02f43a6e43a42c14a40667ffd8055c387064", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465305, "uuid": "f6a52d91-6b32-417c-ad1d-3f29f4d7028a", "value": "T153F4F110A7E0D034F5B712F44A7993B9B93EBEB2672590CFA1D026EA56346D0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465305, "uuid": "40f7ebb4-6e3e-4dce-a64c-838592492b17", "value": "fa0d97a230fe11fa07527833b096cd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465305, "uuid": "1aa2dbcf-2a9f-45ea-88ac-a1573c8c2843", "value": "12288:ZF5BmOjctCP/e9BHu0MeXLsKDRWSaYKb0aujBWvPkv23oYLLpkLNUSB:P59pe9FHMeXLsKLaLwajEv2jhkGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465305, "uuid": "aeea7e7b-e3f5-4758-a6fb-400997217367", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465305, "uuid": "ed68dc77-b2d8-40d1-813e-c0fc8e6e0855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465305, "uuid": "cf7910ce-5a4c-43c6-914e-e4213613e7ee", "value": "b1aa8ead1f756e1bc6bdd1dcf64f070d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229cc2d5-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497704, "uuid": "aa99d776-3f6b-41f5-a631-ee4311bda6c9", "comment": "Malware payload (Formbook)", "value": "acc9f7894131880d911d6127248e1d31", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497704, "uuid": "5df69395-36e6-4740-ae50-e5cc6fed0eb0", "comment": "Malware payload (Formbook)", "value": "e77ca539893a624832014e86337cbf73a4eef0247fc65f7468b2ed747ae55010", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497704, "uuid": "20b6286d-09c4-41fc-bd98-b0b00a23744d", "comment": "Malware payload (Formbook)", "value": "51a4a1a452e26c88b667b317a41167f6ebc3ce1c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497704, "uuid": "b3df71cc-f2e5-41fa-af68-982f6de64b2f", "comment": "Malware payload (Formbook)", "value": "7ff9c3bf2baf57df095574ca6615cfb442f68766eb36dbd4cb451d57f14b6514a9f0fde9982281ffb41f190d91f6f02d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497704, "uuid": "6cd82f01-fd24-44d7-a451-0cda2ef1ac1c", "value": "T132D49DA130558287EAA759F11D8EDE2025FA3EAC9098928DB4937B3E57F3351005FB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497704, "uuid": "fec38d68-2794-4d77-9311-bdd9c00bf707", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497704, "uuid": "c86a1e76-a0c7-4816-bc15-917274395320", "value": "12288:s2V31xJPrXjEYKqyhSGpIZ/XYmMlU+uANnWrMTK:hkqysGIZklU+uANn2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497704, "uuid": "7b5f5b0a-37bd-4aca-ab80-3b780d90f993", "value": 634371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497704, "uuid": "3c9f06ff-9d43-48ef-b965-a1aba19d66c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497704, "uuid": "892e7901-4672-4dc4-a619-b2812047187d", "value": "DHL_AWB_NO#9078538809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcacc84-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461622, "uuid": "98ebafbe-f88c-4416-9a6d-5eded83f0d22", "comment": "Malware payload", "value": "8c3b5cefadf721853c5a105e75889198", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461622, "uuid": "b1887951-06a9-4647-8ed5-970f25c67eab", "comment": "Malware payload", "value": "e811d5d6e1167062b6abe18ea6756f1ec757e7d8c6d45cffecb1a2ae4ec87097", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461622, "uuid": "a91d0366-7304-421a-ac59-a74a490b6d47", "comment": "Malware payload", "value": "bc585b449ad198e52edcfe9350660c4bb18d6f47", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461622, "uuid": "708a3e19-9d28-4a2a-b4c6-92c6d9c26d89", "comment": "Malware payload", "value": "5e4818c95fca32453369cb8400791a4d6ed55f5020ba6a7cc32834030beb2139cf7c8583552a25fc89fe15039cb6a645", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461622, "uuid": "aa9e6f54-264c-47fe-a1df-09f83787bc70", "value": "T14075330432FEBCD4F9EB062926625CD4C3A932F1D042B09576881CA256B72FD539EDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461622, "uuid": "9239e24c-751d-4577-9fae-9d2466ede563", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJw:IDSTOhnXSI0Wk5jG2nfB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461622, "uuid": "ccb05d53-4548-4fbe-aa8c-938dae7e9d89", "value": 1585152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461622, "uuid": "17c7c60c-7e1e-4841-a80f-ae6d29ac0fa4", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461622, "uuid": "68ee7138-1c91-4ab7-96c1-67528cc12f52", "value": "e811d5d6e1167062b6abe18ea6756f1ec757e7d8c6d45cffecb1a2ae4ec87097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb5b603-5c7e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639445724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445724, "uuid": "448c4b95-88f2-4bf2-a219-bba8affd0c94", "comment": "Malware payload (Dridex)", "value": "8451f4ecac4db821aabb43f83078e596", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445724, "uuid": "5255fd81-e32d-46ac-a94d-85f0a0c65893", "comment": "Malware payload (Dridex)", "value": "e8b40e350941513e25125bda776582af0ab862f06648792424c924d1dc001875", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445724, "uuid": "dfddb0ff-aaa6-422c-b2e6-ee03e9ded904", "comment": "Malware payload (Dridex)", "value": "7b6017003b33f58477cb8afa14071fbe87cf61bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639445724, "uuid": "15a8f110-37f0-40c6-ad30-12e47c863326", "comment": "Malware payload (Dridex)", "value": "18c6317a2602dc662beff910cb31377ff4d74600d95c7abae4e5b08b1f26642c2d3dae8342f06c3c45c25e1d4c4052b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445724, "uuid": "ca5fea50-83cc-4a90-bc51-9e5683f7de78", "value": "T173B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445724, "uuid": "ceddb6aa-b9b4-4f28-b0fd-4a02583f7676", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445724, "uuid": "25aa632f-3d4d-4c4e-b85d-a04dd4d22ae1", "value": "6144:rKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:r9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639445724, "uuid": "64e21d87-e074-49f9-a114-fdc5ad098c1d", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639445724, "uuid": "3e42b777-c64d-4d9e-b9f9-4838efd1e3a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639445724, "uuid": "db168f8a-a34c-4daf-9aae-1759c679a37b", "value": "SecuriteInfo.com.W32.AIDetect.malware1.25989.15981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8e855d-5cab-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639465212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465212, "uuid": "81130191-676c-4652-8c8c-73ac508103ff", "comment": "Malware payload", "value": "d55bec5e292d2bbc3a095f7de2541e20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465212, "uuid": "07ccc244-6dad-427f-b175-082689899e47", "comment": "Malware payload", "value": "e9a6b408ae0890d61af266710be9c73891022c3b0b6bff3470fc68e3a2357801", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465212, "uuid": "91c59ae5-cec2-4ee4-8dd6-c676eeb416af", "comment": "Malware payload", "value": "23a91781ca218af086753c96c43bd2c778ff43fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465212, "uuid": "44c48825-4d54-4a07-bbbc-bb8da9b43533", "comment": "Malware payload", "value": "36fdcfc844f5a7f5856e5c5ee00544a688510a2178bc862ad18276197c92d2c1e1757f050e5d913217f6a5b8b84337e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465212, "uuid": "037aa35a-3df3-4b8c-a56a-600a194b862a", "value": "T10595330853BDBCECFC9F13292B6249D0C2EDB6E0E84191A172545CA45D3F1BE039FA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465212, "uuid": "b0d1b349-4bcc-4bbc-bd21-d6580e18ef04", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Ls:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465212, "uuid": "b062a5b7-ee82-4985-89df-6a5051ef9853", "value": 2052096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465212, "uuid": "395c93ec-bf78-4c2f-bb32-891b681225ca", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465212, "uuid": "89f502e9-5075-4632-872c-a06b4407a66b", "value": "e9a6b408ae0890d61af266710be9c73891022c3b0b6bff3470fc68e3a2357801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78953b12-5cae-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639466495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466495, "uuid": "20c0f0a3-c164-474b-bfcd-e5560a2965d3", "comment": "Malware payload", "value": "7f8b5f84bd9c35f3922bc0d32e085d78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466495, "uuid": "c3f0dc1a-361c-4c59-9fb6-3c4c4948bb0e", "comment": "Malware payload", "value": "ea59232e0153ff131963fbdabd175ff588392125eb31ebd877d35ef07aea9958", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466495, "uuid": "40a7245b-a10c-4a19-a680-add7c31074eb", "comment": "Malware payload", "value": "ee10dd7a3d16e38d5dd980898db805126e19154f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639466495, "uuid": "506470a0-c20a-452a-892d-f3c185e6c8fa", "comment": "Malware payload", "value": "7b0f3e636a776e96f93c316141b090c01dc90deb0a398ecade4c9103c764353bb944b6cc81dadfc99c3bb423b3e26600", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466495, "uuid": "edf92477-6085-4a5a-8dc8-ad3fcbcff9f1", "value": "T1CA84E0D176E0D132D6E2AA7084708BA45F7BB851EDA090CB3774776F2FB26C04A35366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466495, "uuid": "07d450a5-ccea-4b5e-843e-4f87402cc370", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466495, "uuid": "4c97dedc-0066-4558-93b5-4104056c4e30", "value": "6144:9NCCkqP7rTyfS61csKVhdAFu8EDTVH6Sd1b7ITsqVeJMQb:9Fkqjvyf11dKC08kTVHX7cut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639466495, "uuid": "5788d34e-c8cf-4992-a779-0914f801ad94", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639466495, "uuid": "ec12db23-d20e-4f9f-8017-f0d992f45cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639466495, "uuid": "0eee18c5-1af0-4aa4-a3c8-465713fd6c64", "value": "7f8b5f84bd9c35f3922bc0d32e085d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c8c41a-5cf2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639495616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495616, "uuid": "acd3439f-d2c3-4120-803f-44baffc793b4", "comment": "Malware payload (RedLineStealer)", "value": "99bdd0d2fb34c92b6774d251e276b1ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495616, "uuid": "64fedeb1-d7d3-4ef5-903d-c99e30a484a1", "comment": "Malware payload (RedLineStealer)", "value": "eb00c243ad0e05655fe9750da44467d29700f088ed7db5c5ff9c7a57c4372bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495616, "uuid": "742757ab-c1f2-4b53-9eaf-aa1034070e17", "comment": "Malware payload (RedLineStealer)", "value": "162e258b12786ca23ced7fb3f07031b810023961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639495616, "uuid": "0452b742-2049-425c-b4c6-8b63a6f15f46", "comment": "Malware payload (RedLineStealer)", "value": "d05164c9c27dc80fec589907e66d292988aeb6789a8c82bb9e5cbbf140f89d752f9844fbf2cb2a29f5d0fb63f2ca4e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495616, "uuid": "1504dd82-9719-4020-b4b4-0718e017a963", "value": "T1F5D48A42D6DB3E8AC3B51677E33BB3F5875ECE191847C0286080F256A97DD4A3D12B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495616, "uuid": "217cf58e-db2c-4bdc-b361-c6b1911fcccf", "value": "2d3764a832ec98820e7a413411f0704d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495616, "uuid": "1d953ea4-8eba-482c-a99f-28c3863fdf8a", "value": "12288:Xb/A9vOfiOLwKw02T26pQ5iId1NYiA7D5oGYXZno86PRCk:Xb49qiz0y9pQ5b3A7D5o9pnWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639495616, "uuid": "af1f6ca4-7584-43e2-9535-85b688606a0e", "value": 629808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639495616, "uuid": "3fc057b5-367e-4b4d-a87f-1d94d3a3d0ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639495616, "uuid": "f745831a-2a29-4a0f-ad78-e0ba63cd5000", "value": "99bdd0d2fb34c92b6774d251e276b1ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6a8afd-5cf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639496142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496142, "uuid": "f099d271-5bed-4008-89a5-ea17a90350ba", "comment": "Malware payload (SnakeKeylogger)", "value": "b1ad86859f844945baa4f14c8c674d54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496142, "uuid": "5ec7e9cd-01b5-4478-9e28-8972bd6045f6", "comment": "Malware payload (SnakeKeylogger)", "value": "eb750ca2f4a93f7b8674c77cf2178ec75f3f858abd51c5fc4979d373b8438545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496142, "uuid": "2eeda97e-5a79-4a1d-87b0-4f020717e13a", "comment": "Malware payload (SnakeKeylogger)", "value": "0f1d65a6d76acedaccacf94f661f3d1c21284a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496142, "uuid": "f1db78c2-9aee-49eb-b647-383989fece6c", "comment": "Malware payload (SnakeKeylogger)", "value": "1c7b95b87322188e518a11225381e770c1143df1d59b57f81d91731d531da0763b03b7f26149e090a698f738bfa46e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496142, "uuid": "39d0c314-dd3a-4950-bcf7-236aa5dd8a90", "value": "T19645F18EA91366DDDD2857747B36C8340322AD396977E22CA8D53C8B3B7B7D27027502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496142, "uuid": "c5392988-1aa4-4126-b01f-f617d1f96b7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496142, "uuid": "ddcb9361-0abd-4f4d-9e19-84492f6fc4c3", "value": "12288:dckuO01HC/VfL30tAkMSrtEXsritj+FCRMDE1g96lhg0SkHgtHFp2CRxyPylgrdi:KkuO+HKVj+vMSB4swkYQ6lh3TAtXt2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496142, "uuid": "0cc2926a-17c1-4b25-8ed3-4c28470baf8d", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496142, "uuid": "a6919886-f3c5-49d6-9c02-9d350aa13f6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496142, "uuid": "fff1638f-630a-457d-b686-aef776799105", "value": "TT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f1c00c-5c9a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639458107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458107, "uuid": "47ff630e-6cd7-4ae2-968d-351e29b677c2", "comment": "Malware payload (Heodo)", "value": "88e592bbb9a9acc0adc98985a8dc78fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458107, "uuid": "abd99339-b7da-447c-8772-04f9b583c443", "comment": "Malware payload (Heodo)", "value": "ed05d10753f034676e5018b9b436b4696539fe3b9c3739f72c5a51eed391f430", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458107, "uuid": "6f5df750-f578-4211-b005-187e20612c89", "comment": "Malware payload (Heodo)", "value": "23255f432986d7c922bca4eedbefb9917fd194d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639458107, "uuid": "fd2f944a-2567-4179-9f31-f7b645625bbd", "comment": "Malware payload (Heodo)", "value": "f147f7c81e00c78c8c506af1497c490c3086a154639e9c30d0e0aad94ef2f44a994289eff7c6c5c536c00e9d35195753", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458107, "uuid": "8d2d207f-8c14-41e8-a3fe-c116e2bec461", "value": "T1D5D4AE1277C1C076D56F02314916831C72F2FD908FBA8687AFE96F2E6E701D29A35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458107, "uuid": "032a6060-523f-4039-bf79-8de907bba2a6", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458107, "uuid": "2c93e608-d89b-4b20-8add-c58474a60340", "value": "12288:WKEUkuAOLka1miSmuYr1V7eAobS3qTHPR101t:TEQLka1nBVqAoS3WvRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639458107, "uuid": "7b8de567-3235-4cb4-9aca-b135af92c96c", "value": 654720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639458107, "uuid": "9cd9ad01-eda1-413c-8f8f-48586b84c453", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639458107, "uuid": "02818f79-d5ee-415c-8a49-dcbafda54be4", "value": "emotet_exe_e4_ed05d10753f034676e5018b9b436b4696539fe3b9c3739f72c5a51eed391f430_2021-12-14__050143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cb61c8-5cac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1639465516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465516, "uuid": "4c8fa8ad-f318-4415-bca3-dbed9d855401", "comment": "Malware payload (Matanbuchus)", "value": "8468f7996980d87613652e994a0ffe77", "object_relation": "md5", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465516, "uuid": "6709abc9-9dbc-4599-824f-f434ef19e5ba", "comment": "Malware payload (Matanbuchus)", "value": "ed4ff6b4e297d9187bb594ddf284b8a9307a6a616111f77ae694ad75ea48d17c", "object_relation": "sha256", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465516, "uuid": "9787b6c0-8179-4a8c-b840-5acd41224c69", "comment": "Malware payload (Matanbuchus)", "value": "a5f16e57afd1b238579696b4c9b8ada55e1b0b3c", "object_relation": "sha1", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639465516, "uuid": "4d4919d2-06fc-4b0f-b14f-b6a93c9d521b", "comment": "Malware payload (Matanbuchus)", "value": "6348ee8d99b158821c35f81f75178d2c518b265336887cb3e2b41a4b30550f97bc2338ce3c3f1d4fe7e7bf8b4009639c", "object_relation": "sha3-384", "Tag": [ { "name": "ALUSEN d. o. o.", "colour": "#BE097E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465516, "uuid": "861a0a65-b408-46b3-9c7a-7539c312aa7e", "value": "T1CFB48CB6B7DF8437C26316389C5B6F74A835FE502D289AA52BE49C4C4F393813526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465516, "uuid": "11c675f7-78f3-4307-afa0-2c12c08c7717", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465516, "uuid": "94de8f14-364e-45a7-9a6a-5068ffe8a5e2", "value": "12288:aCoerqtL8cwg/dQA1pb6ENUvIq9YXItrhL+hvaLfccHtMRjp133:afcqtGWdZPuQIDHaxarC33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639465516, "uuid": "fbcead46-1a71-4900-9048-2b5a28b9f6ec", "value": 535448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639465516, "uuid": "28fd9298-097e-47cf-8ef4-76580f5f2dfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639465516, "uuid": "037ec742-947b-40b8-928c-2e97b819f139", "value": "ed4ff6b4e297d9187bb594ddf284b8a9307a6a616111f77ae694ad75ea48d17c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2f3594-5ce2-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639488678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488678, "uuid": "d7e868d1-6abb-4117-8495-4e636b0e9b25", "comment": "Malware payload (AgentTesla)", "value": "9bef59d20082419e24530fa886b0f295", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488678, "uuid": "87d5486e-9383-4c6f-a33b-8f0aafbae06f", "comment": "Malware payload (AgentTesla)", "value": "ee0aab8bab3436b0960a3b8cbf669370dadd949fc02210d08858fa7ec4c068cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488678, "uuid": "20005676-50b9-43a3-bc1f-4e880c39ce11", "comment": "Malware payload (AgentTesla)", "value": "a36e578f07b1837ffffee7ff4cf43658eb7bf153", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488678, "uuid": "cb74b062-6297-46bc-aa1d-20f033ad2e66", "comment": "Malware payload (AgentTesla)", "value": "ecfe562d433063fbcaa96b3be04007902bf75adff5d876b6780ed4a29071b441ebf8f73f9612b27751f307e297e9d0e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488678, "uuid": "d33cded1-2a87-4dc1-8f1c-1b06c63b880d", "value": "T1D8B4225765C890A7FB6489313E794BA3A1FDC34D06AA05DEF73D5AA30D7B263030099B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488678, "uuid": "5773e36f-805d-4f93-945c-0f2eced7f39f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488678, "uuid": "a7c5e645-cdaf-4c2b-93c5-6eed86cdb902", "value": "6144:lGicLRcsIovN5xpobBZu1Os738vlDi4qnRfqMYNrmg+fKEUrLjjOjvD8UO1PF:q/IovxubJ43Yi4qnRfK91jID8p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639488678, "uuid": "b291b905-6d9b-4113-b5bb-4b9a64e02876", "value": 500918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639488678, "uuid": "51d410b4-05f5-4f7e-abb0-715b7a0c71c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488678, "uuid": "b9fa64d3-e2a2-4da6-8525-5d43ff9d53a3", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383820e9-5cf9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mercurial)", "timestamp": 1639498600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498600, "uuid": "fc02e57b-1faa-4f36-b886-6b5f1e23b6eb", "comment": "Malware payload (Mercurial)", "value": "d90bbc14a5483f4fe900af5267553377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498600, "uuid": "82816a7d-8f08-485e-811d-e5b32b2524b6", "comment": "Malware payload (Mercurial)", "value": "ee77c05139a72dc3f1c86391c2bb0c16f198249ae4f099adf3f27ec3a7f0cf4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498600, "uuid": "9abf65dd-1bd9-4abe-8e50-f185093a234e", "comment": "Malware payload (Mercurial)", "value": "88e93e2d57e7be1ccddda4c12d02d50d63616f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498600, "uuid": "27ad6384-9cbe-4ea1-a31c-5985bfdf7289", "comment": "Malware payload (Mercurial)", "value": "aaa12e690729970fe10ea2f309eb603b4327865a15984fcf6aabf38f3f5aa2c530ba1069674a9518cfac0bcd9979fd60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498600, "uuid": "eb48bf81-da9a-4e2e-98d4-322239db6d6f", "value": "T1CB435B09B7ED8609F3FF4AB95DB241608673B866AC32EB4E59845C5D08B7B80C850F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498600, "uuid": "0eb1e47d-1f74-4678-a16c-12a986084961", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498600, "uuid": "005704c3-ba95-4965-a6b8-d15596610341", "value": "1536:6cKfnG8eRWT5F7EqC2Tql9EPgY7gvZLy0P0:b8G8e8T5F7ENgW9kFt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498600, "uuid": "8aad3042-2dee-4e43-b293-7a2328972b47", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498600, "uuid": "ac3ec5eb-8b0b-48db-94f4-56ffe4cce87c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498600, "uuid": "eac15227-7ce9-4840-a583-bd941e40e3bf", "value": "d90bbc14a5483f4fe900af5267553377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcf73d2-5d35-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639524543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524543, "uuid": "36ec3a0a-7964-43ee-b39c-e05839a38f33", "comment": "Malware payload (DCRat)", "value": "a9bb475eb6a28de7d8bf76e17181e251", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524543, "uuid": "e62a81c5-4ada-44b7-97c2-fcccce12fdbe", "comment": "Malware payload (DCRat)", "value": "ee9c0e245b1d3e8e5c048e275523b3bb5c0c61a489c5c74652146f315c9607da", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524543, "uuid": "7b4daf9f-5cba-4b02-be54-3b65b2e79a75", "comment": "Malware payload (DCRat)", "value": "044f30322af1f93b61dde8b827987c6f0621a3bd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639524543, "uuid": "1c33b59b-3015-4718-ac1e-2bcda96e3972", "comment": "Malware payload (DCRat)", "value": "383ce8892872b4140016b444bcaf1c3016db3cd871e1fcf8b8ec9a417e9e94a1ea91368ee8801217de32306aa009b163", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524543, "uuid": "cc8db6d1-5333-4b3a-be24-443f0e134a82", "value": "T1897533FA31FEA47BE946F3B74DB44B865E50A03D62CDE58970DC658B889D830E8F5210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524543, "uuid": "bf3b21af-ead1-4b8f-bf99-42b206a8349c", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524543, "uuid": "6341d341-a428-4ae2-b141-b81b658ed131", "value": "49152:dYf/DikajYr0Vt3dbc2N46ZLjOSngWqPENeiJxiI:dYfLibVcqbpOWaF3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639524543, "uuid": "8e3d2108-8da7-405b-89d5-63ac0156f10f", "value": 1678336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639524543, "uuid": "6ec885a5-c7f8-4574-8ae4-ccdf328c4d3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639524543, "uuid": "a51d49f5-b9c8-4c69-bfb2-c7fe78679316", "value": "a9bb475eb6a28de7d8bf76e17181e251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d960031-5c95-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639455686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455686, "uuid": "4ec8820d-8cd4-4d77-b4b7-db2b3e94a3f3", "comment": "Malware payload (ArkeiStealer)", "value": "a856bb79692e098d68c3a9f4219a6abe", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455686, "uuid": "a7933add-484b-4170-9f3a-96133ca65e86", "comment": "Malware payload (ArkeiStealer)", "value": "ee9d6c7a2b699d1a119e1c02620941bfe288a22b4b2942a38d5e84a6b7ac2d7d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455686, "uuid": "6a254931-eb57-4444-a040-0f172843f2ae", "comment": "Malware payload (ArkeiStealer)", "value": "772225fbee671209755c5f0afdfd32b84aa47ca2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639455686, "uuid": "5949d546-25ac-4e50-ad72-788dd9942278", "comment": "Malware payload (ArkeiStealer)", "value": "b6420af45c4ed76835e3d674dd0370f1106e9f072d485a2d7dc328373fda5fdfda358d3282f7501ff7a863baa35ce6df", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455686, "uuid": "7e9e0072-72b0-4f0f-97f7-d9ba493b282e", "value": "T126D4121278A1D031D6F72E30587286981E7BF9629D70514B73B45F8F6FB22C06AB631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455686, "uuid": "71a7a643-fa61-4338-946e-86ae04d39c1c", "value": "794b7cd20ec7276fc8d2300f9007d7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455686, "uuid": "c466322e-5db5-47e9-b3cb-7943a0843bc9", "value": "12288:ylgUIiyCV8YSMFoRkVz+XF6svhK9CMmWoXzPzFihHf7auFRb6BWWL+bsPleIV:o7Ii/SbMF4u4F6b01nzP5YzauFp6Bwbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639455686, "uuid": "befb5962-9d89-497a-bfd2-9cb438771a12", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639455686, "uuid": "fcde8e8c-3668-4643-ba23-5547bbba94bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639455686, "uuid": "31f88045-0e01-4ff8-99a2-bd7be99f2aa7", "value": "a856bb79692e098d68c3a9f4219a6abe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2801bf15-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639497713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497713, "uuid": "51308613-07ee-420f-8330-f29daa4f64bf", "comment": "Malware payload (Formbook)", "value": "26b00c97033ea7fc0e082b55041ce592", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497713, "uuid": "07ea2446-0de6-49cd-b23c-5341ef7e3f21", "comment": "Malware payload (Formbook)", "value": "ef01d0ab95ce9f671eb587fb220d44d59f01ee02205ab87d4f2b0875e06344fe", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497713, "uuid": "c4c99df8-e1d9-4e77-8f82-6846b1e3c4c8", "comment": "Malware payload (Formbook)", "value": "c16db86c4fa76648efdb041ff679342f0d3996b2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497713, "uuid": "16645f74-3206-4f80-9a2d-e25d2e039f91", "comment": "Malware payload (Formbook)", "value": "0d1d355fa83ba7db0aca99c424d2289e7c7b501c1595b3971d5f714df65e25e216752917367bce3020a706461af08474", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497713, "uuid": "ac95b5b6-24bf-4223-9184-cf2b1345cea9", "value": "T1A35523633560CA01E1B657778B5725A00B7C1CA5A592EBCEADDEF99F31703E20804ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497713, "uuid": "df24b496-a7eb-471e-9749-55b3d9dc8bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497713, "uuid": "d7fbdb54-723d-419b-a5cc-df52adf8cc5f", "value": "24576:TiIs+SNIJ6AyZRPTX7a0dBWxHrk8/nog6WI2yZ0qDqrNxnQZX4qQGZT3O0BT5EBf:o+SNc6AyTPr7aisLkNrPWqDAHQZXHQiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497713, "uuid": "57600a05-ad35-42d1-bda0-9a68ffbdfd6c", "value": 1385472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497713, "uuid": "dd9cbcf1-54ad-497a-89d4-b85b455a109a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497713, "uuid": "d59be583-f451-473b-91a9-54c2c5fb5930", "value": "DHL_119040 receipt document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171011be-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498974, "uuid": "afce2566-c7af-45b2-861d-b644ac4daccb", "comment": "Malware payload (Mirai)", "value": "0da4ff52344077eab698c2e13d52b7b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498974, "uuid": "e0f73696-6b9f-4dab-895b-afe9508934c4", "comment": "Malware payload (Mirai)", "value": "f00e66f4159a491a19c82008970be9f24ceb3d7864d054d414ba6e9ad3f093a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498974, "uuid": "169ba69d-aa68-47cd-bc49-671c1d7a98c7", "comment": "Malware payload (Mirai)", "value": "e49c64cd47eb2e57bd8d6ac94e764a03ad1d1d81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498974, "uuid": "ce1c61d6-a1d7-4d8f-a4b8-09759dd37691", "comment": "Malware payload (Mirai)", "value": "0567466470c5f5a3aaa5bd3d8e0bc3dc38a654386e9d99dd3f9937faa5bd2b0035c2f0457d1f663e6e23e5f54c264276", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498974, "uuid": "5ad97b99-7c93-46cb-bc99-a34f1a60f8c4", "value": "T1A203F1635077582BDB7D223401DB2E0B541C1B5C991BE55ACFC83012CCAB9BA237AB6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498974, "uuid": "be25e4d3-f24c-4d5b-9389-853534a635dc", "value": "768:hu+qAsndizHVyrbncODf/C8PqhW/XH0AsOwrC8ZOBRnbcuyD7UGQRjCWeV0LXGS1:EA9VKoODf7lXTshrlOrnouy8GyuWe6LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498974, "uuid": "3ebc783d-5cb2-4e62-be6f-91c73d6a9089", "value": 40972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498974, "uuid": "e121a3bf-eeae-487a-a255-b6a3a8be26e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498974, "uuid": "075af407-8f5d-4f86-863e-926031cf91e7", "value": "0da4ff52344077eab698c2e13d52b7b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afbc6ee-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639497718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497718, "uuid": "cd3c7ae8-e10d-45e5-9c69-825a585187c8", "comment": "Malware payload (Loki)", "value": "53711d3c1cc72f566eef7a2dcf8087d3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497718, "uuid": "4647ac15-cabc-4e6b-9f66-45efe3c09cef", "comment": "Malware payload (Loki)", "value": "f127be90ab220cb3db7debf732795cb24b670ed4beb13e94b7c5ea177a8d94c3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497718, "uuid": "4cbe81fc-201b-487f-96da-78125fdd1109", "comment": "Malware payload (Loki)", "value": "f773a3e2dc15f709cd465d6d85d94b11459d2a94", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497718, "uuid": "bfaa0d6e-7450-4a2c-8dc8-253bd9f3387a", "comment": "Malware payload (Loki)", "value": "f8a7aa9daf68cc749e166601b7f8525d3a52634dbd3c34b9415fea795f7a518ae872556b04d84fab381726a9779ad1e8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497718, "uuid": "46745f09-66ba-45bc-86fb-34c761165cf7", "value": "T1734523A73741CAA1C1256372DAEB658507FD384A3970DFAE7CDAB2ED11213E44A006DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497718, "uuid": "de7fac37-d1d8-4bcd-9bac-b85babb95d31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497718, "uuid": "1a94c1ee-1122-46f4-8437-3cffd52f1a33", "value": "24576:wqgwHvIjASUFkG9rRrGMJrJAR60C5mQJba7VWXp:wqgg+ByrBPJlc60C5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497718, "uuid": "597ce306-ef24-4aca-9502-ca72bdb4be92", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497718, "uuid": "780a443b-7d95-4631-a9c1-9467c237c6c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497718, "uuid": "e0c16cc3-82e2-4864-9b46-46e2666f25bc", "value": "DHL-AWB 2228282098-12132021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448404f8-5cc6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639476716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476716, "uuid": "9c97ccb6-2328-4a73-87c0-1bb0ae342721", "comment": "Malware payload (RedLineStealer)", "value": "13e28d118b6cc6a42949ba6fd819790d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476716, "uuid": "ba3b21c5-93ba-4926-9d62-e3c32670ccbc", "comment": "Malware payload (RedLineStealer)", "value": "f205d997f3469fa5d8540696459731adcb30a2c8db46ece9380d2ea70ea94e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476716, "uuid": "291bd2aa-4fea-4f1d-bc3d-3fc2f50668ab", "comment": "Malware payload (RedLineStealer)", "value": "2c4964a8be564395d8fb92289f519f9a3fcd8865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639476716, "uuid": "12824ed7-afa5-4e7c-a193-1800dca248f3", "comment": "Malware payload (RedLineStealer)", "value": "ac4a3c8aa8d827c770655d052c40c7670780b3ad453d63bec3c3174cc9ad4a27459c37f681282fc50a1b5e81b98803bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476716, "uuid": "5006faf1-e2a6-43cd-8f9b-0b0d3c050eae", "value": "T13294D000B7E0C035F6B756F85DB693A9A93F7DA16B3490CB22D526EA5A306D0DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476716, "uuid": "93785dc4-c2e5-48e5-a768-edbbe82c742d", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476716, "uuid": "de6450cf-4d0b-44e4-aa16-a2f2c1265910", "value": "6144:2oVPpdIfYpdktaxWo3ZDjaMseZyXthowzSfBKcvhDkoJ5wCrGv:zQ6h5vPZOCwzSfB71kodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639476716, "uuid": "a950437b-8ff6-4eb5-9edc-8802930c4656", "value": 419846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639476716, "uuid": "813be79b-9d92-48f0-88f3-368ad2258828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639476716, "uuid": "6d5740b8-fd3f-427d-b03b-f90e7da7d402", "value": "13e28d118b6cc6a42949ba6fd819790d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddfc0a6-5cf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639498394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498394, "uuid": "51e02add-0b44-4d32-b490-21b1f5b32b95", "comment": "Malware payload (Mirai)", "value": "cfacfec0151dd9523c7d93ba94acf0c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498394, "uuid": "6bafd38c-3684-45b6-94e4-c015958e60f6", "comment": "Malware payload (Mirai)", "value": "f228d1108d483c17c4b6f74b463f9e725840129c217c9165d8b908d9b15bcfee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498394, "uuid": "f8a53e51-684c-470d-8e51-8aff78082169", "comment": "Malware payload (Mirai)", "value": "28497b9149e37d9c553f089c511fff1b671704eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498394, "uuid": "cfca3d46-a69f-4aaa-9ce0-e09f14cef178", "comment": "Malware payload (Mirai)", "value": "d29b4d4115066e5fc6026897d661304ef9337b17a6baee11f82906271da8b28f538f023e75cfada2a246c6b4e5a88677", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498394, "uuid": "b11acf91-8a95-4988-be6c-11d693741a60", "value": "T1E2C32B2B3B270F23C0D9507102E32332A9B5D79934F953D7AED16D5C2F1AA883466BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498394, "uuid": "52c0f5ab-e41c-4681-8b65-c0f99747ec61", "value": "1536:ACgJxbrHa1AobBfCOZfXNM5zbPCtyDytW8QlePhWsmtfEqa/4xOcAMp:OFrHaJXN8zDhDyI8K9smtfEqawxO7Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498394, "uuid": "0ec30d11-64c4-477c-a90e-9ab4914df830", "value": 128473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498394, "uuid": "c323923b-47be-42ae-947f-db87983b5996", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498394, "uuid": "252c1702-45c2-4b6d-9794-75f408605609", "value": "cfacfec0151dd9523c7d93ba94acf0c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ab0845-5cf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639496387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496387, "uuid": "fd6b93e6-4aec-4a8f-80b4-c06fb923313b", "comment": "Malware payload (SnakeKeylogger)", "value": "e220ecd6448810ac58feede187b1e427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496387, "uuid": "7c3bbc54-e9fb-4b40-831e-c455b76aca32", "comment": "Malware payload (SnakeKeylogger)", "value": "f284406ec28d4d2bf0ddfe8cca5186dac70fff170a1bf365e78afd82cb975223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496387, "uuid": "67e252e5-3ea2-4de0-9293-9bd89c774ac1", "comment": "Malware payload (SnakeKeylogger)", "value": "769eb9548a98d082ec45011ba0db019ded49318d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496387, "uuid": "b26c4c76-cdc9-4876-baf4-daf7e2dcfe15", "comment": "Malware payload (SnakeKeylogger)", "value": "811ba4809d0b051598c92c0543c1d5a0588a60ebf7778af15338ac758a9f5797a2cd338af3fe9274c65270370a641c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496387, "uuid": "45e54151-3474-4921-a27e-2d955b61be76", "value": "T10955232E2A43AAEED53913F8337DA06457A25D355003F3A5EE9E71A71833B617E23107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496387, "uuid": "1b0b5248-1a82-4e45-ac14-5f2548246d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496387, "uuid": "0efeddc9-5692-4382-bc40-eca6affd3301", "value": "24576:nLiaxBn9Dd7PS7imqSkoyMJU2eezBZ8GqdSFwyd4UGsE/Kuwu8yXqL:nLbjf7PiqVDMJtMGGSFRCUGnC88aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496387, "uuid": "43cf4990-90d4-4c0f-98d0-50462078a5f4", "value": 1303552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496387, "uuid": "550de268-714e-4288-a560-03fdc9699fbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496387, "uuid": "314c396e-b16f-4f7d-bd6b-4d6690faa171", "value": "Scan Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dbb09c-5cbc-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639472495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472495, "uuid": "9293e969-d868-4d3c-8ec8-b9e8593c8570", "comment": "Malware payload (RedLineStealer)", "value": "c2560c03d901553230bc89de78bf5516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472495, "uuid": "345201ab-c3fb-4c6e-a1ac-b3d22a65cf5a", "comment": "Malware payload (RedLineStealer)", "value": "f292e6bd74efdadbfd0d10baf37ed6164d05eac44c391967b919d1dc69933ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472495, "uuid": "aab6a0b8-3e19-4c97-8b2f-83b19d6ac6a0", "comment": "Malware payload (RedLineStealer)", "value": "d9f03c6204aa916ca75f0195d698e8a29bf86fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639472495, "uuid": "621cc632-982f-4648-9ae3-0587df33cf7b", "comment": "Malware payload (RedLineStealer)", "value": "9ad25eac21f13453bfc7105593d1e73a928b40632dbad50edff36ac9088e80d9e5567ecd73bd8ee4950667e0a1f215f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472495, "uuid": "85f2c911-f9ab-43da-8d97-1fcb9c54e3ce", "value": "T1FC649D00B7A0D435F5F716F859B993ADA93F7EB1AB2590CB22D216EA56346D0DC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472495, "uuid": "633559d1-3c6b-4e3a-a539-2814d34a0f6b", "value": "2f9c37997e4f6c022f6907755dbb312e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472495, "uuid": "c038c297-4372-4d55-9a20-891758e35a97", "value": "6144:4UQmX6nCf58AgcrCb5zp4MZSD3Lt7wCWD:amqnCB8AgcrCb5zpnY3Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639472495, "uuid": "847b269d-f97c-4543-b7cc-0e19ee83a04b", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639472495, "uuid": "827f487f-818f-4f38-ac9e-8607186ff0df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639472495, "uuid": "65d0e3f7-66cb-4230-aae9-6ecb9e9a5681", "value": "c2560c03d901553230bc89de78bf5516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68228bfb-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639500398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500398, "uuid": "37aac6c0-b5bc-4294-9b68-cd7871d4e21f", "comment": "Malware payload (AZORult)", "value": "8e87e339a9a787e5d75062aea5164b34", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500398, "uuid": "8591bea6-778c-49e1-bb08-a03dbe61086c", "comment": "Malware payload (AZORult)", "value": "f29d59ceac2360ab6b5727973c27f67b9ccf9833f2ae01a4c3c3f761ff584f2e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500398, "uuid": "4fcba68a-ae63-40dd-a342-9ce5b67ae238", "comment": "Malware payload (AZORult)", "value": "804655be369ff236b2ac65c14aa23a254ea6a43c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500398, "uuid": "84b6022a-74ce-4f6c-b6d1-8e94bf1e31a9", "comment": "Malware payload (AZORult)", "value": "17149aaf4ac0bac569ab07a8287fbc337256aff89a5be7b45aa9b98f9a4071e66acb570c0f7c28613f95812e4d81888d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500398, "uuid": "9aba3f39-92c7-4543-9bb3-09c125f7df27", "value": "T1C4D40F24597F902EF0659A7C1ED076E679EAB372228AB07A53740E734723D41C9F313A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500398, "uuid": "29464e10-8447-4501-bd32-65ba3adab4cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500398, "uuid": "eace4e2b-2b8f-4332-aca1-39475195125a", "value": "3072:dsBmBZDAF71xNGYugL68cdU4IZbLronedP8ssIbgfO7vQBA0z/555XrRy7mXLww6:GckLGKtZrw0b01rRy7m8CoJ8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500398, "uuid": "2151de9b-cbd0-4eb3-9c3f-ced98dff38a3", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500398, "uuid": "1f9304bf-db57-4004-974e-824a5dac39d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500398, "uuid": "a6a2127f-d050-4edf-adab-cc39941b0d3f", "value": "8e87e339a9a787e5d75062aea5164b34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a6d57e-5ce3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639489061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489061, "uuid": "27ba70f7-97bf-47dd-8947-e88b785d9e73", "comment": "Malware payload", "value": "6ac57a1e090e7abdb9b7212e058c43c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Khonsari", "colour": "#827828", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489061, "uuid": "bf58adee-1036-4e55-86a1-97122dd93f69", "comment": "Malware payload", "value": "f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Khonsari", "colour": "#827828", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489061, "uuid": "a906792d-1170-4f7f-a871-7bca6fb2b819", "comment": "Malware payload", "value": "0a1e239348a73b1a95ac1767c8afebe4b98cdeff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Khonsari", "colour": "#827828", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639489061, "uuid": "bdf0c211-dab5-4dc2-a793-19655b58c16a", "comment": "Malware payload", "value": "c613a77a556db0c8b11349accc7c0eacb82d9a667fa2557992763018990876881438dd06e78ba68faa7b8621034dcc23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Khonsari", "colour": "#827828", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489061, "uuid": "f100275a-76d3-4839-ac90-bb4785858a21", "value": "T19942D60566A89736C2FA0F79CCA3875103B1D7A1D977CF1E3CC8A21A9C9274447936BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489061, "uuid": "d6136fbb-9d02-45f9-8016-f327f690764c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489061, "uuid": "7285794c-83ca-42d9-bd9e-0f9236c50d6f", "value": "384:uo95XKnTPKv8CtjGdcYprMRpEvA1SXs/177:phKTPCtF5SXst77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639489061, "uuid": "0033d48a-d378-43d6-bcd1-cc4fed882096", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639489061, "uuid": "c33a6fae-80ca-4b79-845d-5eca0330b7bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639489061, "uuid": "eb9d1b7e-c448-494d-86ed-848bcedad3c3", "value": "khonsari.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6032e2-5d1c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639513938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513938, "uuid": "614c80fc-e4b2-402b-b3ef-2f76ad60d4e0", "comment": "Malware payload", "value": "34e139b8bb61832906e9e4aa183997f9", "object_relation": "md5", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513938, "uuid": "0f8de5f2-0f07-40cc-a0de-412eb10f4d02", "comment": "Malware payload", "value": "f2e65bc6bfe3d1368dbc9bb3dba0806edf9934b4641501532038a0b86089f881", "object_relation": "sha256", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513938, "uuid": "c48d8262-ebc9-4c70-80e9-d85765830ea2", "comment": "Malware payload", "value": "6c92a9f72603c5756c3e59554ec56c31cfd99527", "object_relation": "sha1", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639513938, "uuid": "6cbf9c03-fef6-4b43-85c5-d785944e7da8", "comment": "Malware payload", "value": "e158bd21072f2e36dc63fd23864612070207efa1b04b4c7470b52636fbb37fecf0cce02926297d55c04ba13ea21a25a0", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513938, "uuid": "3cd8ea97-8925-4219-9c84-d20224cc0705", "value": "T11B62D746ED1C10932FA8F46ED4749D143F0882315059097AB2AE5EAB22ECE2B611FADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513938, "uuid": "5bdfd058-0dba-4d6b-9829-780f60c30370", "value": "192:FMofEik/qcRr54E2E4iKDWKQMM41k1LlOqcRr54E2E4iKDWKQMM41foV:FMofEik3/4dKKQ74C5k/4dKKQ74M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639513938, "uuid": "5abd4f8b-8eec-4c92-8c4a-acc398e39d01", "value": 14802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639513938, "uuid": "ae318eb6-b681-4773-b477-a9235ba95fb8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639513938, "uuid": "30dccc51-13e9-4cf7-9dd4-973432fda9da", "value": "69r32i3V.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7619666b-5ce1-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639488396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488396, "uuid": "28a6203b-1555-4d70-a216-2bc174858fce", "comment": "Malware payload (RedLineStealer)", "value": "d454d2c5919ea1e90eee274396c098d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488396, "uuid": "38c8edb9-8c29-4e9d-a4fe-bfa1475e3b8c", "comment": "Malware payload (RedLineStealer)", "value": "f2fea6be8930ef021ce06c2631e6eec2353c8d6143e147e04ca3f4811963a41c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488396, "uuid": "933fc337-9f2f-48e7-b93d-3ee833f0ec2d", "comment": "Malware payload (RedLineStealer)", "value": "a4ba787b3d7db0ffc24f48db2090382e391234c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639488396, "uuid": "06aafb2d-3ab0-4f80-a05b-5540f7a0b32d", "comment": "Malware payload (RedLineStealer)", "value": "59c1a02e4a41ed2fb203ff79ee03323846921937f4276dc4df87aac02bd8fb2f742d914e3e434ed99f53c0f78e12b5cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488396, "uuid": "4e0b873b-58ae-4d80-b4f2-ef142bdb10b9", "value": "T11394BF10F6E0D035F6B356F44ABAA378A53F7AA06B3850CF12C516EA4675AE1DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488396, "uuid": "608f113e-34e1-4c25-92af-b4af3edefc29", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488396, "uuid": "2d950738-74a8-434e-9648-5da789d4d6b4", "value": "6144:I/zeCuXRBJU5o3hw/82JZzsBzKgoKAhvRMXcrmG7fRa1cYr9vvwCaDS:hC2BQ0qNsBzQvyXcSGrWcYr9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639488396, "uuid": "77ba861c-bdba-4ead-9a6c-7f0404161630", "value": 443442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639488396, "uuid": "9ae9435a-221a-40a1-9d5b-27328c364639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639488396, "uuid": "a6d632f3-83f1-4e00-bbaf-5325f83eb68d", "value": "d454d2c5919ea1e90eee274396c098d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ed732f-5cf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639496099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496099, "uuid": "53ced3b1-a931-4185-af9a-57fa1405274e", "comment": "Malware payload (SnakeKeylogger)", "value": "1668018a3413a240a56bf356fc45bb1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496099, "uuid": "e24b67f2-33db-4ba6-92fe-6bbfa38764e0", "comment": "Malware payload (SnakeKeylogger)", "value": "f3ccaf0603cc13edaf8c3e63f939b55b40b578387ce2471c8db97c788973e0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496099, "uuid": "4247bcaf-395b-4576-a8f6-be78415501bf", "comment": "Malware payload (SnakeKeylogger)", "value": "e1935ef5a465b2209d163f0970f1528eea8adeea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639496099, "uuid": "007b0eb2-7bfd-4744-8da9-69023d4372d3", "comment": "Malware payload (SnakeKeylogger)", "value": "90afe91a86a13994b5d627e0d0e66f3a3d7ab4ef6d9dbc4fe3604a08804a96ff631e09c3c1201aa2400b4ef4ae72eb6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496099, "uuid": "61e8a5c2-1309-4004-81d3-b7a4b9b28b56", "value": "T19A35121C3A4396CEC5460EB6376990246676AC796507E387F8DD33AF1C3B2683973B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496099, "uuid": "72899d10-0c11-438a-b01e-020f3c19a85a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496099, "uuid": "6341b5c7-e17e-45f2-a69a-8c861b65278e", "value": "24576:R3WOUbNQU1Fw7/rIepUiDi+zQMVySnX2cHs2RWL:FU11Fu/3ptzJ8S22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639496099, "uuid": "5d1e2610-de1d-45bc-ba51-ec69f3f4abfb", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639496099, "uuid": "a37bd48b-ecf2-4a17-ac38-0741985f220c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639496099, "uuid": "9db0b530-b9d6-4334-9329-30ba70686fdf", "value": "Halkbank_Ekstre_20211101_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66993a7-5c77-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639443004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "9ebb5390-7c7e-494d-94c9-b15d2c9b084f", "comment": "Malware payload (Mirai)", "value": "83c8f34fa93cdba79b84681f6363fe44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "71ad6371-4a6b-4e8a-9ac7-ab3e827bf604", "comment": "Malware payload (Mirai)", "value": "f3e3bb7b1326d2a9e1f0882ae64828fb7f89518b7f17e46400ef78c1ccefd1dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "18777e63-fa20-42ca-8880-9e2e75ee77ae", "comment": "Malware payload (Mirai)", "value": "b6aefd12292c7e0991ea4fb554b5223cdbfb30c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "c655687e-0c18-4f2e-a21e-14da9210d858", "comment": "Malware payload (Mirai)", "value": "be806cce9092a89d9822d4528c46c2d70968200c4e5beae15124c299cf8a0fc3ab32b3ec265c65c3cf3ce3c0084b2299", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443004, "uuid": "8ef47d2d-44ee-42d3-83f6-c1da7cd3f33f", "value": "T1DD23F1D3E873A23DD0DAE57911FBF849C724E0A656009B60B2CCF8378A43B59D74B5A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443004, "uuid": "1246babf-f045-4c35-8603-4a1cb6ca579f", "value": "768:TQqgSuJpfVtuwHHZE8Ea7hzvCbyKDKOrCpbmD+2dqJnbcuyD7UGQRjPDrDXbN:kjVfmwSMu2Qrsd1Jnouy8GyjjbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639443004, "uuid": "fdef8692-031f-49bd-b783-15262d6da17e", "value": 46412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639443004, "uuid": "fcf816dd-72c6-4ab1-a943-f66e8dcf59c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443004, "uuid": "6770fda4-6a77-44ef-a55b-970253338ef6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75d94bd-5cc3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639475701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475701, "uuid": "2c055d86-5ec6-4947-9baa-fa63412ba1cc", "comment": "Malware payload (AgentTesla)", "value": "a19fa5a84842c4cf1ed106906e8979a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475701, "uuid": "ca3fc4df-6cd8-4c12-a0c8-647eab54d559", "comment": "Malware payload (AgentTesla)", "value": "f4ec9d2e18747cfccc81bc3bfa99b7de1caa849dc20526153f9ff5b6fa72d121", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475701, "uuid": "91788293-920c-4a2b-87d5-ae0ebf729b48", "comment": "Malware payload (AgentTesla)", "value": "9e33923f92935f9452762efd82bf70a347328ed8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639475701, "uuid": "485196d3-3551-4455-9f79-9f4728620543", "comment": "Malware payload (AgentTesla)", "value": "0adf0bf9051b66cd42ee74b095934c074060d583fe7794768e06e0072c6811abaf7dc210183414d0528f2236f139c792", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475701, "uuid": "2e576bd4-ac6b-4239-84b1-c80f6c6af884", "value": "T109C4B0BD09959B4FF26A1C3D91683B89A07499CA53435D4DDB3C39FBE6F130860CB84A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475701, "uuid": "c8bd019a-1d76-4723-b2ca-5c80e186ca74", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475701, "uuid": "55be407e-a9ba-4b79-8a70-1074a5dcb7cb", "value": "12288:bwuUYPRBYVgJHWxoIjtyJxUIAUQd8fPbPqRZaugwQgClq12:bwu7PMaJ2ljtyJiUg8fPXugw1ClD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639475701, "uuid": "75a53aca-be5a-42c6-80fa-78de8c011019", "value": 555701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639475701, "uuid": "f4df660d-33c0-4998-b825-1f00e42ecac2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639475701, "uuid": "c301ad34-23a7-4178-a28d-883f3e38378c", "value": "EDC Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcd92d1-5cd4-11ec-96a4-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1639482661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482661, "uuid": "25329657-84cb-4b91-a257-335712ebf693", "comment": "Malware payload (BazaLoader)", "value": "2e24a603bf93ee0210473eba8e1b7d51", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482661, "uuid": "66598ecf-4e1d-4530-8049-5040822eaf35", "comment": "Malware payload (BazaLoader)", "value": "f5ec86919d7c1d52bbdfdc299cd93aa9393069fb00b3aa6be2687959b4b0e925", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482661, "uuid": "c979a64b-384c-4f36-b805-86363d31cc2c", "comment": "Malware payload (BazaLoader)", "value": "41ea0c23115d86c83b32203e24fa6783d3b6bb24", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639482661, "uuid": "3e753886-b1f3-4e0e-a856-e7f208681de6", "comment": "Malware payload (BazaLoader)", "value": "43278ac8b8607bfeb0e2f53f3e12265b7d1165d43d1dbab3d1d41989732dff95af53c0ab90a2f81a26d14c5b5419fda7", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482661, "uuid": "bf3f7287-8cd5-4bc7-91b2-8fff1790a734", "value": "T1F834CF4976B618FCF562817A89918645B2727C224724CEEF03A4C379DF236E25D3BB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482661, "uuid": "5235db57-215d-41bc-8b64-abe4471589ed", "value": "63a1e25ccb63258cc76f156e284f8cf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482661, "uuid": "f21c847d-0e35-4a8b-b49e-1cfb6f3e16bc", "value": "3072:kPrEUUYkw4DqRcLfLrdZOd5FYEguoPRrlcD0S2oRgM2oWLExEETl2gqClCt9w83G:uExqS2jYlZPRK2cFmE1RBylDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639482661, "uuid": "a80137e3-c711-4f1b-81d4-f0b45f187192", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639482661, "uuid": "07f84833-0548-4414-92d7-9f59155ee52c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639482661, "uuid": "a7a03b9a-f6d9-414a-b03d-99041c8e92bc", "value": "Invoice and documents\u202efdp.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ae5e1b-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639500451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500451, "uuid": "06d0501a-c887-497f-a800-8c551cc92a1b", "comment": "Malware payload (Formbook)", "value": "97ccb52c7c644dd07b5ffdff93224863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500451, "uuid": "2c599363-97b1-4e93-84fd-bf13835a36cf", "comment": "Malware payload (Formbook)", "value": "f6ce0dcc1b8935f69bc1d3af7e524f5bce8d287e93d0e49cbd0db3c142d315b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500451, "uuid": "837e3dd5-faf9-4ce2-ad61-a24008e2b998", "comment": "Malware payload (Formbook)", "value": "0346a121d296f19edc1c3ee14149aa0e84a76e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500451, "uuid": "06ea4d43-3198-4324-844e-078988c5bffb", "comment": "Malware payload (Formbook)", "value": "5a5f5f65e5ad3390f904ddf4f20547b02af88dcdf9392aea777aa519f93f28d2375b17dbb7dec9c73d1428108f1dcdb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500451, "uuid": "05f591bb-00ae-417b-a8f0-d78f43d90b36", "value": "T17FA4234A75C25932FFE64B7A22F9D734E7BEC42917E1460B8FD44F05A933042E629272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500451, "uuid": "69d21a7f-bfec-401a-95b9-30e3bf1dfc96", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500451, "uuid": "5e175412-74a0-4402-96a3-5255329844be", "value": "12288:DW3QYwHoeG5ahJz+tx7o/90OAdJ+Sf+gwNTp:D2J+oeeaCtdoAH+Ofi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500451, "uuid": "198ce3fc-fc70-4917-b865-2960c83727b7", "value": 471133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500451, "uuid": "e6c58a17-0a71-494e-a055-329da4e1bfc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500451, "uuid": "73d29dd6-6dde-4a26-929d-8a6404c703d1", "value": "97ccb52c7c644dd07b5ffdff93224863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0084fa3-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639497485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497485, "uuid": "7ff494fb-1ad5-4cd6-b19b-4eac137e0959", "comment": "Malware payload (AgentTesla)", "value": "2339cd029b5111eaeb8028c8f528996b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497485, "uuid": "221eab46-b074-42bb-8e60-931e5852dcbe", "comment": "Malware payload (AgentTesla)", "value": "f75f3bfd3e18d29e31ff3dc286bcc5c9ba147d49d01e87261cc71f76fd012e44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497485, "uuid": "d8bf9992-7d77-443b-8913-b73e14178b9b", "comment": "Malware payload (AgentTesla)", "value": "267c48f3c197badfd078e22c6b65470d1f568fa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497485, "uuid": "50d96714-cb6c-446c-89b2-d3d1e0393229", "comment": "Malware payload (AgentTesla)", "value": "329d1469b8a78174b77fbcf552e3270eb8d5ceb152c71ae45ff4eaebd76738a37f9153498120e455db2a90948decabe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497485, "uuid": "1ab80099-9090-48ff-9766-55aafe371c46", "value": "T173F1F9B8D8B41438EF8746406A7EFE7015EEF087D9CA064173ACD4720BF93525E24C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497485, "uuid": "97c455fc-0e6d-4790-8fe3-9636b7231eae", "value": "96:S3Wz37v7tovKf99AzpURJguTCVNHLtWfCD7pR8vt:S+jZoIbxRJTiHpW6D7/8vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497485, "uuid": "d09e1677-b056-49f6-9dec-67644cb5382e", "value": 7944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497485, "uuid": "ea451ce0-cc77-4988-8f9f-9bab3b9ab274", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497485, "uuid": "39b1f90b-7f0d-4c2d-bb3b-526b533f10e5", "value": "DHL Shipment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2680f20d-5cfa-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639498999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498999, "uuid": "d977670e-339d-423d-ae68-18693b8e105c", "comment": "Malware payload", "value": "868efc65f84fe52b25f14019ceee952e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498999, "uuid": "65f27773-fa51-4048-945a-d05fd92d9d41", "comment": "Malware payload", "value": "f77875cdf43d02b2f63e7c89fcac1b68c6865b8c3498d5ed82049eedc0c64f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498999, "uuid": "9b5ee619-e03f-40e8-a9fc-906884465b97", "comment": "Malware payload", "value": "406567d25b7e5dfeccab0e6de9695403209d277f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639498999, "uuid": "d8195b6e-8ad1-48a9-97f1-06c4572648a9", "comment": "Malware payload", "value": "5bd5150f9278953deff3e92e0912862558c7cbd7782b5ab06554108d89ee260fe872065c409ecdec99e981040186535a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498999, "uuid": "e9d45ae5-78ce-4dec-9906-cd009776f012", "value": "T159E34905D7408B57C1E2277AEBDF424933339B54A7EB33059A28ABF43FC27994E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498999, "uuid": "6940ca19-fa12-493e-a281-69d6b5397b0d", "value": "3072:De63VDzi+Xl6B7pafmkXjQ7L8buxVRfEEdCmLwfCDQSAW:S63VDG+IB7pajTQ7L8axVRMEcmLwfCE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639498999, "uuid": "4c58b41b-3c0b-407b-9865-ef7ebda7370c", "value": 149966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639498999, "uuid": "cf598e9a-6a59-42f1-9d94-84ed37532f6f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639498999, "uuid": "6ccd3742-f535-4a0a-b6ed-64c86e33ab42", "value": "868efc65f84fe52b25f14019ceee952e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5a9e85-5ca8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639463980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639463980, "uuid": "eaa003cf-4cbd-4604-be7c-d3cc2b50c02e", "comment": "Malware payload (Formbook)", "value": "6f1e08f3aeec64cedb74a5bb7ff22392", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639463980, "uuid": "3e4f9b30-2c76-4211-bb4b-742e34a0fe2b", "comment": "Malware payload (Formbook)", "value": "f78ac503e0942a1bafd27fc9464ab605eac94184d9da91a0385beb8debef65e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639463980, "uuid": "3e3f7f91-3c5f-45e0-871a-b18f222d5a24", "comment": "Malware payload (Formbook)", "value": "961cc902df5b2ebc015dd848e7da4f7992eb6b54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639463980, "uuid": "a553fc7c-328e-4813-b0e2-9eb014c8f2cd", "comment": "Malware payload (Formbook)", "value": "60c4a2d2a615808b18df8b032195194c7a741bc0789ea5a28a9faddb15a1d98a063c85549877bde7387d8aff17f04cd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639463980, "uuid": "d1e56fd2-c455-4e04-bf70-e4dc5b595968", "value": "T19D55125473A49D34F02E0BBC94B1C230D735BC156826931FAAE53DAFBE337A09A09657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639463980, "uuid": "86cc3abd-a21d-4738-91fe-d533f36bb161", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639463980, "uuid": "cf1cc751-b38f-4592-afa6-0ab33157e8a4", "value": "24576:mUMReViFKnQpN1Df+vdN20FurEoTrhlYBp7/BY0XOHtEgah:RMcwuQpnKvXFErhlYjdYoOygah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639463980, "uuid": "c0c8bc01-dc59-48c9-9cf0-273b8bf8f586", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639463980, "uuid": "2969f2cf-19d8-4d33-b926-daf4ffa14166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639463980, "uuid": "018f3974-b258-423f-8e5b-ef3cf2e264c7", "value": "6f1e08f3aeec64cedb74a5bb7ff22392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1818a8cf-5c80-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639446577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446577, "uuid": "45563b96-f582-4e1c-b809-76a76816122b", "comment": "Malware payload (Mirai)", "value": "9fc75907bc1bccc203c62de116ec9065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446577, "uuid": "42da39e6-c5a0-4697-8e96-6c70ff030c11", "comment": "Malware payload (Mirai)", "value": "f8342dd83fd5e197fafc101d4a3959ad7a7f378579cfef06da0be52b607e82e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446577, "uuid": "7e6307e6-e001-404b-b64b-26dcec743c50", "comment": "Malware payload (Mirai)", "value": "0a716d0987fe3e86ffcc8f0a06f9d8c1e23608f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639446577, "uuid": "04c8970b-4b66-4f20-9209-22bb13edfe0b", "comment": "Malware payload (Mirai)", "value": "2dd7c58f5244278c3aa0c391c752be5244427e2c64d326fc93f168dac03a0b19adfb5e689093eddcfc4cbaf047935435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639446577, "uuid": "e08c4a32-1540-42b1-a84d-5d02c34faeba", "value": "T164D2F1329267DEB7DD9E1370178D0EAFF835682D47ADC00E1588E4D29B95231819F2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639446577, "uuid": "c44db107-ae71-448b-bb84-b48254ee9028", "value": "768:eXG8nyKdZ3h0m+34nD5+AWyIgdMH0YfbZNS:eLnZ3hlB8dyYH0MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639446577, "uuid": "533c58e7-b443-4f9c-af81-63f5b9d55dc5", "value": 28864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639446577, "uuid": "bac540da-2210-422d-a967-f07a6f009e91", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639446577, "uuid": "09b729a5-4cc6-4945-855e-90b63ea43335", "value": "9fc75907bc1bccc203c62de116ec9065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11980ccf-5d24-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639517003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517003, "uuid": "5fcc6cc8-f753-4c76-8f75-9ff76e01022b", "comment": "Malware payload", "value": "876a684ef51df9fc915894f5c9c0ce50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517003, "uuid": "e333499a-ffdb-49f6-b870-55bce375f0a0", "comment": "Malware payload", "value": "f86a826bbfb984d41a46c7b41cf1dd6e7b4c7576a73b7ed90f15517c261022a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517003, "uuid": "79bfda0c-7084-40c4-b4c0-e32e582a73a4", "comment": "Malware payload", "value": "71ecae27bd8ca2af43d92dcf4d0de4bdfc28571b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639517003, "uuid": "860e5dbe-e150-47da-acea-a99396b473e9", "comment": "Malware payload", "value": "c44fd4d5cd46139c907557fc7dd155486724295293b81b457f6df235fa994ce488812b1fbc3829e7e3f04964640f8585", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517003, "uuid": "9f2f35ab-1625-4bfe-a4c0-2b14259754e0", "value": "T12334CF10A1816031E8FB187A86FED56E8A7C67501B84EDCF83DC28754FB66D1BA305DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517003, "uuid": "50bb03bd-e2c0-4faa-948f-ca7768342c26", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBs:6jIG/pjjuLbJLmGshoCUnWTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639517003, "uuid": "279c0c2d-e524-4ca5-845f-530df6fce208", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639517003, "uuid": "395d29f3-15bb-4f1d-80ba-b01d30282a21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639517003, "uuid": "daade0d4-b53a-4355-8f1a-a2d6f16022e9", "value": "emotet_exe_e5_f86a826bbfb984d41a46c7b41cf1dd6e7b4c7576a73b7ed90f15517c261022a0_2021-12-14__212318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02775735-5d06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639504093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504093, "uuid": "27353739-962e-48d0-903d-2ae13cf0d63a", "comment": "Malware payload (Mirai)", "value": "8fa8145b5a28dff63dc8ac73896d162d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504093, "uuid": "143744c6-3691-41d8-a6fb-1bb68402dc2b", "comment": "Malware payload (Mirai)", "value": "f8ffb349717ea16f80fa8b0c1d72f6874effbd57c96c3a699ac8e4e015ff8f64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504093, "uuid": "1ad8e467-6b5d-4d5d-bbc8-6ca042ea1ecc", "comment": "Malware payload (Mirai)", "value": "394648c44b2a52070843d3f5f6255710621c928c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639504093, "uuid": "6ff85c5b-8cee-4111-b47d-4ed41795e20c", "comment": "Malware payload (Mirai)", "value": "b02d9513b5f3bbe49157b09b156275cd3b3a167d73e7a0768f8b2fc7afee5bd830c86c63bfc285b22dd7a92bd2f4f5fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504093, "uuid": "7a13d539-c916-4f9a-8496-0e261a30c632", "value": "T1CD431925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504093, "uuid": "908b5a75-a4cc-4f6a-8890-6ab4990c2d85", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDH:eL0AxvSHfymp0xgunvCkV6vTMDau8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639504093, "uuid": "823685bb-0ba2-4eaa-94e4-66b0d8523d63", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639504093, "uuid": "2bddb9f0-a790-4248-a9b5-1acf7ab9fede", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639504093, "uuid": "1170b29b-5f7d-40d7-95b7-349facafe0fe", "value": "8fa8145b5a28dff63dc8ac73896d162d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14979b7f-5d03-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639502835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502835, "uuid": "a03063d5-c19e-4f7a-b114-47dbb9640c1a", "comment": "Malware payload", "value": "c681c785d6055a1d5a8fe74403c9dfe9", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502835, "uuid": "040a5cbc-14ee-4ca2-9db5-733be41ef73e", "comment": "Malware payload", "value": "f9c4a119234df78e1ad71b10fb0bf18622fd5245b72b93e5b71992f20cb9fd2e", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502835, "uuid": "d541f08b-6308-4814-9e50-7d767d5ca7c6", "comment": "Malware payload", "value": "50713534b62404d6f502a3efa129460fd7fb6927", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639502835, "uuid": "22ff7042-6fff-4d26-8fb7-a89789750cf0", "comment": "Malware payload", "value": "05e94350e84884a4e256872c52cd07e939094b76b68bc12daacdc56a118d7c5a9fcb244636f011920c3744afb0ed27e9", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502835, "uuid": "d94f297c-5f51-4ad3-a3f3-d367b37a3d11", "value": "T11A944B4AFBB488B6D066D139C5738F8AE772BC994B30834F2364576E2F337A15929311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502835, "uuid": "05d2f905-aaef-465a-b1b5-a31eb1bf05a8", "value": "ac6c0c32deccf9120556ee5df8768890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502835, "uuid": "92a2763b-83b9-4e62-9df7-de5cc0618784", "value": "6144:qSO3AQzd77xgBz9+61ozdamlC0rfwC213w4eEX2o8:qSO3/57xgZ9+62PlSC44bo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639502835, "uuid": "25feec4c-22e8-4463-a5fa-6c6b2f5a65ce", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639502835, "uuid": "d7cf6c17-a544-439c-bad3-e9fbcde01f06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639502835, "uuid": "0e7a0c65-6b46-4091-ba3a-ae6a021aee98", "value": "Ihopot2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d6e2d9-5ca3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639461625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461625, "uuid": "92703012-0dca-4094-afe6-338347a160b8", "comment": "Malware payload", "value": "199a0c527e45b03ade819c59910115a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461625, "uuid": "8aa69d69-45b1-4448-a285-647951a8ec92", "comment": "Malware payload", "value": "f9d014c05c57e39c862771c007d36184ee1a72b6e8b5f8034da4ee72868f2691", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461625, "uuid": "37b0f806-6260-45f1-9b0e-f9326ec57cb2", "comment": "Malware payload", "value": "8952ed9212a5e102bc3d544c7af251901e599294", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639461625, "uuid": "fe59d0f1-d23e-4c1b-bf74-a78168846ccc", "comment": "Malware payload", "value": "76871882da239c964e7f2b1f76370cd21bf2479bd5ee946e0472840713adb29b9b9b43b2e48f9b32c73faf8cacf461ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461625, "uuid": "591c331a-b80f-4582-abf2-c84e8b7f7846", "value": "T18D65334822FA7CD8F8AB062937521C94C3A532F1C045B09577880CA656B72FE539FEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461625, "uuid": "a4598091-a514-416c-ac12-1829deca3c94", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflri+PvR:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639461625, "uuid": "39f41db0-0bbb-4fe6-9816-0356b673bd50", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639461625, "uuid": "1f6c0451-7e69-4166-b8a1-31315d3c2bc3", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639461625, "uuid": "c742506a-5573-4003-962d-606a76dd3b40", "value": "f9d014c05c57e39c862771c007d36184ee1a72b6e8b5f8034da4ee72868f2691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378b78e8-5d15-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639510624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510624, "uuid": "ee23403c-66b1-436c-a131-3541241cf548", "comment": "Malware payload", "value": "7b8ce524ae078a76a69548aebb95cb7e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510624, "uuid": "31063566-f004-4989-a38a-0f1e5de263f7", "comment": "Malware payload", "value": "f9ec3ce12d9b61fb4b15ee80383256779cc62450107e4e37ac44f8cf4df2c24c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510624, "uuid": "dd8f37dc-884d-4ef3-81fe-9d8d507b8e48", "comment": "Malware payload", "value": "978276bdfdea4cad24c9b3091780d6806dcd6526", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639510624, "uuid": "57915ffe-2f4c-41dc-a8f7-680f76e5ec47", "comment": "Malware payload", "value": "793d40b6e66d73edf1fca943088a1c76655b02cb596973f9594cf8d5a5e40b80d393cbdb4e9c0eeddfcc7483527884e7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510624, "uuid": "9cfc4a47-c00e-4176-91ed-91d9c78ad65c", "value": "T1A70633D9F7782926BC0863717CE841AD84B8BF47C4EEC648E0C46657983D687285B4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510624, "uuid": "76b40e08-4d63-44a4-a8ac-35c5908db2cf", "value": "98304:YJ43Lco1SxmVeCmj3emFXogxd5B/2ZUpNSfonQ2tA:n3LQMsCK35B/rpFQ26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639510624, "uuid": "ed4a8c66-bbd6-422e-a1f9-3855001ec0e6", "value": 3800727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639510624, "uuid": "6959f79e-1c44-4e73-8d15-31d3547c1b89", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639510624, "uuid": "31a1b753-67bb-4b57-8c0d-14e3d55bc61b", "value": "log4j-orcus.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378ccd6c-5cf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639497310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497310, "uuid": "b3f5d782-d60b-47fb-a45b-7e4bdfee10cb", "comment": "Malware payload (SnakeKeylogger)", "value": "2f2418119336cc9d44a7db67260ef457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497310, "uuid": "0f2566b4-5ef6-4fc1-9fbd-750f9012ecbd", "comment": "Malware payload (SnakeKeylogger)", "value": "fa11ff2dfdf24b8e4628ba1e868a27510b4cb3936d1c03dd1d6bb8049cbdefa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497310, "uuid": "3d3247e6-dfa2-490c-afc2-a11474596889", "comment": "Malware payload (SnakeKeylogger)", "value": "ab9f8adb7cc26ae471c1d5f53fb8c552d218516d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497310, "uuid": "36c42b9b-c652-4133-b8f9-4a1a72ca071c", "comment": "Malware payload (SnakeKeylogger)", "value": "c1dea897a906c432e84b830e6390371ed084df337573345f21197e6757bd5d68f516f4a8b9b4de940bd6159e4f3effc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497310, "uuid": "40f2bbc9-df1d-47ce-bdad-c4965676d58c", "value": "T18355E0283A0764CFC58F89B13A5E40A09661BC34A313D94FA6D47E2FC92B6F42D5E1DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497310, "uuid": "41017baa-bb67-47ea-8a46-86ebd9270610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497310, "uuid": "fa488246-6f0d-43d8-9d58-79018c8f7573", "value": "24576:TGqostWO8yPY6WRKYMmPxbBK2gMu8btUs/uz0g0Gw:0O8yPdWHxtCSH/E0ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497310, "uuid": "e44649c9-6a50-4473-a4f9-20187c56b4da", "value": 1322496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497310, "uuid": "48579bfc-5a0b-4589-8e8a-ac78c652c5ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497310, "uuid": "eada2366-c056-4e5d-8ea5-0ce7e97b9841", "value": "NICE Trading Co Ltd - PO (PO202101129 & PO202101130).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d303efb1-5cfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639500577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500577, "uuid": "891de870-5b26-42d8-9505-74c2d03ade6d", "comment": "Malware payload (ArkeiStealer)", "value": "6fb2dfb607f9a0d0030c6f44486a93d6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500577, "uuid": "cd3f893a-223e-4529-a132-b505896c70ea", "comment": "Malware payload (ArkeiStealer)", "value": "fa277d5b2064278927b94cc32331394d620dff4b7af7d5c9bddbdbc01237862e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500577, "uuid": "b6c2293a-be89-418b-8568-1588db1d1ee0", "comment": "Malware payload (ArkeiStealer)", "value": "537d8881f500800eeed863c20732a7fed81ed974", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639500577, "uuid": "345ecdbf-e0c9-4cd9-9f1b-6e4361634d90", "comment": "Malware payload (ArkeiStealer)", "value": "cef347a613f3032b9ccdea8a1354a996bc320cd568599d298010afed6735e38c8e48860d873dd689920fa4ae4665fcab", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500577, "uuid": "4f873311-a9d4-4b40-867f-62515b0ede68", "value": "T19724AED175D1C872D5A73A3094B09AE4DF7BB861E660508B72783FAF2F323D05A26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500577, "uuid": "fe6a1689-d994-4864-8b97-f002f6761eaa", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500577, "uuid": "1edbf7e1-2640-4d61-b4ea-53808ad725c9", "value": "3072:XVXs0Izi6BZWu98pKCbNjFTk/4L5WEshsZVggjcGkNIVqI4HVUO6WbSu75032:KieZZ69jFQzAb7ITsqJ1U+ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639500577, "uuid": "674b0fe1-92da-474d-859a-083d3d71305a", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639500577, "uuid": "8e50c289-9150-4c43-b534-cc6d7a2dbba1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639500577, "uuid": "97fc8c78-51ea-45aa-8f4c-5057d5f4fa5b", "value": "6fb2dfb607f9a0d0030c6f44486a93d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c33577-5c77-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639443004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "2d27e5ab-a10d-4430-9606-2eb4550e42f6", "comment": "Malware payload (Mirai)", "value": "744e7f994431be37f30fcc45f24ce3a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "b4d81e75-c506-4a50-99bd-3fd4e24d5aa3", "comment": "Malware payload (Mirai)", "value": "fa56cb399987b3100ccb3acd60dbb292b0d4a5b3054f5afdc49e6cc384a01c61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "410a5cb0-0382-4be1-ac90-ec68e1a07fb4", "comment": "Malware payload (Mirai)", "value": "1018bcaa667279f1a76cdca80ac3ed197ba7ecca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639443004, "uuid": "e09861ed-e96c-4f7e-b7c1-e30229dbb920", "comment": "Malware payload (Mirai)", "value": "e64e4c220748bb6616364f0775ceb96bfd4f4722ddf0d491b249f7d9ad8dfb99f39562ac094ac7480cca563a9a8a87f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443004, "uuid": "9996da01-5e31-4534-bcde-03caf8092585", "value": "T1A623F171612EA0E2FC748DF6A6748EBAB5123BF2CDFA70347450455E26320726BB94C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443004, "uuid": "1d9209c3-fff8-410f-88b6-416f37b642dc", "value": "768:gZsT8r3MG4bm2GOkymVwoEGxhnBYDVnolaDh/IwPGOy9q3UELwwFwQM6n4wmYcAS:gZrrxYm9OkpqlCGgweeLwwq76454aSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639443004, "uuid": "798900b5-6a7a-4820-8687-52d1edfc4042", "value": 46788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639443004, "uuid": "632e1599-f390-45d2-888a-6c009d18cf5b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639443004, "uuid": "e192def6-fb62-4efd-9c33-3e07edc7ae6e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b499ea-5cc0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1639474267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474267, "uuid": "88898da9-06b6-4cf9-882d-528ef7cd77b0", "comment": "Malware payload (Gozi)", "value": "ac57d694b86d8532b38d3d62f6de3afc", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474267, "uuid": "c820fb52-ca26-42dc-a7b0-9406db82035a", "comment": "Malware payload (Gozi)", "value": "fa668d1a58b3b92d9c1b9a740facfaebb35dd723deaf5a3833592208a8a47e5e", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474267, "uuid": "c864b8cd-4d7d-406f-b9b8-e48a5153a879", "comment": "Malware payload (Gozi)", "value": "c858ec742ba91bf8c139b7bb654ca2d67747c5ef", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639474267, "uuid": "544ff939-2c54-4676-8d96-4850c6085791", "comment": "Malware payload (Gozi)", "value": "55e11b53c33641ee09ad61ca315d08969c4e12591d354ac547768633a1808ebb0535bcfc2e7137c1ad9be9df4a95e9a5", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474267, "uuid": "0c9b1e33-9bb6-4c8e-b7fb-f03745ce477f", "value": "T16785F4DC6281871BE825723C7429D2B68B156C875B75813E6E473EFF3532346A68EE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474267, "uuid": "7d38c3aa-520d-4468-9f98-26a76681c434", "value": "90a569c76737ac6eae14ae164dabea89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474267, "uuid": "5d51b9fe-d678-4456-8ef1-425a325f509e", "value": "49152:JOMo8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8Mc:xo8UQw8MT8UQw8MT8UQw8MT8UQw8MT8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639474267, "uuid": "4762244c-6bb5-4ab6-abbd-de468cbdc19c", "value": 1781920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639474267, "uuid": "1d3b6232-49ec-4cdd-b5ea-8cc94f9b9f2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639474267, "uuid": "c9ef12ff-c90a-4851-bd7a-5d9d31c2e222", "value": "6.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5759a2ef-5ce6-11ec-96a4-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1639490491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490491, "uuid": "e5fdc123-79fa-4487-851c-9ede6a1f9c9e", "comment": "Malware payload (CobaltStrike)", "value": "b873bfa8dec8c3a1f62c30903e59e849", "object_relation": "md5", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490491, "uuid": "ec6f1691-0230-44ac-97f0-7f2d53cb65d4", "comment": "Malware payload (CobaltStrike)", "value": "fba9dd0ebb8d838fa394cda10dca50450d8c0fc6158deff38904072140d64507", "object_relation": "sha256", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490491, "uuid": "6e5ac6ad-7b92-47ae-8a09-402a1ec98fa9", "comment": "Malware payload (CobaltStrike)", "value": "2c4aaefe0c20843db9b9f4996d42c7563b081097", "object_relation": "sha1", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639490491, "uuid": "79baea5c-8ff1-4ba4-8bc0-43606ac718e5", "comment": "Malware payload (CobaltStrike)", "value": "ec63f6528f7ba5a42db74a586f97bc11998059f288ce8085b94c050db8dfdb76c6285aadb5391e051a54b8f094842f6b", "object_relation": "sha3-384", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490491, "uuid": "36fa1ab3-c2f0-4fd5-8e6d-40ebed1b82fe", "value": "T147742D09CF5DC2CBEED640B4DCAAB9CBD138DB924C9045F3BEA98D967C228395507E44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490491, "uuid": "55905ae4-3c08-45f7-bce8-780fccbe174f", "value": "bd51a645a9c68bd03b2e51586e5cbdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490491, "uuid": "ed9c5612-e565-4ac9-a4ba-9d10fb873e9e", "value": "6144:4GG9uLzUVA9S35rB9msFdC/6Oy6MpNahmawTxLUfq3e7BuXIYtEiwW4VpJQ9gHRa:lzQe5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639490491, "uuid": "6d9fea3a-d072-442e-862d-b7c751d7cef2", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639490491, "uuid": "d84455fd-4684-4f74-b51b-811a17ee7fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639490491, "uuid": "57a6a9ea-9c07-4066-94e9-900b7a97b456", "value": "oben32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92722f3e-5cf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639497892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497892, "uuid": "87271ad9-8cb0-4d8b-9b56-b158c7c7c170", "comment": "Malware payload (Mirai)", "value": "48aafc6c86072e093c686c578dc7e269", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497892, "uuid": "3cfa562a-49c2-49e5-8039-4174c7e76ba5", "comment": "Malware payload (Mirai)", "value": "fbca85114da5bc60d917ea3856ca62cd90ea800653a5f1d1c98ee94977181da7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497892, "uuid": "348aa636-56bd-43e5-a5f5-dce16e48f9c5", "comment": "Malware payload (Mirai)", "value": "da073ceca372205613e62e1513bf4788356413f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639497892, "uuid": "bcaa3c97-38c5-4708-a7c2-d98c018cbe64", "comment": "Malware payload (Mirai)", "value": "df30f960dd555617ff144c2d22550b1100cc5306ee2be30e5ec0ea240c174b7f5ed3fd0f572ea7b3948afc12368de35c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497892, "uuid": "07c5ce42-5441-44e2-b5b5-4cdf109a03f4", "value": "T160B34B4395A59FB3C192A97224BB69300716E9524F1F1B9972399BF8030F8DDB40FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497892, "uuid": "44d17fd0-5854-4ccc-bd2a-6b0c2e74af87", "value": "3072:xRChH4L42H/3Q58QDCltW2O/k4ImUf0q7GlOrsp:x5/O8qUW2OlImUf0q7GlOrsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639497892, "uuid": "f16a9afe-b69a-479e-98b3-0221733809b8", "value": 110674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639497892, "uuid": "cf9846e1-0036-48b3-864f-709c7e7ac943", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639497892, "uuid": "bc24a885-fbad-45ae-bef2-41b036a34637", "value": "48aafc6c86072e093c686c578dc7e269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3e8d6f-5cee-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639494177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494177, "uuid": "a950d122-1e3f-47af-8a37-9aa27c1c42ca", "comment": "Malware payload (Loki)", "value": "b26b45529faf97ce3c9c5d3e7e206d8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494177, "uuid": "85644053-566f-4171-a00e-a5da81b954ee", "comment": "Malware payload (Loki)", "value": "fefb2946d721f2f8149ce1291c33bbd13d31590c573d0b0d3838824a76327154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494177, "uuid": "1ed2ab3e-b8ca-4aff-a136-e33e42c267f2", "comment": "Malware payload (Loki)", "value": "261e6aa2232e15803c8a5d793c2202f47b1f51e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639494177, "uuid": "93862795-25b3-4ad0-8d25-ad427eee0aa2", "comment": "Malware payload (Loki)", "value": "0e0b02f213ad1c6f07acc9a88768f06cb68310a300fcb8b2acbdb24ee70b705c53dd93dd83e50ea5f1836655a86c841d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494177, "uuid": "bf158541-bf45-45d4-a4b7-24a9fdd6dd00", "value": "T170250254927C7F34D9BF5BFA98B4225A43FEA8033596D73A4D84B1CA2913780CF059A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494177, "uuid": "6762d97d-3126-49ba-9652-72ec16645d57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494177, "uuid": "f8c5b2a5-faf1-4d32-a594-e4ab76f0bfda", "value": "24576:IYREoBdODOyLd8C7dY1RBVW+7+t6D9s61huIk+ThTncd:WEaR8ChYvB5+s9jhuIttk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639494177, "uuid": "2b9df783-2d02-482c-9fc3-dd2c0f98d57d", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639494177, "uuid": "d7b01429-80ee-4122-9151-802d81f087fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639494177, "uuid": "e44ebde9-db95-430d-a5ec-a0b8d27abc6c", "value": "Dhl Documents Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a05bff3-5cca-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639478470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478470, "uuid": "d13638e1-41a4-42ab-85c4-b274b57c12c3", "comment": "Malware payload (RedLineStealer)", "value": "8e2e6e5de5bc8f91b66208969b4fc725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478470, "uuid": "0041f004-14b1-4102-8baf-8fb61677d1ae", "comment": "Malware payload (RedLineStealer)", "value": "ff521cb8bbcadcb1e47d60bf9620bf2e264b3daa29710826e46924349624f6ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478470, "uuid": "7a59b010-7dd3-4b99-998c-719bb71cfe7f", "comment": "Malware payload (RedLineStealer)", "value": "97a568e16e9df3f030df504aceab1990c8c2ebad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639478470, "uuid": "cf1b905c-77df-4816-bbf4-cb91e1039347", "comment": "Malware payload (RedLineStealer)", "value": "5a534fc350c7be64cbfa2b8cf24486061bdc62699d7afd52893ff25faa05b3de9f5e01557e27ccc6bcc19df5662641f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478470, "uuid": "214a4cd4-5b56-4985-8227-cc45a9226d20", "value": "T1F194CF00B7E0C034F6B352F549B9A3BDA93F7AE11B6895CB12C516EA5A746E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478470, "uuid": "b15f36c7-d092-4426-b29a-58c47291b58d", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478470, "uuid": "588aeea5-d11a-41ac-ba2a-d4d0f60d3af3", "value": "6144:ej8hPMxoVOypQXfFgMrSnRWcMiKLliVXHKZ1F5B3tEdqV6CrwYpr:k8hkmbpQTORdMiWlmKZ1FvtEdqpMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639478470, "uuid": "30272999-98d8-4de7-8e3e-3b872d4fe5d9", "value": 420392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639478470, "uuid": "9192a743-bfdd-44a7-8364-a9ecdc94e13e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639478470, "uuid": "592d9816-7769-4104-aff0-102a4e5a4f7b", "value": "8e2e6e5de5bc8f91b66208969b4fc725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }