{ "Event": { "published": true, "date": "2023-07-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-28", "timestamp": 1690588981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0ac29ef9-95f3-4650-96ad-2d713c1ade0e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0ab955-2d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690550839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550839, "uuid": "88bd399e-3b58-48b1-a804-61f4d726e0f3", "comment": "Malware payload (Formbook)", "value": "5fa77a0ae7a8fc155d396867e33dbcce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550839, "uuid": "f08ec367-8651-4cf8-8d37-308fecf0d002", "comment": "Malware payload (Formbook)", "value": "01b671890aaefc4af8c91936da19e526f9b104c0a0db0b82734b3328359da0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550839, "uuid": "c6c48d76-240c-47dd-9ebc-57494d6bff50", "comment": "Malware payload (Formbook)", "value": "be9553d1b65e3a65cbc74ac5136389004fd0b40c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550839, "uuid": "81856667-5d81-4e8f-9e74-d20f9fc2cf35", "comment": "Malware payload (Formbook)", "value": "455869d4bbc048555ea942a80135af75d1bd30510c890edf5affba4ab7a99696177c18835929f5772f073e45d7b247dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550839, "uuid": "4bddc4b2-f39d-436c-8384-29902bca97e2", "value": "T1E8E4F051E26C1FABD43697F94822950447B2BB7E203DE24A1DF674CB11B2FD1094AF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550839, "uuid": "ed7d257e-4f35-4580-a60c-1af25f4b750f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550839, "uuid": "7e605182-ed43-4da3-b05d-97bc9667f9b3", "value": "12288:RHM+gjjWQFpcJIsqdshN6jAQcN0Wysjx5cB+QRRwjQLV2ZvJweUg:RHPgjjWepklqv5cyWys95c8QD+QLV2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690550839, "uuid": "8b8d482d-8e80-4703-ae76-6dd0381ba181", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690550839, "uuid": "7700ad0d-c0f2-41dc-95c2-89df7b0430fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550839, "uuid": "d2c239b4-f937-4ec4-aae6-3d237b9565a5", "value": "SecuriteInfo.com.Trojan.PackedNET.2211.24742.1161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf611ced-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529507, "uuid": "cf961033-8e10-4093-94fa-899a40c8036d", "comment": "Malware payload (Gozi)", "value": "d16b0dbeb4d43194cdfa8fcf1a36c567", "object_relation": "md5", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529507, "uuid": "63683617-881b-49ee-91c4-48b93a8e40fb", "comment": "Malware payload (Gozi)", "value": "02f384df8b7b3d9f050d7dc6f3308b95837f3fa854733095c04bcc687d11c442", "object_relation": "sha256", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529507, "uuid": "70652502-a680-477d-a518-57a03ce68fef", "comment": "Malware payload (Gozi)", "value": "814a0d381456910b05a14d08a0c7c7594f563756", "object_relation": "sha1", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529507, "uuid": "5ea9576e-92c7-40d6-8b5d-7812ddcdf510", "comment": "Malware payload (Gozi)", "value": "5d4baa28bf22a6affcff20c0011cf557e18663b0cbfe3ba75ccb75a51071363b3fdda20def0107c996e2ffc72f2942a2", "object_relation": "sha3-384", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529507, "uuid": "aeff65cd-a66c-44f3-ab5b-bbca28cefc39", "value": "T148251B593A8A333B4A02309B6ACA019D7F398D7D1316C090F55C4ABCB94DD2ED36A7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529507, "uuid": "3222d291-d8a9-46c8-bd11-7af767280a21", "value": "12288:xgyoCoACoSCoFCoRkVrOfzbGrYVYmKiwQL7////905Jjns0J:xgyoCoACoSCoFCoqVasugi305Jjns0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529507, "uuid": "1bba3f08-64cb-4bc8-beed-d29d76000e7d", "value": 969892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529507, "uuid": "44ee4cd1-7423-4c7e-8245-e7b5032c9719", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529507, "uuid": "78535b45-b5bb-4655-a904-ecb26a0cd3ae", "value": "Inv_7272023_from857222_403234.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2aaa2b5-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545350, "uuid": "67ab4a48-abc0-4170-9a4f-efd6f02a5e0d", "comment": "Malware payload (Mirai)", "value": "ec2b46ef7b6915c8c280d5b94125d6ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545350, "uuid": "567a4087-c569-4835-8c4f-1aba32c7312b", "comment": "Malware payload (Mirai)", "value": "0358e8b86d230465911485f5f53fd378dfcb06fdaf39bc7ba1d9505873767a24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545350, "uuid": "feacc080-da8e-4438-8842-99e28e85a7b5", "comment": "Malware payload (Mirai)", "value": "7178bda66f2c005ef021d42d956d95f7fb870b3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545350, "uuid": "ac783105-a91a-44eb-b661-67e28b9d8acc", "comment": "Malware payload (Mirai)", "value": "06474536a831d8e5a6ee020a736d59f93b6753ab806f68a089a2bcc5d2735b225f5712472af876a839b70fdd8e3e3264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545350, "uuid": "d502d747-0c99-4846-9f4b-4c4a0604b674", "value": "T11973F846B8828E12C9D413BFF96E018D332663A8D2DF7227DD105F547B8A86F0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545350, "uuid": "6fe2e0b7-6557-4285-8bca-355400d37597", "value": "1536:9qnyzrI5ctqXLhkO/11TVt83Q0Ds8+Bh9kuzTIYiJ0kX1RRO3nSI:Vtihn/1B83Qws8+B40kX1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545350, "uuid": "33131530-2e71-4ca0-9d7a-26acbfbf2da0", "value": 76436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545350, "uuid": "afa09d6c-5c3c-46db-b48e-caff29aa0ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545350, "uuid": "2bcf8947-6a69-4ad1-a6ca-79fe8ab22f1a", "value": "ec2b46ef7b6915c8c280d5b94125d6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e5bf43-2ce1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690505736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505736, "uuid": "18d3f3ca-9561-4c67-8c89-e1ddbf60dbb3", "comment": "Malware payload (RedLineStealer)", "value": "0f292f77a077453192e286db34b4bdb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505736, "uuid": "b48d5cdc-d2bb-48f3-8cc7-c7e00c3dfc4c", "comment": "Malware payload (RedLineStealer)", "value": "05255b2110134abc0fd1f36c356f48b13287fd7dd652c146d1a3e4fe4ad1e22c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505736, "uuid": "0405bdf0-d38b-4828-9866-a5ac4480558e", "comment": "Malware payload (RedLineStealer)", "value": "1e11082ba9abf1d3bac593d3e19d7779383cd25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505736, "uuid": "51f52d4b-3d45-4b79-b81d-97a678db68ac", "comment": "Malware payload (RedLineStealer)", "value": "8f15ca4ec7328909dc3b3c25ab6b899e7f485f84651f1b684226019fb1ae43821ec96a8a6add5d5c02aa5d66ebfa1f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505736, "uuid": "70a19766-2024-44ae-8b1e-fe036670a304", "value": "T166935D1AA3DD8A24E67F0E707871111D43F1E8436412E78F4DC970EA2F66F88576A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505736, "uuid": "6c71e886-91c6-40eb-ba17-8e5d64a1aaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505736, "uuid": "76356fbe-080f-462e-a652-c0548af29c69", "value": "1536:QoTx9HNwDE1lDTN1QFzxMgwCrB/atqgdbibEB/l2k+oSGe:QoTxFPDTN1QBqgRJatvqEhfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690505736, "uuid": "bf409ebe-c9aa-460f-8dc6-aa966c09f893", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690505736, "uuid": "7d79dbd6-e1ee-461d-a381-cfa6f5b265fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505736, "uuid": "adc86d24-4e00-4719-97ce-7c7047ecf800", "value": "0f292f77a077453192e286db34b4bdb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d52e48-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690527615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527615, "uuid": "bda2db67-ee56-4a31-89d6-0d12a0e01b49", "comment": "Malware payload (Fabookie)", "value": "2ac37c808268006196caf1424e1e80de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527615, "uuid": "33496049-9e78-4df8-b429-83dabc6c8ccb", "comment": "Malware payload (Fabookie)", "value": "05dee9f4c380a68fc57d5c3786ecef75e96343c2ea4d1a6c3066581af973d37d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527615, "uuid": "ad9d2e8b-e0d7-47a3-b30d-d16387b06076", "comment": "Malware payload (Fabookie)", "value": "2150544c2360db3f75e5c54f403d439c932f4802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527615, "uuid": "727a9d5c-1db4-4d05-97bd-b390659f64e6", "comment": "Malware payload (Fabookie)", "value": "1848de26988d568000002eca099f66c84899a31017baff4079a9a0689b54d36a431f69c5ab6cef8e3a33e87b66eed90d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527615, "uuid": "757bc029-7989-4918-8710-c880e8947e44", "value": "T19E15CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527615, "uuid": "fd84d8e2-a670-4271-934f-a843f5167502", "value": "02bc376d1ae63a2fef892492d891a666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527615, "uuid": "d6583eec-43d2-49a0-bed0-02d11388a1e2", "value": "12288:kXGetS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:duS/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527615, "uuid": "dcd61366-adc9-42d0-b731-90c8e076c84e", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527615, "uuid": "e279d071-98f3-4087-9411-d5641e469b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527615, "uuid": "738f50c2-369d-4ff1-963a-193e82ad09b7", "value": "2ac37c808268006196caf1424e1e80de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f2413d-2d5e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690559481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559481, "uuid": "ce22a1f3-597e-4393-b615-a58d87f30b09", "comment": "Malware payload", "value": "e5655066c86f74f6b444f66f3222ce07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559481, "uuid": "3e67add1-fea9-4378-a489-f321c4b15c0d", "comment": "Malware payload", "value": "062de0a9fa284c56323ccaa5cf9b4a70801234b129744e1def53b29a7a86b8cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559481, "uuid": "a7c6f692-08f6-4e3e-b02a-e95a5f6fde20", "comment": "Malware payload", "value": "c9f8053202994ee734ecd76d09b56f57f539102e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559481, "uuid": "73b4c655-7589-4355-880f-c1dfa983c48a", "comment": "Malware payload", "value": "8d392d4da859e75ea20c8eeae954053bf71483f0eca29ee5e3341f18cdac3928fc1390d3b663b6fabbead40cbd660d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690559481, "uuid": "1d6329cb-4072-4e16-924e-950b736271a6", "value": "T130F38E02A7E84136E9F21BB05CFA13830B3A7CB2AF75836F2785559A1C72680D971777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690559481, "uuid": "f46f952c-c75f-4596-8d91-4ff955e29148", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690559481, "uuid": "4491a37e-ac8b-4a88-9907-94eee239e6d3", "value": "3072:5eFRQGCIIm1xn5GWp1icKAArDZz4N9GhbkrNEk4fH7YEqZuk8Ox:CQGCIImNp0yN90QE7fUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690559481, "uuid": "533aa6c8-87a6-4b92-91ae-8fd7eb876201", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690559481, "uuid": "55122215-9cd2-4a1b-b35b-c9487dd9e404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690559481, "uuid": "c3849b4f-44a2-4e25-a477-463238bd10d5", "value": "Tumeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1adb692-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545376, "uuid": "52e07fbc-98dd-4fd3-a5d4-096cfbd60b9e", "comment": "Malware payload (Mirai)", "value": "5990613d14e531edaabb38e839bd56b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545376, "uuid": "f1738a98-d068-4e0b-b0ed-72ae6d343213", "comment": "Malware payload (Mirai)", "value": "0734b52c751928dfbff7d2bbfc51b99b75bc32227625965fa1fd0dbb7a00c61c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545376, "uuid": "baf20b9d-8c99-466d-bc09-7526b1591637", "comment": "Malware payload (Mirai)", "value": "e310b5292a8693659d77b0fed2f2945274415f3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545376, "uuid": "e055a6f3-c42d-4a5a-91e1-2d9519d1314a", "comment": "Malware payload (Mirai)", "value": "ccb59f5ca1c9b76f73ece89fe3adece169d03fe395c99024cee0d857a90d5dd9086575f98320e028a918721451a403cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545376, "uuid": "1049b675-17bb-4707-b286-68566e74bbcd", "value": "T13483C71A6E258F6DFB69C73447F78E20924833962BD0C542E16CEE015E7038E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545376, "uuid": "53d8c23a-d81c-44c9-a039-1228e76b1b24", "value": "1536:pFjFFgWs67iOWFVxlJKRrvMeXxhBtv+58wKL5/cO3nSIJaK:pnmWs6RQCM+VwKLZ9aK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545376, "uuid": "07702034-375b-431f-8efe-e4ab57b33c7b", "value": 84184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545376, "uuid": "aea5ff7a-e87c-4e15-a557-914d4f4c665b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545376, "uuid": "521756d6-a2a6-4237-afb8-40ed2da12bcf", "value": "5990613d14e531edaabb38e839bd56b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fceb6c-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690534062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534062, "uuid": "a6df1011-6c3f-43a9-bd13-64c4654a49c4", "comment": "Malware payload", "value": "d18ef9ad1cbbc56046e93e388cc5d2c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534062, "uuid": "0debd048-f7cf-4426-bef3-95645621ac36", "comment": "Malware payload", "value": "07dcb5eb90f0d52a52154b496ef7a778532c7e535117be2a1af14f23ad7f5c33", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534062, "uuid": "e64bcae7-7b8a-4645-9f17-e5e1ad2ba939", "comment": "Malware payload", "value": "4b3f16b12d677c1a6ab587a293db5feb9d1d3dd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534062, "uuid": "57e7e3c8-4287-419f-ba0e-d4b34a523450", "comment": "Malware payload", "value": "dc8e9347fa6f7b3d276685d7747d796b9264578317ae64c5cf3efba039903cbdea214cde6676f3a54add2e8ac36aa835", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534062, "uuid": "816d4b61-fde4-4506-8b42-8d7fdcbc65f9", "value": "T19B63B407BF519FB7C81FCD7306B9871220CDB86722A4372A3570DA6CB65A58749E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534062, "uuid": "7a6ace8b-2ebf-436a-9f5e-0c6d8d91e3ea", "value": "1536:s8ygDZVrXHKHz4coWY7k2AI5BwBxk3IuXWyakKtCwfFXWz:UgDZVrXKgB7CtCwdXWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534062, "uuid": "8dc27707-9244-4bfe-b3c3-1fbb6f665042", "value": 69168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534062, "uuid": "fc42c1a4-066e-40b0-a093-4f5896798081", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534062, "uuid": "a66b2c65-3cb1-4b5b-ab6a-a6b994638c9c", "value": "loki.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28984da-2d15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690528143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528143, "uuid": "6f1db6d6-8a32-41de-bd92-0de75fe70aa1", "comment": "Malware payload (DarkCloud)", "value": "647f17f3cbca30359b98deb1ec7e6c18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528143, "uuid": "92fdf458-58fe-4ebf-bf6c-f787d66937b9", "comment": "Malware payload (DarkCloud)", "value": "084e6af7f798500eaf2e9f11ccce06d70cde7d1cd2b8c9c02846f58b5ccce973", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528143, "uuid": "e44c3760-5303-4610-b306-5c86a282fa69", "comment": "Malware payload (DarkCloud)", "value": "1134d88884bbe379557a3da2b1a4561d2cd713bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528143, "uuid": "bd2848e3-3679-40cd-bbaa-0f34daa63e5f", "comment": "Malware payload (DarkCloud)", "value": "4a4cc1d17bed7ac3aa673a630c3ef4b2b6d5c917597652e9cc4d4d53aa3a99f76601f43937e5457f864a237ab5844c1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528143, "uuid": "bc6301fa-784c-4a97-9ebc-6a134af7b4c8", "value": "T18125E013BEA17144E9A26A73083A51CC123A6E3E7ED4D61F181DF9DFCD3268E871161B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528143, "uuid": "92f3aba2-fbad-4eaf-bb95-6c1f8db458d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528143, "uuid": "0ca64525-bdf1-4354-9776-fb42a33a3a14", "value": "24576:+U7ypXGGf2xZ0dEp946+KAGsB0hblzm9:+SypWGImkm6+Fmhb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528143, "uuid": "619a9843-5aa4-4e1d-be76-6fa7e6184a4d", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528143, "uuid": "b79e680c-73db-4326-ad55-0467549c4a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528143, "uuid": "683c392e-044b-4a3f-827a-597d3ad03655", "value": "647f17f3cbca30359b98deb1ec7e6c18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8879db24-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690527241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527241, "uuid": "3fd5a3b4-8d84-416c-bf87-946dce8ad243", "comment": "Malware payload (AgentTesla)", "value": "9d4ab9e1099efea48258b596ee419ec9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527241, "uuid": "8bc48e34-a7ba-48d1-93ed-deda62f94d43", "comment": "Malware payload (AgentTesla)", "value": "08945f9a3a4f95a556e3ffef86bb051b11b67171063d04f73dfb8517fc935cff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527241, "uuid": "9b58e77a-aa3b-4826-8751-be8c6679c60b", "comment": "Malware payload (AgentTesla)", "value": "8c44373bd76ffefc6f04b7647a0988e3b4013e01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527241, "uuid": "c83f9f31-347c-4d9f-95d0-e023051748f4", "comment": "Malware payload (AgentTesla)", "value": "14c6173d2f84dd709432e94ac4d11567a5aa21ef6290268777538596d0d2dc0c62f59b4ac2add467f645840b0d45fd1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527241, "uuid": "f0d78ae9-0339-492e-8f32-f77544c0c81f", "value": "T10BF4E0512490B675C1897D37F5C6E53A476F1EB79A02C1C2E3797F823AA2D248F0392B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527241, "uuid": "82cd0cb7-f954-48b6-a1e3-563a20b6f952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527241, "uuid": "211e2d47-2b23-41ae-9450-e1f63baeed82", "value": "12288:0bO5aW8KELsnH3cpm+5ZDJwPRljfwyxN+kMks+bO5v0kkkkkkkkpkkkkkkkk9Z:qOo4WsH3cckZD6Pf4wMkZsoOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527241, "uuid": "a5da3b40-4543-425f-af6e-006f31403ba0", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527241, "uuid": "d2f13dda-5e6d-43df-9e5e-7fb286d096c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527241, "uuid": "0cbfdf81-4b08-427c-baab-943f953f42dd", "value": "dhl 6833295033_AWB_23199_2026-07-25 (21).Xlsx 6833295033_NPG_0235200266 doc.xz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3d09eb-2d69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690564075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690564075, "uuid": "81e9300c-b8cb-484c-bd0d-e3b35f64e10e", "comment": "Malware payload", "value": "b50cd2f74e75f3631e431f2e3cecbedb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690564075, "uuid": "d853e4b7-27ea-4872-9075-54e19a0c6205", "comment": "Malware payload", "value": "0989ef172876d348e22e0ef2aed952ab3b80c992b8ce6da18a267690aff1643f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690564075, "uuid": "54235b3f-9b7e-49d4-a701-041aaa5fad73", "comment": "Malware payload", "value": "ba6252a371d9facd847ad5f9d7b25c4e822a874c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690564075, "uuid": "90c0e0ed-48e5-4c24-ab2d-1e44c7e2cc78", "comment": "Malware payload", "value": "5430ba3af0a9d2607c934b2739041092ee2a6e53a93f3ad5e58c6f90a6cae06d31cde4ff1cfa531acf6a2c4220d3d208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690564075, "uuid": "06230dbc-b886-46c6-b178-eb7f947d75fe", "value": "T1C8F1C71127A88633C5630B328CB3578113BAB752A896CF2FB4C4516F7D962009AA37B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690564075, "uuid": "b1fa57da-9c83-485c-8bb4-d25cd740ee26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690564075, "uuid": "c843dc59-5e98-481e-80dc-5aeb2a87369d", "value": "96:ht2GfYvUB/B4/cpc4f/gzs+S56BRebj6JBzNt:hQGfwUB/B4/ca4f/ClS5IReqJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690564075, "uuid": "7aceeb51-523c-434f-9038-a3cbfc8205a0", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690564075, "uuid": "3ffabf92-93de-406b-8a01-aa342936e453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690564075, "uuid": "64cb075c-ea45-41c2-bfd6-f74e0bef7d2b", "value": "order100025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0ba4b6-2d0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690525500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525500, "uuid": "2305ffbd-bcc6-413f-b70a-e81ed347d6ad", "comment": "Malware payload (NetSupport)", "value": "963624004b28f220178980d65daf89b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525500, "uuid": "90836378-ebc4-4bd9-a2fa-84e4f2e7732f", "comment": "Malware payload (NetSupport)", "value": "09b92b2853051dabe5eb693f0aa5c268708b553c756f123755e66924e4f3a7af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525500, "uuid": "2799de6e-262d-470f-85ee-6960eda48a39", "comment": "Malware payload (NetSupport)", "value": "24cf0917df49d56f2449cecbf503ddec5974bd98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525500, "uuid": "a0cd192d-2bef-4954-bf0c-e955f8bf7fb0", "comment": "Malware payload (NetSupport)", "value": "f373cf15a989f3ef70031f2b663ca584991bd3d86e61bd18a053e64c49ea5e9e03eafa335eac38388f6eb199c6543470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525500, "uuid": "66325773-3ee0-49cf-bc6d-52bf5b55d5a7", "value": "T186061682A6D111A9D03781B4D6693356F93BF1DC1B288BC3AFB9844F43DAED466F9310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525500, "uuid": "a9e2388e-d8cc-497b-8329-b4b2e738f0f1", "value": "fe1147df2ee30051a844565381a6e079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525500, "uuid": "1e45ff32-72e8-422b-b121-416fef71ebb8", "value": "49152:KqrL4T4/oEdV18S/S/N3ImU1It9nY/Eahww:7rL543Uyt9Y/Eahv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690525500, "uuid": "afb6df75-d293-4123-9257-c5c54d0fa551", "value": 3893888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690525500, "uuid": "429a8347-1ff3-4f7c-8633-36f3a1d9196d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525500, "uuid": "b2fee948-2613-44cd-9050-d9715139888e", "value": "963624004b28f220178980d65daf89b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6856a1-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529477, "uuid": "6264b8e4-95b7-40f7-8e4c-19516d3a3f53", "comment": "Malware payload (Gozi)", "value": "3e38385510dde2641e544cd396874aeb", "object_relation": "md5", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529477, "uuid": "1885309f-e7c0-4aad-b516-a41bce4e4764", "comment": "Malware payload (Gozi)", "value": "09d47b7a8bfae1425d2cc0d20ebe950b649fafac6750d6d54e3fa78a9dfa90fe", "object_relation": "sha256", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529477, "uuid": "4a4dadc5-7502-41c4-87a4-b0028a071875", "comment": "Malware payload (Gozi)", "value": "21977046aeea697c3c3a59929b40f6e033c55f3f", "object_relation": "sha1", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529477, "uuid": "43cb87da-1a42-4db5-85a0-ffb2a43d6057", "comment": "Malware payload (Gozi)", "value": "aea4b81af37a5611c1ff44c1e82363a668d28a5ad936742fc3d10f183902daa745775bb4f1016b35a38beec2693174e5", "object_relation": "sha3-384", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529477, "uuid": "e9367482-3b7f-4c51-83cf-cf2212fa55cc", "value": "T10235F917374433370A5331926A5A52D9AF3DCC267311D060FA6C916C266DC78A3BAFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529477, "uuid": "e0080d8c-0e0e-4bf4-8415-438df5ff852b", "value": "24576:EuxQ15BLCJ3V04xV04Y3C0ooWXrr3zvDk63PvKcurKG5VVVOKNGThF+++f:EuxQ15BLCZV04xV04Y3C0ooWXrr3zvDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529477, "uuid": "10f21b75-a9d1-499c-8e2a-2fae5b287d98", "value": 1089555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529477, "uuid": "6e4fee0f-433e-42ea-b838-031a03c347c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529477, "uuid": "d0d10834-c03e-4425-999d-b6164b132a38", "value": "Inv_7272023_from637606_583358.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66ccd5f-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545357, "uuid": "7d07bd0b-3c56-456c-b83b-38f82d8b8b1d", "comment": "Malware payload (Mirai)", "value": "6ab803df62088ddc39005e204ebb24fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545357, "uuid": "7c1eaacf-cf4d-40d0-999a-e6f8c39b1619", "comment": "Malware payload (Mirai)", "value": "0bfb95207864c7496a8283cdcf3321231dc44a006290458f56c245077bced9bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545357, "uuid": "6ecdecee-7a47-490b-894a-a432f23c6d65", "comment": "Malware payload (Mirai)", "value": "5d5f85f6548cfbb0f2be3093b6ce348fc553b66f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545357, "uuid": "06e4b90b-9fd7-4f89-9e37-1832c3656cab", "comment": "Malware payload (Mirai)", "value": "c107b4acf8aabe3aca468751baf81c9271bdeb9b89e0bc8fc048c6a405a4d189fe326caac569491513e2525de596a9c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545357, "uuid": "aa0aabaa-1382-44a2-888a-1f92ba37ada5", "value": "T1EFD34C46EA818E13C4D5277ABAEF02493332A794D3DB730799185FB43F8665F0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545357, "uuid": "561d7f48-29dc-44d9-aa1e-608c27df2c53", "value": "3072:fsx3EO/HYedQI7pmyOoaC5srYQHo/SFl+fjf8M/9oyz:kxFPQII3oaC5sUao/kkfj0M/9oyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545357, "uuid": "7b20351e-ea18-4a8e-8072-196fda67f832", "value": 140414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545357, "uuid": "53bb5fdb-f2c2-439b-9e1e-548c624d7105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545357, "uuid": "38ae3ef1-2307-422f-997d-d677fee66158", "value": "6ab803df62088ddc39005e204ebb24fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a630a542-2cf6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690514835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514835, "uuid": "06d9e34e-3392-4c30-a643-4d4ae519c063", "comment": "Malware payload (AgentTesla)", "value": "b1fea49fb9fe79e409b21dd216f299ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514835, "uuid": "adff419d-fec6-4f24-b853-10635f27ff24", "comment": "Malware payload (AgentTesla)", "value": "0c1b251249518e1b58f3dc0cc771bf74bbadcb46c6175f45f1a0fe4d7740ca95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514835, "uuid": "a7b0b172-56f7-4fa3-b568-7a75222dc136", "comment": "Malware payload (AgentTesla)", "value": "f54cf02433383edac6f9af2f1205fde106221d6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514835, "uuid": "3594454f-c36a-4919-b251-334e34dd0612", "comment": "Malware payload (AgentTesla)", "value": "cd6ec3bc3e73936cab914e9bfdaf823cb836621ae53df843d68b9494ebbc707ec9c4bc56484e46f9b617598021c3cad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514835, "uuid": "3e33703e-7edc-48de-b8d4-09efbb3a2c24", "value": "T10ED4234071A8AF6EEB7CD7F505211509A775F4292893F2A49CC379CF6D9BB0C8698E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514835, "uuid": "d9cb005d-fe90-45e9-a86b-fc003165bee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514835, "uuid": "6ff08a9c-d47a-4c8f-ad61-46da151360a8", "value": "12288:KJIWq/hWt75TGmDHzsbFiMhHC/B1/k4C9I0D0rH/i2OR:izqy5XDIboMhi/B1/kN9I0Def", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690514835, "uuid": "a7feee7e-925f-4c7d-b63c-f0f9cb34d9be", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690514835, "uuid": "78318149-2a73-43b6-bd3e-158958b4a953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514835, "uuid": "abeac138-8b9e-411e-919b-bc299e9361c8", "value": "SecuriteInfo.com.Win32.PWSX-gen.18853.21905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc02055-2d63-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690561717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690561717, "uuid": "0a4917a2-6e1c-4393-9ab4-a2f78f086eb5", "comment": "Malware payload", "value": "9f8cf9891b742b3d0c528cc70c224138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690561717, "uuid": "39632eca-7276-4db6-b0a4-5f6815ef7bbf", "comment": "Malware payload", "value": "0d6b214da573ad0dddd2fc08ec4967edd5a1965b6525ed535117e3f3de1f87f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690561717, "uuid": "77581b92-79cd-45f3-bd78-348de0c99a53", "comment": "Malware payload", "value": "f73262c649ca8b016d8e249b202001c5dd3c5b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690561717, "uuid": "ab05d003-1978-41dd-947b-ec28e70d7e6d", "comment": "Malware payload", "value": "b4e39074b2222e71cd329afdcd421cc7f70ade06c1dd84cfde65c7ee292c55973d03b2171f824cad38476b95a3c9d635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690561717, "uuid": "35b0aded-efc7-4e58-b992-6f72ceaf472e", "value": "T16A15B4358A77120ADC2731A9391318726FD8FE08E1B8E7A5FF07866975E2020CD799F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690561717, "uuid": "30d50f42-bbca-418b-8b8a-1a5456d2abc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690561717, "uuid": "c7a941c6-3c21-42c5-9bdc-9df9cd522b66", "value": "24576:svgIpppupppppfyAIpppupppppfyFA7aqPrSfBCyt:sIlyAlyFsa0rsBCyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690561717, "uuid": "5fff37b6-d7a7-4bc8-9896-d8360125afbe", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690561717, "uuid": "4617e92a-f330-4ed9-8bb0-765e9c53f536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690561717, "uuid": "f6b2025b-3390-4034-a22a-36a1624b2861", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e67d0ed-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527492, "uuid": "df7eb00b-77ec-494c-8a6b-09d6adcdfe1f", "comment": "Malware payload", "value": "f15d921dc77df8f3b5aa3b5793d023b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527492, "uuid": "ad28d323-ba63-4083-92fc-147f0a2746ab", "comment": "Malware payload", "value": "0dc019ceef85c7146482cd0678960dbfb8a3b8d85a9fac5303eba04add54f466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527492, "uuid": "b3aeffa0-14e6-4523-b52f-459e3474a4f5", "comment": "Malware payload", "value": "64920d799e415185a1dd0cf079fa5dbd921078b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527492, "uuid": "0bfec4ef-ef52-4897-ab62-fd9a9a599d84", "comment": "Malware payload", "value": "767bbb1d6cfb18f8ffc21e4ffbc2450072019e635030930839f86b055c5a2197a84c63098de9c6b73eacb21f7c3a8880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527492, "uuid": "5a5d74a2-6633-485a-99ba-1c2bd14b214e", "value": "T14C752211B6C5C471CD6B083A1AF2A771BB3CBC211B658ADB57886F1E9F308C0A935767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527492, "uuid": "1081b545-147b-4081-9fde-95216feccc9a", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527492, "uuid": "41823387-afbb-4294-a062-8989c382ef06", "value": "24576:8cbD/e1EBapdxqhBsrwo4YSIp5UNVygdixFlG1TK44g9eyuwZjhocoVv+WTmQ:8cbi62dxqsrwDk551xL6RkyuIjhOrTmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527492, "uuid": "7f63b0a7-0689-4f3e-94e1-3fce09d379af", "value": 1692463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527492, "uuid": "1b71b34a-00a9-4c4f-b69f-fc0ce9562a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527492, "uuid": "146547ad-aa22-4f65-ae0d-2a8893a5f5b4", "value": "f15d921dc77df8f3b5aa3b5793d023b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00699c77-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690527012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527012, "uuid": "98188503-6f99-410e-8852-706e14618c93", "comment": "Malware payload (Loki)", "value": "8c024f6a91b5f22b3a2a3e67562adea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527012, "uuid": "429479d9-9e0c-4f85-addd-45facacb76e1", "comment": "Malware payload (Loki)", "value": "0edc218ce875571b4ad5323bf2f927e18f02d03a16b5778a4a2985b08a75af70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527012, "uuid": "8cac2158-65c7-424c-9fa0-ccea90a91d52", "comment": "Malware payload (Loki)", "value": "ecfcca35a74373dbab1126af1987e6f10ae315f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527012, "uuid": "ae4ff84d-c630-4abe-9340-2dd54f5102f5", "comment": "Malware payload (Loki)", "value": "2563aaedd999ee6a67ec1ff77168a2b2e1acc5c2276c0d31dd92709de789ae2ff4e7a3c36144d40aa53483d970df53e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527012, "uuid": "902476dc-76be-4111-96b9-67896b4eaa7f", "value": "T13BC4CF20B6B65208F9FA2BB2083751C012767A77AE14D71D2859EDCF8D32A8FC711767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527012, "uuid": "1c5b60b6-8571-49fd-a9a0-664931adc22a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527012, "uuid": "9b3fb61b-ab46-4bdd-89db-f16ae6dba913", "value": "12288:luJsLOXkUygUQIfkXnk/wXyytRPhLVX3klHpIomXNQKtc:UJ7ypLfakYtdhLVHWpbXKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527012, "uuid": "44d4fd0a-a614-4c80-bb39-16eb3ca8445d", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527012, "uuid": "dcda739e-f17c-4934-b86b-d2f36d279b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527012, "uuid": "39795265-b419-4ec2-8bfc-3c2149987910", "value": "20230727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0f0cb2-2d10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690526094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526094, "uuid": "fb20d3bb-b7e6-4071-9faa-1df7c5726ce3", "comment": "Malware payload (AgentTesla)", "value": "b05a728e263ab5e6336975819495b9f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526094, "uuid": "d8756a66-c632-4a40-b091-75c1af64e5c3", "comment": "Malware payload (AgentTesla)", "value": "0f249132a60bf6e772fc500ac0fe11a564feae9e738f29c40424f88ff5ba623f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526094, "uuid": "8f0f42dc-79b6-4f5e-ab6b-9d891503b62b", "comment": "Malware payload (AgentTesla)", "value": "2df15959039309ecf9d8c0864fdd0bc19a704d7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526094, "uuid": "c9e457a1-ea34-440d-9ab9-089f8b83b636", "comment": "Malware payload (AgentTesla)", "value": "9304843cf4871403c11c61f686ec8e19b972acbfc4755f88681b25be4d248b0fcbe870dbcea7ad81aa333cdfb6d4f1d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526094, "uuid": "125dbb89-9a2d-4881-8ccb-fcda5c458574", "value": "T1AC156DD1F15088DAED6B49F1AD2BA53024E77E9C54A4810C569EBB1B76F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526094, "uuid": "6df08bce-0bb1-4416-b4dc-0ed0879b21c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526094, "uuid": "4674356b-3358-4db9-ac52-445effe98dce", "value": "12288:dypk89pa57r0HgYqa8K/FaFmcH4+Krq9h2ZIafgseavLQsW:1L58As840Fmc99WgSvLQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526094, "uuid": "77bc6c5f-9b00-4228-8c42-16c0febf6d96", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526094, "uuid": "bfc698e2-112f-478a-9391-569a39df97e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526094, "uuid": "d53c0d21-70b4-4351-9397-0420c70367a2", "value": "PO_450027447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7742a2-2d44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690548217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548217, "uuid": "5323cd58-f440-4a61-857f-ed08fe03d958", "comment": "Malware payload (GuLoader)", "value": "5e8fe0f0a8973ff6341a390cf9c848f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548217, "uuid": "af0c5b80-7232-4463-9def-195869b5d101", "comment": "Malware payload (GuLoader)", "value": "0fc4fb7b5fcc297f013d08d158f759e444e7e41cf307ad27f04c5ec717bd8e74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548217, "uuid": "5f76f84f-5913-4796-8bd1-0e6f09401d76", "comment": "Malware payload (GuLoader)", "value": "9f2c6ec15fad795bcd537e901c5bf7b2fbb572a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548217, "uuid": "84945646-6094-4cbe-be71-4e6c0dbee6e9", "comment": "Malware payload (GuLoader)", "value": "b18394d165d46d2779213894cea0d457256fafdfa3bd7321b81984b81f2344ae0523e3343a3458b749546a851d885404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548217, "uuid": "3db3582a-caa9-4e6d-a3b6-40c1bb2d3cc1", "value": "T11A642342865494A7D8D50FB002355C8FDFD9AE4975FA694F8F143A3A3773793840EA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548217, "uuid": "ef3b719c-3eac-402d-9d03-ce08ba3f9d7f", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548217, "uuid": "457163cd-3ace-4c12-b571-71c0c51805c6", "value": "6144:dtZ92vYVUtx8mUZ/tvF2uc4OW80A6y08iikqSdyI4riOq9zJuu1tRt3LJpa9:FVc8bxtUt4xZqkqoHGq9Vh1tRJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690548217, "uuid": "0cfaba97-913d-4f02-8f31-8b54f94d6510", "value": 332088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690548217, "uuid": "9b4f02f7-4ebc-452b-b266-7aba26e8c88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548217, "uuid": "6acf737f-f463-4c15-9fcf-ec0b7f68d7c2", "value": "MV DESPINA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a312356f-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545324, "uuid": "eda4843c-2ac2-4edd-9536-32aafde0f69f", "comment": "Malware payload (Mirai)", "value": "94651b353ac47859cc8925d9fb82dbcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545324, "uuid": "0c3d4b02-66b2-416c-8b71-b178a985f74b", "comment": "Malware payload (Mirai)", "value": "10540aa029d8c2aac4bc7e13de474256638266a3bccca9e99bd4523662abb2a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545324, "uuid": "e04f07e3-4431-492b-90e6-d3f0e6059620", "comment": "Malware payload (Mirai)", "value": "ad2bd2439f7fd6e029f48d93c8981f45fc3e4827", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545324, "uuid": "5eb52fb4-1f86-4604-a75b-c0c28029c437", "comment": "Malware payload (Mirai)", "value": "e3902daa6563ca615a59ab9ecc1ca49ca15f96d573d9c07b65312fb9b08d745d72b2f62b99d685ada5e2e836f0786518", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545324, "uuid": "e97129ad-bd9b-465d-8633-512ca0cb6afc", "value": "T14E536C95B4019D3CFD6BFABED4150F09F620732821531E2BA6A6FCD36CB32A15D1AD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545324, "uuid": "6c58e1d4-6aea-4a0a-858d-ed1b77b1de48", "value": "1536:bEko7R+KhYz5RV6xJv7mDzuIdnQwzHBt6Bu87D:b87R+KhA5uyuAQAtQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545324, "uuid": "c1c96c54-1781-4955-9075-6fda7834ba64", "value": 65184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545324, "uuid": "0e0d834e-86eb-43ac-8e8e-2740dab66009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545324, "uuid": "f96ffbbb-5432-42e8-8127-8cf4ceb45038", "value": "94651b353ac47859cc8925d9fb82dbcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3291760e-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690526667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526667, "uuid": "feda47b7-b36a-4c5b-9218-03c8cbfb03dd", "comment": "Malware payload", "value": "a136f06b1d49177ae0b7919f4f8744da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526667, "uuid": "d5ca2a4d-021c-4952-9d9e-e88086e6d9fe", "comment": "Malware payload", "value": "10a729526820de154adf331c38dae17e17ebcd6b250d14897d14e5b687041049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526667, "uuid": "0b947da0-c90c-4809-909e-f9aa8ea9f873", "comment": "Malware payload", "value": "fafb601ed483edc0a01a4067af57d84a9a240699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526667, "uuid": "333a0610-4b14-402e-bec8-4e26e766930e", "comment": "Malware payload", "value": "aca8998d96de2e970f37464f8fbf551640495c92d70858301b8a26ae2e427ea92a0dd370e1365e1086b78ffcdee8af6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526667, "uuid": "847fe301-2a9f-4f22-a80c-c76a3dff68f6", "value": "T1C344E043E7D58432DDB827B058FB02831B35BCE19D78926B1782A95A1CB26C0B53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526667, "uuid": "c5e8199f-c4f1-4ba5-b381-d385a21e9a9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526667, "uuid": "e9abf276-2424-4d35-a6e3-52cfb6ab0874", "value": "6144:KKy+bnr+Lp0yN90QEgtkfmG3IgZCiD3PxWxpYD9Snbr:eMrTy90TugZCiD3gpYJSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526667, "uuid": "8bb7356a-dea3-4707-8433-4d24156ee0b1", "value": 261901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526667, "uuid": "63850dd9-62d9-43ae-b831-becaf2f9600e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526667, "uuid": "bf1d4e4c-8859-42ab-9cb9-425ab3a89449", "value": "a136f06b1d49177ae0b7919f4f8744da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee914b7-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690527547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527547, "uuid": "943902c8-90fc-44e5-85e3-22f0f450a67e", "comment": "Malware payload (Amadey)", "value": "aa9fdd26902f6a13d54043bc79296f89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527547, "uuid": "0e3a1f8c-25b6-4689-bd15-38ddba70d9c7", "comment": "Malware payload (Amadey)", "value": "10ad3fc951803aba12eafab7202e38d5daa7710653ff084479417311ab9b1df9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527547, "uuid": "c2b7a202-42ba-4c6d-93de-61877a23f14c", "comment": "Malware payload (Amadey)", "value": "a587ec95dad222f46c1b62cde9f12f617aced283", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527547, "uuid": "1b348864-68ec-4842-a7fe-058e7c17e96c", "comment": "Malware payload (Amadey)", "value": "ce4c0b012b39d9776f68fd952b953130863bbdc14f9e73904aeaad059f6223b037ac1934b07eb72dcf945c1396b8f4b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527547, "uuid": "5704e40b-a0e9-4a4d-aec8-1c2c3ea4e211", "value": "T182B41212F7C88033D4F5577009F613931B767CA2A9B8839727969D1E1CB26C8A5363BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527547, "uuid": "3a228d17-c887-489f-b123-ba66c2415e3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527547, "uuid": "de51a2d6-63ff-46e4-9cba-461f83890412", "value": "12288:aMrTy90pL9a4avnmwAMrqtPu8av4xUW65I2J0fioZlqnwkfp3mGY:JyVbnmuwPwSUWs1ugBfZ7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527547, "uuid": "37081c1f-e1bb-4659-96a9-4779efb2f19d", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527547, "uuid": "fdca9f47-c069-43b5-aac8-ea91976b4927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527547, "uuid": "63d7dcf4-4cad-4720-a045-344813d7a225", "value": "aa9fdd26902f6a13d54043bc79296f89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fabfcc0-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529427, "uuid": "231cb029-4bb0-4e62-8ec6-bc45e4439657", "comment": "Malware payload (Gozi)", "value": "c87d132f2636e4aa8300ba2c4c2d761d", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529427, "uuid": "2d2415dc-3f05-4b0c-956e-027dfe4d2468", "comment": "Malware payload (Gozi)", "value": "111f50eb98d75ea126683e965414fed165937aca19714a1c24e0859dadd61098", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529427, "uuid": "081c8ad7-6562-4271-8c85-76e8ed7d3607", "comment": "Malware payload (Gozi)", "value": "08fcc4cd6cbe2bc0d1897e4cd044ebe8c124218d", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529427, "uuid": "4e6bebb2-e031-4013-8753-c320cb8a4a51", "comment": "Malware payload (Gozi)", "value": "7e7977eeb1ced9035f22b4deff91181b02366e535ff1d1cf5bf7f3b4cecf4337f87cf4a35db2b3b59848a78c2b0c0c0d", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529427, "uuid": "725be2f1-9026-45ee-8259-8a4c15d53037", "value": "T13F03C04AA664ACE9C8D545B3C43B3945A7B8B13306C4B89C6C6C71CB3F0ADB5D9C69C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529427, "uuid": "d30594cc-022c-43b9-be99-3d94e36d5f24", "value": "768:hI5wm3Aid+woTuNDIZehmb4FYzolkOjA0L/il2yoXWLOnI+X2arJfx8Q:y53+w61ehmbjzek0Ol2yozIxarNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529427, "uuid": "b44f5a7c-a714-4337-866d-c4ba5c6fe7f2", "value": 38016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529427, "uuid": "f28a70ff-47e7-41d4-bae2-33640d79b97e", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529427, "uuid": "8b72c81d-ddd4-4dac-b2a0-2c4018606b86", "value": "Inv_1322_from_QNI Accounting_279047_17808.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0a46a1-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690539088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539088, "uuid": "1c385b26-f346-46ae-9ae9-5119634fd34c", "comment": "Malware payload (GuLoader)", "value": "e00fa4a46ae4ce2e40633009560f00d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539088, "uuid": "bedbef17-9576-4f37-a073-0c44b3101e2e", "comment": "Malware payload (GuLoader)", "value": "17f44197af3265a5b98e18579ac44f00fb90a1f82d22021ec29801e896414b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539088, "uuid": "6dcca393-99b8-4a45-bca3-19c5c49f7861", "comment": "Malware payload (GuLoader)", "value": "710a2f3a90e3ab9224a05cda4fba6224fb58b635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539088, "uuid": "e9a605a5-2c99-444c-ab9c-0f2f5586cfca", "comment": "Malware payload (GuLoader)", "value": "a6df25e70a7187c4a85bd865e9b6750c8a99b833e0a762d75285bf9ede945dbb3fada59e972881c12f5da3407301c6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539088, "uuid": "5731507f-f3bc-423e-baad-2ac9ac7a5081", "value": "T16EA4F107B510B295EC288132A56BDAC627407D26A3D46BE773E8A72631D3121D70FBED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539088, "uuid": "08016f1d-96f4-4763-91c4-7cf4b3959aa1", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539088, "uuid": "2dfbe523-4d93-44d5-9f2d-607f86aaf9da", "value": "6144:5gORaVB91674U+w/OlWpAxFvcYzbpq8thMh0iRaQF6bqAPqv5Ek:5ghtOb0pbpq8thMh03T5iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539088, "uuid": "a7b3deca-a5b5-4c8b-b773-a23b93e64feb", "value": 451568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539088, "uuid": "563ff906-5ecf-47d2-b5fb-6580a15db7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539088, "uuid": "0d5b3a30-9e0f-4a06-b69a-439c6916ab39", "value": "Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5ad8df-2d10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690526016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526016, "uuid": "c7b10f53-5e4a-4703-9279-4052a83362b0", "comment": "Malware payload (RemcosRAT)", "value": "2d03c51fa82bf249adfaab556ac3d08d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526016, "uuid": "64134dd0-4bb2-4108-86c7-c1e35173a2df", "comment": "Malware payload (RemcosRAT)", "value": "180f09c1346f69b5273a595bac15a705cf4a5d15b3699742baf292a5e81050ed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526016, "uuid": "9ced05fe-2527-43d2-b52e-6f6bef32e2ff", "comment": "Malware payload (RemcosRAT)", "value": "aec10abb64d4f9e2c11538adc0f94da340c724a5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526016, "uuid": "9f324ada-5a1a-4f06-9c08-de41aac8f484", "comment": "Malware payload (RemcosRAT)", "value": "9af204cd4fda7cbd40394bf4bd5af185d1479aae3648ffdb79803de54a2993e7e2d434a90b3d488319b5e877ed90a24f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526016, "uuid": "c65f78c7-05a2-4f68-b60b-6aa6999feeec", "value": "T13705017121A8272AFDA18BFC5ED714BA9B3391290492E7105EF1F1C79CA6B09C2D0D5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526016, "uuid": "ad609e00-b3b7-461a-ae6d-82b7b982a3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526016, "uuid": "2ee42b2d-a22a-488d-a8e7-9c97f39304aa", "value": "12288:/DexpPSzWUAPSzWUEeRNq0tnJQ6LQ9hIVNUyX5fnGzxOFNLu9qqV9r3ElqvoM:rerdUmdUDRR26MxyJGzx4pua0oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526016, "uuid": "76152e15-e92d-4287-862a-4b1d0ff4940b", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526016, "uuid": "1b71bfa3-0353-44dc-90e0-10830c1a1826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526016, "uuid": "cd12c92a-fd1c-4ed3-8266-3343e44d6b98", "value": "\uc9c0\ubd88 \uc0ac\ubcf8_ KebHana Bank_Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e18925-2cdb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690503312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690503312, "uuid": "4caebcf5-7a61-4bd8-9749-54d48a8fc3e5", "comment": "Malware payload (RedLineStealer)", "value": "7e80b843f2688e8c90f01cf12c52b5c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690503312, "uuid": "d4b8ec42-8ef3-4ff3-886b-227ba765dab4", "comment": "Malware payload (RedLineStealer)", "value": "1859dd196014b0f90a66bf735688f441dbb5dc83031cb64b7b16bb8e1ca367cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690503312, "uuid": "78f72752-a63a-42ee-8fe6-2bb3d15246db", "comment": "Malware payload (RedLineStealer)", "value": "e34cb4a74b3c077fa59cfc6cc450106e3faa37a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690503312, "uuid": "fe309657-ee45-4ee2-9b4f-bc836f3daef5", "comment": "Malware payload (RedLineStealer)", "value": "2d0b93d4153c6ed4a5df8266f1aee8ebb1fdf712726b8016c4f3899922fa734ffbdc5834f3b4455f0aa90f37d38169c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690503312, "uuid": "2b26024d-9b52-4164-8278-bf893156b265", "value": "T160740AE033845DDECD8E49F5652105E48A64D846E787FB937C8BA8F63E593887E083E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690503312, "uuid": "0997cf01-a048-4dd7-8c1d-1769ff6d4187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690503312, "uuid": "5c278fe9-afef-4488-811f-6d09f38b19bd", "value": "6144:x5qqEUWGXTgEFJb0DlPslmcY1lY1Y1l1XgGw1111Y11GY121hjw2s45Qvd9l1AN5:6qIGXTNJb0eH5Qvd9l12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690503312, "uuid": "8ddec516-a85c-4b5b-b35d-9d5aa363eb46", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690503312, "uuid": "8e37f91f-c4de-483c-bd0e-cd9a96b09f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690503312, "uuid": "08249f7c-2236-4d78-8c58-4e0684b7c6ab", "value": "1859dd196014b0f90a66bf735688f441dbb5dc83031cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2b8b25-2d1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690530899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530899, "uuid": "c30184a2-8020-40ee-8d6d-449026242241", "comment": "Malware payload (Formbook)", "value": "cfedb5392fe657e71351dbab3d64db48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530899, "uuid": "c8b5e508-3a63-452a-9910-134a0de0f82c", "comment": "Malware payload (Formbook)", "value": "1d0fa921b50a59a69562aacda33efa21e39c565d54bcf37cc55072519cf9fc5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530899, "uuid": "05995359-6287-4c0d-ab7b-0f2666c1e1ca", "comment": "Malware payload (Formbook)", "value": "2187ef583936d9ff941a6c3a0eedb08782efa55d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530899, "uuid": "14be925d-66eb-4b88-bac9-fadedd3b0060", "comment": "Malware payload (Formbook)", "value": "723b50d4614ec166ced9f1135a1ae5ddcbe355a7551d8db7c4776d646245b64ebbe958f6ec4bd2598bc37ad9752a45a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530899, "uuid": "7d8bc082-6326-4f5c-8e3c-90eebfdb373d", "value": "T122F4AEE0B7918154E8E35676483796D36133B62E9D18C61C2895FF8F7D3234F4223AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530899, "uuid": "ce9266b9-5749-4393-b15b-6da946fead7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530899, "uuid": "fcda89d0-6432-4ac5-81b6-af61ca694ff2", "value": "12288:snQsLOXkUygUP/rVXl8uJwgDc4aERuGscJSwzj+xMs6v5MLwACndAA:eQ7ypP/rVXl8ug6JS+j+Crv5NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690530899, "uuid": "493b1ee6-2375-4f9c-bae5-78e05bce4c51", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690530899, "uuid": "dad4234d-3ce4-4bc8-ae3b-5621b29575ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530899, "uuid": "850dd29a-08fb-4816-9218-faaa4862dda3", "value": "Invio proforma pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38988328-2d3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690544716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544716, "uuid": "85d9f820-f1f2-4960-bf13-c2093b8f62e3", "comment": "Malware payload", "value": "b742180f3ed7c1df9132bcdb8d08bc5d", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544716, "uuid": "860732e4-b73a-4be0-bda7-4811cb7ac478", "comment": "Malware payload", "value": "1e362a998af0a7d2691bc2a37b11619eb501c142389c571181ba12f99874576b", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544716, "uuid": "57a99f93-7556-45a1-b78d-8e994598caa0", "comment": "Malware payload", "value": "ba737c299db718eecab581e826602edc2d3e52ca", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544716, "uuid": "479645f6-1e56-44bb-b77c-405ec55922b8", "comment": "Malware payload", "value": "c370285c006fa86aea73ca08b0c0c6407f97cb7057892e06532703af1f6bd00cca296aa2e29ae9ea0a97c13fce3e5056", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690544716, "uuid": "bd367ffc-d568-4a18-828f-1078ca31734e", "value": "T11643C510B2DAD169E0765973CEE9D2DA3731BC25BD10831F30A0730E68768A18F66B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690544716, "uuid": "d29f8fae-c6ac-4ef2-9a5f-0714757452af", "value": "384:4httjEme3Dxvq4uDzxpGLc0zu7lz+qclFo39D:2QmwxazxpGSJz+qcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690544716, "uuid": "fa912d90-a7be-42c3-8e1e-3c0053a9f630", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690544716, "uuid": "c59a6da3-9e20-4789-ba4b-1a43f3bc6e21", "value": "application/vnd.ms-powerpoint", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690544716, "uuid": "81951235-83f9-4d1c-b9b0-a85d4514c7bb", "value": "Siparis TR68368 icin Hosgor Plastik Ambalaj San.Tic.Ltd.Sti.ppa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c0f2f6-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690539074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539074, "uuid": "d25cb120-e93f-4d48-a4f4-d6da0b78b5be", "comment": "Malware payload (AgentTesla)", "value": "054b59761c9afe5809282eec17fd7791", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539074, "uuid": "04911ce6-5cd2-41da-a66e-f63d2769aa5d", "comment": "Malware payload (AgentTesla)", "value": "1f1ab0f189106dcb2a60e16dd8b060ccdafbc3356c71ca69a7efeb4b180c66be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539074, "uuid": "16fa6c4d-41f6-4afd-a12c-60ef5518e5c3", "comment": "Malware payload (AgentTesla)", "value": "4b2747303ac12d80c6cc4eeb6debdca1c4d32f71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539074, "uuid": "af6c3650-2b24-46c4-a0d5-68a0fb040ee8", "comment": "Malware payload (AgentTesla)", "value": "b40e9528b098a3fb6567909c1a90e6605cb505f957510eb3e761ece620568fd82fa10a9d5920454a90be6aba6ef77339", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539074, "uuid": "ad3065c8-def1-46dd-8b4c-5d0663281113", "value": "T1DA3302A2933ED8D03B0278E5A5FE71F642E1441554F51D0B2FB43AC57A81329BC3F998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539074, "uuid": "dac3bb7e-529e-4cb3-bb38-9420472a0238", "value": "768:mcxJNYiw6zxRAsfesJqbBp+FAWsAHzzIsijIVudXDfRFKm0ze4pz:m6YinSROAWsATziMQdTrop1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539074, "uuid": "87b38125-f9fc-42d6-a437-59d5fcbc651a", "value": 53775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539074, "uuid": "9d5ec415-2789-4736-95a6-a544c577acf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539074, "uuid": "c6268019-d0dc-4f9b-8350-93975dd26897", "value": "ORDER216238068_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1951b545-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690539080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539080, "uuid": "a88783a6-e2f0-41a2-9ba6-c31aea23ae26", "comment": "Malware payload (AgentTesla)", "value": "e550de74355bfdd2068b82b922f05430", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539080, "uuid": "3cd0878e-fb26-4ace-a954-d505a520b061", "comment": "Malware payload (AgentTesla)", "value": "1f3c7beff0c3f2e7f7c21ae2ad886224c71a739c7554ba8f38aa3f9019ec48db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539080, "uuid": "07c2daaa-6946-4619-9063-695dccfeec62", "comment": "Malware payload (AgentTesla)", "value": "af3aad651377733d99fb1561ae2c3852c3cbf908", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539080, "uuid": "8b712434-c273-4ed4-86e1-9ce71497151b", "comment": "Malware payload (AgentTesla)", "value": "906b8378a92a4bf7f40052cd9669cecf80730e0b9713c9840e6d352c2ba5d1208819d9892f70e9086d9d9f5fdc1d7416", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539080, "uuid": "ef8c4221-07a7-4c1d-9dfb-2676dcbc0cbd", "value": "T138D4E090B2B91F6AD537E7FB1151621007FAAC6EA66DF31A5DC630DF22A1F004A01F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539080, "uuid": "dfc81aa3-ebff-4bb9-9885-950174a673e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539080, "uuid": "4ded6ca0-754a-47d3-abb5-a8f8914e9156", "value": "12288:irjQr5S2iNtOk90pYk7xXs6V3Vitbp7ksFKWBlBXVVIFo:ajQr5S1V0imsu+pN5BXLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539080, "uuid": "73962dc4-9c32-4f8d-b908-4b56232995a0", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539080, "uuid": "bc7ca404-9968-4e9f-8d1a-1f80fa929557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539080, "uuid": "a049a510-a541-4405-8178-94e1241a15d2", "value": "PO#000SJ-N03.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3859eb42-2d60-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690560178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560178, "uuid": "6bbb4a4c-e2be-48fa-9ee4-037d17bd75d9", "comment": "Malware payload", "value": "ace76e002879349e7cd45867f2ca5d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560178, "uuid": "0b9bad28-7e5b-4f68-9e58-e5cdd635700a", "comment": "Malware payload", "value": "20bef1b05ac0c6739b20331e333193c7443c487430b5ce388408875c0a937d39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560178, "uuid": "d4042bc7-b280-4c61-b2db-1ba4fbaa3408", "comment": "Malware payload", "value": "c3059a1e8b2f06faaf8243fa88dfcb682903ca6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560178, "uuid": "60229246-1d0e-46a0-a290-677b8960e607", "comment": "Malware payload", "value": "db044addd757d8d5070378133de152fe4d5c0c3b3e2564d617cb2792742ad05137442f7504bcd22cf0e66cf72d47dbc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690560178, "uuid": "ceac6a7d-5fe3-4da8-a5c5-03437b4bfaba", "value": "T16E35B67486771106DC2732B8392348316FD9BE18E0B4E7ADBF8B792A76F20118D359E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690560178, "uuid": "f04b1102-bfb7-4a34-b57e-efb040973f24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690560178, "uuid": "62b269ee-6dd3-4371-b634-4432ab5c716e", "value": "24576:ha8IpppupppppfyAIpppupppppfy2At8M9NWoHrZuvefJeap1q:hFlyAly24eUutaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690560178, "uuid": "30790c9c-d272-48c1-8fae-25e6d6d7b166", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690560178, "uuid": "676d7832-c44d-4948-9031-038298150ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690560178, "uuid": "478a6333-ea92-49cd-ae33-ab42225ab537", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0a51b2-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545317, "uuid": "358bdc9d-52dc-48b7-9bb0-caa9419ad3ff", "comment": "Malware payload (Mirai)", "value": "f7a7414c0f211e22a12c8045a816bc7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545317, "uuid": "10cbe75b-0f6c-4454-baab-6b7ab14717d3", "comment": "Malware payload (Mirai)", "value": "21e6bdfad34cee4a4d3e528b5776c404aa9e07d26c9bb224ee398ee5bd74bd07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545317, "uuid": "9538dee7-248f-4724-9d73-801a2d7d7334", "comment": "Malware payload (Mirai)", "value": "aa1d53f44a1e720bde2e41e521622a09a0752b5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545317, "uuid": "5b80b0a9-6a96-4db3-ae58-addd65f2b9e7", "comment": "Malware payload (Mirai)", "value": "09d514f14a0cf3796b09c120ddf12f9a96399ce0248a397b9306a4c7f0a4dc5fe7969eab95c203bb27731c4672534bd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545317, "uuid": "f375e0d1-98a0-4181-bb3e-2e318c9e8c27", "value": "T18D534B2172640747E3620AF0393F1BE183FBD55075F4B989A84FAB5A8275E336182EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545317, "uuid": "0ed1a589-65a1-44e6-be7a-7d051c12b10a", "value": "768:myHpwBXXB+3Go0gAstKU++FTph2kZUjRrfrD7bXWd5pYUAu+vH7sprPC3bWMnO32:CBXXi/UNPHQnYU+vItPC3bfnO3nSIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545317, "uuid": "e7d601fd-e7ae-4376-8095-edafb1c4e771", "value": 63280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545317, "uuid": "cddc74ac-86c3-4307-a809-4a8e7c563d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545317, "uuid": "fd6a2b8f-b3ee-4e79-a04f-c7bb8de86574", "value": "f7a7414c0f211e22a12c8045a816bc7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82d8e36-2d95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690583209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583209, "uuid": "f768ba25-1e56-4b55-accd-97580a5700e6", "comment": "Malware payload", "value": "0e4e30fe797e02f3f18892b24a6b3087", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583209, "uuid": "719b7b82-d115-42d3-a76f-d178b1707e3b", "comment": "Malware payload", "value": "22b037f0a42579b45530bed196dd2b47fd4d4dffb8daa2738581287932794954", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583209, "uuid": "b5328f23-71f3-4daf-88c2-55290480726a", "comment": "Malware payload", "value": "e4846460539e51e3e0f9398b8c215d5bc39e70fe", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583209, "uuid": "93b694e4-a9ee-4181-84db-ef2a69fce6cb", "comment": "Malware payload", "value": "855a82f1cb13e92319a5e445f956fee2fe9beb592b020dc8d4e2bf060357ac9f45427011abb6a2c30fcbe9e13f5c8aef", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583209, "uuid": "2d2c10bd-364a-40c8-9bff-57ec3b54034a", "value": "T16ED5A382B93DEC63FD9C38F0C886AD583C1D3E96A66F34AF357AF6599433910A640D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583209, "uuid": "b7cfffd3-fb81-484a-b9b2-d63e3ffaed04", "value": "24576:ITWA3VMNdRaQK29cult36t6p1F0s4gmoDKoV/A04HqRNCodot:T/9cufb19vPV/6W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690583209, "uuid": "e0f081d7-abbc-4479-a4b4-12a93ac42f10", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690583209, "uuid": "b21cf5ad-a5bb-40f2-849f-b4d50059bd0e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583209, "uuid": "64424357-5cac-4c34-aa87-0cb79ce3c100", "value": "Note2.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dac0b5-2cf6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690514838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514838, "uuid": "a5ccc144-b58d-4a98-b43a-3eb5810661fe", "comment": "Malware payload", "value": "def41920c4f309b50604d92a2e55940a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514838, "uuid": "f7d7259c-28e5-415f-829c-4c4fa4621e02", "comment": "Malware payload", "value": "24419d67f0b1684395c0b62e50d667cfef10412e17174f5bb6e6a8290041843e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514838, "uuid": "8c409fdf-9f13-48f6-a816-383c9ff4ab0c", "comment": "Malware payload", "value": "7395393443991eee74086bba81e7509208dc98fd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514838, "uuid": "5d5bdec9-9166-43c3-b32d-fe7db0896cde", "comment": "Malware payload", "value": "a77eac0b2d5809dfba08201e0b9a0a70893415eab5632176ff9a78722571a91e81c36be8c2a3bd1cc396e248a4142a72", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514838, "uuid": "76064b52-dfdd-47e9-bbaf-0fdcda77d2fa", "value": "T1B9E34B00A7C88DB6E1BF20B804B099315F797971A71F88EF97C15D6E4E28AC15E70D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514838, "uuid": "362c98fc-fd87-41da-8043-110062c73bdd", "value": "a2ecf7c2da4ac6acf191df9346749d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514838, "uuid": "b9d7f031-f5f3-4f98-9f4e-8e1fb0424a83", "value": "3072:pcmageaY6VApZNHSNP0mg7ZJXg7+esTJW+ZFBnjip4SLTEiJVeu09Y:pO6VqNHcMmg7ZJXK+eYJLFtjip4HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690514838, "uuid": "69f69c93-897b-4a14-8d4f-309e17f7544e", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690514838, "uuid": "c7129961-b7d7-4ad7-bfc2-41cdd9b9d26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514838, "uuid": "15b2bc00-00d0-4e17-98ac-9a5218c0580e", "value": "SecuriteInfo.com.Heur.13436.19207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb35d4a-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690527810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527810, "uuid": "8b83fac3-f3df-457e-83af-152c90370895", "comment": "Malware payload (Stealc)", "value": "e07874ac4f95b67e7663003031934259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527810, "uuid": "413f5ecb-9733-48ca-9051-13536fc20e0a", "comment": "Malware payload (Stealc)", "value": "24522c085bebb45e123704c16949e1c450acd159c91b67db7d60cb3e865c2252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527810, "uuid": "32f03ef0-3f68-4005-8244-343ef1ad51ff", "comment": "Malware payload (Stealc)", "value": "23efbc3c7dea6f35ff3c4754288d2d06bf071af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527810, "uuid": "f2ce3638-14e5-48a5-9927-2a6444d477ce", "comment": "Malware payload (Stealc)", "value": "8331ec25309f853d68b1bd7bcda367de61ac6502cbdab61dcfef31d203c3592dfa31e9afa5199a620b6967e41447674e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527810, "uuid": "b5aca9c8-73b8-4c8e-ab90-5f01b2a6d19b", "value": "T1FA644B5392E17C61E5264B328E2EC2E8361EF951CF1977EA22186E2F05B31F2C273751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527810, "uuid": "41124aea-f764-4ce9-811c-a829041ee414", "value": "b882663a63604a8f377b23a82216e7c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527810, "uuid": "adb08c9c-9a23-445b-9ff4-09fca91ee759", "value": "3072:XPLrg228vNbt/YWhW1ud1G7nwHEKsGxOan1P6Fli2IQDheGoFkcP+aO:fHZ2INp/1LrMnwHES71gIQDkFkct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527810, "uuid": "ce809aee-817c-49bb-b945-ae8c2cf9fc59", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527810, "uuid": "46cdba53-ac58-4385-86cf-97c1fc92cdc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527810, "uuid": "67d0623e-e39a-4759-b1bb-34205c2d0c36", "value": "e07874ac4f95b67e7663003031934259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df82036-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527626, "uuid": "3c3e0565-7cf6-4f0d-84e6-e9cad3c72b77", "comment": "Malware payload", "value": "4549173150ca7cc3754132dd82b99381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527626, "uuid": "fcaff166-f398-4e18-8ef8-6cbbd0c0a5d8", "comment": "Malware payload", "value": "257a8bfbee9b23fccc8b41b840532099a70199665d9b598c772cd0bf69ac90eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527626, "uuid": "7449fb99-19c3-4b32-853a-3779c5a02768", "comment": "Malware payload", "value": "7d7a9b78eda0dfc485efe889f96f7cca0bbe90f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527626, "uuid": "49259217-bcdb-47d0-a6cf-8097f4ef292d", "comment": "Malware payload", "value": "b2f38d0efe08732419f5def6451a2f3e0b09809da3f4bb9af265c9afd22c9a10edf642a1b62c93d385a1cf34f6358c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527626, "uuid": "81956726-6581-413e-af1b-4ac0fb038def", "value": "T14A34232FA8DA6471FFC4CEFB8275665A10826CD943FB894030CF759F9B04B84697D84A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527626, "uuid": "02c7dc4a-10b2-499d-b134-d51407d370e3", "value": "6144:0XX1u30WEySqIiyTt8U7uajerGlCp7kKBPQtTQi3+g69LlY:0XFukWEySqIiyTt8U7PjeVP8dkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527626, "uuid": "0b09be6c-ece2-4c20-b99c-8f9784c60eb9", "value": 237082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527626, "uuid": "68f5ddf6-8e32-4512-8f94-dedd5b3a35c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527626, "uuid": "51373a32-beed-489f-852a-d4ed1c65bf20", "value": "4549173150ca7cc3754132dd82b99381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff325cfc-2d29-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690536889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536889, "uuid": "b0104e66-d805-4de4-b0e5-9807ead8d2b4", "comment": "Malware payload", "value": "5d4d83a35a65c815d4f12909fce1e776", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536889, "uuid": "e86307d3-5673-471b-a560-113484498cf5", "comment": "Malware payload", "value": "26d7ee8aebd776c43512559380308b835786b07a16b06bf10711e169804011a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536889, "uuid": "4fadb197-402f-46f3-a5e8-366c5ceb0907", "comment": "Malware payload", "value": "85ea7e46d40612c1ddf87fd6b3cadcefc8cb311b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536889, "uuid": "fb50ab23-1dd6-4394-8bbf-13670afb5665", "comment": "Malware payload", "value": "a07ade9db886a644c1316ed1c2e881bd27ea26aa8cd797790fe211e8d0f667f80725c80a21528748e71f1eae9f6e29bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536889, "uuid": "c62cc58f-24b7-407e-8905-4d4defc62142", "value": "T108133A939A564F07D14B96F062B14E711B62FD39495B0FBE3360EAE88143DC8F58A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536889, "uuid": "7ac989eb-96be-49ac-b690-ab2d1602ebb9", "value": "768:hGzGuOpNh2BU2gYofHbttKC/hraU2zTFFf78oCLI:heGppSevHKC/hGU2bbCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690536889, "uuid": "ba4f3a99-5923-4f6f-9d5a-820189316d45", "value": 45128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690536889, "uuid": "1963c22d-be51-44cb-b35a-ec1d189a3961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536889, "uuid": "290089eb-8f76-450c-ad58-f69020a54b87", "value": "5d4d83a35a65c815d4f12909fce1e776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e8f87e-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690526725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526725, "uuid": "24f5dc93-b798-4897-afc2-ca4e6b92cc6a", "comment": "Malware payload", "value": "df9239abe1eb792eb69c805ff08984e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526725, "uuid": "f1c5512e-c265-4708-adc3-77b1169097e7", "comment": "Malware payload", "value": "27c45dbf28feac97fda4278ee96465a57cdd8a5fe984c8a976574a95e60989c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526725, "uuid": "e3057135-4928-49db-af7e-d023b469698d", "comment": "Malware payload", "value": "dae74414a104e9b4ee3dbcda723243e5a8d5e82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526725, "uuid": "8692b553-9ac6-4ebc-a97d-3dde6ae77416", "comment": "Malware payload", "value": "0b2213e89cf0857212a9385ef77a4cb556af7a634958a8cd722cdd8a2ec6efe7a25e5e8b6b8e534fd9049a4f9cfd175d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526725, "uuid": "ab6fb7e6-88f3-4a53-8ca4-7f3024b68af0", "value": "T140838C3171D0D073C0A3663055B4C6E22F7E293227B5A9CB5B68293A7FA07D0673939E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526725, "uuid": "22723dbe-1382-4879-a7ac-284a255591ed", "value": "1536:EESs5FicjoLt2PMDI4UwnEILSK6RwYEC4JfnH8Aknhw:pX5FLoLQr4hnDuLECeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526725, "uuid": "386d9448-aea5-414b-a4c1-3c7fa6718b08", "value": 88638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526725, "uuid": "8a5e8b6a-d03d-4f24-93e0-50bbf9a29c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526725, "uuid": "ec5e8c6c-89dc-4cba-9ca4-71e9ec36e099", "value": "df9239abe1eb792eb69c805ff08984e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3b0d67-2d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690550817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550817, "uuid": "a0b0a5cb-f4f0-4f40-bbc9-15bf06450c99", "comment": "Malware payload", "value": "80b326f4a0a143972a8cf5915c42362b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550817, "uuid": "b504c723-4127-4b3e-bd25-311e81339aa9", "comment": "Malware payload", "value": "27e25babc7f132e6ad8c1e8eaf80d13f2dc973be112f826844134223900a661a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550817, "uuid": "96911429-9812-4e5f-938c-c13437cf6cd2", "comment": "Malware payload", "value": "2bd6b51a81b3cac6b3b2da60bea6bba06d2a0af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550817, "uuid": "1de4cd74-a026-4ee9-bc09-0f16af6dab76", "comment": "Malware payload", "value": "4ebc56ebc90b64ee165f4a750fcfd7eb305f550deba8e02d5a03f4e9f7ccebec1f4e396fe723865ce5a28f27eab6c0c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550817, "uuid": "8eba991f-77ed-41e4-99dc-379c4335a4bc", "value": "T142F1C72023E89637D5624B315D7397800379F756D5AACF2FE884215F6DB620087937B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550817, "uuid": "88f7e972-da4f-4513-b289-2e4e22503ab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550817, "uuid": "243cb7c6-9fba-497e-8eb5-8e98501970a5", "value": "96:iU7q0dGfw1vfK/B4NwiR4bEb8jEXHQv3JOfzNt:hVGfwVC/B4NxR4bEb8jMQvsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690550817, "uuid": "2a94aab2-7658-4562-8a56-259ec995e988", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690550817, "uuid": "71ae0198-8a06-40aa-8972-f31c3dcd7538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550817, "uuid": "f7527c9b-e255-4908-90d5-ad5d0329e814", "value": "PAGO DE FACTURA PENDIENTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f43dda4-2d44-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690548324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548324, "uuid": "4c2fc6ca-cef2-4ac3-a969-25b9d6712250", "comment": "Malware payload", "value": "1f3623270824a4cf9e03d0efce211e2c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548324, "uuid": "be67e29c-371f-4801-a2b1-7f03be2605fa", "comment": "Malware payload", "value": "2ca709940eafaedc9003fae388fae466824b03a387ba387643298b0925cda3d8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548324, "uuid": "cb0910f4-62c7-4474-bcd4-ac29fa9df7a3", "comment": "Malware payload", "value": "03ab2272600b43748b61a38f4844add1357a0418", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548324, "uuid": "b15921dc-e630-495f-a1bc-69a5784818bf", "comment": "Malware payload", "value": "148b6b52ead0ca23519b2671db6c7474b6f4bf522e98c23dcfa09faeef48dfa98a8641eb4fba63cc42e859721e441a5e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548324, "uuid": "5802d4df-afd1-4113-98db-9f8d5628545e", "value": "T169F4233CCE8FCF158DEDA66F8B9A8F358F9594E161206704E548EE580DB78C84C2C957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548324, "uuid": "f8b17e85-6941-42f0-8b9a-e27436dec2ae", "value": "12288:330OkzxoEUmGcbt/v3iOWjnjT/Ql4nJSbSG9sdpneHLBOzRpYq8PTIPzNwl2cWzm:3HkzxxUmnSO2nn/nJSAzne8T3eTwlzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690548324, "uuid": "ea7c2418-68be-431c-a8b4-04a934cd122f", "value": 764922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690548324, "uuid": "c5b1a84c-2ede-43cd-9e8f-250c1f82e184", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548324, "uuid": "fc9ef6b6-3ba0-4152-b267-ce209c59f7b3", "value": "pago dettalles.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37306fb-2d5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690559928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559928, "uuid": "93c86ce4-f16d-4c89-884f-c051c1ae0133", "comment": "Malware payload", "value": "6fd336e404c820cea27c1ab6f627189c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559928, "uuid": "5731d9ec-bfa0-4589-86ef-abb9a3c7193d", "comment": "Malware payload", "value": "2e5731639e0f5eed877b8a6efc4f765e0afcf1065f5046f963abcc9df818a163", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559928, "uuid": "02db9cba-3928-41f3-97ad-694098a84153", "comment": "Malware payload", "value": "f3762bd54aabdf45b086ff6da85aa4fa04a183be", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690559928, "uuid": "3da6771d-3c17-4002-8062-3a01ea8d04dd", "comment": "Malware payload", "value": "216ee93abb4f8d7fd11aca37d12e0119d0ae51a7baa4016f84070097a25f2dababa21b79bacd95244927384f721ad8ec", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690559928, "uuid": "cb316a73-62d9-42df-ae98-9243e6322e7e", "value": "T19E13BC41BD078312466258B0951D2D40F3A962EED732CBB461D6282C5C2B779F2FEBCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690559928, "uuid": "2658e19a-ac96-4851-bc0c-729ccddf43ee", "value": "768:58RhJLWEE08AxPzjc5O9tKVA2BCielbMq6ii5qHxAx7K5OpKVA4BHnKbK63Vgjg:589jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690559928, "uuid": "5c82b494-df4e-4580-961e-283535dda3ca", "value": 44977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690559928, "uuid": "a6637239-db32-48e3-a7f4-82fc4763c5fd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690559928, "uuid": "16de3508-9d06-4d4e-96c3-95d7f4b4c8b0", "value": "Tumeg.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc4fbcd-2d9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690585849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585849, "uuid": "61c8b70b-b8aa-4e6f-9455-73225352dee3", "comment": "Malware payload", "value": "642dbe8b752b0dc735e9422d903e0e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedEnergy", "colour": "#72C45C", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585849, "uuid": "3d4a5dee-9bcc-4541-b3cd-65ec2a439beb", "comment": "Malware payload", "value": "2f489f6462ba4887dee89aa32aad464d5933dc3f4913ec55456e13b28fc3c01f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedEnergy", "colour": "#72C45C", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585849, "uuid": "31f0b23a-76f4-4d86-a51c-59a6e2f9e1bf", "comment": "Malware payload", "value": "df40a22f138548f4af363766eec48a4ea8b11faf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedEnergy", "colour": "#72C45C", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585849, "uuid": "4b044e82-f4af-473a-a362-137aeba6eb27", "comment": "Malware payload", "value": "0142e900f26b328488612a22e5b90ac3b6e42c9b7ce91490097a44a6d3dd6aaec91d3d47a59c9908914c472815fe062e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedEnergy", "colour": "#72C45C", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690585849, "uuid": "a0391203-e56f-462a-95c8-c437a7333067", "value": "T15875196335062D61E3DA2373418BFF00C3A014A626A5F75D381742DA7A49F85BDCBBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690585849, "uuid": "5bb9c513-686f-4b11-b330-3d298343ff15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690585849, "uuid": "8f389306-72a7-4ad1-b661-11ff4ebeea16", "value": "24576:bqox8c7Yx8x6obU8aLU471k60BQN9XC43pXubp0ZYC:ua8c7YebU8MN7vUv4po/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690585849, "uuid": "f2e09095-5431-4227-adda-13d681e96fde", "value": 1689600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690585849, "uuid": "b0f29ab5-40a2-4eba-a32d-04e7c3454661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690585849, "uuid": "bef52053-af7b-4905-a677-e342a70dbdb1", "value": "2f489f6462ba4887dee89aa32aad464d5933dc3f4913ec55456e13b28fc3c01f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92061e56-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690527257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527257, "uuid": "9d480015-5105-449f-a1f8-6059dfeed443", "comment": "Malware payload (Formbook)", "value": "2dfdddce0907a7f754c7dfea7cb3de00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527257, "uuid": "e5e64625-8778-49f6-ae49-bf6bc6e32135", "comment": "Malware payload (Formbook)", "value": "2f4e4ad21cf764b8c109f7dd4ac1e328fb144ad3fd91d692fe1f992f236ee540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527257, "uuid": "0d322529-a853-4181-bc3f-a4cbdee0af06", "comment": "Malware payload (Formbook)", "value": "abe6b0e8e64e82b355c499c32598c79ee399e26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527257, "uuid": "fa298616-2cad-4f53-b807-7eee78f2729f", "comment": "Malware payload (Formbook)", "value": "d2d5f78d996140f8bd85cf5218c0cfc3ebe19eb37a97921d834461484536ae192d283d78e9e35bc6c098c938162ac1f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527257, "uuid": "837b3d9c-88d4-4e8c-89fb-680e1ff946d4", "value": "T1AEE412112CE2093BC4794BB64861961C37F9BA6A37D4FB18F89C58943D7732D420BE7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527257, "uuid": "e2a34855-1c06-460d-bf3c-f8554eff754b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527257, "uuid": "d79f7220-7591-43f3-b0f2-93529e54ae51", "value": "12288:cbO5DbO5Clr8IQIuG7EsAhE6FVzTtjyOrKqgHebypgPUesuvHjhKlMFH:COJOgs9GIsvuJ1yO7Oe1UduvHg6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527257, "uuid": "f49104c0-cfda-4eb0-9940-ee157c4aa3bf", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527257, "uuid": "0550b41c-86ae-4236-82f6-3115e1147714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527257, "uuid": "f60e7d6f-e1e1-4e0b-a4d1-518eddb27ae5", "value": "Ko\u00e7 Holding.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc2ed59-2d52-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690554231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554231, "uuid": "f14d8886-0139-4ae3-97ac-d49adf0612a0", "comment": "Malware payload", "value": "d3c5d0eb39ecd5556bb6be4cb7715a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554231, "uuid": "a4bc893a-42ea-4e81-8dcc-7ca3c67f9699", "comment": "Malware payload", "value": "2f911c0863786dbaa96e2f7c228dc9c143e1f3209c2a29128e6ec56a8c0f8fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554231, "uuid": "730eb0f0-0c6d-4d70-8bfd-a6699e802725", "comment": "Malware payload", "value": "4e59f647e42f4f23406b563523b220b47d79c281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554231, "uuid": "d0d5d056-6d36-47a3-a6e6-6451211b7a20", "comment": "Malware payload", "value": "9ebcae7b68996caa2ce3e451f8426579370ad3e0eabbd3ebfb8279af6cf95aaa78ee43aa67400add5a1e487e8b0cc449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554231, "uuid": "29d03c97-6c46-4df9-b032-36e945cf14b2", "value": "T15BE4E061F6280F9BD976A7FA0825E10457F2B76B113CE70A5CF6B4CB2172BC10A46E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554231, "uuid": "a6ad5eef-a3c7-4c1b-b48e-0d49af59be4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554231, "uuid": "a7a5e456-114e-4482-acd5-b5637124f44f", "value": "12288:/CgjjqSrSVSDqenUwnw/aN51Q9LbpfTcYmEPcWJiqQIK:/Cgjjr+oeeU8L1qRcYzPcWIqQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690554231, "uuid": "9097895d-29f0-442b-a543-0fe0e54b4734", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690554231, "uuid": "a796526f-6b1f-4836-82a9-2e7b0c919452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554231, "uuid": "28bc9926-b8d0-452f-9b77-9d19680ef3d2", "value": "Sygnet Order 28-07-23__PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183d81bd-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690539078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539078, "uuid": "48b7e9fe-4e68-4ac5-b20f-906893e37d13", "comment": "Malware payload (AgentTesla)", "value": "2b89f858b82b77f1abd91f3dc030ce32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539078, "uuid": "67d8c65d-0e6c-4593-a172-f865fb66f6fd", "comment": "Malware payload (AgentTesla)", "value": "31674e8a01124e27202229cef6640e6fd1b48c1872053d4b97fd60f828ab9861", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539078, "uuid": "55c738ae-07f9-490e-9546-507d87d066e2", "comment": "Malware payload (AgentTesla)", "value": "fad6d08f938c9b2e53c929a6fa017557ab09741b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539078, "uuid": "6490ac35-0b40-4527-be43-5e9e00afd1c4", "comment": "Malware payload (AgentTesla)", "value": "575392a21081cb334a5847b292b110cf3093c81872865fe977cabe418b4bc4f0532334dd1f1f7220cf2f18c640cd88b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539078, "uuid": "a7ef260f-77d8-427d-a0c7-5876173a6dd9", "value": "T115C4230E515C61649207821BE1C470E4EB199CDB1FAAF35A63E80C27E62708DFD74BBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539078, "uuid": "adf696d6-47b9-4092-9dc2-e7f71fb0a96e", "value": "12288:dVkuLCYKEvBlXINzuXPJGh2rZ4pt9eo5QnmAOYJqJ:bTZlYNzaPu2deTTqmAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539078, "uuid": "638fd751-c35c-404a-806e-d2db49192610", "value": 560528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539078, "uuid": "a5f67c48-8e30-4074-85ae-4b7360d92c45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539078, "uuid": "8e5c9beb-a53f-4890-a419-2d0844c742a6", "value": "PO#000SJ-N03.pdf_1.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b47ea2-2d4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690551442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551442, "uuid": "cccc2fce-da28-4c75-be72-b8de4e73830b", "comment": "Malware payload", "value": "e6b47bbbcd79f04558daf7e1c86b2bc8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551442, "uuid": "108e754f-c42c-4a45-863a-14dc46bfbb56", "comment": "Malware payload", "value": "3255372b4f1ba6ab2999f1e4e488aab81adfce46e5f728dbd0749400f3d1a7ae", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551442, "uuid": "5e6e134a-1a14-434a-aeea-a5bc4b88033a", "comment": "Malware payload", "value": "8ddaf49858a371111eee0d5d5d77a55755e733cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551442, "uuid": "3416b70f-4c06-4389-b9c0-2d8a990e9740", "comment": "Malware payload", "value": "13576a2885a5b464c38fb113b17edca3fdf6bcce67f053eb4f7e2397dc1a79c709f20cacb9d7079f7625a81f75842942", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551442, "uuid": "6038d341-d065-44d0-a560-ff32fd7e7085", "value": "T13AF2AF628141490FD3624E35810F710CF3A9EE17B51773A7B9B18D9D8CAF5DA2FA0A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551442, "uuid": "7dbc3c93-24e2-4164-8b78-6cce9df909db", "value": "768:fI4a5f4ZyQlFkA/tIgglgUS/n4O6AlfiAd/368R00dNDfiA34O6ZfiAWq4O6n/fg:f7w064tIRyn4wKSd003Ki4bKdq4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690551442, "uuid": "a92d3869-eb98-4354-83f9-2f4539be29d0", "value": 36195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690551442, "uuid": "a91d1d46-155b-4af3-b756-0e169f4951b1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551442, "uuid": "177c0180-3785-41e7-9be2-e044e6d9d75a", "value": "inv.0886526374000.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c29a3ac-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527489, "uuid": "0d505594-41ab-46f9-baa3-e12654974e82", "comment": "Malware payload", "value": "f31a9e26a0ca519bb58d9048786f1c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527489, "uuid": "ba4cda77-1f74-4189-88d6-732280303997", "comment": "Malware payload", "value": "338a876bea8fbeac2adb46df8f67ba1adbbbbf4e5536deffece8f8fbc0d56e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527489, "uuid": "ac11dd85-68a5-4416-bffe-79ab3317da6a", "comment": "Malware payload", "value": "09c8f8fd95095023fc99ef2155b1ff19e1b3225e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527489, "uuid": "64d9e264-c2a1-4fc0-a6e5-10b33c4bbb85", "comment": "Malware payload", "value": "428c620c63e85064f83ae0d8592817788984f302ec60a170aeded345991474328b2844c069ebd03eadb22b3553e3a6d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527489, "uuid": "b264921a-2c34-438c-8bca-876796734327", "value": "T1CD04231E2CEABBE4F0E774F51506B2B8A21710F079DDA60843AD7C9607B6FD14B11A2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527489, "uuid": "033bcbc8-93bd-491e-ac93-55e268ff0079", "value": "3072:3IwVNpYkXQff1pA6g4je4tDr3qEhRpIetfVuSglI8s727ZDh4Mz1Dui5jPx484vK:XmkXQftpXg54xr3qEhPtwDewh4Mz1DuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527489, "uuid": "41a6f82d-21b0-4f56-89ae-8aec88f8afd2", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527489, "uuid": "9cd9979f-1811-4476-aa76-347de6a51151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527489, "uuid": "ab5009e4-5771-4cd4-8c0d-7999f6a00ded", "value": "f31a9e26a0ca519bb58d9048786f1c28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25126605-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527503, "uuid": "7d7573fd-867b-4688-88a4-e89275e72120", "comment": "Malware payload", "value": "5a97b8ccb3b3f3a9aae737b3878a7306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527503, "uuid": "53b64299-2bec-4d04-a132-16272214b27b", "comment": "Malware payload", "value": "33999930570e34ec77b4873a8cffa5466bbfbf5ad83f949d10d95eb40151bbe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527503, "uuid": "64ebce1e-5332-4c33-b103-9d877dcbbb75", "comment": "Malware payload", "value": "1272610239331729240d6549ece9a2de5b338c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527503, "uuid": "c4a25d8e-f00c-41b3-b612-77200528ead3", "comment": "Malware payload", "value": "707c06e11d958ed6d1cd11875da91a95003b32972d6213a60c278357c77e6b983326780cbd950c3d9dcc85a899dd638a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527503, "uuid": "438d047f-3136-4f0c-bbe3-1a9c88c8d096", "value": "T1E6B5BE03B66786F2E28967B6DDAB8C04C361DA83731FD70B788E23A555433B79C46607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527503, "uuid": "5e81e102-0c9a-4574-92c4-2c744debe7b0", "value": "49152:irjqkI9wbOEyCbdaveg5Q7FHo+sbC40fDWJmmb:d+OKJo+shoWJZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527503, "uuid": "99b22db0-2ef2-48ee-84b9-685b1ae57092", "value": 2312595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527503, "uuid": "cb1d62bb-aa44-4d8d-ab77-aa3b26142f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527503, "uuid": "caf4b89f-16e0-4cf0-a7e5-34f752912e7b", "value": "5a97b8ccb3b3f3a9aae737b3878a7306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8e658d-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690526790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526790, "uuid": "cc56a90b-12b4-4c39-8ab4-d00130e115a0", "comment": "Malware payload (AgentTesla)", "value": "00b74c5057b113ded149ed0b45dbe1a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526790, "uuid": "4a53f87a-75a3-4dab-b38b-b9f3dd1e1550", "comment": "Malware payload (AgentTesla)", "value": "33cc1948aef1d96eaa733345f427a2fd48d86d8621510ae754fc4cba16aba619", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526790, "uuid": "19b30ff2-12a9-4fda-890c-a6f6039433ab", "comment": "Malware payload (AgentTesla)", "value": "ef4afa9810b7bec0d0d1e9a2336d3531d077f8a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526790, "uuid": "420727ce-5dd6-4a9f-b56c-a0658ce4931d", "comment": "Malware payload (AgentTesla)", "value": "9b9111bcbc726c1a5bdbb88e868d23b5aca8df7af12f80e32e4863046f1a845229d9aad9b9d48c001fe32754b88acd8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526790, "uuid": "4216523e-50cd-46ab-9b3e-22eb644f32ef", "value": "T1E06501079844CBC3C41D83F87E035EE80F5ABF08D4956DEB10667F8B3A71A72595A26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526790, "uuid": "58ae3f1e-1865-48f4-8c28-5dfbd9f56952", "value": "24576:T/u9VNZyOw6VO1nDZyHw6V8ViNhuuvvtkVMk7gAl6G8dry7nAfMdCrVR/7:T/uP+6VO1Fj6VAiNhv3tkVjg46jrDVd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526790, "uuid": "d138ecfe-a6d6-46d5-9f87-4134ea921d5d", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526790, "uuid": "39f623a8-d245-4959-a2b3-fdcdced43e89", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526790, "uuid": "03f9af21-5193-411e-b07f-c1f6009641a4", "value": "Purchase Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5c0edd-2d5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690558815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558815, "uuid": "afd23bd3-3b28-43d9-8e0c-1f5c9e571736", "comment": "Malware payload", "value": "9dc7237ac63d552270c5ca27960168c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558815, "uuid": "2ad129b9-d1ec-437b-8f16-25b657966c78", "comment": "Malware payload", "value": "370d3b2ac96306a83cc49f1c5929a0badbeb2459d966046d88bc38709fb0245f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558815, "uuid": "2abcebf8-3f27-433b-acbf-ab3f10939c54", "comment": "Malware payload", "value": "c9eea274813603cb2686ac902383352384312319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558815, "uuid": "ddfad7a5-7d34-423c-bde3-b87a893e7d55", "comment": "Malware payload", "value": "510c72c8cc0f20cb07ae656b9ec351fd67cd3d6e7ea2179de33fab619ff4c1ca9b1810f3fa290b2c7d78333968d3bd10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558815, "uuid": "0ebdaf79-9460-414d-8bbb-baa8810976e3", "value": "T129175B43F89181E8C4EDD174C6269256BBB03C895B3067D72B20FBB92B73BD49A79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558815, "uuid": "afcbf4fe-d9a1-4905-a684-2b2994d50d3e", "value": "ff9f3a86709796c17211f9df12aae74d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558815, "uuid": "ba770803-f18e-4ab0-9e59-25ef6d8471d9", "value": "196608:87jy3FXs82XuWvzWQywOl34Rd9HSYIII2fzJ:AuJzWLtywdIILfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690558815, "uuid": "392776f0-9902-4394-917f-19507351176d", "value": 19370928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690558815, "uuid": "c386aba3-b98d-44f3-8e50-6c946eec482e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558815, "uuid": "ccbb594a-0b1a-4734-9502-da1a2826478a", "value": "ngrok.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bcf2fd-2d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690566933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690566933, "uuid": "a9b4c7f0-a11b-49c2-851f-f787e3f2911e", "comment": "Malware payload (njrat)", "value": "29ea734b22eace3486a0cc5e90b6fc4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690566933, "uuid": "57d8a839-dbbe-479e-892c-6fab80b9da68", "comment": "Malware payload (njrat)", "value": "3730dbd6ff21165ad30181ca623658e346ace9a40877868c9a3354dcab710558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690566933, "uuid": "602e06af-c456-41e6-99aa-91cf149922a3", "comment": "Malware payload (njrat)", "value": "5a7e0e7a0a7c0a81d172963b6cd17c6960a7e718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690566933, "uuid": "8719e097-fd20-412b-a61e-57df1701d2eb", "comment": "Malware payload (njrat)", "value": "082e46e5507c79fa800713f951a6b6380490387717c6ab0f71c4cc131bd21802bfb768495fae3a69320a503dc80df780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690566933, "uuid": "ade56c94-fa60-48ee-8b8a-1c56e5cbbd68", "value": "T16A83161396635031ED048EFB3891B6937546AB2D5C144706BACDEBEAFA374A2334D3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690566933, "uuid": "d11a30ba-7eeb-460e-80bd-c7575997bb1c", "value": "81ac56a083c748697b24105dcf7873a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690566933, "uuid": "d461fd36-34c8-4470-a934-d32a1b1c2a22", "value": "1536:jGDGSS1g7kVXRCutcgC/1jG8plwbjr666vEXdz:jGDro7XRTtQ/1YvrkMXdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690566933, "uuid": "3e8bb4eb-0e77-4276-ad19-c8b56569f7d4", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690566933, "uuid": "bb526f65-d8ed-4e78-83d5-1a288293da1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690566933, "uuid": "c9894b24-3423-4959-9165-86f2d60e094e", "value": "29ea734b22eace3486a0cc5e90b6fc4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33308f48-2d11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690526239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526239, "uuid": "201d82bd-03d5-4a2d-8168-000e7d8d9fe7", "comment": "Malware payload (SnakeKeylogger)", "value": "f30673ee0518982afd8b39dc2d9d5ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526239, "uuid": "7ed7907a-c251-4a36-bfae-6db3b53d67fc", "comment": "Malware payload (SnakeKeylogger)", "value": "38e497ba967a7027611f38d868b02f7c00405cc0cde0500ee32a61103dddd4f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526239, "uuid": "53914a3e-78ba-4d22-803e-ffec57d7b5ce", "comment": "Malware payload (SnakeKeylogger)", "value": "f0d0dc64ef073a4a2fa132f3e47877304fd34d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526239, "uuid": "7a8b0d1a-578d-409f-8b2d-1b1886f51aba", "comment": "Malware payload (SnakeKeylogger)", "value": "f96c6aa5c25ae06d1390f73e9322fce6c91afbe890298e3474a2783e4071342070b346b5d3e26b00ed80f17b619d56fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526239, "uuid": "627e8e5e-76e7-4814-ab2a-cf87bce37164", "value": "T147D412502CD20A36C95E86B34C911BE8637CAEBD03A5C755A5E438DCAE17335C247E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526239, "uuid": "4b1d0a6a-c618-4093-aa99-2aaf38dfc710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526239, "uuid": "834f9d07-5c65-4112-8f5e-34e66782eedb", "value": "12288:6bO57cZPwzlubFicMWIVsRjDrQLzFOhlXjmDy+bO5:MOZcZxQc/ZrQvFEoDyoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526239, "uuid": "aaea1b3b-d4db-4335-ad21-64e828659296", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526239, "uuid": "6ce0aa66-5fe4-4fc0-95c4-2327330be763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526239, "uuid": "0d5656b7-f5fe-461f-a227-3c83273e82c5", "value": "Scan003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972a79a0-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690534137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534137, "uuid": "47db0367-76ac-4001-ad35-2aeb8c52fafb", "comment": "Malware payload (Formbook)", "value": "7c2bf2746f521e49ec599314b4132a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534137, "uuid": "0ebec839-3ee6-4fb0-9db9-b03318ea1b9f", "comment": "Malware payload (Formbook)", "value": "390949c73b14c735f1e18c0b86780320ba7ff485128118a7ebd2b458ba987ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534137, "uuid": "69720eea-72ee-4102-9777-58ed3670e4ae", "comment": "Malware payload (Formbook)", "value": "cddadf9100d6e64292ec7727a68dd9b659ca4fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534137, "uuid": "3c0c1bc2-ec17-466f-902d-80eb0b0594e2", "comment": "Malware payload (Formbook)", "value": "eff6e9384a121fc7612699dd271828a6803a55548ea019be97ae82cfda44cda446af8e2d81d7ebeee2360ff66af587ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534137, "uuid": "a72ff48e-bb5f-4b3f-9a43-201ab0922703", "value": "T138E4F051F22C1F97D87A57F90C24E20487B6BB6E512CE6492CF278CB2572BD10986F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534137, "uuid": "8d04f566-5a6f-49f7-bae3-13928b325944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534137, "uuid": "e86ef29b-3046-4ecf-881a-6fa3e4f83193", "value": "12288:Kp1gjjJxNtBmxRV4j9OuLV+sezYRTOx0tre5tbXJthXl:KrgjjJxdLIdw6x+2XJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534137, "uuid": "412f641e-a111-4383-be8a-23dae606354f", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534137, "uuid": "1fd14eac-0f34-40f8-b475-ca30b2732195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534137, "uuid": "20e57036-66b6-4544-9c59-632266677717", "value": "Request for Quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17563ba5-2d16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690528339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528339, "uuid": "6b432ec2-c572-48a0-b651-45418211e6c2", "comment": "Malware payload (AgentTesla)", "value": "921a6dc47e75cbf2aa84815669dc416c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528339, "uuid": "aa4f4e8b-616f-4c9b-b629-88880af06291", "comment": "Malware payload (AgentTesla)", "value": "3b528e9e1b0d0e90ed37317bbaee8777a0d69d79feeea63fc0c76cb6520ba484", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528339, "uuid": "d3928a2c-9246-45de-b268-c51878f89ef7", "comment": "Malware payload (AgentTesla)", "value": "b80c33b0389a1da3296ec618430cb23483402d2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528339, "uuid": "e070b5e8-1de3-4a3e-aac9-cc7f8ac0d2bf", "comment": "Malware payload (AgentTesla)", "value": "ec1f5e7a479cc74ca8d68fa64c6590f0fab8d6364d0877aec578438cd6c62ff9377706d783c909427dd2eed778c9b14b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528339, "uuid": "7d23485b-ece1-4cab-abdd-62d9c8994383", "value": "T117D4336FED6557C3D9746C2C4CB423C24AF798A88987B059D8EDB9888BC2EDEC0404F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528339, "uuid": "bc05922f-3611-4ec7-a01c-005a249b8fdd", "value": "12288:IcVjGR4RxqH7PfLS2CmWJGLUJLYQfH4VkkTwCWwdbq+8MXPda7l5k2T:Ic1TRYHTftCmWJGANYaHVkljtV9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528339, "uuid": "a7bb4313-3f88-4fb1-b5e2-67206e3d4d31", "value": 634544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528339, "uuid": "e91f03eb-c973-4e96-8f44-55d8f4ac621b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528339, "uuid": "04f05993-7f64-4f66-b298-fae57d21a55b", "value": "Invoice pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0bb068-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690527191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527191, "uuid": "d3de54db-a35a-4c1f-a646-72e63e668c7a", "comment": "Malware payload (AgentTesla)", "value": "70a7aeeee3a73605c40a16dd6f68e014", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527191, "uuid": "de29a2ad-e461-40d8-b277-6676ceb8fc76", "comment": "Malware payload (AgentTesla)", "value": "3c3bfc4353b8c082ab7c4202df58d8008cd322258c4c5505d387cf3a128b78ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527191, "uuid": "ca64c345-a7d4-4131-8267-ef5beae7e22f", "comment": "Malware payload (AgentTesla)", "value": "771d49611e576f75890c009038486d8a1d4bda87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527191, "uuid": "d351f73c-4b2b-4f94-a57a-f9435cf145ca", "comment": "Malware payload (AgentTesla)", "value": "1b53af7ec01c65c847fa02ec45e12fe117e0bc128048db5081a2465b80f1e41cc19886b903799a61a8ab2cd9afa07a53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527191, "uuid": "d83f46ae-6aac-4f73-ac56-1fd3cc0fc533", "value": "T153D4230022E8BB6EE43CDBF54171161A3B7579152402F242DECF9ECD9F75B680938A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527191, "uuid": "1609537c-8281-4001-a0bb-0cb129e64c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527191, "uuid": "cc541702-43e6-474b-8020-19613efd2793", "value": "12288:ZjZK1y7XacK3G7R7PZUB+vJYSZ3uZGhalPUy4khkeGeY:3KMLa93GI8r0nsy4kh6eY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527191, "uuid": "48ddbdad-bba0-484b-bacf-159653c446ed", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527191, "uuid": "252b749c-f457-4eba-94f9-468cee2ae6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527191, "uuid": "ea17128b-67ed-48e2-bf1a-7b94dd03c2bb", "value": "DHL_74833922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08428fea-2d11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690526167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526167, "uuid": "371da6f2-54e0-4ee3-9b5b-256f9c940c32", "comment": "Malware payload (RemcosRAT)", "value": "fc6ebc523570e9019d13e628e4b733dd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526167, "uuid": "e4c1f201-522e-43cd-ad22-9e6c2910ef04", "comment": "Malware payload (RemcosRAT)", "value": "3ddab0e4f018293bc930fb5a635c471074af3cce36801955d938d3eae8a5c737", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526167, "uuid": "fa711e8f-9c77-41ab-9aa3-279f5c2a56ce", "comment": "Malware payload (RemcosRAT)", "value": "e2c46a52e5ef4da6de9d57305d4f572c6fdb5b8e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526167, "uuid": "cda8bf07-9b83-42ea-9151-404b990d7973", "comment": "Malware payload (RemcosRAT)", "value": "58f0c4a87d1c5fe2f4638f7041e55e91f2762b9a610c459b05c2a2bd3ca66d64e6f9ca79731a909245b755e1d3f2b382", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526167, "uuid": "f8413154-51c3-46ce-9578-63170e34138c", "value": "T1943502B0DDDACCBEC43604785430572519769FD61B42E789E46EBD38EC31B12A2A9C3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526167, "uuid": "837624a0-7c25-4028-aca2-cd4bdd73e3b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526167, "uuid": "8d15b298-1271-47d7-bdbe-e60cd1f1103c", "value": "24576:PROqhhp8Bf4xX2AVXz5LmnG9qnDWstbmxY4O:5OqDp8WfXInGMyst6xY4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526167, "uuid": "d8ec02c1-1b19-4ce2-a903-19eb67bb1ffd", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526167, "uuid": "ea7577cb-781a-4673-bded-99460da06b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526167, "uuid": "0468621c-3d9c-4e22-b7ca-1233d5563ed9", "value": "DHL Delivery Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e068acc8-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690527818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527818, "uuid": "9a55be94-3f9e-40ce-9e2f-db0e5093f06c", "comment": "Malware payload (Stealc)", "value": "fc27d3603e285ecc15884b14598d1eec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527818, "uuid": "387dcb35-80e8-4571-ad89-29d9127dbd9e", "comment": "Malware payload (Stealc)", "value": "3e073144bb200d405c0b92618d6264dadaae9f7f3b43232a5f36db8fc1ea2641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527818, "uuid": "ff420a4b-a1bc-44b7-957e-33892e275770", "comment": "Malware payload (Stealc)", "value": "d69fd84c84597fd384f547727e115b5f1707bd3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527818, "uuid": "02f1ed57-04ea-44fb-bf81-8c4ea54e969c", "comment": "Malware payload (Stealc)", "value": "fd5de29e6e14d241c3e52c66ffd6688f27501469c407a517041ba071bfd4e8aa7ee66bfe6fe426fef4f2647e86dbca20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527818, "uuid": "0d29def0-4956-4755-b871-11402d71f5ac", "value": "T167644C0392E0FC55F5264A329E2EC6E8371EF9928F1977A622186E2F05B31F1D363715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527818, "uuid": "0644cb89-3139-4909-978f-107c89f6a83f", "value": "40f5175c04a7e34207ea3837a6e797ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527818, "uuid": "a7751597-fef9-4bfc-ab38-6e64433e3670", "value": "3072:Jr/kGPY9G1hgwYVCws672PD8Vhh785oJv6T7YzyfyB+:ZkG+G16ZVBOoN78T7my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527818, "uuid": "038ea425-3e70-4af5-bcad-4760bb9c7cf4", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527818, "uuid": "5bc19217-afc6-4155-b1bf-1a662dae035f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527818, "uuid": "c1bda9e7-183b-4d5f-801b-c0b0e6ba92d0", "value": "fc27d3603e285ecc15884b14598d1eec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c9c784-2d7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690572659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572659, "uuid": "41b339b9-dd30-4837-b1f5-10223602cee4", "comment": "Malware payload", "value": "37a6120c65d16f200fd27e55fe825afb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572659, "uuid": "28f1f587-f964-490b-8589-ef088477dd87", "comment": "Malware payload", "value": "3e11f564887dd36f9b43d3a8d30df1213ff15401917be84ffb138aa21584d47c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572659, "uuid": "893957d1-f0e7-411c-86a4-7094e344e239", "comment": "Malware payload", "value": "bf7944489b630a0baa41abec2c38e2895ae0519b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572659, "uuid": "9d00bcd5-0c76-4cca-af8d-5474242453b4", "comment": "Malware payload", "value": "8ed95ff932a65de4d1d5ecd232d727149a61d6cc3c746fe5bb59d08144a93ba75493907c5eb4aefb9fabe001db0024a6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572659, "uuid": "4c107ef4-5dcc-452f-a81a-f67aad2152ff", "value": "T127D3E910598F64CDB1627F63079E7DD98F6BFBE1672A50B97180030B8B96D54CE88B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572659, "uuid": "82024a81-708f-4c8a-96b6-f0e3f3a5e303", "value": "3072:HIIIIIN77od2KIIIII86aIIIIIYVZFiFaFAFqFbFwFUFuFZ5:M77od2e6uVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690572659, "uuid": "fb39ad71-5c0e-47be-b62b-5f7598d31d44", "value": 135362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690572659, "uuid": "a465d027-c424-4774-ae63-134019462fa3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572659, "uuid": "80314682-2b5b-4994-bf3e-52fd20944039", "value": "Onlinebbbb.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02935542-2d4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690551497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551497, "uuid": "d254bdc4-b9ff-480c-83cf-2b371bf16005", "comment": "Malware payload", "value": "64262e14320cd5d5b1a24b0784faba74", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551497, "uuid": "fb78345e-1250-4519-b93e-f89b4671c908", "comment": "Malware payload", "value": "3f6c16f45b77b17f9cd70abafe5e25db7caa21b44065b0ecdbe12b90c825903a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551497, "uuid": "3a0c3cfa-58f9-4d54-b4f6-10fccb021bb9", "comment": "Malware payload", "value": "275a1a4cdae156036639a3a4113b128fb5279d13", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551497, "uuid": "0bf4a3c4-a8f8-4041-b058-58ce5e5db294", "comment": "Malware payload", "value": "eaee279cac496bcb03d6d70539bd7c96efc722a23413bc4153ed69c16c3a1799bf0203b044b2f5b84cf59ba5a2213efc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551497, "uuid": "94335bd8-c7ed-4cea-82ea-c253265a9d33", "value": "T197F09904559B492327BAC5B0CB463050F57CF01F1E198874F252A0A09FEA3849EFEDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551497, "uuid": "c5fddfa7-9822-479d-ba40-767e449be3e1", "value": "12:XtpzHipHmMSI8BbgAFWKLerEn1yy5Nj2rN8BieAkNmLlyYBBscko:dpzHOeI8BgaWJyyQ0Oke3c5/sc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690551497, "uuid": "d1573d8c-84e1-4442-9b76-3fabae4bf946", "value": 650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690551497, "uuid": "da170d16-d0f8-484c-a6bb-36b11e282cc1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551497, "uuid": "22573aad-0c11-454b-9ea9-30ca33c5fcff", "value": "Vbucks generator 2023.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40aa11a-2d1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690530347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530347, "uuid": "2248d3df-207b-42d4-962c-10d1ee0bd1f8", "comment": "Malware payload (StrelaStealer)", "value": "47ebb70ae9e8cc35f92a732785bd8c28", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530347, "uuid": "e5ff79b0-7fbf-4bdc-b9de-28e1e8b24ed8", "comment": "Malware payload (StrelaStealer)", "value": "42d33b0f188bb9f53e2b043fcdccdb88ab0df26f1e48cb64a98be851ce631283", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530347, "uuid": "66082d54-0d46-466e-9b47-388c6a75c547", "comment": "Malware payload (StrelaStealer)", "value": "5dd5b67c5dff74f7fed2285c608267e83791ff9e", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530347, "uuid": "a52ca824-1093-4b7b-94fd-51ef5fcb1895", "comment": "Malware payload (StrelaStealer)", "value": "87eb806ed6dfb33cd6d39c4a073733eb27a875428298f7ba1e4e7bcd0a845df77d290837fb4240576ddb3361bb5f3d88", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530347, "uuid": "292e3cc7-80db-4945-b293-da7b5b4ccc19", "value": "T112D44CF07BD57BD70F765A0DB38B50B23C58B417F0ADED8626CD0D1D62803989AAAE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530347, "uuid": "bfbb010a-e4ff-484e-94df-e99b4c8f91a4", "value": "12288:QZTwaHan/5MeRUki7VxO6L2/vGHTFi3+36WVj2O:Q5TanqeRRi7VxO663eTAWVCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690530347, "uuid": "77f5f3c4-ae9d-492c-a929-6565e3d6e6cb", "value": 607518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690530347, "uuid": "85f1a34f-e6a0-4367-92a1-e355f48b6593", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530347, "uuid": "036b66a5-96ba-45a7-9e39-36c39ece10f1", "value": "PDF246451346617712.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5021dd1c-2d20-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690532730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690532730, "uuid": "d9458703-6e54-4154-b333-4612749a1598", "comment": "Malware payload (Stealc)", "value": "52a35dd506f4118b5be9c4dcde55005e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690532730, "uuid": "af20161a-513f-4ee6-a123-350915a58f31", "comment": "Malware payload (Stealc)", "value": "446a85f78205c1be988c518d875f380e6c0b61ba1b295c66ace73976a59c8032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690532730, "uuid": "9b27992a-cf06-4471-aede-d4c1c06c0f2c", "comment": "Malware payload (Stealc)", "value": "9333014a2d3e1f8f7b59d9fea544dd7c68254796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690532730, "uuid": "20fab931-6c12-450d-9771-b3649daa345c", "comment": "Malware payload (Stealc)", "value": "985033f271aa5d48ef81990b7ed270f7ead8de85b8e87c88930143c231c3dfe97cad8b4bdc4019b3c82cf49263b59c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690532730, "uuid": "017ed747-fff2-490e-9fbd-7fc3094e00ac", "value": "T120F58D21369446B2E0274231F599F274E7BDAE2F0735428B93D0BBDCBEB27416A1417B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690532730, "uuid": "83a6a496-5d96-4a96-aae8-6f3891894793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690532730, "uuid": "01688c8c-28c0-40d0-9778-99fac40e780c", "value": "98304:L650zwcStRuNb1wDiZuDWCMczXPZiAQFOlmmbKz:VwVtRuNhTb1FOlmmbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690532730, "uuid": "644dedbc-b683-4a43-9b0e-61449b4728d5", "value": 3403416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690532730, "uuid": "c90da437-252f-4794-a4e8-098ce8b63a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690532730, "uuid": "1b4ab42e-29b9-48c8-8130-a4386f9ba8ed", "value": "52a35dd506f4118b5be9c4dcde55005e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1c3d2c-2d33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1690541128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541128, "uuid": "b5cea71f-9f38-4bfe-8453-54593ed86739", "comment": "Malware payload (PrivateLoader)", "value": "845d6ba0c49672796273a1c3f0b54c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541128, "uuid": "ff068bec-e739-4f87-ae18-6caacfded9cf", "comment": "Malware payload (PrivateLoader)", "value": "453371b23f797c8b9954f6aa4ddf1bf6866b53a9e148aee9f4212c2db0b9ff1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541128, "uuid": "876a53c7-52d6-40b4-bdfc-c926084d37d2", "comment": "Malware payload (PrivateLoader)", "value": "4a319bd7eaca86ca09612a9475c37479a070dddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541128, "uuid": "9a30def4-3fd3-4cc7-8cee-5c1060ccc244", "comment": "Malware payload (PrivateLoader)", "value": "fa86be7c9dce91f92991e1ca248d79a2fbe2774ef3c4d7afa2e6c6b64878783cba2cea416dc83d5d06a0f520bf6079c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541128, "uuid": "5c68a449-92d2-4743-9dc1-7707cad30595", "value": "T10D56233363A040C0F5D6893FD637BED631F702A79B44A878A5E755C636228A8E727D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541128, "uuid": "760cb7b5-735f-42f1-86b7-5f445f9c9a43", "value": "5655e27fdbf7c1df56e25a218a416f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541128, "uuid": "7ce0223d-7b9f-4cf3-b036-71a96ec7b721", "value": "98304:Zw7GMc2JIdln4NQa6uM1NL4pagrkAV4laHkg0Xy6E/UYQoSZwLZdrbRW:a76knOa7kgaIkPXbEgZwPbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690541128, "uuid": "dfd87706-0e0e-4432-9098-8a03111ef35c", "value": 6371840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690541128, "uuid": "3d9439a0-5709-4518-aa07-3ec9c6faebae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541128, "uuid": "1dbb8138-bb63-4970-9200-d74af89c578b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5517dc-2d2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690537020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537020, "uuid": "19843426-65f1-419d-b697-521e748c77f4", "comment": "Malware payload (AgentTesla)", "value": "5c3b6a061b747240c9497f5c9092bf80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537020, "uuid": "507e4a8b-751c-48a4-94a7-28b0a93353b4", "comment": "Malware payload (AgentTesla)", "value": "47f5f97b2bd40c59992eeba640da3a57c5df13ad8286914f5a823ca0a4d3e9db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537020, "uuid": "8892ae27-920a-4b50-bb7f-10b82be99ba5", "comment": "Malware payload (AgentTesla)", "value": "90f2f8f26927cc4a44a76be2b3ca0536d8e34b6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537020, "uuid": "21d93a61-ff18-4cb1-88d6-efc69fab819e", "comment": "Malware payload (AgentTesla)", "value": "9d1401fb0c9eb72b048e97232e98d86c9ce38ebc7c45caeb7a020aba065163c906d59ce3f69559aefe60906109a3541d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537020, "uuid": "d3fc92a2-29c7-40a3-8a3d-34958ac58b35", "value": "T1CAE4F192F2681F9BD87A93F90C21D10457F6BB6A503ED6091DF2B8C71175FC20A46E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537020, "uuid": "1d3759f3-83a7-4aed-b5f0-3e05e37c9098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537020, "uuid": "9e14ecf5-d815-4c20-b881-b3a7efa74010", "value": "12288:DFVgjj4XxWdoZE+fxr9VZJPUK6Z5mwXAApUoFWEAzYe6hOYN2XDm:DLgjj4hWdoZEgLVZuKs5msAZocEA0hV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690537020, "uuid": "b995dc02-7113-4f86-afcb-c1cd29ee33dd", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690537020, "uuid": "e7ad728e-0ef7-450d-bb72-7459a313a5f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537020, "uuid": "fa31cf08-0d60-4d18-8f32-53af2f07fbe7", "value": "SecuriteInfo.com.Win32.PWSX-gen.18466.21263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15d77e7-2d32-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690540651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540651, "uuid": "9ef22008-f08d-46af-94b9-5eee82b3303a", "comment": "Malware payload", "value": "654da63bac658f27cc0b12a6a3cf443c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540651, "uuid": "8973a64b-0592-4650-9dce-1a5ea53ff3ce", "comment": "Malware payload", "value": "495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540651, "uuid": "c4d8ef35-0946-41d0-a8bb-78675e8231fc", "comment": "Malware payload", "value": "185cbefab3f51ba74140e32d2c0d7b1cc6c2e32d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540651, "uuid": "63c5e3ce-874a-4a5a-a905-69c7ac9dbbe3", "comment": "Malware payload", "value": "669b36b465b0f4cc96d4a66c5b36a0407938340cfc83ae554964689717cc047e8e64a2a670d21fbdb2fe8d1a886e97dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540651, "uuid": "b7db6a9c-24f8-4de7-a1f0-682c2f1fe840", "value": "T10D335B0D278D6633D6BC797DC4EA524423BAA2B73702E34F9FC451A80A93BDD4543A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540651, "uuid": "521908f2-ae45-403c-9254-2de35683d31e", "value": "768:p60DXYj8+GVq8zaWo2a4ikkRio0YOv3gDq7nC8/qKX830BU+KELDKP6JJc+ia:pbLYj8+GVq8zSRTrigfnKi0vr3KcJjia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690540651, "uuid": "46a1c310-cadf-411d-9303-2a8420cf2e4c", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690540651, "uuid": "a0f6be99-b734-431b-a5cc-6553cf350872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540651, "uuid": "4c479bc1-93f6-46c8-8c4e-e47d6edf5d09", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.688.32409.9930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ba3733-2d1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690531388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531388, "uuid": "95a82971-f67b-4b0c-b327-08efda611eee", "comment": "Malware payload (Gozi)", "value": "13c71e34526e5bb8991fc997f3645858", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531388, "uuid": "f05e4065-67e0-40c1-8f2a-7e0ad6103d0b", "comment": "Malware payload (Gozi)", "value": "4a4b9c34cbb3a257da66ae6415f786aa0fba4383c2d3e62059c7227062f35ae8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531388, "uuid": "37016713-7985-4edd-9688-3fdfa58aa913", "comment": "Malware payload (Gozi)", "value": "f3b63cd351edd513484e3a738938da8d43f1933e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531388, "uuid": "f022f550-e89b-4c16-826d-0aad2675530e", "comment": "Malware payload (Gozi)", "value": "d2ba83e81e35f048becc908085ec7c1e5e51a171db0b7b9224d09b420e2fe08a0ee829d5fba4a8c006a2dba99f0bb605", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531388, "uuid": "114b8904-bfbf-46d2-a0db-05934d980dca", "value": "T132E25C4DA73C349AE4B26AB88155F10B653073691725A4FF49E1D7780C333C5EE38ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531388, "uuid": "43dd0628-bf74-4ec8-91a1-64bbd0b64275", "value": "34340c2c4e9aa6ef6ad12bb695fc695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531388, "uuid": "2415f998-86fb-4b3e-91d1-60db1d5a7487", "value": "768:MoV3jO9YmckVPxIiTAqMwwyg2ulzxAfv5r6wD1Pe3pU:MhYmckVPxIiTAqMwm2ulzxAfv1Pe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690531388, "uuid": "58aa9e3c-f97a-4bd3-8ea8-7c04166a4536", "value": 31496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690531388, "uuid": "e09aa3d1-b9ca-4c32-b9f4-def46e519b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531388, "uuid": "bd5edfa8-1e3c-4176-93ea-b557f8bfdaf0", "value": "tmpUUChj.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ee8a2e-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529570, "uuid": "2bce700a-6f43-41eb-8329-04efc37efecb", "comment": "Malware payload (Gozi)", "value": "41006d295b2b8739374435cb3c767fa9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529570, "uuid": "2bb3021c-ae9e-4fc2-8791-d83c4cdf865e", "comment": "Malware payload (Gozi)", "value": "4b077453328e879e8c929edba4080ed7159b721aef849ff19a470cde18d481df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529570, "uuid": "a10ce12b-7696-40a1-9cca-022a11feedc7", "comment": "Malware payload (Gozi)", "value": "ca019e549bb8b31c7a2c3778b4e5b9cafcec4fea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529570, "uuid": "75d82e39-4853-41a9-b964-bd2a51af1eda", "comment": "Malware payload (Gozi)", "value": "ebab47fee6554b85c96aaf7893940d300cff9d595fabb4b7d418c90c8d27713b1a149f20ffcbc34cde382c9071684090", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529570, "uuid": "81eb657a-15d7-4693-b4fd-906ab9def7ff", "value": "T1C2E27D4D976D329AE463A6B88159F607263073361324A5FF09E1D67D0D333C49A38FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529570, "uuid": "56f7b2d2-575b-4d2e-b473-0bb0e2b74362", "value": "34340c2c4e9aa6ef6ad12bb695fc695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529570, "uuid": "1d80242c-3118-4615-be73-8c5e35dcde1d", "value": "768:F85rAO9YmckVPxIiTAqMwwyg2ulzxAfv5r6wD1Pe3pU:yrnYmckVPxIiTAqMwm2ulzxAfv1Pe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529570, "uuid": "f286dc99-090f-4ed1-bea9-1e8342a9ac2c", "value": 31496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529570, "uuid": "b2fd1a7d-8687-49f2-ba58-7e21f72779cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529570, "uuid": "0bd8f97d-7ace-4692-8b72-a78526089d97", "value": "xpspushlayer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aff1a7-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690527255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527255, "uuid": "e42b9c4a-817b-4804-8ff3-9df4590a98e1", "comment": "Malware payload (AveMariaRAT)", "value": "8f989c5e365b2e87a1612d8cffb35051", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527255, "uuid": "f4fe72cd-0c2d-495a-8eea-4a526b4e0f41", "comment": "Malware payload (AveMariaRAT)", "value": "4c0f9f12462d7e4296e0d590eb153f39bf83795c4ca805924b9d690cfb51fead", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527255, "uuid": "36d60360-1cf9-4696-ac86-df2c45968a7d", "comment": "Malware payload (AveMariaRAT)", "value": "f95b5cb4c34132027554abbee8078ec443670faa", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527255, "uuid": "41df9d6f-889d-4e04-8aca-ff2f86e772de", "comment": "Malware payload (AveMariaRAT)", "value": "20fe214e9083fead5684d9e8bea100964aad28f66f5ec41dc6e675bffd91e6a5461693c717e38d8c2a7bc84f3473fd2d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527255, "uuid": "54189249-3a28-44c0-a082-747e5a0421d8", "value": "T162B5D0A575C4C4B0D9F229322AB5D5700D3AF5746A935D6F6B2446260F283BE8B32CF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527255, "uuid": "e670e7b9-be56-4ce2-81f0-aa8d13be7700", "value": "5ae00e2dd0d6ab06bd890c0724ff7ed0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527255, "uuid": "6dc4edf7-f304-4953-8e2a-e85ed44e7710", "value": "6144:rHGDOCLms7Gr/NsS5uTIsd1AyW6u8g6uMaC6RHnn9isYSyfrn:jqOYclsgaIsdU8kMP6RH9HYSyfrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527255, "uuid": "91039da7-023d-4506-a308-c819189127c8", "value": 2438752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527255, "uuid": "fe005665-3b13-4717-8162-e91929032fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527255, "uuid": "b3856038-5f8e-483d-bd06-3122c66ef4a1", "value": "IMG_3823.JPG....................scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f1a5b0-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690526785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526785, "uuid": "7d4ed3b7-3731-4614-bf5c-9cfed4192d75", "comment": "Malware payload (Smoke Loader)", "value": "836ba814536eba316a04c4008d717712", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526785, "uuid": "c75bb99e-8782-4190-8f67-20e90842dbb3", "comment": "Malware payload (Smoke Loader)", "value": "5125dce900d1be7d2e71e54c733a88f5963d40ee12c7d08241cc4ee652d00c2e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526785, "uuid": "28912dfc-02df-4373-b004-b371976e60ac", "comment": "Malware payload (Smoke Loader)", "value": "227180a699f4d86ea6a8756e90f5b689ca63c653", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526785, "uuid": "a30588e8-e12e-4e2f-8b4e-f71d2e5549d8", "comment": "Malware payload (Smoke Loader)", "value": "98326a975a91f7c5eebc4327fceb1ebd0c46bbcdf31e6f05591384bdef589ad0c8c735db0681e10e209a56f818b8d8a7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526785, "uuid": "6569254d-a77a-47a2-a2fe-ba37366966f3", "value": "T19C65F103DC04CB83C40D83F47E431DE94F1A7F0AE89A6DDB11527F9B3A72A62896A55D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526785, "uuid": "ddbb3eda-9fa2-4dc8-b5ac-0f3ab85215c8", "value": "24576:4bu9VNZylw6VMEnDZyjw6VEViNhuuvvtoDEoLhGXQwngZsigpcjUfRwmgZ:4buPR6VMEFL6VoiNhv3tgQXXnAgWj+Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526785, "uuid": "f51b11ff-38f5-4881-8db5-f7c191f72bc3", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526785, "uuid": "9dfea6c7-07db-42d7-bc5a-266259e21db3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526785, "uuid": "dd9c5eb9-35db-4b57-be93-4c9133928a89", "value": "Order From Cuba.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76cc71b-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690527830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527830, "uuid": "4f8d2208-6163-4607-9f7c-ccec39a16786", "comment": "Malware payload (Fabookie)", "value": "3dd7dccedd90d51fab3688db00c3648c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527830, "uuid": "750a5ef6-feba-4f4d-9d95-4fedb8f3bf3e", "comment": "Malware payload (Fabookie)", "value": "513824a6bb9c3dca75aa9e316243be0908e47a76b03bf7e23d639678cceb144f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527830, "uuid": "bf4d3a42-5a3b-4a07-9f7c-f6ff5d2857b7", "comment": "Malware payload (Fabookie)", "value": "38598affb405d51a3e0a7fd08d4efa94ee238b48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527830, "uuid": "88e9d1fe-33c7-4f22-86f3-682bfbaa4a84", "comment": "Malware payload (Fabookie)", "value": "fc21dc999709f68d0a55ebaa5a543b4208d52518a90dc175f81d114f9883a59a72f810c97f2b617f4f77a386a330cb4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527830, "uuid": "e35e7b6f-0195-44cc-bc41-4694b0ca5879", "value": "T13715CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527830, "uuid": "9cc66970-b152-480f-9a10-4ee84ca29427", "value": "02bc376d1ae63a2fef892492d891a666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527830, "uuid": "42cd1a0c-a436-4404-bf55-e64fcf020bdc", "value": "12288:knGetS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:tuS/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527830, "uuid": "fef5e16a-3066-4289-8466-d9f95800602d", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527830, "uuid": "0abd3e3c-2a2f-4dd1-859b-6268b9d6ca1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527830, "uuid": "151b6b9b-e5a7-43b5-ad9c-5e9d02a1c027", "value": "3dd7dccedd90d51fab3688db00c3648c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ac5341-2d34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690541441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541441, "uuid": "e870e7b9-9b6f-45b1-a958-507a730248e3", "comment": "Malware payload (Stealc)", "value": "1050aa5a1eaaa9f59f66b2e0f7702dd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541441, "uuid": "5b0c5aa4-fad3-40f8-bdf5-c008c7c4050f", "comment": "Malware payload (Stealc)", "value": "528a04c98597c2ab37c0d9d536707c2dcd2d1f7bdc0a26fc9b24a8a3035eaf88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541441, "uuid": "32674bd6-6dd9-4479-bf29-a73df18d3ff6", "comment": "Malware payload (Stealc)", "value": "62a245778e6459fd4b63197d8ad8e939502de479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541441, "uuid": "aa46ba18-a3c5-4e59-9cc0-47928cc26bd3", "comment": "Malware payload (Stealc)", "value": "0253fc3e650b2b8bab0798f9af8660ad6f3a9227f0dcbd8b6188815f0f8c45f41c3b2d6ea0e0b53513715cc7ba10c2fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541441, "uuid": "0d078d4e-78cd-4000-a979-aa2bcd2c1db0", "value": "T198C5188236FE7CDCE9A9C3F0F2BFC054C624BA1D16109AAE0D591C7C5463E52BD53A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541441, "uuid": "a97d15af-f44b-49f8-bee5-9aeb7ac93050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541441, "uuid": "1b7c2981-51c7-4e43-89f4-f4e59db00d55", "value": "24576:48XqeVCeRIje7mHM26hjZub/xrNOK9kI8gq1nCb+TUeraBS1iX3ozC+TQyOUJuwp:hXvIje7mijZubpcKdKunBSNLjJuwleU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690541441, "uuid": "0734c469-6510-485c-89df-9bcdec2b65d3", "value": 2608128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690541441, "uuid": "83ca71c4-9e64-4043-a278-36c762966fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541441, "uuid": "e85ac81e-117c-4068-8e0e-217ac39c22fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6515b4-2ce0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1690505425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505425, "uuid": "e809df3c-6dfb-49c8-96f8-c812725387e7", "comment": "Malware payload (CoinMiner)", "value": "32df36cfdf612960149aa5030ff46f58", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505425, "uuid": "4b770e72-b021-46c1-a717-2999dc92bffe", "comment": "Malware payload (CoinMiner)", "value": "5318af28d1b77df7a83165a90420fa200405c632e870423ff68fc1285fa3a233", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505425, "uuid": "addfa4f1-dbef-4c0c-9431-e12219a50e90", "comment": "Malware payload (CoinMiner)", "value": "e50a6f996bdc9f6564a93ef37ff77333d8de7a0a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690505425, "uuid": "90136bce-f0de-4abf-9f32-e152058fce09", "comment": "Malware payload (CoinMiner)", "value": "6fa6de44e5825a8631f6f33e4dd63b2fca469334524dcc861ba639e94b2907c5f23b123b6b18c231e370183c45ba5830", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505425, "uuid": "db285d36-6624-44eb-8249-e1c6700ae560", "value": "T117D6D0C57A43AB8ADD02073260AF06264B50AB343C5FF6FE9C97A3D74FD495D29A3448", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505425, "uuid": "36f88ec4-a0dc-45ce-8dc8-bbc67f7b9a54", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505425, "uuid": "2faaff9d-867c-4f7a-a17e-ccb40ae0760d", "value": "393216:/X/PpBFZHMnHKDtKDuXgqltz46yF9Ypb8:P/TXHMnHKDtKDuXgqPyF9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690505425, "uuid": "9ac56a8f-be8f-478f-8242-9597532531e8", "value": 12678144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690505425, "uuid": "98744262-1f6f-4eb6-993a-b907c0fb905e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690505425, "uuid": "1d43e88f-1979-469c-b72d-c4b3a7c821ed", "value": "32df36cfdf612960149aa5030ff46f58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64cd6e4-2d15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690528150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528150, "uuid": "c29e7c1f-2695-4a57-90f6-21059d225d46", "comment": "Malware payload (GuLoader)", "value": "665f93abbe5d9241c9b8146e85aacaa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528150, "uuid": "fab02e12-3d7f-4ee6-a81d-91d72f06b41f", "comment": "Malware payload (GuLoader)", "value": "54cafdf8da41670e57c16daae615b7109e4c475de30ee61e84e270efe7ada372", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528150, "uuid": "b6c098f1-820e-4133-b4ec-9124dde86f4d", "comment": "Malware payload (GuLoader)", "value": "5989c50cf0cc6e1d936cbfc6d543c358cd65747d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528150, "uuid": "09f2cdc0-4fc5-4c54-8731-5b14b25f6fb7", "comment": "Malware payload (GuLoader)", "value": "b44f85ffb352613a9f59960737170122e8ee4f0ea6b4d11634a8087b5e44495ebbe31d4095cf4129fe57747274790fdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528150, "uuid": "61b61169-22e6-4a9b-a962-6ceeb7955683", "value": "T1420402537BE0D9BBC09903754639AB6A6BE9938831B6430757D16F0376533C2DB1C293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528150, "uuid": "7499a76d-886e-4c9f-8887-4e9bff8c6246", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528150, "uuid": "e9191648-eab2-4718-bbdf-34f457c55067", "value": "3072:nwDijpS4DbYcr8buK4WCGyZPm4zkEQ7ybA9j30+TXDH6dlUa1gYIJ3yY7o1emkY1:nFPeu8CdmotWyb6j3x6gz3y0We2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528150, "uuid": "afd91667-5731-4ed9-8146-d2c1ac11033c", "value": 185399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528150, "uuid": "2ad5376a-48a5-4aae-8d56-c9187b09b53f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528150, "uuid": "8c2941cb-3491-4ef7-8a57-0aac90088bbb", "value": "665f93abbe5d9241c9b8146e85aacaa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37537ca-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529460, "uuid": "4bed8c93-9251-4af8-8f1d-bee108e18572", "comment": "Malware payload (Gozi)", "value": "3846e452892b2a1284cebb4cea2cddd6", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529460, "uuid": "9875a5ab-62eb-4c22-93d1-2d6e171d3acf", "comment": "Malware payload (Gozi)", "value": "5918e4f359953f2323069cc78a442f4dddf675e0cab1a944c29ec17734ede39f", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529460, "uuid": "c01d13f5-b374-464c-a8f1-22f1f4b8a7c2", "comment": "Malware payload (Gozi)", "value": "21d19df8b161cd5724dcf75e421e9167989ad0bf", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529460, "uuid": "d91d14f8-88ed-41d8-abfd-1375e949f0d2", "comment": "Malware payload (Gozi)", "value": "4fba65c9919ddf0c3d45b0ed7206aad077421a02d55391789c08a55c3750ce663a45cdc377983f009045dbe0a500d2c4", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529460, "uuid": "bbc1e123-b007-4696-a80b-f55b838a1971", "value": "T11E842327ED852A309B1358DA388953F8E3590D54FDA9AFCB022EE4CF531F44C5467B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529460, "uuid": "dd8f587a-607b-4baf-9b65-64f5237d3f9c", "value": "6144:CP+DIJn90AWr1x26zNoGf6iKUM1XfMAaqaXws74aI4u4CQ3bdL5EAPNyU1X1McpR:wdIr/22kiWRaZ74V4uNQ3jYAp1S/Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529460, "uuid": "9a796178-e634-45da-93e4-1ba68a84346b", "value": 396940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529460, "uuid": "abc7f825-e5bc-4d54-a7ca-01e2ba7a5582", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529460, "uuid": "a758bacc-4fbc-409e-b8c1-478c78a16422", "value": "Inv_7272023_7978637237.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c710590a-2d60-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690560417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560417, "uuid": "d3df0a16-df4c-4e7f-b045-9348647e55c9", "comment": "Malware payload", "value": "bbaa5659e05412090ee8e203245b7d53", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560417, "uuid": "4e0617f7-062a-4809-8586-5c73b8841a71", "comment": "Malware payload", "value": "5922af008f0edeba71a7dd685b9dd7092c4ce79ffeaea2d98f225abe8b5fa320", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560417, "uuid": "5dd600c1-4af2-4cde-9565-c962db66cd60", "comment": "Malware payload", "value": "bd737af5f066fee927f781551d69776f9ae4f59c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690560417, "uuid": "fd54cbe9-9697-4cc6-87b1-3d0b7bc75e40", "comment": "Malware payload", "value": "ad33e29b0c60aea6f4de6f6f33686e40192221ad7f66dbd07431a0c0e7ab46a9dd498659939b816d785409e76072db21", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690560417, "uuid": "4356981d-cc69-4fa6-90be-cf5d6ab88140", "value": "T1D0E423CA5F9F2A74E46FAC74094C1B25B33165B041712DC214F256EA0B8B5BB09EECA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690560417, "uuid": "db90ba5f-1c14-4119-b474-58e5442dba18", "value": "12288:iZnXyq3EKnRi9VwgURbezKvDRu4ywGjBv8JdJvjpH7UMrPJ1:svfA9Vf6eSu4PWv8JdJLpdPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690560417, "uuid": "b34a88e7-3bcb-4623-8822-7aa092a96697", "value": 676495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690560417, "uuid": "eee80daf-9284-4e00-a2c8-be50b523a2d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690560417, "uuid": "f122bb26-5d01-4a9e-ba1d-13981d0f465a", "value": "Detalles del pago.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a6c6f7-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690527207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527207, "uuid": "192c8bcc-38f9-465b-a2d9-6e67e8066dbc", "comment": "Malware payload (SnakeKeylogger)", "value": "4b0e0239866ec4fd0e2fa7b3a011b362", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527207, "uuid": "b7f5488e-83f6-44c0-8f4e-e54e061649a4", "comment": "Malware payload (SnakeKeylogger)", "value": "5c9e41c57fc02e8a6832d92888f838a455e75ce93c833f2b730376a11f0040e9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527207, "uuid": "3a646e98-9a9d-4049-a6ae-ca385fe493f3", "comment": "Malware payload (SnakeKeylogger)", "value": "12f9b4f54fc834a16cadf28fad91dda1a55dc9e1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527207, "uuid": "9f61e11e-d40c-4555-90aa-997b3e7e7de9", "comment": "Malware payload (SnakeKeylogger)", "value": "876cc8f35ae5694c02d14557bc6e3dacd7dea24b852a001ea6ee00bf56161ebff353a2130b1d0cbd24297c17d4940cd9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527207, "uuid": "b1d0369e-cddd-4fc6-b51a-a90307f9e08d", "value": "T1F8A41221B5A8673AD97C83FE0471570943B4B86D2412FB8CDCCB7CDB9E66F240295A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527207, "uuid": "71e99418-cbe4-4736-b39d-f214558df37d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527207, "uuid": "60ca3582-c830-4414-b7a1-15ebbcf3d08c", "value": "12288:oAiYeJvaSz0dUOGk3DK2OJcjm5Tf7lDeZ48ZHyk2YOb:d9eJvudNZOJkmLeu8lySO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527207, "uuid": "f0d04eab-bc4e-4b3d-a717-4f4b1caa507a", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527207, "uuid": "3ff6a444-6094-4892-86a3-e2f7c68dbfcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527207, "uuid": "618a1006-189b-4333-b170-1768d20a717a", "value": "DHL AWB 50162400320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfde8c9d-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690527790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527790, "uuid": "648642ce-6192-4155-b448-01203b18f079", "comment": "Malware payload (Amadey)", "value": "d7f543c9c94d0a8fdbed379cded9cbbf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527790, "uuid": "06f62abe-ba74-4351-a25c-a00880aec7f8", "comment": "Malware payload (Amadey)", "value": "5d7f15bb1f5a34592c1b7a2451cacf2b1beb04a1810dc67bba82c093774458f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527790, "uuid": "51f3e168-85f1-4e06-958b-1d15ac588b2c", "comment": "Malware payload (Amadey)", "value": "b89c96bfa45bd551631b099224311d5b93eb28fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527790, "uuid": "6b11a4af-bdbb-4bf2-835f-b0cd1342d718", "comment": "Malware payload (Amadey)", "value": "99da11c89a2aa4fce5e2df9889ae6c115b6d29cf0212bd4b50fd073858e09fce05fdd8a618dc679e405f741e967a92d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527790, "uuid": "9982523e-7d6f-4f29-ba98-4f8505f52d47", "value": "T1D0B41203BBD49532DAF16BB098FB13930A357E921978829B2745DD9A0CB37D4A43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527790, "uuid": "9ca134f1-2f49-4b7c-82ee-46922b1d5867", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527790, "uuid": "96c46bbc-e4fc-43c3-9c12-88d8dcdad22e", "value": "12288:mMrTy90ozOGxxf54xm4y6sze4wS7gBYCkGqN/4CqVBm:dy7isZnZfUzJGq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527790, "uuid": "5ee0fcc2-a1bd-447f-9b51-777858182f29", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527790, "uuid": "0da1bf42-2e61-4ad8-95b4-0b69fbee8d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527790, "uuid": "76592741-2963-4e48-9ae0-3e81b2116746", "value": "d7f543c9c94d0a8fdbed379cded9cbbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334558a3-2d1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690531393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531393, "uuid": "678f7206-d623-49ea-b838-2e99be22e2e0", "comment": "Malware payload (Gozi)", "value": "47ec39139525f1e12b109fe6b3d670c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531393, "uuid": "f45f2f70-2e71-457f-bf7a-cb5301fea8a7", "comment": "Malware payload (Gozi)", "value": "619e08cd6ad2335e25de534d79d628905ac8cdf7f307c60e61a6c5190ab17140", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531393, "uuid": "d096ffe3-6042-49fa-9592-a95c6ecf97cc", "comment": "Malware payload (Gozi)", "value": "9db6b30b36efedbf253c9a05a47d9ca09daea927", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531393, "uuid": "fa6ebb19-b0f8-462c-b08b-62fbe069f106", "comment": "Malware payload (Gozi)", "value": "b09333b36406be2469c5b4769394be5574c563fd300c9900712615519c6a70d147adbb6087527d44c410a6419c401727", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531393, "uuid": "7f96613b-a8b1-4819-b135-51f84fbf1763", "value": "T163E27D4D976D329AE463A6B8C159F607263073361324A5FF09E1D67D0D333C49A38FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531393, "uuid": "0844d012-ace6-407d-8a51-cc412d422cf1", "value": "34340c2c4e9aa6ef6ad12bb695fc695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531393, "uuid": "1a959fd7-c308-4aa0-a524-d9fce693d4b3", "value": "768:g85rAO9YmckVPxIiTAqMwwyg2ulzxAfv5r6wD1Pe3pU:7rnYmckVPxIiTAqMwm2ulzxAfv1Pe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690531393, "uuid": "ec03ad65-6b8a-494d-9d3e-13130f7755af", "value": 31496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690531393, "uuid": "283ad531-c416-4448-b790-56a3c199ca87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531393, "uuid": "ee5d18f0-6af5-48e6-9b5a-c937cd75f119", "value": "xpspushlayer.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e00f97-2cf6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690514836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514836, "uuid": "47a7e959-d3f3-4ab0-9ad2-04e49cab0a40", "comment": "Malware payload", "value": "fe0874dfe691ae34867fc5b53ec943ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514836, "uuid": "49b32b14-9a00-4afb-a858-8bb8cd0bd4bc", "comment": "Malware payload", "value": "620ba245e50bf3ce3809ea2821eb742217344ee8db2d3da6c3f4e94d0fdd731e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514836, "uuid": "25ca884a-59d0-435e-b7d4-95c8ca474071", "comment": "Malware payload", "value": "9596d7a5924b619ef047d81cbb7aa0444999aa76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514836, "uuid": "3a0c611a-af03-4f73-b07a-0a0addfe15b0", "comment": "Malware payload", "value": "d3ac07b58944c2812b2688606453273d662247dc73bec709481981f0127bc0a5cf3272ca57fd8c68c53ce5c44955d6a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514836, "uuid": "b13c62d2-e1c2-4046-8273-72f44be72ec1", "value": "T1085502A54273BFADF527AD3F5549EAD86CCE1208620F6C88D42AEBCB1CF4D901095E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514836, "uuid": "56102606-95c1-408d-b43e-13ffc947009e", "value": "deb564b9c3a122d504eb758fb4ab3f52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514836, "uuid": "df39d605-1901-4df8-8a6f-1e1c10e00bc4", "value": "24576:fIAbD2gvtYueoDUhlpfWnqTJz/wj77JKu6O4BiW14XNPkHXtcw6lpZPhOc6F:RDn1YnLTpfP/QZKu6O4BiM0NqXewkpd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690514836, "uuid": "062d7f55-8544-4794-9efc-d78acaaa2b01", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690514836, "uuid": "e4c71883-51ef-407b-b159-a3b880c28796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514836, "uuid": "0fff0fc2-a918-4a8a-9381-0ebd988fe608", "value": "SecuriteInfo.com.Variant.Lazy.365790.27782.4771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f554b03a-2d8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690579392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690579392, "uuid": "6794d8d6-a107-4b91-988f-d9bc605b07b8", "comment": "Malware payload", "value": "693e02d30601b37640e60f01cd0b6df3", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690579392, "uuid": "85bd156d-4744-45a1-9fc5-ad293cbc5af3", "comment": "Malware payload", "value": "6318e4335b1098781e35d7464d20b7f92015e86f21c5aad3147e18d6bf9bba7d", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690579392, "uuid": "f5a8ecfa-3c29-4866-85bf-87d9fa0063bc", "comment": "Malware payload", "value": "8b10da539b39970a495b03d3ed0c491fa2e0a279", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690579392, "uuid": "3bf4c651-7f84-4303-8089-6dbec424ea95", "comment": "Malware payload", "value": "c2e196d6e23e31fa16ecb6e7dfd6acebd0adc36833b85511f311e9d56a61ae011ff9aa141a39e17a8609ae359ea7dfbd", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690579392, "uuid": "00daa755-2105-445d-b243-01599aff470e", "value": "T12045DA38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A352C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690579392, "uuid": "45bcf19b-4bca-47a2-a0d7-773c8168f1a8", "value": "3072:5pkwPJpIt+HsvH1yUDv8lxCGM0R3SMempy/o:5jPJpIt+MQMv8lxvM0demw/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690579392, "uuid": "cbaeb1ac-6dd3-4f7f-8c61-27833d5282e7", "value": 1252710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690579392, "uuid": "bf04e3be-0f39-41a3-8e1c-cda9e05f27c1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690579392, "uuid": "b4c4f21f-8dd1-465b-9ca5-80b653e0862e", "value": "EN-localer.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8ca84b-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545337, "uuid": "230d564e-1455-4110-853d-dbcdc2133333", "comment": "Malware payload (Mirai)", "value": "c7aa75afa72094d88df8f6a764f4d0ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545337, "uuid": "19253dd2-d8a2-43b4-84a8-e4614ceff1b3", "comment": "Malware payload (Mirai)", "value": "639954ddc61ab230831497971c935455a3f072dffbde648e1e1d777c8de61f2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545337, "uuid": "a721214a-adef-4dc6-ae73-b6e835903c81", "comment": "Malware payload (Mirai)", "value": "b25518274adda80e62047204941c75554082309d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545337, "uuid": "3d3fb493-52da-4dd2-a3bc-03f4c0048a5f", "comment": "Malware payload (Mirai)", "value": "83caf23c96fa1f13c399c09e525fbc116581ba0970479ad9fdd9f52f89abf2f14ff85e398de21ec69d89a63fe2432d0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545337, "uuid": "305390e7-a0c7-4b45-abdd-eee5048c0a2e", "value": "T1C843E7457D929A66C6E062BEFA6E119D336173ECC2DF322BCC104B447A8691F0D73B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545337, "uuid": "f04a69e4-5845-4247-8dd8-765a0e593e74", "value": "1536:eWLr4PP9Qg4FPxGaB+K3XUg1O5vT6fol/t5DuO3nSI:eWLrOB4FJZ3EOgWw9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545337, "uuid": "753b2307-6812-4829-bb7d-360d4a5f20a2", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545337, "uuid": "c8f3d9a4-2747-4b6a-b35e-fcb658a32651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545337, "uuid": "18d8fc2a-970c-4dce-a243-b4b409ee3179", "value": "c7aa75afa72094d88df8f6a764f4d0ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3074e6fd-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690527093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527093, "uuid": "8fa8ede1-070c-4fd9-b0ef-10f5ebbc7512", "comment": "Malware payload (Loki)", "value": "27ebd36f001d70bf417f1293df2b1246", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527093, "uuid": "2adbf45e-5f32-4839-a682-48a43f321906", "comment": "Malware payload (Loki)", "value": "656503f39d883991e9fba0b9bb417794542d02254ca9a5489a0075c7525aeec8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527093, "uuid": "0fbc1e36-478b-42a0-8ae0-b216eff217c2", "comment": "Malware payload (Loki)", "value": "2afa2291376811bc83483b0370b4d9b568da93dd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527093, "uuid": "4ac5b88a-de20-4c7a-8618-87bee5faf912", "comment": "Malware payload (Loki)", "value": "3a561a416b78b3cf08c26f2f67b664153cebefce7220afce5835518f05c92ffaf99ada2d3824c88a4e189a05e7fc2e14", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527093, "uuid": "b1642d0a-3ce5-43c0-b5d2-f5a701774430", "value": "T1FDA423BE14C56F72F22D69E88970634891797310ECD9BC88BD3A15EFA126172CF12BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527093, "uuid": "95172aba-2d8b-453e-9a57-a5efc930e5db", "value": "12288:neuAEDRIfGXn0CisvyzfBhLshhLr45p3Hiv4mXd7yN+wLlW:nkf00m+fB+hhLUxm7yN+wLlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527093, "uuid": "9f895281-878e-48e7-aaa3-6b56d080c656", "value": 488568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527093, "uuid": "dbaff3a6-8162-4468-82ac-9c3cb1f66b81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527093, "uuid": "9c64325a-e512-4a77-a645-03eb3d7d6b8b", "value": "PO#13046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e33606-2d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690562126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562126, "uuid": "929c1535-bed0-486d-9019-d31c27492131", "comment": "Malware payload (NanoCore)", "value": "1e5e35d803988e436309d35333ca1785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562126, "uuid": "9bad57b2-87b6-4521-85b8-439243634708", "comment": "Malware payload (NanoCore)", "value": "663774b7a1e5d1ca2028e0a2ce7cdda1e5666a7f929e0c3636e1546eec6e8410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562126, "uuid": "40445fe2-aff7-4557-ad32-d38d4f02ea07", "comment": "Malware payload (NanoCore)", "value": "0e5847797a62b027c2fc7e1e4a4606859ee1b926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562126, "uuid": "a1eacc50-ab7f-4c9f-a174-f5289c864b2e", "comment": "Malware payload (NanoCore)", "value": "15f6cb550e261653c9d019184520707d695785b6c2b7e241e468e5a79104b3ac5415ef1788a69e02f7ef4880ad23ed34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562126, "uuid": "4c34e4dd-4c73-4ddd-a282-a4979f3e5abb", "value": "T16C14CF157BA98A2FE2DE8678611251128378C2E3DCC3F3DE18D855B78F667E40A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562126, "uuid": "29af0c64-3db3-45e5-863f-6ae3fe0e2bce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562126, "uuid": "aa84efec-5c35-40a8-b440-d3369bab9816", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI8PSAShCWi5bu/qaBAIfG8vabk:wLV6Bta6dtJmakIM5kFhCWKbuf+PL4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690562126, "uuid": "d5c97db7-3321-4644-a83b-3fc38cbb1b8e", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690562126, "uuid": "4e8a5762-26cc-4f9f-87b3-f1601cc82870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562126, "uuid": "c7e0a976-4ee2-4e77-a978-af32cf3062dc", "value": "1e5e35d803988e436309d35333ca1785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654a85da-2cfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690517733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517733, "uuid": "c9a6a9d2-27f6-4c4d-a6bb-f0d42a84ff04", "comment": "Malware payload (Gozi)", "value": "0a8d5dd535e009d4109c690be03bb0c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517733, "uuid": "7958e560-9b0d-41d4-997f-6757fd59f500", "comment": "Malware payload (Gozi)", "value": "67a91e81c85bbb02744f47ac15b503e0c5302f145c0c22566608a3608ae78f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517733, "uuid": "4471b6c9-4197-49ce-9a73-4e5461ef0d7b", "comment": "Malware payload (Gozi)", "value": "b6e61950080fc3aef4518dad82c8fac9b417ac16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517733, "uuid": "d798ba3f-1044-4b87-9043-0b2a1008b9c5", "comment": "Malware payload (Gozi)", "value": "e5b253ceb7cfa78504a4ef3829d86ac82442c5280a9482513d90892b20846fda57498c2b8b0fb9caeaaf33757461176c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517733, "uuid": "b99397c6-5766-4585-96ad-d3142c1c0106", "value": "T129644B135290FC61F5264B329E2EC2E8771EF9918F1977AA22186A2F15B31F1D373712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517733, "uuid": "4c40f33a-8c11-4aea-940d-3a85fa63e04d", "value": "56227397015ae1e1706d3ca1be331d38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517733, "uuid": "d62adb73-273b-436c-a59d-c2f77d27c0fc", "value": "3072:y5F9vnvcZJGWqzpXLj0yFlW3D5qXXhHkqp3ArhV276u/dBo:oFFnvaGWMlLoy+lEEqp3ahg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690517733, "uuid": "a3c6feeb-03e9-42ef-a799-54ccd6b96893", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690517733, "uuid": "aad1b453-b628-4f0a-b55d-95fe6cb2cda5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517733, "uuid": "a7023a35-7a22-4874-b352-6528074d4b71", "value": "0a8d5dd535e009d4109c690be03bb0c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adb4101-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690539083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539083, "uuid": "7fe6f292-d8d8-4c74-a473-af402914d092", "comment": "Malware payload (ModiLoader)", "value": "a74dd5fe11a87afe1f534d5f58e67cba", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539083, "uuid": "f425012c-8152-4b8c-9a2e-8573b372494f", "comment": "Malware payload (ModiLoader)", "value": "68b6c90d2f3ade9bdffc47ad8ea30ebd38035cf539324977be1437b7ba835beb", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539083, "uuid": "5fdd6617-6325-41be-a1f5-3434b6dcb9a3", "comment": "Malware payload (ModiLoader)", "value": "be3b50816b49feb2b4b6a05c5338a36ae387307b", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539083, "uuid": "c034d725-67ee-43c8-8bbf-2b094ee18778", "comment": "Malware payload (ModiLoader)", "value": "971ebad9c8fec6775dba2309783752f9b380d97cbb6f187a817f3680c2fa379d53d6a288aac2a9625816eca3e11a84df", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539083, "uuid": "b30ca66b-c993-4a75-83cf-f07be8eb3917", "value": "T14D9423AC17670482D44FECEFF3CB12B634BE574BA85150028BA09372799E0FBDA60566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539083, "uuid": "99f93f01-73c7-46a8-b707-f170bf86698d", "value": "6144:tRPfJxRsN+Xzqu+fup2psdLNmz2MDi+p+zISqtjEv54Xn/LyWtP5ZW7wwSWEbmEg:rPBTsN6mPSSzPiu+MdNvX1hM7RSHmED0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539083, "uuid": "d6cee3ef-a980-4ee8-a7c7-65eb606da9cc", "value": 429046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539083, "uuid": "74a5248f-9a8a-4158-8634-19e775ca9ecc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539083, "uuid": "6dd971ec-d075-4efa-8170-fc2eab05c7fc", "value": "Pzqjjdgmvxfckd_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bdb4fb-2d0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StormKitty)", "timestamp": 1690525458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525458, "uuid": "b35011cb-1b63-49e3-b733-be8b31b305df", "comment": "Malware payload (StormKitty)", "value": "984508c5af6bd7744bd767ce822be17a", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525458, "uuid": "f97ebd56-f0ab-46db-8a67-f3c300b1e566", "comment": "Malware payload (StormKitty)", "value": "694cc4ed4867a6f50494c7a4228791ff52ba7b086f7b5bbcea3d50032142c8bf", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525458, "uuid": "1f8eda04-ffb1-4fd2-9831-252b740798e1", "comment": "Malware payload (StormKitty)", "value": "d4abb220ce21eaeb27ee63fe5d4d5700fccf4251", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525458, "uuid": "3760a810-31fc-40fe-aaa0-fc7eae0d8c35", "comment": "Malware payload (StormKitty)", "value": "dae256c350010cfe2299f55f028619f3a9a362a409a4f291c9f2bfc79386d53249cc1c6b047f06293456adc8451b99ca", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525458, "uuid": "60abcfa7-f440-47d0-9442-ec7ac16f7e77", "value": "T1EDC5AF5577A4CE06D3AE2776906354180BF1E38672A2E71FEEAB10A72C573701E423E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525458, "uuid": "1c17b2ea-0603-4777-9637-7240b403ebaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525458, "uuid": "c2986e14-d2c9-4932-8cb4-b9b2bf79ffed", "value": "49152:Scim4UhQNIQPFQlA7876XreAvS3Zuu+irFak3ZOsXD+c:Sq4kc46aAq3dFaQjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690525458, "uuid": "10fc6c3d-26c8-4ddc-a1a6-fa7c19c3d14b", "value": 2718208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690525458, "uuid": "d499c250-54a4-43a6-aa0f-b8ecf30af2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525458, "uuid": "07f6d3d9-555a-4d2f-ab55-85c3daaa139b", "value": "984508c5af6bd7744bd767ce822be17a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfe96de-2d11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690526230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526230, "uuid": "6e9b3f0a-88d0-4fdd-9394-b5094e843397", "comment": "Malware payload (GuLoader)", "value": "2c44e5ceab3c984d8b9d664267826f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526230, "uuid": "f8f7bba7-954c-45bc-b40d-4c70fd32d547", "comment": "Malware payload (GuLoader)", "value": "6b045381560ab640dd0b6c29b060a6d6ce9e34e65cbadd4898d3c595f2a81c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526230, "uuid": "832b9216-c4fa-4d70-ac25-13f5285fcbfc", "comment": "Malware payload (GuLoader)", "value": "3bba97af9353fc91c4b684627a9832bb248b477c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526230, "uuid": "24f1606b-5047-4e91-acdb-0a78688ee148", "comment": "Malware payload (GuLoader)", "value": "fc6c09a001c1641f9ba627bf7e0f444b1fd2d6867d966e0ab9e696c79a48955be61328ee12ec659579aaf951bbeb9b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526230, "uuid": "c9746541-b42a-4a96-b23c-de7776f7f78b", "value": "T1459422D45A50E15FDAE6833178FA6C3B5F70E203A5B54F0B03A82B09BD22FB6556D342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526230, "uuid": "56e6639e-09db-4f37-a1c3-12efd5ec939e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526230, "uuid": "451db1e9-0516-4735-a0cb-54337be5f6b1", "value": "12288:2czYeH9Yi+gGMfyWpArkc2YV0WDK4SxpvmcUlxi:2reH9Yi2MHp9OlD7muPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526230, "uuid": "762505d9-18ad-4997-a6c2-e2d821a2a9d0", "value": 445368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526230, "uuid": "ccf27fd4-cb2e-418e-901e-235f0da80725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526230, "uuid": "2f256dc1-c728-4836-8198-f5da4e27d33b", "value": "SR-2305001-C TIBILISI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57798718-2d45-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690548633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548633, "uuid": "80afce5e-2d85-49a4-a1a5-dda120c7509f", "comment": "Malware payload", "value": "5d262ab89d4bc0a9e258e5a49132f6d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548633, "uuid": "f8cd8877-78ab-4687-a9fa-9bb0bd148c78", "comment": "Malware payload", "value": "6be3f9d31646418e1275590630c10e817cd6d0dce2b8dd453d7a87b603c5d9b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548633, "uuid": "8f9ca877-85ff-4eb8-8be6-5d24416df10a", "comment": "Malware payload", "value": "58a5e622b340e54f6adf9fca914f442c31d4a6a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690548633, "uuid": "c07b25ce-b0f3-4222-9036-ad6b23e47ad6", "comment": "Malware payload", "value": "fbf5f2dac4b196c698f36f2df607deb6089ff41d4b82dffbde9f5a9c355d0db3667d7ddfd092bc959e4d7fae4c49b0de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548633, "uuid": "82f578af-b580-4f1a-9771-7e8cf2031e29", "value": "T1E0A445452B4FC0E0F7DABA438BC8B1B5FB4BF2C6463929678580941DA7DEDD03066B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548633, "uuid": "bc344dbb-466e-4a40-aa3c-bf6ab889ca9d", "value": "3072:3WEcEZEBEVEsEmEyEwEZEBE/EmEyECEBEZEBE/EmEyECEBEZEBEMEyE4EuEjEwEz:C/4CeDalwP6uPwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690548633, "uuid": "c8f3afee-9421-4aa0-91f6-c91a5d4955de", "value": 486582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690548633, "uuid": "f6e43194-6460-4b68-86ba-677b17c7e042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690548633, "uuid": "f900e3bd-4b40-4f36-9f5e-592d5fca5b72", "value": "qasx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2b3adb-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690534065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534065, "uuid": "9993ad4b-64b5-4053-909d-3dd23fa2a0d2", "comment": "Malware payload (Mirai)", "value": "6b60da1f062d5ac0a1834e7ca0ad4bda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534065, "uuid": "6e0b0080-1087-4389-b6eb-e1d4bf274347", "comment": "Malware payload (Mirai)", "value": "6e6d90c6df2d3bc732a65825ba1c2f0e87d2d4fbb81cb6343af63dacc6f98fd3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534065, "uuid": "c667e144-b29f-47fd-821b-c793a0fe5d76", "comment": "Malware payload (Mirai)", "value": "313d267c6d913ac48d12f3b5b3169e6137361e76", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534065, "uuid": "0eacd2e3-e1ed-4122-9c9b-11b2fd1be48f", "comment": "Malware payload (Mirai)", "value": "7ae9771f5f0ae877f9a0e9b1aafb01b3255922b60a4fa9d89e770f1fb36e2d69eaf533894528277ea07e1933e2d0be2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534065, "uuid": "84c5f378-eac4-4a03-929b-764d723a7f56", "value": "T1E343D546F9919617C5D10B3AFA0B134A73335718D3DFA3121E296EB49F87B6B0F2A901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534065, "uuid": "279b3307-e6af-4f5a-b705-a7523a666167", "value": "1536:WhnYHLrT8WO9QUpV+wuhL2IXiuhtm/281lYrScY:74SUpAFtm/28T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534065, "uuid": "3eabf22f-0da5-4d05-b1de-27a962f531ac", "value": 57175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534065, "uuid": "40633fb2-d0f8-4000-98a5-1a3adb11a6dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534065, "uuid": "06678d0f-963c-4289-b704-1a54b449b05a", "value": "loki.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e31dba2-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527572, "uuid": "1ef618f4-f408-4f1b-87c0-efa687e9e669", "comment": "Malware payload", "value": "5aa405bb3b08d4ca6502e7fff506d251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527572, "uuid": "4cfedcf8-c8cf-44b8-a68d-a11e112ba27c", "comment": "Malware payload", "value": "7127339ae0428d451887fd0279d7493b26a7eddeb6d566d83a71ddbc0ded3b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527572, "uuid": "118430f8-9f66-45cf-abb6-6170d2eaf6b5", "comment": "Malware payload", "value": "8fa2e3cf552c4476dac0fb52af1eea4dae95d385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527572, "uuid": "6fedfedf-47e0-46ce-a95d-b1b77bf86a12", "comment": "Malware payload", "value": "d4b477304943c585e87e118acd912ba599221931674aa5730c83ed70c3e6b67ac2818a9bdc43effdffcdd969d24c9c1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527572, "uuid": "1abc29ee-bd89-460a-ab2f-bb8d6a127d32", "value": "T10E0623D2F83C86F9C5B74C3404DDAA61E25EEEB25098BC374929AE538FD9F92554080F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527572, "uuid": "7b3b0ad7-48de-497d-8480-1520812f55d0", "value": "98304:hXRMxYUKJxO28EJuhT8VArZfrYUyYOep+KM7a:wYUK/O2k3VfZxOep+Kka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527572, "uuid": "0b185916-bb2a-4ca0-a569-1cdc709c9ae3", "value": 3670016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527572, "uuid": "b014f347-dd2d-4bd6-be78-5edb766e9691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527572, "uuid": "a7be1a1c-e881-46c8-9739-364b1ad57714", "value": "5aa405bb3b08d4ca6502e7fff506d251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df73b94e-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690527816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527816, "uuid": "d8e4c765-36b7-4f1d-86a9-f085bee0d237", "comment": "Malware payload (Stealc)", "value": "90a084b588a7efa0c8bfe3d0642c3b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527816, "uuid": "f995bd2f-9e51-46ef-96b8-61043d48ccba", "comment": "Malware payload (Stealc)", "value": "716857f5e8b803a240c78b87ed060fbef2c96695eadb0e5ac8b83e3d5e817c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527816, "uuid": "e886c0ed-ca9d-4a68-9101-fa2a9e919c5d", "comment": "Malware payload (Stealc)", "value": "4ccdfaebc9f9f16fcfeeff33547b7442670b243f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527816, "uuid": "ff84bafb-cebb-4a0d-a359-0eaa97ba4908", "comment": "Malware payload (Stealc)", "value": "c3fabfc0f2967886f892edaecf937e55ee476bcd7e43270a61682d79775a712a4906d339f3affd9c94afba505b905cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527816, "uuid": "578edd5e-313c-4abd-8e7c-f1ba9d8e9a53", "value": "T17F643C0352A1FC51E5264B329E2EC2E83B1EF9918F5977A622186E2F14B31F1D373716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527816, "uuid": "080cb2ed-1351-4d30-8093-5282b331ea3d", "value": "a5494563fbba88cb05fb13a72779b2e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527816, "uuid": "1792c585-b08f-4616-8fbd-6fbd7ae903bb", "value": "3072:aLL72A/vtGPbYpk226CLYWvmX+34yWOLTq6iAUF8oABFNkwkxwBo:m2ANGPkb2X9g+34yvqblAFkwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527816, "uuid": "ddb7e34b-85d2-4632-b3bf-adbe6e363b24", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527816, "uuid": "95f9b6a7-fb32-41f1-a790-aaf81e0dede4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527816, "uuid": "b67d9235-55be-4d9a-bf0f-8ef4c9ff6b6d", "value": "90a084b588a7efa0c8bfe3d0642c3b1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034eeac0-2d7e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690572973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572973, "uuid": "fa97a152-a3a9-4c66-88c8-9de60fa229d0", "comment": "Malware payload", "value": "8bd31a86cae78477f0787225eaa78926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572973, "uuid": "7b9277bc-2e18-45ff-acf2-d596b2865cbb", "comment": "Malware payload", "value": "71e00f9e4d1b0ed0f6125950c172a29b1a8b3d422762b539fd14355b2834d1d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572973, "uuid": "67d090b7-0cc2-4fc3-8f97-1e2dd7d0a598", "comment": "Malware payload", "value": "0658e7dadd566f06fdf0b919cc12d4143e88d9d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572973, "uuid": "a46291ca-bd1c-494a-af82-1fb3a6e18f02", "comment": "Malware payload", "value": "c865be6fb9262bbf92ca9173d7cd79bc484114a45543f1577b55eff61552aec3db59520f83065e22b00981601737a4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572973, "uuid": "c986e812-08bc-464a-8085-12599706bb79", "value": "T1F3340F037E44EB11D6593E3BC2DF6D2817F1A0CB1A33960BAF48AF6529416436D6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572973, "uuid": "5ea0401c-54aa-4c3a-87c6-c1ed61659193", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572973, "uuid": "aa990d08-fd4f-4964-b74a-041262c9e770", "value": "3072:rxvuk9GjXW1Lpjk7qi6mxvV1tD3vTziJ9fZws:rNGbW1LZk7qi6mxvV1tjP++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690572973, "uuid": "8b227755-cff6-4f27-a196-6c820080a199", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690572973, "uuid": "9ab20031-617e-494f-ace6-5758e3229126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572973, "uuid": "109ef637-17d9-489c-9b16-ce701c96cfa1", "value": "8f3252e4-0a32-4beb-828d-8b6987a6ae99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047b6dfe-2d9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1690586719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690586719, "uuid": "4921887b-6d2c-40a6-9860-4c210b964c3f", "comment": "Malware payload (LaplasClipper)", "value": "09c157f9647f8b0d434b38d7eadb8b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690586719, "uuid": "8f7121fa-88ec-40c7-bb6d-c4e51c2df372", "comment": "Malware payload (LaplasClipper)", "value": "729a18396d223d572bc1be314969a0cb5bb01e7dae5c5d1b429ed421c82b1394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690586719, "uuid": "322753a8-8f53-441b-a768-86fcda3023f9", "comment": "Malware payload (LaplasClipper)", "value": "e93dcdbab46003f7d06914125990874736f659fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690586719, "uuid": "7b630270-7bc5-4b15-941d-07cc3b1e848c", "comment": "Malware payload (LaplasClipper)", "value": "dbfc21e6d28c310def9c0757c5463365637d35d37101814364ab0e386f89ab4fe9a1bfb3a740be8239a22ad30f7fe55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690586719, "uuid": "a4e81eb5-73c6-4f5e-b287-43fa687d335c", "value": "T10304D658364BA57EC97F883D9C700CD56A7CBCA61246AB078C8EF4E4393B7919B051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690586719, "uuid": "8c70f7a8-38e3-4b2a-86b7-19f1d4b0ecb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690586719, "uuid": "951dc08b-2d15-46bc-b4d1-63ad5709dcd0", "value": "3072:lvnrZuzNeB6ng8mxNky0zWPsGTT8e8hI:lnX6g89JmsGTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690586719, "uuid": "7c82278a-1383-4008-969f-2165b6b36b09", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690586719, "uuid": "71102dc9-164c-4ffc-9c2b-5ec4bcc8bef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690586719, "uuid": "9a848e5d-f8a4-42b7-9882-28ff611ed477", "value": "09c157f9647f8b0d434b38d7eadb8b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdec16b-2d33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690540829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540829, "uuid": "26b16364-7fe8-45f0-a718-3694f0fb685d", "comment": "Malware payload (RedLineStealer)", "value": "56bd5c9ae2273e56306b4f9147b72cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540829, "uuid": "71ebcb3f-4ad9-4f5b-8db9-9e7bf69e4e9c", "comment": "Malware payload (RedLineStealer)", "value": "72f45c482b050d91a8653afd26c4acdcdc093ba92cbe1715ffa017d60fe46b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540829, "uuid": "ce0e3baa-c02b-4917-9efd-917ffcee8b48", "comment": "Malware payload (RedLineStealer)", "value": "114710c8be1daa33c26db1cd69402e94f3991578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540829, "uuid": "682a9f0b-52c2-4647-889a-3a42f3e0f24d", "comment": "Malware payload (RedLineStealer)", "value": "ffa4b3b0cc801f58694c0cfdc9b1239db78845cc04f7263718e5e244cbcb357e8a1b3e71a1fb7997c9ab50730a13361a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540829, "uuid": "728564a5-e509-4a7e-afe1-d909644aaff5", "value": "T1977409C03B8499EEDC8E49F16521067C9A60D482F787FB537C47A8F63C5A7897A053E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540829, "uuid": "d622213d-f217-408f-98f4-e79bfa72de94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540829, "uuid": "d156f136-ee46-4b63-9b84-881b794681d2", "value": "6144:Eu1gaIqhCgGXTTFR7Jh06Mz2+Xnze1HmcY1lY1Y1l1Yg9B1111Y11aY1+1h/w/q8:+qFGXTfJhLF+X2fqmv6hlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690540829, "uuid": "6bf630f2-ff65-4d75-a624-c3436bdd7287", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690540829, "uuid": "eb10b21f-f381-4058-95b0-e851eb0e34f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540829, "uuid": "d2e1422e-1476-48d7-89ae-2669b7700a57", "value": "56bd5c9ae2273e56306b4f9147b72cd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3ae77b-2d1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690530361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530361, "uuid": "781a5aab-cd30-4cc0-9d8b-b68e10689371", "comment": "Malware payload (StrelaStealer)", "value": "ad5b939469e9014588684e1ffcb4781a", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530361, "uuid": "2696fe74-2c8a-4e1c-a0c8-b1a0188ec89a", "comment": "Malware payload (StrelaStealer)", "value": "738975418f0642a9a3a4f5b45c6204d89112008c198c2484a2aaa7bb28287654", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530361, "uuid": "bc21efa8-4c84-4e57-961f-d667acfcc298", "comment": "Malware payload (StrelaStealer)", "value": "298cd0b1b72de71f22903bafcede0bf535f4c7ad", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530361, "uuid": "7f1d275c-514c-4c96-9108-1fe87652756a", "comment": "Malware payload (StrelaStealer)", "value": "9c14c827ae917995db298e6839dc985620ee1b65f0e13c5022b5bc0a31df1d578bc2ababdcb2c53cba85e921aa0844ae", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530361, "uuid": "b9b55805-42a2-41df-af38-881f5b2b8631", "value": "T10E943BBD64EBA54AFE618C342FFCBBA1C77B24A98757C7F045D9A03015204A3DC16A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530361, "uuid": "dad64dd9-056a-41a0-a1e5-0d52362a44a9", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530361, "uuid": "982fb796-53ea-457b-a536-9aadde6ed4c4", "value": "3072:i7KmqiImgYheDy6nHf7ZpihXMTBlGu8Md9IGa+ceaKUDcNwTZiVV7GtR4zuir8i5:iftU+zgXqYI1nwh0DAynpHmOTK5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690530361, "uuid": "4985cb54-9086-4e32-83df-811e451eaab1", "value": 418485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690530361, "uuid": "af636f36-ec99-462b-955d-7fdf26124956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530361, "uuid": "555a7acc-44df-4e41-bd8d-89cdd450760f", "value": "vefobxajshklyvirfjuqndiicfossnrgbwuuphnpjcijooagix.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd1fe0e-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545369, "uuid": "c0251c5b-0c69-448e-9274-e06ce2b77f18", "comment": "Malware payload (Mirai)", "value": "49e315a8fba2ce88de3323461d92feb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545369, "uuid": "d4299b0b-a3ca-4b26-afcd-e09f702d2318", "comment": "Malware payload (Mirai)", "value": "75ab7527310e26b62d16f50235ff2d7fdc6e847d07dd929213345c4d857e13a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545369, "uuid": "70770e65-3b31-48bf-ba04-5170a4153bab", "comment": "Malware payload (Mirai)", "value": "61cf8d66b246577cd60c6bfa82a008bf276d950e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545369, "uuid": "f5fc992d-5343-46fd-8b5d-d04ac0f5d181", "comment": "Malware payload (Mirai)", "value": "b105ffc5877e0cf6c661fd5bedaf197c99c196783e2493a6938e25478bfea505344080f75ab827433deab4b9cc1e662e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545369, "uuid": "e2cfb110-fd59-421e-a8cc-b9a3705a387a", "value": "T19C439E73C47A9C94D0848A34B260CDB81713B101855B3DBB4BDA8B6E4447EACFA5D7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545369, "uuid": "df11a84f-af0b-4118-9ba2-42c27a671ed1", "value": "1536:gam3WYvnz2wXgYcV0BX5l28VbWgnDgMrZDCKUO3nSI:gVFvnz2qZo0Bpxn8MrZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545369, "uuid": "5ba2e249-1fab-4345-8938-45800e64c811", "value": 58960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545369, "uuid": "03fb3952-db03-4eaf-aafd-2e78956088ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545369, "uuid": "5cdb871d-0581-46a8-9e73-9ee7ccb9fd66", "value": "49e315a8fba2ce88de3323461d92feb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce9cbe8-2d04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690520725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520725, "uuid": "1d328172-930a-4da6-a392-08191b5ad3c4", "comment": "Malware payload (njrat)", "value": "4b445d1c2ebe715d6405450000582acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520725, "uuid": "146ebf92-ca70-46a1-a63e-4f8875497985", "comment": "Malware payload (njrat)", "value": "75eb37d974cfd6c04ecc2558bf088bcca733322f96e40be9e461eca640dfe7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520725, "uuid": "11a2954f-12fb-474c-9292-9558761d20a6", "comment": "Malware payload (njrat)", "value": "f88b3a44268f43ea7fb6d36e606f72a3b34067ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520725, "uuid": "f1454739-fa7b-4fa0-bb83-9feed2379f9a", "comment": "Malware payload (njrat)", "value": "735060a910403457517264e95429e933a6e170c3e79eb66cb42b25667c6ac4a48b777603d13b52d22197cb14ed15e03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520725, "uuid": "0e11b892-9f00-498b-82d4-8fd70d3e5bf9", "value": "T190032A4D7FE181A8C5FD067B05B2D41207BAE04B6E23DD0E8EE564EA37636C58B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520725, "uuid": "489f99dd-f562-4103-8427-c9a6f050fac6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520725, "uuid": "02847870-2624-4d2f-ac89-4e519d5c999b", "value": "384:JmOs0IiejvCVLO309QmykrtG+dA+VfwvOSifrAF+rMRTyN/0L+EcoinblneHQM3q:bFdGdkrgYRwWS0rM+rMRa8NuKgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690520725, "uuid": "5cead2ee-0c0e-4ed5-9f15-b869cdde2b4f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690520725, "uuid": "f58f0f3d-623f-46a3-a5d2-9bb07fa6f331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520725, "uuid": "fee6688e-c147-4781-ba9b-ff6349569bc5", "value": "4b445d1c2ebe715d6405450000582acf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652386d4-2d17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690528899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528899, "uuid": "0ae169d7-107d-4681-902a-94028d813e29", "comment": "Malware payload (DarkCloud)", "value": "a3adc5e04b6ea5a57aa727899979ee55", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528899, "uuid": "8e5dc148-ce45-471f-bbd9-a88a7c8f534a", "comment": "Malware payload (DarkCloud)", "value": "7644909858b408032ab382ef3caf7fc32153cc2ef1e1e429812a2a20d75df284", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528899, "uuid": "f3b287f2-9d72-4267-a873-cf40032e9563", "comment": "Malware payload (DarkCloud)", "value": "a1674b7817776661fd174885e97de7b7dad7c2a8", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528899, "uuid": "6c3663d8-0260-4709-90aa-6fd31d2f679f", "comment": "Malware payload (DarkCloud)", "value": "f04e62e4da20875a2695d1dea1f1829102c0adfbb62e8614562bbd119d6b0b81e9be16f95b484a11243179c2024fb307", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528899, "uuid": "42130fa2-c69b-48f6-821c-d3e1e0482959", "value": "T1CA15336A8DCD617C6F2704E7895DBCF8EA41375778F3A87F243B18CA2C03949852D926", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528899, "uuid": "2638a6ec-2da2-4d59-9e2d-a525ea15c28e", "value": "24576:nZcGbKOcPMG0fWrNmuwrcqqkzoc0K4iNURWhv6ypp:nZcG/NG0OrNLwrlXv0K4i6Rifp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528899, "uuid": "457dc7f8-1dcc-4201-858b-aaee1caf5615", "value": 891130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528899, "uuid": "b6d4f4c9-9243-4a1b-96a9-9a668c54c89d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528899, "uuid": "11ded618-6269-4d8b-96a9-3cf3ff0d4c80", "value": "INVOICE.pdf\u626b\u63cf\u4ef6.r02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4374d39-2d15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690528227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528227, "uuid": "7e0b19b9-ba9f-44f0-8dc4-4612dfcc7799", "comment": "Malware payload (AZORult)", "value": "d840ac28b7d8dd654298df19b820a85e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528227, "uuid": "9ba10aac-6a6a-4da5-8519-116ab373a75e", "comment": "Malware payload (AZORult)", "value": "76ec93687676ff7c8e91360983e4f80f4af6719620be56de72464e6f25b0b341", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528227, "uuid": "df4f70b6-667b-4fca-9c92-176aeab951f1", "comment": "Malware payload (AZORult)", "value": "de096cbce31e364ba42ec6da13948fa673d406a2", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528227, "uuid": "3ab9d9ae-9ae2-472d-87ee-f4e14c476972", "comment": "Malware payload (AZORult)", "value": "0b3da586098ae509e9041667ba09faf7c28553af7d6e3768403e45a64ccc0ba50d3de3ea310d77df859ec067e690270a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528227, "uuid": "552083a5-b283-4abf-b0b6-134ed3a7fc93", "value": "T1400412177B90A877C61905710E3BAA57DB7AE908946A9B4B27805F4B7E030C1C73E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528227, "uuid": "17e32e3a-1aa2-4d9d-8449-be04004f185d", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528227, "uuid": "fe93305b-76ca-49fd-891b-3344414fc48b", "value": "3072:nwDijpS4DbYcr8bwndeauZqRVje/Whh9UNzUrvtr0b/Tar3Ls4ZMIJ3yY7obemku:nFPewdeaTjelNQJ0b/Tar3LD3y0Kea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528227, "uuid": "15368ea2-b060-449d-9e7d-4a951027a787", "value": 184387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528227, "uuid": "6335461b-921a-4454-9236-25194ce64f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528227, "uuid": "2593d1cb-1ec7-495f-b783-b57556ee311e", "value": "Order R04-T4077 TBA-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d0a233-2d17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690528924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528924, "uuid": "c4134268-f8f3-4a2d-bb13-f3359cc1f006", "comment": "Malware payload (DarkCloud)", "value": "1ad1f2c6e0363a8a33b5a1390e862f28", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528924, "uuid": "6509c6b5-9154-4a7e-8d9e-96f10ebb2189", "comment": "Malware payload (DarkCloud)", "value": "78ec83665474fd6f60faa871d76d20dff87da57146bc9af5858181e0daf04184", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528924, "uuid": "8f1861b8-fd91-42e2-9010-11793377de09", "comment": "Malware payload (DarkCloud)", "value": "1069afd4fd14757ea82b40bf04f8bc7c8c536224", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528924, "uuid": "dc02da3a-2911-41b6-91a2-05e1318c72b4", "comment": "Malware payload (DarkCloud)", "value": "a93290d431d485e172743cb923d8c27bfe04893d450c3eb79a8288c1f0e4f0e52fdf60f313252461a8f0ff3559dbd57c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528924, "uuid": "11338dfb-7c9b-4d90-a9df-91424029ad5a", "value": "T1BC153312118159EE9327FB3EB4F96A39725CDA824AC0E815CF767C25DA6D1007C3B6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528924, "uuid": "24066a8c-4fa7-4962-8712-5451a116930c", "value": "12288:DmCiB4eK6dU0EYlMCdkCx7UNAv1d6leVrPC3VY8ceE1WNcwOFfBGCD7:DmCxWdMzCfqlAG3VY9nfBGCD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528924, "uuid": "f194a28e-8e91-4307-abdf-7c95516efd8b", "value": 894932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528924, "uuid": "6b1f44f3-5451-480a-940f-739bb644bfd5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528924, "uuid": "ad80bcef-6ccb-461c-9be7-5e5335f2ade2", "value": "PACKINGLIST2.pdf\u626b\u63cf\u4ef6.r02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78f7c9e-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690534165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534165, "uuid": "133dd189-e455-4e26-b95f-0efaba83abfc", "comment": "Malware payload (AgentTesla)", "value": "6b7e4858203be7a162adc938a0a6ee77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534165, "uuid": "6c2e202b-041a-4bee-bcb2-050225a8d77c", "comment": "Malware payload (AgentTesla)", "value": "79b920d634334a0c90d75e4630730604ca9caad3ff3ec66f85bce143bbb56d49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534165, "uuid": "79648ee0-b645-48d0-970c-f9a7f72a0055", "comment": "Malware payload (AgentTesla)", "value": "8a96106107a20a28988bd891a82df57f350bd2e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534165, "uuid": "46d5838b-ab67-4970-9299-736f6fbd343b", "comment": "Malware payload (AgentTesla)", "value": "980073df02b368d1272809df07e113e6ba2714959a0de0ac087952d65b3294abbf2551ead1f5dc72ad1c7a3eaa36e0f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534165, "uuid": "a54a9abb-6479-46bf-8212-cbcbfde763bf", "value": "T15FF4E091E22C1FA7C43A97FD0825910463B6BB6A113DD2495DF778CB2176FC20A46F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534165, "uuid": "294cc91b-a340-49ad-bba5-8589cb63aee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534165, "uuid": "011cc1f9-b95f-4411-8605-a80db5b0dc81", "value": "12288:QRgjjHxak4/eCTpsjmxBvoP5R1AW0AhjCy0Ma1keNE:QRgjjHok4Vrv62Wlz6kSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534165, "uuid": "6a47724d-921d-4259-9032-62d82f5adc66", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534165, "uuid": "c3ab5a86-e682-4cc7-8d8a-ea63abb7450f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534165, "uuid": "577a6203-bd01-4947-8ceb-e21bb5542601", "value": "Invoice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71699d7c-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527632, "uuid": "fcfbb78a-4765-47e6-b536-591ef47ab0ff", "comment": "Malware payload", "value": "6b8db5cd41df873b90f18fdb09b1a4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527632, "uuid": "7b22ba98-eab3-4409-bfd3-25089ce7ece0", "comment": "Malware payload", "value": "79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527632, "uuid": "894a51dc-d235-496e-aff5-3d55af13896e", "comment": "Malware payload", "value": "d043db0f576cb97efe3edd11890795319becd70b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527632, "uuid": "c8fd246a-5cf8-4d01-a2e7-930784010841", "comment": "Malware payload", "value": "8c45ebcaeb1821ad256068ff0e1cfaa496a1623f962525c2f3d3a894df323e72822b365b846abe27b1750fc9de785998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527632, "uuid": "85dbfe62-3a3f-4164-b382-476bd2216e5e", "value": "T15414AF4A63E460A6E4BA57B498F302835A31BCB15B7582FF12C4D57E0E336D4AA31F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527632, "uuid": "02cc2269-d599-4041-b5be-0a9d4fe26c60", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527632, "uuid": "8be701d3-f5de-4e86-a02a-eba41742892b", "value": "3072:TahKyd2n31/5GWp1icKAArDZz4N9GhbkrNEk1+q9nqtrJReNyT:TahOfp0yN90QEIQzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527632, "uuid": "da877968-a236-4106-b68f-df56a1ef6d66", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527632, "uuid": "2a83e301-23bc-482e-86e0-6adbfecac42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527632, "uuid": "dcc599d3-bab4-4c38-89b7-1ec57e92ab85", "value": "6b8db5cd41df873b90f18fdb09b1a4bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eae001f-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690526687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526687, "uuid": "2bd719b7-0098-4bd6-81b8-660b0be58dc6", "comment": "Malware payload", "value": "271525205f56d7e5d46daf74f11771bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526687, "uuid": "61440b56-124c-488d-b1b0-db3faeb1d5b5", "comment": "Malware payload", "value": "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526687, "uuid": "8a547d55-0c12-47ce-9274-af7515649e97", "comment": "Malware payload", "value": "7f0d7c8dec642aac154d0f39dc576da6d6977c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526687, "uuid": "d1238f77-84c1-4755-a33e-9066d158e1a6", "comment": "Malware payload", "value": "9f0c179a788b93eca6ff3d38e3de58185777024c7d11468d799a269317bdf7443108308c583e3eda63688cf0e23f7218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526687, "uuid": "5d4583e0-ee6f-42c4-bd5e-b3795f7b0385", "value": "T18EB523A19C4394EFE6DB34699843FD623B2E36E1C422B9B144F81ACF7757B08AD59700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526687, "uuid": "7667a7ca-42ce-407c-9836-5a74d408c34b", "value": "49152:KyLAuFqcgIVtpYxATSG4vSATVlAahREhGsmczLMOSi10EvkAfVjZgsIB:KykuFqMHmGlYVlFPKGszK006t9jZEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526687, "uuid": "f8ba4ce0-f022-418e-881f-0535c477017c", "value": 2369753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526687, "uuid": "a8225e9a-22ac-4de7-a8f6-710a89b7b3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526687, "uuid": "2edfa755-dbee-4739-a3a3-14c74ccc36e0", "value": "271525205f56d7e5d46daf74f11771bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bb8c7c-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690527149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527149, "uuid": "62c944f5-53cc-4ce7-ba89-6e7550b4ebb4", "comment": "Malware payload (AgentTesla)", "value": "2e4585df27a043a6caf11f85f0d757c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527149, "uuid": "1db9180c-4891-46af-8b84-5ed82f107c6f", "comment": "Malware payload (AgentTesla)", "value": "7b37b945add0e6c872027313e3e011bf368c5cd038d48d3f719e6f08927af861", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527149, "uuid": "afb0872e-caf8-4c46-97ea-99b5783d2664", "comment": "Malware payload (AgentTesla)", "value": "b70e0d855619b30eaa38678b13f1041669305494", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527149, "uuid": "075ea791-aa97-48ae-bbb4-f22cc7e6dcd1", "comment": "Malware payload (AgentTesla)", "value": "d58fc54b3a23e4dbf754eb5ae355c5484cd568585c15a228a8adfbb7f657800c4a712af25911a98d257abe71ab74fc82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527149, "uuid": "b3189d0e-4c99-4b79-b427-782aa8fbd53f", "value": "T14EC4123022FC6A15C9FE7BBB557145050BF1E52A9A22F7086FACA1D70E347209B94F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527149, "uuid": "1c85e327-7d81-45bc-862b-9ded12e8a3b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527149, "uuid": "0349736b-3ad4-4143-ad9c-4339ad0e679b", "value": "12288:NXPZ3ArOhbyxHc1RjSW2reMhD73RCjhj1WirITOarH:XAKnpS57p73RCn7Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527149, "uuid": "2fbc6189-40ac-412e-aa82-877191cb2964", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527149, "uuid": "d2079a76-a33b-41e4-8f41-df6f0265d1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527149, "uuid": "20ae83c8-a710-444f-95f1-7c790da0685f", "value": "comprobante de pago_4002664000.xla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48725f04-2d73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690568365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568365, "uuid": "86d9c3fc-5561-4309-bdde-d564814f1c76", "comment": "Malware payload (njrat)", "value": "b73054ccf28fdef8e454e2fb39f53fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568365, "uuid": "c3590950-e253-49a4-a7b2-885d0203dc20", "comment": "Malware payload (njrat)", "value": "7b867c9229398ff0eb65e6f23123fd7b779bc03df3aa045227a3f1edef91c962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568365, "uuid": "07e5c7c5-51d8-4c1b-a8a9-b28485576c8a", "comment": "Malware payload (njrat)", "value": "737e8b883bbd39be6ba34c636221b216146aa8f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568365, "uuid": "76214616-e95d-4e8e-9f2f-46465b3e2eeb", "comment": "Malware payload (njrat)", "value": "d54b18d5f6eabe8867264c91b83682a5bd32afd8256dc2df738bc0c67f1c0aca062c85cb9eda96578e76057ee69b697c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568365, "uuid": "cc38be3d-3c88-4c6a-850e-51c1576d8e04", "value": "T1AEE208067BF98215D6BC5AF88CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568365, "uuid": "61839a95-c272-4da2-ad14-3cb44b0931d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568365, "uuid": "78c06003-674d-48d1-871e-d5ae0f6e429d", "value": "384:Z0bUe5XB4e0XOOVcsw0Q0mS03AWTxtTUFQqzFlObbR:iT9BuN6555dHbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690568365, "uuid": "2cff3d66-f602-46f9-951e-623def9fe55a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690568365, "uuid": "92da81f5-5e06-47d4-9099-1dad09e774b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568365, "uuid": "6f0a1a54-9513-4418-ab12-a4e8500c2a32", "value": "xV6JYfdQbs6o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654d2d2e-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690534054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534054, "uuid": "f904e155-f497-4004-9ea4-d637a32d2990", "comment": "Malware payload", "value": "6e11f805db7c9acf6d1784796235aea3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534054, "uuid": "86536269-fdad-421c-ad7a-642d3e276067", "comment": "Malware payload", "value": "7c9345e5342f667ed37a63de4623342694a76aa285e4640f11e725b21036b3c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534054, "uuid": "44688023-ab9b-44f7-a4e8-2b79e67af3fb", "comment": "Malware payload", "value": "1020aeb016962c5e521e5def10cfdbaae50cf85b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534054, "uuid": "6dbcd004-e26a-49ff-8350-e555f1df3ff2", "comment": "Malware payload", "value": "9424706635261a8923f005d39af9567e0402a8b6843ea679ac21becf781b42eec6cbc08e3d847680a23ab36e98cf089d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534054, "uuid": "7966359b-c126-4945-aae2-69ac820471c6", "value": "T18A132A46AB43DEB3E80B11F112FB5B324971FCBE1822D691D364FDA0AA258D0E51776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534054, "uuid": "4fb7cb58-5254-43d8-a102-55ba5aa1ddfb", "value": "768:gC+f1HkKMZ3rw/SXxKti35PJhXWdk5tgbOVB8IGLRkIrD:gCP3raw35xhXWu/PGLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534054, "uuid": "4aac9c32-72fb-46c6-adf8-1d4b77f5d487", "value": 44448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534054, "uuid": "d19b67f5-e9b2-419f-9ac6-145258d874ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534054, "uuid": "e30f92df-65cb-4fa9-b0a6-e8c586649c49", "value": "loki.x586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cab0de-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527696, "uuid": "a4bbe953-7f0a-47b0-948c-25fb34245c34", "comment": "Malware payload", "value": "84d3a740884cdfda97da629a2b685342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527696, "uuid": "75dfb24e-3f62-4f3e-abf6-58c6766b0afc", "comment": "Malware payload", "value": "7d51870883190ec7869944c52c99fa1635d19da5b3f60636cd07f7bb33ff096f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527696, "uuid": "cf5748f9-c5e0-4cd8-8301-7c1d1ab86d1e", "comment": "Malware payload", "value": "d81daf0ee6ee7b9ae77a0e04799344ce4315da45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527696, "uuid": "a3688577-ca2d-4fca-9132-27847945dd2d", "comment": "Malware payload", "value": "536e6bba013848ca3cad8f6b1d76e26d8ccb7c9accaab92741f7d8f28af20b892598e453059581a4e4b91382471a93f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527696, "uuid": "396717b5-7fa4-4d09-abfd-3f3ec72978a2", "value": "T1A0E37C2135D0C073D46365344871C6926A7F79322F74A9CB7BA81A3E6FB03D06B7939A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527696, "uuid": "a04c4c6d-66c1-4aa0-b123-285e7fde7f51", "value": "1536:nP1Wrtpj0DF2UAWvL8BWIIRZAWRBjDJR77Y6snJwp:nPwrjq2vmL+W5ljDJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527696, "uuid": "ad7ed897-c074-4d76-b155-43dba2b6438d", "value": 156991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527696, "uuid": "8565247e-df0a-4a9f-961e-abf06fccf74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527696, "uuid": "86778560-967f-4a5e-8895-aa7c74734ea5", "value": "84d3a740884cdfda97da629a2b685342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef32b35a-2d5b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690558337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558337, "uuid": "d4c94391-e9a8-46a0-8c32-77f367b9b0a0", "comment": "Malware payload (RedLineStealer)", "value": "b674a6eb6da2769d68f7d4589513ce51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558337, "uuid": "faa5cc7f-d819-4c2b-9cb0-ae6fc9fc46ec", "comment": "Malware payload (RedLineStealer)", "value": "7e29748577f5438f686487356117cdfe33225170c255f973c6ac1b989b4f89f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558337, "uuid": "9ef4b903-5e3b-44c3-a3ba-5a8fdb9de2a2", "comment": "Malware payload (RedLineStealer)", "value": "064b1ea27ee4fc7d6fe1637bd7b95ad617f18ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558337, "uuid": "da284750-922a-4cda-978f-e58a4c97c949", "comment": "Malware payload (RedLineStealer)", "value": "e5725e0f5842919f835bf3182afb85c5b325c0a39dad38065b5826ff16d96efb17cd1c9dca259b61d7b67dcb391a371f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558337, "uuid": "0ba20394-7c2c-431e-8a7e-d7d9b718698a", "value": "T16244293A11A144ABC8A99D35FA4BD8D135162EE401BD940F7FF75E386BC20938DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558337, "uuid": "8e986f84-5ec2-45be-8b7a-68497f9ee9b4", "value": "f49ae647ec736589129faec477cb9455", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558337, "uuid": "74634461-553b-4b4c-89f3-49c2ad5074cf", "value": "3072:9L+k+cAVmfQDIstzUblswcAJDDgio3QnfqqLfNByR4q9VxIrG7jxo:9LUiQDftSXgio3Qnfqqf24q9AS7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690558337, "uuid": "870d1437-7cf3-4718-a58b-bb5b80a069ae", "value": 258080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690558337, "uuid": "2a56f84c-7f4b-44b2-9a4d-ce8b4eeb14ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558337, "uuid": "b4bde8b9-046c-4a9d-9c2b-61b609f6f67c", "value": "SecuriteInfo.com.Win32.PWSX-gen.14945.30837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fa92b4-2d32-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690540652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540652, "uuid": "5f1f3144-1c51-4c6a-8712-2d9c9dc815a4", "comment": "Malware payload", "value": "be231d0b99fd570186881418144b8f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540652, "uuid": "90d3face-c436-4d02-99bb-e515679cb7e1", "comment": "Malware payload", "value": "7eeabb966bb76b7feea6cf3963677d7634fba3c4b5ed2c10c541c40738ccc64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540652, "uuid": "f4c72218-8454-4ca0-873e-95cf42f1eddc", "comment": "Malware payload", "value": "ad0e23b0c6679b01d28a6f3aa34883dad52b83b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540652, "uuid": "2fc96b08-1681-45a6-9e04-69f1e35a89cd", "comment": "Malware payload", "value": "257f73acef6dce548ed87000984544b8ebf520020d1f5dd37533e7d101feff9dba1430817af225b4a8f3cd3a09184aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540652, "uuid": "e5b2dd95-e3d6-4c95-a377-35147e1abafc", "value": "T1BF336B1C678CA233CABC297D84DA614127F9A6FB2B03E30B5DC4625C5D63BDD5502AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540652, "uuid": "35c83484-a6df-4073-ba51-68240bd62d4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540652, "uuid": "85e1552d-7d24-4c1b-960c-c737aa4c9957", "value": "768:Mbp/rhE2NeWD/7M9WkEludkRhh0YN8g1HnC84qKXIHKE9MEAhPWJJcXx+:MbdrS2NeWD/4ckEM8h1liN89RSgJQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690540652, "uuid": "552a9c13-90cf-4288-802b-06df9c962733", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690540652, "uuid": "abda6d58-e9e3-4907-9032-8ab0adcdfd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540652, "uuid": "1b7b5159-7103-478e-993d-a6b9383cfbac", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.688.4659.9090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247526a1-2d10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690525784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525784, "uuid": "d9c6d8b2-b698-45ed-ac45-299280935b2c", "comment": "Malware payload (GuLoader)", "value": "1f4365fb20db051b2b510416ee167971", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525784, "uuid": "af41f9f9-c806-4d11-ac98-194fa8a055cd", "comment": "Malware payload (GuLoader)", "value": "7f68efee50129fb2c25b58908d378d5d716113090c0169aa2dee3cec7f808421", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525784, "uuid": "6ac1cfe1-90b8-424a-856a-380ae29c37a4", "comment": "Malware payload (GuLoader)", "value": "316b3e13761fa5733d0e87f4ff28620214465a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525784, "uuid": "1897f7ea-53d8-4ef2-9d85-74681bd64627", "comment": "Malware payload (GuLoader)", "value": "86f05b99c52c4dd2087672866209fd64749327e1bfca96be329cd31b48024f11f8e2ba830c55438aa4f74795804abcdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525784, "uuid": "4f93557f-292c-44e9-b9e4-227177258248", "value": "T12D84E183ED904266D8180439A6E7B72535F78C7D9B8ACF1313D871262FB2192257E37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525784, "uuid": "5e70d677-d1e7-4cb3-8f38-df7bb4ffa992", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525784, "uuid": "7fc7ec34-f921-4ac0-a933-22ef93dedf83", "value": "6144:pBe337n8xkABZYQkutr1+8nkTN5044WYtiT+ab4nX55MjFGC9:q7LABZYQkul17kTXW9vab4X55MjFl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690525784, "uuid": "6ac07e16-710f-45f6-8ffc-e73192a7b86d", "value": 407696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690525784, "uuid": "fb9cd00a-8c5a-4d35-9072-3a7b86cdfd9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525784, "uuid": "178dccff-bcd9-427c-b94e-350eecaf2164", "value": "1f4365fb20db051b2b510416ee167971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3535893b-2d11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690526242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526242, "uuid": "2cb485d5-adcd-4771-9855-8c088db0e560", "comment": "Malware payload (SnakeKeylogger)", "value": "599dbb42835f2c2389a3ac00625c6d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526242, "uuid": "545330ab-e8ea-4be1-a61d-52e1c03c1d12", "comment": "Malware payload (SnakeKeylogger)", "value": "80c0c7648149fdb4b41f5abc6316de36da5c3133676d4c9d68e783ba70cb46c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526242, "uuid": "5325f8ad-23d6-43bf-92bb-2512c94ccc6e", "comment": "Malware payload (SnakeKeylogger)", "value": "18681d0de8bfc3787e3d5d4d90e7813936f6cead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526242, "uuid": "dc16e354-577a-40d7-9c68-f5cd00034341", "comment": "Malware payload (SnakeKeylogger)", "value": "e7370dbe8f515bebc150afb345dda8752467fd82d2579d3f38ad0390ecffff11582d33d76454479ed3dad8334f876f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526242, "uuid": "e5e6ab3a-6a45-4341-86df-c5abfd2fbea8", "value": "T192D4132118924A36E55E4B724CA0176D93BA9DBC2EA8C33CF5F61C8C9C073794256DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526242, "uuid": "6370d344-8b55-4134-8470-4302872f3356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526242, "uuid": "bb0082ea-1cd7-4705-bbf9-578478f8061b", "value": "12288:vbO5VXjsqBLDJ3vUiXsYahj7uGZhdMT4PLrGbO5:zODzRL1ds5zZDmGLrgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526242, "uuid": "9979884c-f77a-422f-9954-00a1f2a90e96", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526242, "uuid": "6e885f72-eab6-44f5-85fd-54406013c433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526242, "uuid": "9559b12a-fd76-4658-ae70-6fae432679a3", "value": "Purchase order.pdf.z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380e33ac-2d7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690572632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572632, "uuid": "a28d109b-a478-4706-a703-72cc98315747", "comment": "Malware payload (njrat)", "value": "3aadcfc6f5d62f461becbaa3dd9b7594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572632, "uuid": "b5b8b3a6-7fb0-4124-90ea-9ef58d95af25", "comment": "Malware payload (njrat)", "value": "81c7f3b893ef08fbdf673f54328da49d4e556e37b5efc5eebed3708bf0132a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572632, "uuid": "d7ce6247-7bde-408f-a86c-0815a0ddad77", "comment": "Malware payload (njrat)", "value": "ff99a6f16e0128c3eb6ef97c02b2a350627420fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690572632, "uuid": "1a6d0948-4b48-4cab-b02f-d3905016e053", "comment": "Malware payload (njrat)", "value": "70bf08bc508f7ee1a7aa04bba50fa1782f83450a58d1333c18b2c3337a6bd0c01e23af51ee249347dc9d2cb0552d4c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572632, "uuid": "907184fe-9077-478e-bdb1-e6199bcb177f", "value": "T10D44E9BE73448F11DB983571C1DB912447A2ED926232FB873F9832B949123B79D097CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572632, "uuid": "9bae18b0-49d2-417b-8b0f-bcea3df81f4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572632, "uuid": "2836d1f2-f227-4ac3-9d75-d8af8fa83632", "value": "6144:lolA3NkvQ4nnkroqMqczZZ5FrCy9vKv2iI/hV9JuB5:q0N41AJk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690572632, "uuid": "a8acb76f-61fe-43d7-8f83-f8e1e10b37c5", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690572632, "uuid": "e0006296-fec9-4f97-8100-0856095e84ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690572632, "uuid": "0e9fb9e0-540a-4704-b735-7d107709b6a9", "value": "3aadcfc6f5d62f461becbaa3dd9b7594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2b3d4d-2d52-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690554144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554144, "uuid": "9228242b-68b2-40f0-9f9c-c835aa79be70", "comment": "Malware payload (AgentTesla)", "value": "88e583780ca5f6e65249c2b371fff4bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554144, "uuid": "ad0ad8a7-09f9-42d2-a544-366d2d95a1f8", "comment": "Malware payload (AgentTesla)", "value": "81f212a2fc589aaec29e362c17af8209bb0ebfc4e92b1c8b0a2da3a3e62c65a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554144, "uuid": "c78644c1-e9c6-4468-914f-b530f436e318", "comment": "Malware payload (AgentTesla)", "value": "d40aca114344eead47147ba4819ac9b7c09eab62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554144, "uuid": "34448510-1fdb-46d6-9db7-71735a8c3a8c", "comment": "Malware payload (AgentTesla)", "value": "ea5d351a34eadbadff226308c501716283897db2a95c593c279264ac33d916890367902b177c9b8df57fb820864d700a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554144, "uuid": "f79cff26-c076-4c47-9ee0-3da7434a4432", "value": "T164F4F051E26C1F9BD43693FA0821E10457B6FB6B103DE64A5DF278C722B2FD20986E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554144, "uuid": "8b9d3a20-7e3d-4398-952f-0ef8b02c9028", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554144, "uuid": "b1340900-88bf-4a06-be3e-3ca307a190b2", "value": "12288:8ZgjjizdwKNwzkGvZgDZH9JNaCMtLsh5GqrzlyyvtjnTE1lM:8ZgjjJkGmdH9JMCMtLshZ3tnAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690554144, "uuid": "eb7cea0d-9d62-42f0-80b8-2a285dd2122e", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690554144, "uuid": "6f1dc3da-a419-4c14-b84d-b7b9526f8e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554144, "uuid": "da58e886-e610-4d81-8722-2fbcbfd75de0", "value": "SOA JULY 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addc1e46-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529451, "uuid": "6aa7f57c-0bd5-4a36-82bc-b91f35dd0574", "comment": "Malware payload (Gozi)", "value": "8ff7db28381ad057d750e0d9da5acb81", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529451, "uuid": "e02b626b-1f76-4146-9b64-c6b2406f7809", "comment": "Malware payload (Gozi)", "value": "847cedc31a4bdcb826dc199aacce9890b22b0384159b5794dd1cc9b71aced0ce", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529451, "uuid": "0341aee7-2a46-4a3a-9c14-5b0b91c365a7", "comment": "Malware payload (Gozi)", "value": "03ee029e92df0158bee7de15929ee3cbf0558fd5", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529451, "uuid": "70cb9fc8-fbac-4efa-89e4-d852aebe38d1", "comment": "Malware payload (Gozi)", "value": "3c6a52f7e43db823d1b8e154921e23e9d7e5e1c186f3e158a1bdccf81c4f95fcb4c7c0fefe4c1b17d43f24972b29ea53", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529451, "uuid": "51f63f66-f18e-4fd4-b1c1-b06c806b12f7", "value": "T1846423F0C0A3F93948F10F87DBEDF364564F7482591066882664A2FD9815AAF3CD9F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529451, "uuid": "01de2c94-79e1-46eb-b7d7-56109bc3fb47", "value": "6144:bXSF7jZ8PkvlWFHd8KlA/sK4Oh+qp2eFhzfCZeA3ylpXN00:biF7dSqlOHd8KlAh4OoKKH36p900", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529451, "uuid": "a95bd059-53b5-4279-9695-aa60addc9e6a", "value": 335347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529451, "uuid": "35a9378c-a5c6-4949-ac0a-8e2f868ca370", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529451, "uuid": "194f7acb-f313-45a8-b26a-4e8f3f93d756", "value": "Inv_7272023_6925114913.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65bcb71-2ce2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690506326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690506326, "uuid": "b61923d2-41d4-404d-b9c0-710f15464ee9", "comment": "Malware payload (RedLineStealer)", "value": "10aeaf8eaaf34b9434e88596138fa18d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690506326, "uuid": "ee110c7e-7b82-468a-be56-513260fa2a2f", "comment": "Malware payload (RedLineStealer)", "value": "8642006c122c788ad5155d411b63f5344639c51fb7ee9064b76ca84085427b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690506326, "uuid": "4e4eef36-3f6e-4728-b448-5fe0dd9ffb03", "comment": "Malware payload (RedLineStealer)", "value": "e884992188eb52ce1df2d2b86086303f732127be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690506326, "uuid": "d9d518c3-17f3-4532-80f6-9862f81ccc19", "comment": "Malware payload (RedLineStealer)", "value": "9d10f2dcb593fd2266e2ec3a424210021231ac2bfa231621be72323c80087f4b1833952578a870d2937282f315f29d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690506326, "uuid": "3cb023fc-a216-42e5-856a-19ffc54d0957", "value": "T169E5A25AA6D904DAE03681349A1D321AFC3BF4DE4B148FD76FB8844F53E6AD069F6304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690506326, "uuid": "d8dbcbc1-ae4f-4131-a0ca-c4056ed35472", "value": "2cce92ff98c626ceeaa0c563d3993e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690506326, "uuid": "9fc192a6-8d3c-4088-bd61-dd1959b87c92", "value": "24576:CsW8/ueTb5qGObMlRJMlu3YF6PtOSG4dQnyEgiX1Y1yL5OWE9HwH9U:CtOqGOb2RJmutTG4dQnkyLVvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690506326, "uuid": "941da985-f7dd-4c42-87c0-42b71c7aca5d", "value": 3101832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690506326, "uuid": "7835b7e3-3747-49a3-b56c-b8da30cdb670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690506326, "uuid": "c3689fa5-41b1-41a1-9cbe-599f454289e3", "value": "10aeaf8eaaf34b9434e88596138fa18d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fbf014-2d75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690569292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569292, "uuid": "82f78de1-c244-41fc-a926-f8b4d5e40203", "comment": "Malware payload (AgentTesla)", "value": "7d541d88562c454f8e7f9aedcb9fdd03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569292, "uuid": "820445a1-1130-4c26-bb2b-cbe757a70e1c", "comment": "Malware payload (AgentTesla)", "value": "865a96900b64bb3aca2d50dd65ab111ec881db5935f1dfd753dc48ce6cf21532", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569292, "uuid": "ce383eb3-e47d-411a-a948-433b04f39b30", "comment": "Malware payload (AgentTesla)", "value": "a0d1ffdf8eea06ec5bdde71dd3bb218f17c6aeb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569292, "uuid": "19e762d4-8c74-460b-bb2a-9e8dbe13828c", "comment": "Malware payload (AgentTesla)", "value": "3971b996b8502460763dcf27ab03d9eae6cbbb8fde598e9f813f96d88badf44beb863f17f0b6f173067576717670c571", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569292, "uuid": "76a8bef8-84a0-4105-be2e-7b2a5585939f", "value": "T1C5E4E052F2285F5BD83617FA4825920847B6BB7B113DE21A4CF7B4CB11B2BD10A86F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569292, "uuid": "e5e5195b-80f4-42b0-a17b-c1b4948a7513", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569292, "uuid": "d758e3b5-1502-4e64-b43e-647746e97f73", "value": "12288:QOgqgjjPtMyfrffXKMBfwZlZhM02mT4zkLG8d+YAjG/EHqk:QOTgjjPtMyTfXVahMYxcGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690569292, "uuid": "0c3fef78-4225-4e47-a1ca-ab6dfdf51b4e", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690569292, "uuid": "492aa98a-db89-41ea-8d1d-899a23ca2d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569292, "uuid": "3d4d498f-366e-4195-8c75-8b5631e9c401", "value": "DHL_624765600.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d6d346-2d02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BlackGrabber)", "timestamp": 1690520121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520121, "uuid": "bbe8ce06-552f-4098-bc3d-2997da91ecc3", "comment": "Malware payload (BlackGrabber)", "value": "c36f10074bd560df1341aeb405b23641", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlackGrabber", "colour": "#984749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520121, "uuid": "2f8e5d89-f10a-4a52-af7d-c4d723c1a361", "comment": "Malware payload (BlackGrabber)", "value": "876c3656f74c6fcfaa25bda37dc1c6f868677c088953c722ef4595efe40f0c7f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlackGrabber", "colour": "#984749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520121, "uuid": "87a6165c-041c-43c4-86e5-3dea30a09ba4", "comment": "Malware payload (BlackGrabber)", "value": "9c0eb843839f201c5d87dfa6c9b7b795d29b449e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlackGrabber", "colour": "#984749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520121, "uuid": "1b01bab2-7b2d-4a12-98c3-69e1f79b06f6", "comment": "Malware payload (BlackGrabber)", "value": "47b297bdb235572a73da60074d5aa12e5844c8159c1eac22ab93e6346b03f6591da4738afd76983b80eefaba76b24b54", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlackGrabber", "colour": "#984749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520121, "uuid": "1feb79ec-0247-4b24-b302-a8634ce14e6b", "value": "T1850525C273949053D8635A704EA3838A5B29FCD1EE70759B3364F71F1B3AAC26D29712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520121, "uuid": "7945fe59-8d5b-4452-a742-09a9bad5ca71", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520121, "uuid": "b943461a-c53d-42ec-abc9-cab8616050f9", "value": "6144:547p0yN90QEV/E9DuLVoF99OHkWOIzDtZ:5Jy90nVoFmnOGDtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690520121, "uuid": "82709fd9-bfc9-4a89-a59d-5093332cf776", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690520121, "uuid": "ae06e749-8668-4522-96bd-6f179a99cf91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520121, "uuid": "a2e9d691-ff7b-4117-b06c-7eced21220a9", "value": "c36f10074bd560df1341aeb405b23641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1c0a8a-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CryptOne)", "timestamp": 1690526683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526683, "uuid": "9a866983-b212-42fc-b63f-72f0e98ecc84", "comment": "Malware payload (CryptOne)", "value": "18e3564841d5c391e0d436ee5661dfa4", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526683, "uuid": "76d0bf0f-5f5b-4178-b054-5e5d5fe0cbd6", "comment": "Malware payload (CryptOne)", "value": "878e34f23c96b70fad11dbf1e6f96869a170ee28c98c26c92d13f87a3936bfe2", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526683, "uuid": "2d138bac-c7f2-4bae-b2a9-dccfe7bc7cbe", "comment": "Malware payload (CryptOne)", "value": "07eb525010bef3f1d1a3ed79009e4148c47779f6", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526683, "uuid": "a7a65a71-cff9-4c4a-ade6-94321443e9ce", "comment": "Malware payload (CryptOne)", "value": "1ff184c49c175eeae74ed62e8bfc92b4a98740fee9c0eff27d5761b306365ab5d47824914ebc1afd499c7dc808c95088", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526683, "uuid": "9fe2dc8e-e3a9-4ab5-bd5e-13030cba0d3b", "value": "T1BF75230177D080F3C56319362F7ABB22A7BEF8604F568ACF53904C6EAD31981A735B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526683, "uuid": "196496ab-9713-4bf9-b85b-1acef343bdf6", "value": "0e806fd55a4f41060c8e206a25d6875a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526683, "uuid": "fb34a3ed-943e-41de-a265-644660a4bf18", "value": "49152:2fWhNaBfJXAE3J1fxknlW0p8dZ1PomKgOjH0U:2fWhNaBfKE75knwU8dZ1QmKlUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526683, "uuid": "378f6339-29fe-4ec5-963f-8fa51d13a91a", "value": 1677421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526683, "uuid": "5670c5ac-8527-4eb0-af5e-c7d37894e076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526683, "uuid": "3b11917d-4a09-4393-acfe-96330fd6de7d", "value": "18e3564841d5c391e0d436ee5661dfa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2aaa70-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545363, "uuid": "92f95a8d-9699-423a-be47-fee632177aed", "comment": "Malware payload (Mirai)", "value": "43503cbdf9e8b3f5763d3c22e4cebb68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545363, "uuid": "c4947021-deb3-46a0-93c5-782df485433c", "comment": "Malware payload (Mirai)", "value": "87c3cd5b1a0bb7848a1900ba2043d226eb3fab1f578b68ade2f2ff5cb9647d38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545363, "uuid": "f4facd10-1932-42b4-87bf-059963ef6d16", "comment": "Malware payload (Mirai)", "value": "4f9cd12b963e45abc2a89393e6097c911e7722b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545363, "uuid": "4a69468a-ee50-49e0-8052-14351d1fde65", "comment": "Malware payload (Mirai)", "value": "f78cf2a4b48fc762b6c534cff2003f57f605c739992a13cf7763c5c4e9fff4ec7bfe4aee3d4bc26ded4b941f835d8837", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545363, "uuid": "a3457685-e441-431b-8610-3c56080c1d43", "value": "T1CA434BC07253D9F0ED0459B42123F7339A36F0390129FDDBEBA9A676A841FA1921716D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545363, "uuid": "e1158975-c218-4842-893f-897cc9c53981", "value": "1536:Qd4POM+sC0ls55vJzBJLTE/dxFtCDkNzQSkdWk3qn/:Qd4osC0ls55vJvfEVxFEANzQSk4O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545363, "uuid": "082b3f57-6901-4977-a26f-46b7090a9e60", "value": 58224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545363, "uuid": "aed2e1a1-d56c-4706-9956-b9128a6eda13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545363, "uuid": "136e9cef-1bf7-4dd1-aabe-5e02058e2530", "value": "43503cbdf9e8b3f5763d3c22e4cebb68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e6393e-2cee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690511283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690511283, "uuid": "e5bae460-e866-4b1e-a911-17bb5dba1731", "comment": "Malware payload (AgentTesla)", "value": "a8cba3abe8162d0334b4f371c19ca510", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690511283, "uuid": "1dfecf60-caea-4a52-98b1-eb239482981e", "comment": "Malware payload (AgentTesla)", "value": "8834293ff51be29614c0531149076be508e3d5b6454cef072b11aad08ec0a20e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690511283, "uuid": "726a2c88-5ce3-464e-91a7-eb32b0af56d5", "comment": "Malware payload (AgentTesla)", "value": "d32b039cfed1eace16b5c07cbb4627827d2fc003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690511283, "uuid": "d482a8b4-32df-4498-883f-79c3b6bb42cd", "comment": "Malware payload (AgentTesla)", "value": "3565b4c6a2691e78bd6000d7f1e14e409a967da96e91456ce651950d02a84c66f61bc551e3b643459bee9c776e30cb19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690511283, "uuid": "dd0706e7-c797-4f0e-938d-36efa979f109", "value": "T10EF4A24B71DE4476FF546E605C2B4B38CFEDB01E640EB50B6825CE861E7DA8CC0AA746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690511283, "uuid": "ba5cb4f4-2df5-4d74-a7dd-70683b684641", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690511283, "uuid": "ee1ab6e4-7521-4031-8535-66a95476888d", "value": "6144:F4OLfKZdoeU8OnFiKPBbpTo8g6fj6KZdoeU8OnFiKPBbpTo8g6fjbtsZ08VNQLvL:FjrarbtsTV6jc8vSTZQdbuIThyRGk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690511283, "uuid": "cd893953-41cd-4be9-bcb7-9d2df192bea5", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690511283, "uuid": "79b3d6c7-051f-4032-9a13-c8b88251bfa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690511283, "uuid": "08e5d640-74c9-4919-a214-b2f430d63df7", "value": "SecuriteInfo.com.Variant.Lazy.366197.5679.22232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f601988e-2d29-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690536873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536873, "uuid": "3c59a386-29be-4587-9523-313cdecc5b0b", "comment": "Malware payload", "value": "256cebea01c0fddf3a9ef6c742299506", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536873, "uuid": "bc6c66ac-a58f-4a45-a0d0-c9bbaa62eed4", "comment": "Malware payload", "value": "88e5ef93b073af67b9d4dec49109a019db57ad6ac1aed3c61307c55e8385d50d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536873, "uuid": "c262f8a2-47eb-4a2a-a509-06102ce9de63", "comment": "Malware payload", "value": "30947f5379d99e0e63af5a8954899ee595011b63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536873, "uuid": "34fdcea9-3c14-4794-a483-cfdcbf27ee9c", "comment": "Malware payload", "value": "b676e0555c1b977b986a7fc8c5f21025db0341bb67871a17591e29973229b9f9cfc12592dff9adad266de67bc5b7337f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536873, "uuid": "1cc2c99b-f0d3-4ed8-8e20-b4ca350667bb", "value": "T1EB331997F901DEBEF41BA77A44E704167130FA6A0D9307317337B9A7AA351D42822F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536873, "uuid": "31d79a25-60c1-4f2f-8ce6-4ce25578446e", "value": "1536:i5H2HbIvdgpH94yul+fmXJm+18LN8g/vLPnFUvAL:i5H2HidgpHmyulZJmxLBXIAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690536873, "uuid": "76216be1-9e9b-44a9-90a3-7950a65c5ab5", "value": 53772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690536873, "uuid": "16f25ee4-7d2a-4dc7-965b-d5381ec19953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536873, "uuid": "3d9e574f-9596-46bc-8b00-058476f5fb49", "value": "256cebea01c0fddf3a9ef6c742299506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0c94d2-2d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690562222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562222, "uuid": "13504af6-34ce-4ce4-a5f5-37787a9b9e8b", "comment": "Malware payload (AgentTesla)", "value": "451c176cc343daae53b3b17d1ddc77cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562222, "uuid": "b71e8794-7e97-4b86-954d-35d1ff813f17", "comment": "Malware payload (AgentTesla)", "value": "8b2356e5df56f3096dddfeeb7c7ea5f61d709a37df69f86d5e88a221b57672ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562222, "uuid": "f48ce16a-4d13-4448-ab74-8613a977f95a", "comment": "Malware payload (AgentTesla)", "value": "ffcc2bde5a155f812d757181e83ce424f353414b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690562222, "uuid": "93444881-6c5e-4a40-8d8f-3bfe54b30823", "comment": "Malware payload (AgentTesla)", "value": "2cff3c1065fff67f34a5a8e4e2d808445226aea4803095c572b1bdd3ab3f05ed85865478f0ca6b1ffc0e5fcf9ff08ef7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562222, "uuid": "68bd0b12-5203-4ff9-a748-b53c1be792ab", "value": "T139531892761C59E6FE6D9277E43F488107A06C6B87F5986D748FF32204B2323850BD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562222, "uuid": "52420c34-675a-4930-b8bc-dc980cd13fcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562222, "uuid": "0eefb9e4-241d-4304-98a7-6b6dce209a0e", "value": "768:o5lnhYvvklhGg6W2EK3mbpnDK3EaC8l2bP3SScNY8nfRqTuM+1+P:o5BB03uDK3EaqL36G8ETugP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690562222, "uuid": "a69ab973-c0e8-4b24-b276-77da4da90cfb", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690562222, "uuid": "f9a1607b-a044-4d46-962c-36f53ca2eae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690562222, "uuid": "2be8f9c5-f2e8-4031-8e0c-a0b3b691768a", "value": "ACH_Payment 28072023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e938876-2d4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690551330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551330, "uuid": "5674a324-4a88-4255-9b13-c8158726f519", "comment": "Malware payload (RedLineStealer)", "value": "9303678a5847ca3c058ac38fd3d65b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551330, "uuid": "da4f9058-0a07-4a18-95fc-2d93ae2bda7d", "comment": "Malware payload (RedLineStealer)", "value": "8c12c5be80cc4db321f1ab1ec626597ab8a8f0b52fdcbf56f8d70203f60af037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551330, "uuid": "fbcc40b4-9303-4f86-b534-00bc22bf5716", "comment": "Malware payload (RedLineStealer)", "value": "c5807a6ed2b103bb9aff5e4312677f03d6c8bf57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690551330, "uuid": "91ece566-9b96-49eb-a328-ea8b2e65bd67", "comment": "Malware payload (RedLineStealer)", "value": "b24e7ed23984445b9cc08c47eec23230c2115b0683e312716a68a5fb080d76e35423b11a873663985390d5c44b09e20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551330, "uuid": "d596b90c-9546-48c3-98eb-9a62156a5fd7", "value": "T190A35D2067AC9F19EAFD1B74B472012043F1E08A9091FB4A4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551330, "uuid": "41d909d0-b81e-4d56-9853-1f1ea3332803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551330, "uuid": "0aedbf3d-2275-4a12-8b8e-6d3812f40493", "value": "1536:CqsoWqwvlbG6jejoigIT43Ywzi0Zb78ivombfexv0ujXyyed2WteulgS6pY:gL3NYT+zi0ZbYe1g0ujyzdmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690551330, "uuid": "cf9efaf9-b7b7-4a8d-b492-b607a8a66ba8", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690551330, "uuid": "1da727ac-e668-41f0-af57-6c1acf7b64de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690551330, "uuid": "ca421ff5-7abf-4519-8837-8fb122dd393b", "value": "Metamask seed.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fcd0d4-2d1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690531342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531342, "uuid": "4ab281dc-3949-498f-88ef-13dc53d82bd4", "comment": "Malware payload (AgentTesla)", "value": "e01d546954b7b9c3dafb2e61549788c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531342, "uuid": "c68a52c2-eecd-4f5f-9c29-34b001f15ddc", "comment": "Malware payload (AgentTesla)", "value": "8d6e314c47750b11aa6099c155ecc867d1d6e2a02d2b25aff78fee643bc2c5ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531342, "uuid": "4c71dff0-acf6-46c9-ab7f-d1a35c1d6c13", "comment": "Malware payload (AgentTesla)", "value": "00691a8b346a8c91ca393aeabb41fa8a83102e11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531342, "uuid": "d4926afe-b7d5-4611-9d64-ab6fa07b3e84", "comment": "Malware payload (AgentTesla)", "value": "e7ea127bcfc2d805dc8223d9083176542456a8c11ac967c2767e8810d7b276d2946c83e868f349c4834ed5e7e187746b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531342, "uuid": "7edc0556-76c3-4c6e-8849-122139d798f5", "value": "T190F4F120B2BA1145F9F61BF2083792C012767B7B6A44D71D1959DECF8D32A8F8701BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531342, "uuid": "5e53ca31-0dd9-4ae6-bb02-29821391164f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531342, "uuid": "04743caf-ad2c-492e-913a-ce73966f5d2c", "value": "12288:LLJFOHkUygUTjTeqkcI5+sR3YZpWnvLexFdfy1Wt6GXQ+LdyrKCFYBojBan:+ypT7I5+sKpevaxX61V4LjCaOjBan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690531342, "uuid": "655135c9-d08b-445a-9bc6-1feaf40de201", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690531342, "uuid": "45d2dcf1-fcf6-42b7-ac75-957785d56980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531342, "uuid": "d74d2c2c-0f1f-4781-9810-61f480ec49d5", "value": "e01d546954b7b9c3dafb2e61549788c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb440a1a-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690527004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527004, "uuid": "fa5fc1da-120e-462c-be36-57798cb3692a", "comment": "Malware payload (Loki)", "value": "7f6021c49835cdab4d9885471707f6dd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527004, "uuid": "20c8ece8-b070-4c72-8d27-8c36eb40aeca", "comment": "Malware payload (Loki)", "value": "8f39164bf1cdd95e5825069a3be69a62cd3100a881454fa5fa2a6fa14c1d8264", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527004, "uuid": "9169224d-1058-4864-b4ba-01b04fb29202", "comment": "Malware payload (Loki)", "value": "eb8222d1bbb5b318dea8c807cc1bbc2ea49fb0f0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527004, "uuid": "0559f629-460c-4058-91ea-d43b1e7baba0", "comment": "Malware payload (Loki)", "value": "1f4b7091862feec474b34dda5ff99957fc104be73d4f63142082b3f954196048e2d3aad7f4b721a880b4e7fb58f37e6f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527004, "uuid": "9fbe65db-d1cf-4020-8f6e-0193e718704d", "value": "T176A423BE10C56F72F22D69E88570634891797310ECD9BC88BD3A15EFA126172CF12BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527004, "uuid": "454b363c-2547-4f9f-b65e-478e627012de", "value": "12288:SeuAEDRIfGXn0CisvyzfBhLshhLr45p3Hiv4mXd7yN+wLlX:Skf00m+fB+hhLUxm7yN+wLlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527004, "uuid": "2e250a08-2ebd-4ee5-87de-fe1ca8349971", "value": 488568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527004, "uuid": "06300cbd-cb5a-4729-8626-94c0e932a510", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527004, "uuid": "c8c57a54-1e9a-4444-a691-2bbeef40abc0", "value": "20230727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2336df-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690527245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527245, "uuid": "888d0ebd-77be-467e-9930-74d9f3c7ae63", "comment": "Malware payload (AgentTesla)", "value": "7b5a42e55da888944ee07a12bcbe7ccc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527245, "uuid": "16199e1c-1c60-4014-ad76-9f3c83607455", "comment": "Malware payload (AgentTesla)", "value": "902a477272c16b948f209594c26089785da991ceb6874223249bdc52c64bad1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527245, "uuid": "ac696df7-bc4d-44e7-ad31-677ae35c5aea", "comment": "Malware payload (AgentTesla)", "value": "7760892c37b53a88f84849b18214b8f3593f535f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527245, "uuid": "ea0d0f7f-4035-484c-8c50-1d6e2ef34857", "comment": "Malware payload (AgentTesla)", "value": "a42924d19b698908cf41db9a0b475469b0b41b2f517fa9e1e320037a1cb357f3cbe28c60d9097ba7de6a27e409dc082b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527245, "uuid": "eaa33aac-d9bf-449e-938d-66fb9e304c81", "value": "T124E4220128C20A29C5864BB30C641F4DB7BFFB766BE0D755A4D52C98BE57338421AE6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527245, "uuid": "0d78602d-e335-422c-b6f7-0613d16c07e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527245, "uuid": "d665508f-2a6d-4f14-a5bd-cfff6a54c644", "value": "12288:WbO5/132NAwP3M0xqISl3/FWKKp/mRd7Gm+7tNNmh/dx2bO5:wODaAwP3MCorIp/mPymqtNa/YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527245, "uuid": "b3712cf9-315a-43fa-9084-9af4003c44fb", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527245, "uuid": "ab443485-622c-4774-a3e7-01c9569bf070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527245, "uuid": "02cc5367-0fa6-404d-8619-d19ad518344c", "value": "DHL_DW004556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47a7404-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529489, "uuid": "7057e983-edd5-4630-b85f-991ce64947a1", "comment": "Malware payload (Gozi)", "value": "987b1ae80e937a6ae1ddc147bfe82dbb", "object_relation": "md5", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529489, "uuid": "d2e075cb-52b5-46cb-b203-789cf09b3f6e", "comment": "Malware payload (Gozi)", "value": "902dbff4eafe27ea704b134d186e3c67e80b12e414261b6266713c103906edf5", "object_relation": "sha256", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529489, "uuid": "12d0018b-44a3-4422-9a32-36ac050e9fa5", "comment": "Malware payload (Gozi)", "value": "f7ade85b55f7e0a11705778497cb5c64beea6e56", "object_relation": "sha1", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529489, "uuid": "4d49360a-a71c-4a44-8d7e-790c601a7129", "comment": "Malware payload (Gozi)", "value": "da4ead0c88dc37d7769109f12e2819577aa9654a4a71e127ed4c8bff4cc7e631f7af2cc9aa83cbc34d3936aac0cd0d23", "object_relation": "sha3-384", "Tag": [ { "name": "first stage js", "colour": "#AEC809", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529489, "uuid": "77f8a757-20e6-4345-a7a4-2ea34c0782a4", "value": "T1D1453A2F3380322B1B0371559E8E06D55B2E98677620E089F99C814C617D925BB7FFBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529489, "uuid": "ad3a2f28-eeb5-4452-8ada-ee149c6b6a2a", "value": "12288:zlnGFTYDrQRp5f9y1ty1Ny1qy1t/dLfxpDnUiiiq+E3xO9u:xnGF8DWpJ9Si70/dLfxOphOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529489, "uuid": "1b49f4da-ada5-4363-b746-e108587f1dec", "value": 1184225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529489, "uuid": "194aa2a0-8ac5-4250-9d64-d621f5a74a77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529489, "uuid": "34b7d8b2-7b95-4a60-97cf-39ad04379a1d", "value": "Inv_7272023_from716517_596629.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55141e7d-2d35-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690541757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541757, "uuid": "fdf350c8-3f86-4609-ab7f-7bff908bd5dd", "comment": "Malware payload", "value": "2889c73e54ad06f96947a2cfaac51286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541757, "uuid": "2d645997-d0ae-406b-8d36-cdb4de120f4f", "comment": "Malware payload", "value": "90cfc5d64814557a88e7ac7e85e75e1e8699183c137b4493bfedcfb20ecebb7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541757, "uuid": "7bdf5463-7c49-45ca-b96d-b3750f915320", "comment": "Malware payload", "value": "e64dcb1a357f151cd4ff642d318c26779b58f52e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690541757, "uuid": "31475896-6356-427e-a7ac-f05c566acde7", "comment": "Malware payload", "value": "ec7bffdba43a6da8d24db83599fc91c4420159a3cd36d23bff7fcf4aa05ff9cbba5c1d052a287941add97a44f4584883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541757, "uuid": "0a676d27-54a2-4714-aa1b-e698dca1d45e", "value": "T192C41124E0AED656C39DEFB880B14A4EAB3501AADD3FCF6CAD6C60DE1DC23509097175", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541757, "uuid": "f4e4bf67-ab15-4dd5-bb1b-651cc7df79aa", "value": "12288:FmFB6tYleATwgqxewHwyW8ZO/gpgUT6VfmTVC:QFB6tYleAbq7Ho8KygUGNqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690541757, "uuid": "3bfb4b11-c351-4936-9111-7d36b6236ef6", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690541757, "uuid": "5265ca4a-f5a0-470c-9c9d-66de21263c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690541757, "uuid": "1a781ee0-9aa2-4449-aefb-f8448f04d3ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef226ca-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545344, "uuid": "b54b637b-f5f0-4524-9a81-a2c5839a78ed", "comment": "Malware payload (Mirai)", "value": "7b59253c2a8ce60ba2292c0c350fa82e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545344, "uuid": "b0fabf2f-1ed7-4383-93b0-1aac739dec42", "comment": "Malware payload (Mirai)", "value": "91cf1772109d104ddbaaff40eb765ea846eff181186dba1b419dc6063926ba30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545344, "uuid": "72e29ce2-4f88-45b8-a5f0-bc83d6d58efa", "comment": "Malware payload (Mirai)", "value": "ac516c628e48b36279091a2c31242fa71b6cc69a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545344, "uuid": "795c7368-ce1c-4d0d-988b-f00f9bd18ea2", "comment": "Malware payload (Mirai)", "value": "55c470ba11a41adb64a03c51b0f07b18b3f2e595a3d44d28d58f4d856a5c7c98c01c0e4dc36c248a22cc37b48b4fc61f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545344, "uuid": "91a816bf-453c-4123-960d-250a524b16cf", "value": "T17A632945B9928A23C6E4227FFA6E408D332523E8D2DF7227DC216F55378A82F0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545344, "uuid": "28e8b8b4-e3dd-4ac1-bae3-ac7d8e1dfbde", "value": "1536:VbmUhYQSDT8qFntnU0ffUU1/YFu47ol3t5cxABI9O3nSI:VbTvywqr/fsakJshbcABI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545344, "uuid": "8bdeda5a-c9cd-4245-8847-75c31111e528", "value": 67536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545344, "uuid": "1d7693e4-ba29-4a87-9c77-d9315e356331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545344, "uuid": "ee0954cf-4aa4-4bc9-bb22-7c50edef735c", "value": "7b59253c2a8ce60ba2292c0c350fa82e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33755f39-2d1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690531823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531823, "uuid": "204123ae-7597-4ddc-a79e-4698b7a5ccad", "comment": "Malware payload (RedLineStealer)", "value": "520a2ff4878c454c3e349a2d115a1698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531823, "uuid": "2ee32157-4d99-4ae4-b7fd-87a08e979bad", "comment": "Malware payload (RedLineStealer)", "value": "924303207226c6dc5e773813f446a0c3d30c340beeb086d2b7583ca3877d289e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531823, "uuid": "5a726e66-4a63-46a6-b980-6a71fd7ab890", "comment": "Malware payload (RedLineStealer)", "value": "84b0ddab16a866d63e31e4ffac67343ee1cc304a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690531823, "uuid": "aca86e0d-5312-416a-8157-0058e7f9b001", "comment": "Malware payload (RedLineStealer)", "value": "1f47cc6e773544cd5438279b3ddf981b686188fad072e13e377a9fa6a40bd1736bfe5a57c2108884f506db6c71ddbd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531823, "uuid": "01053d06-dcb8-4555-86d9-371efe4f9620", "value": "T10A935D1AA3DD8A24E67F0E707871111D43F1E8436412E78F4DC970EA2F66F88576A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531823, "uuid": "d6172755-3b27-47e0-be4f-76a1791180df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531823, "uuid": "75b91612-bd29-48af-9886-c3da279cbe66", "value": "1536:ioTx9HNwDE1lDTN1QFzxMgwCrB/atqgdbibEB/l2k+oSGe:ioTxFPDTN1QBqgRJatvqEhfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690531823, "uuid": "5fbb6e02-5868-4bc3-966e-d65caa1f6fd7", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690531823, "uuid": "69d4dae3-c896-42e1-a49f-5593b9dc91b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690531823, "uuid": "315cc563-c276-4c20-b572-473dc81f90b0", "value": "520a2ff4878c454c3e349a2d115a1698.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69406c16-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690527188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527188, "uuid": "08bd2e5f-a1c8-4cfd-ae10-e35d0c6a97af", "comment": "Malware payload (ModiLoader)", "value": "f338524559be7f585bd468bf2e55415b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527188, "uuid": "0b3d18e1-a488-4b9d-aafa-47b127d978d3", "comment": "Malware payload (ModiLoader)", "value": "9515dc6f8aaa483c90acf2da9661b7ba9081f55be39accdfc84692090f3241e1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527188, "uuid": "df4450ca-568c-45a8-9019-f139e013276b", "comment": "Malware payload (ModiLoader)", "value": "f7fbe92c937e967be7730213db84bc344fc1735b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527188, "uuid": "ee9c53d4-6dcf-45df-84e8-4dbb48e0c973", "comment": "Malware payload (ModiLoader)", "value": "d7397c16ed00c4ef29781297cd25c476e58f8ca677c23f054639c50f0c84113e0eb397138788b3cc8429c1cc8ed54c90", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527188, "uuid": "4fc06346-a187-48c3-81de-513a41dc97f8", "value": "T1D1059E31A2B444B3E01A6E3A9D47F72458347D653D35E45A9BFA3CCC9A7B283F815282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527188, "uuid": "b8f9d8e1-fbc1-4c33-929a-758a06753e01", "value": "c1bc1b4428880431ffbb0e7b82ce2dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527188, "uuid": "7f8dc29b-6e02-4962-b785-9dc5c864ddf3", "value": "12288:h3H75pQe3LJf1jpBVudoJrLsqkbBjXjmhGHxWgyFaB3Z6:hL33tfd8dgLTklo9aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527188, "uuid": "172df08d-029f-401f-9070-7ed1bf896ca0", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527188, "uuid": "e94811f3-c320-494b-b3dd-1448838cd361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527188, "uuid": "106bb7a6-97d6-4fee-b365-7723dee31bd8", "value": "dhl delivery receipt,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00287eb-2cfc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690517429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517429, "uuid": "4860f050-1316-4744-8a4e-d01279ab1efd", "comment": "Malware payload (AgentTesla)", "value": "f69ceb677edfd92ee1cececc01fcfeba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517429, "uuid": "1a621e33-a907-46ee-b2d0-6433d91e5f95", "comment": "Malware payload (AgentTesla)", "value": "9822889664264cbb7f1d066f187f73fcc2206b612787883e438472abc38f01c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517429, "uuid": "04983296-5fdd-482e-a776-f32b8dfc1e16", "comment": "Malware payload (AgentTesla)", "value": "17bd4656d418cbc401230c1aff7620b849533b73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517429, "uuid": "16d5d414-f186-472f-8b6f-afc85f022d3b", "comment": "Malware payload (AgentTesla)", "value": "4f44f169fb4eb68daaed9f22082c7726b92b6340a91deb8d52817d758c1363efabf64166355e2d2aea4d8cce66b30a38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517429, "uuid": "1c3265ad-e802-4a7d-b688-d020ed79e8e1", "value": "T15B236B5AE78F02A48F451377135B4A889ABDB23EB35154B1346C933433EDC3E46A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517429, "uuid": "a1a49b29-07e8-4043-b765-db9ba672f23f", "value": "768:BFx0XaIsnPRIa4fwJMROkpXovGctGwgminneqZHbgScVuvaXt2eIAtAPDqE:Bf0Xvx3EMp9ovGOWe8b2uvat/tE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690517429, "uuid": "caf200ad-b721-437b-85cd-01780603538d", "value": 49039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690517429, "uuid": "e93b5282-b6b2-4142-b00d-7a183a2d5dac", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517429, "uuid": "cb720677-920d-4647-8142-16731c27d3ac", "value": "f69ceb677edfd92ee1cececc01fcfeba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6d6060-2d16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690528724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528724, "uuid": "f66fc403-a193-4819-b58b-1ee60f514c1b", "comment": "Malware payload (Formbook)", "value": "3a7cc97f59790807311ef47ae5cc28ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528724, "uuid": "aefb7297-442d-4706-960b-c74d7be82f64", "comment": "Malware payload (Formbook)", "value": "99bb71c925f112035797c13df8af4106c78c305aecea027583007145fce87de7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528724, "uuid": "ab02c18f-3a73-4083-8447-4ef8e5d49aa1", "comment": "Malware payload (Formbook)", "value": "92a1a19be873c6b8fddcaf1af0a88b85b31e2fbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528724, "uuid": "5bad4525-987e-4ae6-9bba-62e0629ed189", "comment": "Malware payload (Formbook)", "value": "e0d328327f32348ce52dc719917b523d9384cf06cd49aa089739d792a9714f94e2c9be872fce8d31327326ef579a5305", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528724, "uuid": "4a3fb6ce-c61d-4399-b041-22967bfe1d04", "value": "T197C4120038A49B3BC96CD7F50822B76E2B70E4B91442F3089CD77DDABB75F184619A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528724, "uuid": "661c9a37-3307-4c40-930d-9651857cbf08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528724, "uuid": "80cf4642-f8db-490e-8241-576d3dac3796", "value": "12288:aX1pD4FjVF4xTHFxNRtPj1/0iLAgAZxvx/wd:aX1l4FH4xTFiiOZxvx/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528724, "uuid": "492416fb-4abc-4dac-8d15-555d6189cf3f", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528724, "uuid": "9806dc27-84e8-4070-83e3-1caee55712ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528724, "uuid": "37afe56f-1f07-4e78-968e-47c08515fe54", "value": "3a7cc97f59790807311ef47ae5cc28ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7211c0b6-2d49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690550396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550396, "uuid": "91545b3a-3468-467b-aec4-a4cc5fb4ffff", "comment": "Malware payload (LummaStealer)", "value": "e1505041ee0cd803b5946dcfdc43dd49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550396, "uuid": "f1592940-8d77-49c8-bcae-89acb3e473a1", "comment": "Malware payload (LummaStealer)", "value": "99ed3461f3f944536853b087750efc90a90a48118385479e38221e0fe855fd28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550396, "uuid": "c6b4c4d2-e835-4191-8f53-702f2875a6c4", "comment": "Malware payload (LummaStealer)", "value": "b3dfb06ee4b2c7155d904ed03f6bbd595b7efd61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550396, "uuid": "3e5d50c8-9afb-4d37-a564-7869cfa76ce4", "comment": "Malware payload (LummaStealer)", "value": "80dcd900e062af1ac1d2efa84398f489d470d2fd217800c132e621be4b74bddec200030e702dd9daba6507a630699aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550396, "uuid": "fa841728-e116-4193-b4cc-49953e92bd90", "value": "T149F5338D044174B5F914D0B6B87B6E6BC7F6AD918FA6312BE87761CF8CDA09EC5102C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550396, "uuid": "606daf2c-f813-4740-b2ba-5931acc33259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550396, "uuid": "9ecd34fc-03c7-4017-8708-79cddf5427e5", "value": "49152:veHU9C93SopX15ixdM55HHSBNtdRpIlaaN6xhfMOnoxhxmJDyhxsPvndkR5oMwYZ:KRTpX1UTXdSzY0hmJDyhiPvWou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690550396, "uuid": "be748dde-f2fc-423e-92ab-ad4c14df2de5", "value": 3336192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690550396, "uuid": "526f68c3-c36a-4660-9690-de6ec3a86a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550396, "uuid": "ab12025a-9107-4a2d-87cf-ad9ff21cd7f0", "value": "e1505041ee0cd803b5946dcfdc43dd49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac6ddd3-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690526815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526815, "uuid": "18e328bf-041b-46a0-9852-e40f49a28bd0", "comment": "Malware payload (RedLineStealer)", "value": "d51c3f68e16b2fbef3210cc8c035e357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526815, "uuid": "5060de2d-de06-4090-9c2b-37fa3cb171b2", "comment": "Malware payload (RedLineStealer)", "value": "9a41f53fdc1750ec34dad320b0edabddfbace20d76693f60778001ad800f072d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526815, "uuid": "3fa84ca6-d94b-4b7f-8f09-e5762180b7a6", "comment": "Malware payload (RedLineStealer)", "value": "a0dc6cd81f2af7237cc5614115e51bec638f50d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526815, "uuid": "8b236afa-2352-4070-ba6d-56b3bac0b2c1", "comment": "Malware payload (RedLineStealer)", "value": "cfe585835c37b40ac3479414226676b1b7bf09cd5b9abdf629811bbde09b781b7eb8a6d7de93cc9f2f9d488c49932dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526815, "uuid": "fa2ddf0f-2df4-400a-8b85-f85210bb7178", "value": "T1B29533A5F8CDF012D907487DD65D9AF66A73EE0496B8C273B922BF073C59228790781C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526815, "uuid": "5597b9c8-6ea0-4199-9a09-d7876a5bb3ac", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526815, "uuid": "93340b21-f574-4f0f-9f3a-54c1ea3685a0", "value": "49152:owwul5002HPq9WpnrWNTpoS9246wyHM32:oDulPCQ+rWAo2FwN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526815, "uuid": "91644563-7674-4f61-83b4-308b2599bca5", "value": 1917440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526815, "uuid": "8b7a6b54-62ed-4fd6-bf52-6acf3f600404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526815, "uuid": "c882324d-ef4c-487a-b277-aab1ad677a23", "value": "d51c3f68e16b2fbef3210cc8c035e357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c6e6e1-2d75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690569270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569270, "uuid": "101c1460-40ba-467f-a301-cee7b19a391b", "comment": "Malware payload (RemcosRAT)", "value": "3e7290b9be409cafa7595479df382401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569270, "uuid": "be82229c-c87e-45f4-8df7-edfc1be6d86a", "comment": "Malware payload (RemcosRAT)", "value": "9acd14f51f44097e8f00ff0bf413ffdd856c2d7d762064843040a2cde4df3f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569270, "uuid": "1cfae419-0e1e-4827-9860-8382f356dcd2", "comment": "Malware payload (RemcosRAT)", "value": "5d18580421f0324f88320d1c4afc3b1a18f4c731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690569270, "uuid": "2d93f91e-bc9e-4e87-b708-f6eaa5cac35b", "comment": "Malware payload (RemcosRAT)", "value": "e401c6d458dc11f1d70fd1ad0631d920e0ae043bf5052c85e34376799230fa9ad99bf5cf58c90e93fe214722a03a5f34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569270, "uuid": "0d20aa3e-e992-49f2-a740-bfc56329a42f", "value": "T11793D713FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA41AD79892D456EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569270, "uuid": "10d620f6-01b4-461a-80cc-07c95a69de94", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569270, "uuid": "e7c9eeed-95c4-40c4-9ed5-6e4b2226d288", "value": "1536:4hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6IrF:ehzYTGWVvJ8f2v1TbPzuMsIFSHNThy+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690569270, "uuid": "0683f35e-861e-49f4-8fbb-00748ebc3f26", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690569270, "uuid": "37677497-a6d4-4257-8ec6-b7ff76b9d59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690569270, "uuid": "5e8d22da-8cee-4744-aa6c-7af5c29080d9", "value": "xAdKTuruwuEV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc6d8dd-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690527812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527812, "uuid": "12dc3064-fc7a-4249-a50f-c1bbd8a28fd3", "comment": "Malware payload (Stealc)", "value": "0fff35af7e881efb36cf90f602b068d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527812, "uuid": "82e8f089-b707-4cdd-83b1-1fc5b179440e", "comment": "Malware payload (Stealc)", "value": "9c07fcf957a083aae4c527c3b0a44f4d2601d563d93e3d2aad7cd81ced0745bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527812, "uuid": "2b0b50ad-5555-43b9-b49c-50cabc6f4713", "comment": "Malware payload (Stealc)", "value": "32d0da04cc8f4f6eb6c26fc2c9bef0b019303fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527812, "uuid": "24a24afe-0d38-4efc-bc04-89286498795d", "comment": "Malware payload (Stealc)", "value": "9fd000719a0328abf7a8247388dac7ff3fb5de92eabcbe3d35f0316cb4648f4542efe2c44640b7e6adaad5ce5c39d9e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527812, "uuid": "5d31b814-cf18-43aa-b133-feec1a2f35a3", "value": "T17C643A435291BC61E5265B329E2EC2E8371EF951CF59B7E622286F2F18B31F1C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527812, "uuid": "6ffc13c0-1a40-4821-ba1f-ea3f94a36866", "value": "6e9c6ac87a49785649f7750be9f53326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527812, "uuid": "1b3c4abe-c9a0-450b-9b03-647b335845bf", "value": "6144:ppF884hnQEpDDniqN36YDC8heu1+yJaY1ft:ppWhQEpDDBy4euDJaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527812, "uuid": "6b0c24ca-dc00-4695-8205-3514e379844c", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527812, "uuid": "6f14c45d-8fae-4cb6-9044-0760d809519e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527812, "uuid": "27747780-370e-483c-93dc-69254ca6688b", "value": "0fff35af7e881efb36cf90f602b068d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b242c671-2d1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690530317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530317, "uuid": "9169fa16-defd-4ccd-85cb-24d1eee0ee2c", "comment": "Malware payload", "value": "9da370474c2a7427495e83bed70b87ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530317, "uuid": "f55174d0-2ba7-4a5c-834b-7ef84a33cad9", "comment": "Malware payload", "value": "9cba1183ed6a9a89a34805730da01edaed2026b3d3cad0e3ef9710fbeb3ec442", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530317, "uuid": "1f0bcd40-e154-40b7-b4d7-4c46759aa3ff", "comment": "Malware payload", "value": "de2b22ba5cf618e0fc6ff30a8927820f1544068a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530317, "uuid": "eeec718d-1073-4958-a3ed-f55968fabb5f", "comment": "Malware payload", "value": "4be6e5be2287ba877730cd98fa6276bba55ac8cad4e6430c094ca6bbc0ddf9f480d2a30c1e2a9486ba09d1154ba088fe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530317, "uuid": "89d017e0-1039-4e23-aaef-f3d605f00cfe", "value": "T150335B0262A2C0B3F2FA477538A466715D3F3C3126F0408B6F8B25696EB17D19778B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530317, "uuid": "d96eab16-543f-4257-ba28-652ab9d86085", "value": "8735daf06cba4e1ed00bad4c4053acc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530317, "uuid": "1bcdffda-8a93-4b56-8591-c6b21cb38948", "value": "768:giAlYLUf/o8gAvsR60hFoOeVI8/9s/ESLRhD46mnTED+N7vyo:giAlYLUf/50hFoRVV/9sRLvDoDUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690530317, "uuid": "b2f5e6d5-23ce-4cac-93fb-76e2fe8e0e24", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690530317, "uuid": "fd00460c-6cd0-4a62-a6cb-541b6a8406d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530317, "uuid": "6a6ccac1-e53a-493d-8522-de6dd9445598", "value": "SecuriteInfo.com.Variant.Zusy.477960.4794.15335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb5a8c6-2d68-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690563760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563760, "uuid": "0f046f9e-1cbb-413f-8446-261ca8236a02", "comment": "Malware payload", "value": "de9de102761d5e00c795d937473f6529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563760, "uuid": "1c4505b8-6d34-4a0c-9b28-7f9cd148473e", "comment": "Malware payload", "value": "9cba81a7ac7f0c7a020ca9c4e06f796c4a585e3d1abd77788868dcd59a27fdad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563760, "uuid": "d1de9dbe-3ce3-4825-b2c0-cb95a45d19d9", "comment": "Malware payload", "value": "f225e7af5f5612d045235c65a063bb46f982c03f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563760, "uuid": "df53ff0a-dc0a-4786-8c2f-a1c94b4ac578", "comment": "Malware payload", "value": "e1a3952b2a7993c7f848708ecd41fd70289f6273b443576d94ab2aa32b5ea1e2ce16eb3e6c586bc9ad0319aed0e40cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563760, "uuid": "28d47f56-fcee-486a-a177-a2aa2bd45924", "value": "T13884DF1EAAD620B0C0A4CC74B7F9A2EE66B5535F51066BEB209912F6EF0175F71020F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563760, "uuid": "573c671c-5382-4d45-86c7-20fd7eb69c16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563760, "uuid": "d022fc47-2bd5-4fcf-bb11-e4dfc3624638", "value": "6144:gme7WPpL6mbNWo3lYMFa2yWrPzE19cpUzt:g1WPpL6+WoiMFac+9cpUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690563760, "uuid": "b14e4e78-7c66-41b1-a3f4-12904bd670fe", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690563760, "uuid": "faeb862f-650c-4c3f-8fcf-2f50ee23fd38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563760, "uuid": "38193045-d6ce-4af3-ac37-5a5df0337257", "value": "PO-SX-000384873A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc8b59e-2d51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690553904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690553904, "uuid": "2b4e8a7c-c710-47f4-bf03-6e0335d969d3", "comment": "Malware payload (Formbook)", "value": "732d840080e5382a366afe1ffd3e7aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690553904, "uuid": "fe6604aa-6030-4bcf-b9fa-0c212ec6b8e6", "comment": "Malware payload (Formbook)", "value": "9ddf04a263108c79a27edc11dcb0314a9d4101e222a4c1406c6e556c3f8bebbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690553904, "uuid": "66c4778c-9678-4c5d-b01a-69d9f2a9c724", "comment": "Malware payload (Formbook)", "value": "0d0d7645818b8779112de7911c791abc85b84259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690553904, "uuid": "d9d99581-4ba7-41af-8b0a-1381dfb60c65", "comment": "Malware payload (Formbook)", "value": "5025227c69f7edb944b185bdba8d744b726a71a14c2242fbe866fce955184c3dc504fc109a5079a0a98ab2bfce4e18cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690553904, "uuid": "43ff2011-9074-42e7-8583-23da6228b30a", "value": "T1D56401707651C4A7D8A207790E78C2FDAAF6FD216C15868B3BC27F2F3A71211960DB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690553904, "uuid": "70578dce-8b13-42e7-84c8-c01ccd7bad37", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690553904, "uuid": "52c7fdbc-d254-420d-84f5-4e4cab832d8e", "value": "6144:AYa6dsjR46ug3MbE1eChVNQPzeR/efcGIVZBCiM:AYbyKZCpAeZezIVZBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690553904, "uuid": "c446474e-86a2-4f7b-8e02-7de8a4249cef", "value": 320954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690553904, "uuid": "4c87cd66-f9e0-440b-ad84-e5e96d8f15c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690553904, "uuid": "2518de05-299f-4f0c-a64b-7fb784165d14", "value": "vvlio7wypLsHed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e3abe5-2d2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690538111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690538111, "uuid": "a6f6ef1a-fe83-423a-a74e-0dbec1544d82", "comment": "Malware payload (Amadey)", "value": "a3bc2918441c10b0b7c79c7124535705", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690538111, "uuid": "056e97cd-75da-4eb7-99f5-65941209072f", "comment": "Malware payload (Amadey)", "value": "9feba5ffc6444c302db8bf63ad5cef63d7281eb7ba3f62ba66750e6baf5a06a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690538111, "uuid": "35b4d43d-8872-41f0-9f7c-f385746ff50a", "comment": "Malware payload (Amadey)", "value": "26f818260c2feaca7905dc88880aeb30f13dce89", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690538111, "uuid": "dbe4e773-9634-4a31-85d1-bb22bfd57b9f", "comment": "Malware payload (Amadey)", "value": "6ea15e07ab58641729cfc1d20e0629b32fafea0b5487264911579f23a6750a1ae4a159c6d00b88122323010eeb17ce0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690538111, "uuid": "06f62af4-a3f2-4102-b024-46820838a3d1", "value": "T14074A64382A27D55E9258B729E2FC3F8760DF6608F5D3B793219AE1F04B21B6D173620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690538111, "uuid": "9a7c4e75-83e6-4269-bc50-20f33d021e9c", "value": "3fe6bdbf36e3eb8a64bba6f12d781d9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690538111, "uuid": "a615771f-0394-4450-93c7-c573599c1b65", "value": "3072:uqAAKTa9y0ktLpoGoegVYbARZZgwcLCL3YZl5EESctvFT:vAXa9y0ktLpQwARZqOgcEhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690538111, "uuid": "c289a5d3-a72f-4ab4-aed5-0c7f330ba1d8", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690538111, "uuid": "0650f827-d5aa-4aae-a044-ab0fa633c6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690538111, "uuid": "5e8099bc-6360-4538-b2c1-2231d6346596", "value": "a3bc2918441c10b0b7c79c7124535705.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd354d3-2d87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690577123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690577123, "uuid": "633203a0-7edc-4209-9f61-074ac60a6765", "comment": "Malware payload (RedLineStealer)", "value": "1b8486e4767d886e89ce15eff3ca0042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690577123, "uuid": "0a2a5ac1-9b38-46b4-b13d-6a68d3c64d6e", "comment": "Malware payload (RedLineStealer)", "value": "a07f03c943f3db63e69f4b8d548efb881e76e976918d67dc987b258e31d718e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690577123, "uuid": "d9efdb90-6bf8-4a5f-97b0-f8b3af41eec2", "comment": "Malware payload (RedLineStealer)", "value": "5778ad39265542365e1cc607fd9e7d0879c53503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690577123, "uuid": "032c4e34-3be1-44a2-b2b3-cb4cb9cca896", "comment": "Malware payload (RedLineStealer)", "value": "dab993dbde46897145637110e50ff73cfa2a2532d6cc7df0b25f8cf49cfbf6ee5f9e8666b177bf7170bf9c39f6e18d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690577123, "uuid": "b8459ea7-beaf-4de0-b5af-baf24fcc72d7", "value": "T174855A413FD4CA12F06A6637D6EE400907B5BD432983F72B2EE6332D45267C63949DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690577123, "uuid": "2006ac14-ac5f-42fd-ab15-319cf14add40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690577123, "uuid": "d379c437-dc04-4105-8480-3c2751a399ae", "value": "24576:vxtlEyWJgelz2qkCTSt/YwoKdyGU5krlEdQ2vGNFv:vvVglkaSKid2ky7vGNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690577123, "uuid": "4b628cba-4e2d-4923-abfb-c0afdca80ab8", "value": 1766048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690577123, "uuid": "5fbfbc86-8b47-47ef-8c93-d0163bfcb779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690577123, "uuid": "1a5d87b6-0561-4697-9d76-08a7a74abf96", "value": "1b8486e4767d886e89ce15eff3ca0042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cddfa6-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690534058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534058, "uuid": "66f1f7b4-e703-4fb1-aa37-7f424af7b959", "comment": "Malware payload", "value": "190587c78ce2bcad72f0bd1198617746", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534058, "uuid": "624d0c4c-1dc3-4632-aa4e-93faf62c2571", "comment": "Malware payload", "value": "a1710ad8d80f496ca31183bbd62898928f785c16af6b07c78888cedd1d78dc87", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534058, "uuid": "585dd303-9d1c-49de-adbe-83e60d9e86f9", "comment": "Malware payload", "value": "ea31ed57fb958144f6ce51f20f078db276e164f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534058, "uuid": "5e00c0c2-8126-4ac5-a3e6-a515b0c3b025", "comment": "Malware payload", "value": "b23509da6563c7edc23bb60f40fd4f1b29589c8fd0293c23f84e59afa8ed3630e60886c63db60b47841ba3627b0192e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534058, "uuid": "c54bb170-fcf6-48d6-afff-1c16e21f7011", "value": "T1B063881A3E21DFEFF66D813047F78A30969877A51AA1C584F15CEA480F7038E645FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534058, "uuid": "5bddd14c-9f12-4e1f-8b2e-44bfe0dc3515", "value": "1536:VHlJb0kbU/gBV+FgcSyWW95poL0amFeHZm:d+F19Y0joY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534058, "uuid": "d0b451a9-dfd8-44a4-b082-e62f46455890", "value": 68944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534058, "uuid": "2888d871-71ad-4ac3-8c6a-e8177f4e5147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534058, "uuid": "b05bc405-120d-4ee1-9ef5-93508de0847d", "value": "loki.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27af41-2d11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690526175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526175, "uuid": "6e7ebb0b-96c9-4e22-ba39-5b76e29c15a9", "comment": "Malware payload (AgentTesla)", "value": "6bb9dc1c25e5a6202793fc7efc60c968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526175, "uuid": "5285bdb6-5394-476c-9298-78f4e7556f8e", "comment": "Malware payload (AgentTesla)", "value": "a242b43ac6c579a5df5ea6bdf5d1f703e51f0abda33342f8cff451e0a0755614", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526175, "uuid": "62818ef3-dbdf-4760-a0c7-b920fd963a34", "comment": "Malware payload (AgentTesla)", "value": "cea5e5e2c95eff36afaf5ae89e31f763ded25b3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526175, "uuid": "755a77b5-10f4-4d2b-a40a-ca639703b5a8", "comment": "Malware payload (AgentTesla)", "value": "8de19ece361e5c4f3273270f319b019f0b550ce4573d3bf17be7b8e29f6ef638a012ca7e2a4d236e616776eb2cd9250c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526175, "uuid": "a628b539-39a5-4fd7-a33f-53bc34b1730f", "value": "T18505C45B71DE4476FF546E645C2B4B28CFEDB01D240E750B6824CEC61E7EA8CC0AAB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526175, "uuid": "f4d82ba1-0bc6-4c39-ba7b-158d7569ac99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526175, "uuid": "cec7589e-c99d-4d62-8b5b-786f2409c845", "value": "12288:2BeusnEHkrarsb57BVqrzvKDk4F65xljKt:2BeusnEkrarY5jq3KD8xlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526175, "uuid": "ac961f14-06db-4371-a5e7-571e82aadef1", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526175, "uuid": "bd28aaa0-504a-4c0e-baf6-002f56bf73d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526175, "uuid": "2ae56cac-23a4-4db8-9efd-cef4a3fcc17c", "value": "PO 554367+678990pdf{67}.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacbff49-2d72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690568127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568127, "uuid": "1e63c72b-0d80-4d95-bc2c-6517bb67ae08", "comment": "Malware payload (LummaStealer)", "value": "3a66552b951bcac1100cbd7e7af6cd14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568127, "uuid": "2b55de9e-d9e2-4406-b0b3-573cabaa2f39", "comment": "Malware payload (LummaStealer)", "value": "a5ebf3f3762dc01bca3696993961927ec6aa376c7246b88089eba88f039d69d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568127, "uuid": "8a4e4705-b7ab-4a51-8511-6450bb5b724c", "comment": "Malware payload (LummaStealer)", "value": "372acaaacf60624d612dec2bc02786963154777d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690568127, "uuid": "7f61e175-a6fa-4717-968d-11460c368eda", "comment": "Malware payload (LummaStealer)", "value": "9e3acb0796afcae7ead6b770ef27336941bdcd9a2efd9ffde02de8becb04314022b72b0ae3b29f8db7b499b58468db4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568127, "uuid": "d8af6708-d455-4389-8a04-fcded19ae21a", "value": "T14A856A417F989A15F46A6237C6EE400807B5B9433AC2F72B3DEA332D44127D63D49DEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568127, "uuid": "7b543326-b355-4cdb-9ddd-c28fc7179ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568127, "uuid": "0a4eadc3-c74b-47bf-a735-d43f2f0f9b44", "value": "24576:2ZfW54hpvs/dLb1ubIyzUY1waiQ4dDoMYWuxU/P3ZzbB3Mm1/vDrheqDqTGQVqF1:2ZfWSqbCKaiFdIWusvpbB3j/ZeqDcZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690568127, "uuid": "df92633d-d865-4104-9d4b-7fa0111724ea", "value": 1840800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690568127, "uuid": "3eea3da5-e87a-4548-a4ae-12785797139c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690568127, "uuid": "9e8a46d9-e125-4576-b098-4efc2d9e2e14", "value": "3a66552b951bcac1100cbd7e7af6cd14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7b9183-2d67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690563330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563330, "uuid": "4af6eac4-50cb-411d-97d8-5ba35369551a", "comment": "Malware payload (RedLineStealer)", "value": "1befe728146b7cfffca5b1c4392deb32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563330, "uuid": "f29265eb-3fad-4cd8-8b82-6da62252ff7f", "comment": "Malware payload (RedLineStealer)", "value": "a7940c5fa64d96190512b08801ea5a9b2e146cc4c778c2c60fd5070bc7a6467f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563330, "uuid": "ca16adc8-7316-45e3-9a05-807a852da170", "comment": "Malware payload (RedLineStealer)", "value": "2260582a756f68b038ce183612089d29e297bd62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690563330, "uuid": "ec0329a8-e9d6-49ee-bff0-f4dbfad77cba", "comment": "Malware payload (RedLineStealer)", "value": "de43be2aa091894a5abcadb605c417ebe7421e8a211b1d5b4c9dcbee35146f5e6905fc75d88325cffe17947a369f529c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563330, "uuid": "de3b1af0-8671-4522-a892-dd11fcddada5", "value": "T1D97409C033846ADECC4E8AF165A145648A70D453EB9BFF537C4AA8F63C5A3887E053E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563330, "uuid": "10ee7c89-36d0-42a0-80b7-6aed2493bd17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563330, "uuid": "428e423b-5c37-4124-9814-9bff4312d0e7", "value": "6144:IWXC6HfrqsTIGXTvfDJctps7g2tmcY1lY1Y1l1/ge41111Y116Y1W1hHwQIHSOvx:PqrGXTzJcXsXIyOvqBZn6KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690563330, "uuid": "f4275a97-80ef-4f48-b4de-30575e42e7a7", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690563330, "uuid": "eab51893-e85e-4674-b371-31069240ccdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690563330, "uuid": "2a1d1008-467d-4348-8976-9592b42f62be", "value": "1befe728146b7cfffca5b1c4392deb32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3a724b-2d35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690542036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690542036, "uuid": "63bffb44-acc3-4fea-aac9-9a4e47ca5b00", "comment": "Malware payload (NanoCore)", "value": "568d697cdc3d9e68c68f22564e48f10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690542036, "uuid": "3b0564c3-7a4b-4765-a466-9d0e58ceae61", "comment": "Malware payload (NanoCore)", "value": "a94379e72297dc7861d4ec95fad1d7bbe4a162f7b6a855dfd293671068468fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690542036, "uuid": "e27f6daf-58ba-4ff6-9c2f-539e1f16f066", "comment": "Malware payload (NanoCore)", "value": "27d59acf8f6272c32c88048cdd9dd263c7b19aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690542036, "uuid": "c064933b-23a2-46b3-b504-92c82752b902", "comment": "Malware payload (NanoCore)", "value": "6e449b55ea4d423a0aef74b355ccf3e69629f4df6f6637f8b2fc2cb443b570aca35d85528986ef0c08f275bf38ef412d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690542036, "uuid": "c79d8dc2-16b9-41af-9c5b-a9a2c13d73b8", "value": "T1A8F4011827BA2B2FCC767BFD1E00513087F95A5A3176D34A4F822CDB8C69F046A91A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690542036, "uuid": "42b498a8-450e-487d-b51d-67c4357e68dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690542036, "uuid": "f68b142b-1c41-4198-adc9-58c549d8c9d4", "value": "12288:QuEP/SJaFhvTEveoOCCevRrPMeNq4mj6QfIk2byhdn+cmQN4KJs81e3ECO5yY4:s/4OhvAveoOCtRrXqjp2q+cmY4TR3zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690542036, "uuid": "d9d9a76b-fdea-4657-81b6-19e3d3e24170", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690542036, "uuid": "0a1a741d-5a87-49e9-953d-da384e0363e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690542036, "uuid": "a2e3e49e-eec0-4fd0-9ac7-930a1b764dba", "value": "568d697cdc3d9e68c68f22564e48f10f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e518e6-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690539096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539096, "uuid": "7646efa7-c689-49d7-9fe1-f5fca0e74184", "comment": "Malware payload (ModiLoader)", "value": "8fc7f06d978f0c1b65a002af8789ca5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539096, "uuid": "9366e626-4f2f-4b31-8c0c-3b7fac5fd36b", "comment": "Malware payload (ModiLoader)", "value": "ab2483e95adf291375bcca0a4b38f68f74c13c24f3a7e5c57fe2c47148244903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539096, "uuid": "dc769165-a3d9-412e-a89b-1ece4ccad2ca", "comment": "Malware payload (ModiLoader)", "value": "29f95e1647a735a182dec437ac8b11b6e1ab27c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539096, "uuid": "6d416c64-904b-4280-9c14-11969d6279c5", "comment": "Malware payload (ModiLoader)", "value": "1e14163ef83aac142a762702362971e1cdd6771d09dec924f95296ce76f9ebf4fe6d4b52fdcb2a0a6c13876a62d24561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539096, "uuid": "62e0d0b6-2f16-481e-a7ec-eca663d65942", "value": "T1DE05AF3195785472F02A2E36DD46B7285C397D202D38B4A696FF3DC8AE7A583F8191C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539096, "uuid": "a3f6cead-28b8-47b0-afba-4f053d01b82c", "value": "c1bc1b4428880431ffbb0e7b82ce2dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539096, "uuid": "3ba6cd89-c845-47f0-920d-b9834beae10a", "value": "12288:h3H75pQe3LJf1jpBVudoJrLsqkbBjXjvhGHxWgyFaB3Z6:hL33tfd8dgLTklh9aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539096, "uuid": "80510521-b5ea-4a22-92e9-f1d89d61717d", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539096, "uuid": "5ab27958-6278-410c-bfb8-c5f83f6315ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539096, "uuid": "e54b0380-9ad4-429d-aefd-c5d048b095b7", "value": "U prilogu je potvrda narudzbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca0037d-2d2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690537019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537019, "uuid": "2b5be234-175f-4662-9079-e1086c7fdff2", "comment": "Malware payload (AZORult)", "value": "268f72aec0ea9dcb0868dbe6f20997d0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537019, "uuid": "176b62d2-3fe9-4e9e-90f4-08fec774b78e", "comment": "Malware payload (AZORult)", "value": "ac8c5ba9b772998b60ae6a1f91bc56086af2e94d213f1062c561b96b3c8df851", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537019, "uuid": "adcd619c-8b3d-4a0e-8aa5-f1d90f5942be", "comment": "Malware payload (AZORult)", "value": "c382ea68180704cd976b1d6ccf432847229b62ae", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690537019, "uuid": "88deb004-04d6-4eff-b6d5-446f9220e854", "comment": "Malware payload (AZORult)", "value": "29e2c8ea6f5124deb24a49e8e320d75e244baa5c34d9548d021d9aa51ea8ef8be355455d18e4b29d06027ed1eb19838c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537019, "uuid": "ad28c51d-0d95-4e82-b0a2-97851778c426", "value": "T185D4E051E26C0FABD83A57FA4821900453B6FB6A503DD20A5DF7B8CB1076FD21946F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537019, "uuid": "0fe0e0fd-5778-463e-98bd-72f8fd4f6b36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537019, "uuid": "81294ab2-5d9d-4635-bc76-0c877c2ba2de", "value": "12288:i//gjjWUxCGBS7ZzD2b6/zAdrd/ysf/OUOnBCr:ingjjWU4vV/zAdksf/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690537019, "uuid": "96a79550-91bc-4ac8-b834-f2722c7505c3", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690537019, "uuid": "94f0af43-038e-477f-8256-9cff8091ad97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690537019, "uuid": "4fe09b46-7f5f-40c1-9303-fa3d3870e05b", "value": "SecuriteInfo.com.Win32.PWSX-gen.10332.29048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fbdb03-2d10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690525997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525997, "uuid": "fa927ef9-deb9-4a38-af5b-c3604809b892", "comment": "Malware payload (Formbook)", "value": "0c99557a08deccedae397186b8b6cd26", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525997, "uuid": "114adcfc-83bc-4270-a76c-7d4f15f11145", "comment": "Malware payload (Formbook)", "value": "aca59f0c799782c11cb0429e0ba68a78368faac1e23397253e0b8375a242883c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525997, "uuid": "477c95f3-0444-4a27-9e7e-d311c0af0c7d", "comment": "Malware payload (Formbook)", "value": "d35ada30f913d23f7d6f81bb45ac0a916c6ebfbb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525997, "uuid": "064440c3-7812-4518-8b4a-fa9d91c6da1e", "comment": "Malware payload (Formbook)", "value": "2fb498518cbed6c75d921108c8c19251aa9448641fb7d7ce81b951bee7d2c29d28fe4375666fd8c0c497a39ea7242092", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525997, "uuid": "e15d8613-6f66-4d27-ae15-87f054510d2f", "value": "T1A123E35AE79F02658F9112B7131B0E899ABDB23DB35054B2746C933433EDC3E06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525997, "uuid": "ef8d2e40-7eb0-4d28-9a18-a16c390a15f1", "value": "768:cFx0XaIsnPRIa4fwJMPDHlTwMjmcHeJhembfr:cf0Xvx3EMPDl0MSc+/zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690525997, "uuid": "f1d60d13-ee02-43b7-bfc2-bedb6c4097ae", "value": 47016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690525997, "uuid": "19a227dd-42b0-4bf1-b922-b26dd569d8f2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525997, "uuid": "e87277db-c0f6-461d-93e4-7fa3fdcbfeef", "value": "Specifications.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07fb722-2d32-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690540649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540649, "uuid": "5f4e85bf-5d73-463d-ae09-8d3657582230", "comment": "Malware payload", "value": "74a21ab7e4d51a07d2c7567a7b87509d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540649, "uuid": "de7404f3-1c45-4b19-9704-f900585cf510", "comment": "Malware payload", "value": "ad75ebdb148b29ed5b190500ce4058e079bd097a780f1f22c9c4c5beaf202e82", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540649, "uuid": "a99d3bc5-e504-431b-9b53-c78ebc1b8b41", "comment": "Malware payload", "value": "8c83e85bd7fdfa9eab1e77d1ca548e66e5a2c41d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690540649, "uuid": "20e208d9-cdc1-4bc6-8376-1771c6b333c1", "comment": "Malware payload", "value": "0358652bb44a80be936b5ba69088f90cc8af6fd4eeb24f20fa2aa6edc810fb1cdd64ac178e326c03d4081e5d78cf8d15", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540649, "uuid": "7cd19238-4d79-4d85-87ed-6d041ae4b63b", "value": "T19265026319D1D2E5CDBA4DBA2FC46FC548DEB5D0708C248EA7E060D01E27B91E878E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540649, "uuid": "2a7f0887-c768-4af0-ad1d-850b296745e1", "value": "55b4aab7b4802511030a370424166aad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540649, "uuid": "bf82f475-c9af-4104-8e33-8db76fa391cf", "value": "24576:tJ9xEh7sRwocMSGVLUthyMj+zFjGdTK0Mg9eGeB7oMoVv+84bn/h:r9xEKRwV4Lz9z5MBYG27YD4D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690540649, "uuid": "daf737ed-6688-4766-9ae1-00c7a6b9ef09", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690540649, "uuid": "c84d84bf-e638-43c4-a818-382ffd7d1a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690540649, "uuid": "fc5a5f81-5e59-447b-be97-311994a2d34f", "value": "SecuriteInfo.com.Variant.Mikey.149047.23165.4165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f15427-2d17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690528929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528929, "uuid": "9385c3f0-21d7-4bf8-98cb-cd66ea32664f", "comment": "Malware payload (DarkCloud)", "value": "ee4636148ba63d0123f9e949071ee10a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528929, "uuid": "c9537a30-4cec-4fc7-a129-9aed6f967dec", "comment": "Malware payload (DarkCloud)", "value": "ae4ca10700c3a8f5ecae88950b7dbab3a5a18f2d514e7adb11ae4e5200913605", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528929, "uuid": "d9706400-77c7-4db2-b4c4-6d6f96c2b7a2", "comment": "Malware payload (DarkCloud)", "value": "ce57b62a4b2b858a0c22b0c28f5b07a930433dde", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528929, "uuid": "eb95779a-c499-4cba-a7c0-e6497258b25b", "comment": "Malware payload (DarkCloud)", "value": "244c0fc2945ac476e0a95913af06c93f65d7a1a5e11b4f03abfe214c7510f04ea387ca458b5f2e8e999345d38e886d4b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528929, "uuid": "0acb552e-ed7e-4eec-99a8-0a5a6cdf1849", "value": "T1E0250150B2BE5FAAD97BE7FB0211921443F66CAE962DF7091DC930DB2590F404A40F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528929, "uuid": "6e432319-07c9-485c-b544-0ae7d257978d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528929, "uuid": "502f4035-efa9-4ec3-97ee-757cdbf45e13", "value": "24576:/1QrqS1DZ7ioE+omHuydCnUSu7RNl7k9CsiEud:/1QrH9NZEwOywn0kMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528929, "uuid": "ff8b79ee-afd0-4b9d-aebe-f767c954985b", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528929, "uuid": "29b14028-a93f-48fa-9faf-197323560d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528929, "uuid": "1dd8ba4d-826b-40bd-b454-eb30b276711d", "value": "PACKINGLIST2.pdf\u626b\u63cf\u4ef6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63fa9bc-2cfb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690517117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517117, "uuid": "ee54deee-0170-4c5c-b161-e4a37c7b80dc", "comment": "Malware payload (AsyncRAT)", "value": "37e965330586a51125db2a420917db17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517117, "uuid": "74322cb6-8820-4ad3-9b91-3bfd3021e15a", "comment": "Malware payload (AsyncRAT)", "value": "b06b398feb7402b0dfe6173944da3413160c8608d60c89fa5311b65892135f5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517117, "uuid": "1f0d6fee-fba2-4ca9-8a00-719e435351d7", "comment": "Malware payload (AsyncRAT)", "value": "ed69679f52a686cccc7c70955517ece277b2d21c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517117, "uuid": "589cda20-f24a-479e-a911-8c6bbb2ae803", "comment": "Malware payload (AsyncRAT)", "value": "3b0c11900b7258c6e2364f1943aea930f25085454a3c857f0f5b46f0ccf7e10f7b53404c7725671f909705ceab01b30b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517117, "uuid": "35d5b95c-fb19-4b29-9913-b1bb75402cdb", "value": "T1FC235D4037D88136F2FD4BB4ADF2A5418679E2676903CA5D6CC814EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517117, "uuid": "b79a5b2e-c4f5-4e62-96c4-a40a187f1ae3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517117, "uuid": "b741581c-e698-40ba-9c42-f9aa8bdaa82b", "value": "768:boK0GnILSC+e+biNtelDSN+iV08YbygenZHIVWICNBvEgK/JDZVc6KN:cKTyNtKDs4zb1WI8VrnkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690517117, "uuid": "6d50d37e-7871-4be7-aba2-c01d5e4771be", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690517117, "uuid": "c4124f7e-d977-4eb0-a5e4-51277566cf2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517117, "uuid": "f7bbad2e-4c0f-4835-9398-d46abb9d9d92", "value": "37e965330586a51125db2a420917db17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7b439c-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527252, "uuid": "c9f41cf6-02e2-4ab2-8614-08321f096344", "comment": "Malware payload", "value": "c94a73a0f5f26abdd5b7e518c078e529", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527252, "uuid": "16bcf01b-475d-450d-b423-eddf466caf30", "comment": "Malware payload", "value": "b08aefe593abf5f8456900b0853d9b906fe9a21702387ff60244f05342cf6037", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527252, "uuid": "fb6d0c56-674f-4476-a6e8-2367ce8a5d3e", "comment": "Malware payload", "value": "37cbc6c6380662854fb12d0b032a3d61d276d524", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527252, "uuid": "8c59f349-3854-4921-a5b9-d1b320c81302", "comment": "Malware payload", "value": "f6b7c2d35be3e44410df09ff5d6f40931f9177491f7705bef1c0104a3b6d7f5c908caa8a195d6b357fd43d5dd16345b1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527252, "uuid": "1c02db83-12e0-45ea-bde5-c0cebb4ccae1", "value": "T106F42328F35794F7F5A0EBB6C90550B2C235242FA7D5B4E5A590E52F0A9033708BCDBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527252, "uuid": "7741aff9-1b1e-441c-b1da-bbad304f1d4a", "value": "12288:e2BLvNKkwqXyUU8VDVA4mkwaGlsU9Mfk2/Wv9m/QxRFh/WeumuHUuQ9c:JM2XM6ZAmGl/9HDF+wXh/fo0Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527252, "uuid": "43a4c5d6-62b9-49e8-8870-141f224d83cb", "value": 759613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527252, "uuid": "f40c2e1f-d852-4d9e-94b2-102c9f15a9ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527252, "uuid": "bc727edc-4645-419a-93d9-6f896f22d483", "value": "Pago_7337832609.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6de911f-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690545331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545331, "uuid": "0ebd7b03-adf6-4840-a4d3-b5d765a4980e", "comment": "Malware payload (Mirai)", "value": "ba9fdea6ad358a4a8fa7317bb0e5cf44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545331, "uuid": "6130b0f9-7e32-4bcc-8906-12f7dd05e01e", "comment": "Malware payload (Mirai)", "value": "b0ff47f60bceeca190f21c3bdf6155299793dc31bb9540de2a1f487565a87abb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545331, "uuid": "87d622d1-1329-48cd-8166-5a16dad57adf", "comment": "Malware payload (Mirai)", "value": "42acfc0fd0ec5b219c394f53955e8eea84714914", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545331, "uuid": "3bf2f053-6467-4f45-8c00-48e910192a90", "comment": "Malware payload (Mirai)", "value": "c7f3aa690ebf70d300553baa2f5abf6ea40c0a22400e9a0c8316d200baaf5533cf2c71723a7e163d9980b1842b94d2f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545331, "uuid": "e2d5d4bb-38f2-47c0-b5fd-48c7e07dd9d5", "value": "T1D2636A22793A3A17C4D0A8BE22F34724B2E16B5E25A4CA1E7D731E4FFF1194051476FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545331, "uuid": "ee6f08ad-e02b-4e19-a37d-50ff214f5c6b", "value": "1536:NH7ou3C2+tOasB5zA9hER5zSghn30CkTQR8ne5XCYRp:5p2gd5zTnECP8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545331, "uuid": "cd75e915-33a1-4a03-b9bb-084da2ae164e", "value": 68128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545331, "uuid": "dbb6c13c-084a-4a87-91ea-85883a65571e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545331, "uuid": "6a581671-bd59-4ec5-812e-8b5791cad5a0", "value": "ba9fdea6ad358a4a8fa7317bb0e5cf44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd3ce58-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690539084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539084, "uuid": "709d59e4-e978-48bc-b236-2dcddfdae474", "comment": "Malware payload (ModiLoader)", "value": "2372928880272511e0e7049cf383b568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539084, "uuid": "3b08bc4c-e84f-42ba-b4a2-b04ab0392bc6", "comment": "Malware payload (ModiLoader)", "value": "b3ac87c3ecd0b2c59f405d9853a7da54925e72d1bdae04793cf7ce804dd6232b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539084, "uuid": "b0fa0c3e-32b8-4b02-b9f7-ea96de42a994", "comment": "Malware payload (ModiLoader)", "value": "0c9bce94e4ab1185874836d50e5d0b8878371492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539084, "uuid": "87b656be-3a57-404c-9e4e-0e3bd415cd62", "comment": "Malware payload (ModiLoader)", "value": "ee3a3dcf778386644da68de188712444b02db9f236df52a05cda07009e9c12b231154b3c238962e08365aae1c0f251fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539084, "uuid": "e2305984-5119-4c85-a1fd-20c11ed859af", "value": "T18205B035A2B484B2F01E59359D46AB5458357D613C38A46E9BFE3CCCAF7B283F825182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539084, "uuid": "0ce0baab-05d9-48f6-96ec-2ee3103a0fa1", "value": "c1bc1b4428880431ffbb0e7b82ce2dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539084, "uuid": "af9e1b31-cb32-48c6-88b8-349a05a7981a", "value": "12288:h3H75pQe3LJf1jpBVudoJrLsqkbBjXjehGHxWgyFaB3Z6:hL33tfd8dgLTklw9aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539084, "uuid": "cba2c5e8-3b37-489f-9de5-bf4297bba6da", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539084, "uuid": "cd49df26-e62d-4d65-bcdf-238b6b37a79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539084, "uuid": "fa18d212-17ba-4391-b0c4-2d3f8179961f", "value": "Pzqjjdgmvxfckd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28c965f-2d10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690526103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526103, "uuid": "9be96117-03d2-483d-bff4-89c8c0b4d0a1", "comment": "Malware payload (DarkCloud)", "value": "38dd18258300f895788ed0d7a8e3e867", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526103, "uuid": "26af88e7-7a9c-46a7-8d0e-69a29e1e7b31", "comment": "Malware payload (DarkCloud)", "value": "b5e54d06d532bd76e74490f3e913f228c3ba105aa3865453602e9d465fc5824e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526103, "uuid": "c1317317-883f-4b88-9d31-464ea3af225d", "comment": "Malware payload (DarkCloud)", "value": "99d5df5196aeb42ebca1d46e4773d8d93e268b8c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526103, "uuid": "46b75184-348a-4b5b-a19c-8c57ac7ed6ea", "comment": "Malware payload (DarkCloud)", "value": "09337ec1536b82caf33e04695db631ac729ece7654590836a7754339d273fa8ddc6032c56db57ede2c90e6fe74f3030c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526103, "uuid": "1fa54d71-f49a-49d7-875c-6ad0ba576a05", "value": "T15B65F1079804CB83C41D83F8BE431EE91F5ABF18D5916DEB11627F8B3A31A32594E16E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526103, "uuid": "4d3906c5-9d7a-4e72-be84-2b6bb2160911", "value": "24576:Neu9VNZylw6VzEnDZyQw6VEViNhuuvvtaUOmGPpdEM1kwOL3wim+xqXqsWw:NeuPR6VzEF06VoiNhv3txOrpdD1nOjwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526103, "uuid": "9601af48-1ba1-4473-a360-cd79f952e32c", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526103, "uuid": "3711b885-2dbc-48ab-a308-2384bfa8680b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526103, "uuid": "83dbf590-da4b-4a3f-adc4-656fac4c29ca", "value": "STATEMENT OF ACCOUNT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522092e1-2d19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690529727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529727, "uuid": "68a13972-ebac-4ce1-bacf-e80400407231", "comment": "Malware payload (NanoCore)", "value": "50a23131e682a65346b629b0d6d84582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529727, "uuid": "f11b1d80-8deb-4f4b-8771-fb3b5f6acb9d", "comment": "Malware payload (NanoCore)", "value": "b6314221c4f4e5d864d35a9d5ff2a03d12f872ff888017fd278d0e23ec09f352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529727, "uuid": "fcc7ca10-772b-4a04-b6b8-56eb8ba28b8c", "comment": "Malware payload (NanoCore)", "value": "a7604552a41aacab24c3ee416040ca1e0fd3c769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529727, "uuid": "a1864b78-169e-4569-aeb2-9058019f8340", "comment": "Malware payload (NanoCore)", "value": "0a57b1597017825295bcc594643fdabdf212f8d91acf18ae3f034a13e21d28813ee641f0cba8573649d7655d0f8feb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529727, "uuid": "65965354-b6dc-4795-b64d-dcb526ff08d8", "value": "T10214CF5677E94A2FE2DE86B9602251128379C2E3E8C3F7DE28D454F78B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529727, "uuid": "20177b0a-3e7d-4620-b961-338267348941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529727, "uuid": "cdb6cf79-7fb6-4751-9766-22a3997031d4", "value": "6144:wLV6Bta6dtJmakIM5plWUu5LYkO0TrWSG:wLV6BtpmkalM5LYkO0TK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529727, "uuid": "3dcb79f1-2407-4d19-9727-e19bab9631d2", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529727, "uuid": "220ee12d-43eb-42a5-848f-4d99992c4dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529727, "uuid": "0741b5be-feef-4cfd-9ee6-efb1f643f361", "value": "50a23131e682a65346b629b0d6d84582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcf57d5-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527787, "uuid": "2efbc465-fad9-401b-8150-d17347bfe309", "comment": "Malware payload", "value": "68c487fdad3b21d806023e8966302a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527787, "uuid": "305420a1-6c1f-4095-bad3-2cac4e478f25", "comment": "Malware payload", "value": "b7398f53dd106d0d344faee6d5e6ce71637cad389d3efdcdf7031f45ed1d5bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527787, "uuid": "bc6f0608-3948-4215-a013-52c41f27ec12", "comment": "Malware payload", "value": "47b2e0ad9b0e0451b95e7560e7b71ce8da774793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527787, "uuid": "cc76bc47-ff9f-47b0-a942-77f0fd730a0c", "comment": "Malware payload", "value": "8019401fb8e1b6d53d53185c408e441b228804198ddaec72099f365f7c9a655c5de73195f5b0e202293abdb1855a3319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527787, "uuid": "860352e7-4a78-441c-be07-35b2397f3c66", "value": "T138C5CF03B66786F2E28967B6DDAB8C04C361DA83731FD70B788E23A555433B79C46607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527787, "uuid": "ee7092c4-1267-46ed-9ae2-2893d62903e9", "value": "49152:irjqkI9wbOEyCbdaveg5Q7FHo+sbC40fDWJmmZ/:d+OKJo+shoWJZZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527787, "uuid": "2d39a963-c219-4faa-8c6e-3f3c21ca8448", "value": 2544219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527787, "uuid": "196ee3ab-c24b-4232-ac63-9b7ad599b887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527787, "uuid": "4837649c-054f-46e4-8b43-f1e67f074952", "value": "68c487fdad3b21d806023e8966302a75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129b1f8f-2d5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690558826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558826, "uuid": "0bd1e4ea-65bf-461c-a807-3c78300e8d02", "comment": "Malware payload", "value": "cc0cad9f4578cd48adb3f7cd925f1d4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558826, "uuid": "cb03fcf9-17f8-48f2-b847-1560ff8601bc", "comment": "Malware payload", "value": "b7d17097a334a02f1336771bfb93b1c2f455ef20147aada4683673dce981e1fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558826, "uuid": "c1b90f03-6964-42a6-a392-d00ca457f020", "comment": "Malware payload", "value": "ba18c820e3e22c1c0fe0cd652292342dcb7c5638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690558826, "uuid": "64252f39-2fca-4c18-8080-adff5aa3846f", "comment": "Malware payload", "value": "80e14120ba8e2f1785a913710f4852695e8ad106e118d8440be8f00ea51781347c4ba80ad6ec492e09498716276af43c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558826, "uuid": "aae0bdb3-43a9-4cfc-936d-ed8faedffae9", "value": "T101D080330B1A40DADAD4033F6675595CD77F8DB7574962310C60DC010C0E6045F52C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558826, "uuid": "39c7ea04-cebf-4462-aba4-6129b61ef5e4", "value": "6:BnX//In8/r1uBxHocmTeQ3RQdygg5XJYD:BvwncrAH3mr532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690558826, "uuid": "c23ff5c2-9115-4d66-8fa9-dbbc1186f1b3", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690558826, "uuid": "4ecf0e41-82a0-49b1-948d-1a341abbd6d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690558826, "uuid": "c4f33730-fbdd-4ff2-bcef-a4c0c8edea9a", "value": "revers_met", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac05d96-2d95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690583160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583160, "uuid": "ed58f1de-adf8-4677-a2d5-7fa9879e6c7a", "comment": "Malware payload", "value": "71d92d610cc7d43aabe67cc9c95e9673", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583160, "uuid": "ab10154e-17e8-45c3-8d66-a90d5b68c87c", "comment": "Malware payload", "value": "b84d6a12bb1756b69791e725b0e3d7a962888b31a8188de225805717c299c086", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583160, "uuid": "b2d26fea-1a35-457f-ac34-93b18c0cc79b", "comment": "Malware payload", "value": "f2b87d3a692b7597bdcee8151e5960fc5959dc7b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583160, "uuid": "e12c7abc-754b-4b0d-b4b1-820e0877c914", "comment": "Malware payload", "value": "e55f55a5297b5b5dbaeac0a8df76d7a8ec473e1ca74f286d80568d621e1354678f8fd93bbe1e1af8f151bd505255c2a0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583160, "uuid": "8b4bfe61-180a-4d0a-a184-bb70fc16e5f0", "value": "T1D8A58282B93DEC67FD9C38F0C886AD983C0D3E9666AF34AF357AF65994339109580D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583160, "uuid": "e243faba-455e-496c-ad4b-bb95f87898a0", "value": "24576:ZhVO0g+aO8IaPJjbw57ouZL0ffoqRNCodot:J5oTa5LGfF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690583160, "uuid": "7878a687-54b2-4617-9a1e-c00292a176d8", "value": 2213888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690583160, "uuid": "ea6e7e5c-86a2-4504-891a-34d5287c3825", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583160, "uuid": "2110151f-76de-4a94-ab30-f2d9371eee9f", "value": "Note.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7886b63b-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527643, "uuid": "191d718c-4f12-4cc8-9cd6-01759a38d186", "comment": "Malware payload", "value": "ff247c3a72e13bf4e517c69a99a933d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527643, "uuid": "d084dec1-0c1f-48fb-8486-2487b35cd4bf", "comment": "Malware payload", "value": "b96dbd6f55ad933143e1ec1fba507aa57fc04c8a6b0ae6b314ecc9df66a52f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527643, "uuid": "d0dd55a2-c449-4c5b-8beb-8d66179cd3f7", "comment": "Malware payload", "value": "cb3ae051a6e40bbd3fa2b4a6533d3c1356abeb7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527643, "uuid": "8d2c341c-2f9e-4d37-976b-1208badfa00e", "comment": "Malware payload", "value": "f69097636c68c6ead07d12aa9cd021eca4592d63c91f8740e43d1eef12ef8d550f389ba1d8557894fceea6dfe49b7173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527643, "uuid": "e3051091-0aec-4f2e-a805-5f576b80638e", "value": "T16866DF8F9E877C655102C86DC736F2E124BE800225393C315EFF29B6A89F975C9A8D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527643, "uuid": "c1386cb5-afde-4b66-8902-544c69fa43be", "value": "98304:dagFo3PcCIno0a4FsmuwCKVmLa0ENswvN8Uiw/0vzDblVJOUOohZ0cNy4MDCLo8k:dFgA7mLzVoOUJ071rCohiKyjDl9E1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527643, "uuid": "24c3e4e6-ef2f-4d44-8b50-d5ca0d7e57d4", "value": 7064143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527643, "uuid": "f93853db-b630-4c24-bbe4-482c3cd631e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527643, "uuid": "2537897f-5298-4371-98dc-b248b801db1c", "value": "ff247c3a72e13bf4e517c69a99a933d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1456d5-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690534063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534063, "uuid": "36b3fe12-3eca-470f-b855-1189d206e73d", "comment": "Malware payload", "value": "a151900e43f3a9adad7a31de8f7e49e3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534063, "uuid": "8aecc4a3-8605-43ef-8733-890e9fe536d3", "comment": "Malware payload", "value": "baa35aea3eb9274692206452c18adfdabd599925b3c266a7042c6207cf601ad3", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534063, "uuid": "a9afc59e-4f9d-42bf-9783-e36efdba648d", "comment": "Malware payload", "value": "f9ab3acd6a9b90d403e0cb915e957aafbb495f50", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534063, "uuid": "ed6b60cb-acc4-4098-a022-652400c9d8d9", "comment": "Malware payload", "value": "8e9bcf9aa129b1c793c81a269554a2ad9a1cb9c414932598a0947f03045fdbf59b02a4232e500c830da227f7b87dfc2e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534063, "uuid": "8a4cca78-fffa-4bea-a604-708bf57908f1", "value": "T14673184AB941AB02D4D321BAFB9F414933536FACE3F972019D24AF6123C799B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534063, "uuid": "96fa8684-9f3c-465d-ba11-c2bc5b669e22", "value": "1536:LBnhnk1IhuMx29Dlpme7wBZ2Yc6b4NJP3veluy757iU4iai9PzY7+Fw7:bgmEZlptwZ2Yc6b4NJ+b4iai9PzhFw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534063, "uuid": "4d3cfe95-7fcc-4447-8e73-0f8a9838099b", "value": 77728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534063, "uuid": "683ae56c-53ab-429a-a3ea-836b222acd06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534063, "uuid": "73a5eed8-ca1e-47dc-9e67-634057750c96", "value": "loki.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab9be23-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690527486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527486, "uuid": "57e42752-b66c-4031-abd3-ee31883bf385", "comment": "Malware payload", "value": "e9d64e56c98124dc00166a367726459a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527486, "uuid": "9d4c69b7-4c84-487c-bd1e-060bc29ed100", "comment": "Malware payload", "value": "bb32941c7c249711953fc129f97c5561368014d24bb1ff7b6da1e5e83eb52da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527486, "uuid": "b4921156-bc04-411e-86cd-13110f381481", "comment": "Malware payload", "value": "e6e4c5f2cb4840c5063a14343defc7ad8f89fc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527486, "uuid": "af89cd30-be68-4a05-90ec-fb780a0b79ca", "comment": "Malware payload", "value": "f74589f86fb07fe7831072d4221120fe2833d8667e71c18e6ebe05964e4c83f88b001ad63146d389012d86dc0aa1c983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527486, "uuid": "dd04dfc9-1273-472b-a443-491dbc3c081e", "value": "T1C4C4026269E11876C4689BBD134E8ABC5BF0FA585412EBFD4AD0600F9C0FFF1456D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527486, "uuid": "74cf6b45-cc20-4b9d-84c6-aade65bff15c", "value": "12288:xClGyoZcqdFF4qGRPnZnBI/uOq7y4My43UUKzvGWxlBOj6y43:xCl6jdsZBNO8y4My41CVOj653", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527486, "uuid": "f05ac738-5620-4e7e-b459-7e514782f3d2", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527486, "uuid": "03822ce8-0a9f-45c1-aff8-7377a7aec9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527486, "uuid": "9b98419b-7304-4409-8369-821784364228", "value": "e9d64e56c98124dc00166a367726459a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5bc823-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690527814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527814, "uuid": "69b2b7c3-c7bf-48cc-b09e-79accea22450", "comment": "Malware payload (Stealc)", "value": "4dfb16a3bb7c0426072d5413090eda8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527814, "uuid": "b6ba7589-94e1-4d6f-b49d-39ebe0421a90", "comment": "Malware payload (Stealc)", "value": "bca7c162b24acbb117dfc1d51b7a0eb2548230281b064aa43d9007218670675f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527814, "uuid": "7e8b5633-377a-4d8e-97ee-b1b94e1ddc0d", "comment": "Malware payload (Stealc)", "value": "378c6272be0523287a8040797c82be90c7e088c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527814, "uuid": "fcb6cbe6-074b-4293-9114-75b14dafb9b5", "comment": "Malware payload (Stealc)", "value": "fb80d71e3b193ec6d3beb63318ca590d235a4f6b0aa8a54df521cd27e1164c78d7f3f902d12f463e4ba46a50533e62c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527814, "uuid": "6f60d768-e5e1-439f-9dbe-18d4302d7be5", "value": "T1E9644C139291FC65E5265B329E2EC2E8371EF9928F1977A622186E2F04B31F1C373715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527814, "uuid": "ee6698d3-af71-4e79-ab02-8d73bbb1524c", "value": "4d78eb5f7b59a8e753748eb85e3f3b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527814, "uuid": "5da2fc4f-bda4-4583-9395-1e490e911b7f", "value": "3072:Zv5Fbk2tr4Klhxj68KIMnfP2fKUjsx3p80ov9xIhc3a9z2ZkPBo:ZxFgu4KlD68nMnufjY6pbaqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527814, "uuid": "56bc7a46-0a6a-4dee-ba17-c744c3446784", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527814, "uuid": "d41e94cc-a889-4ab6-ade4-4dc0617299e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527814, "uuid": "b99a1d38-6310-4cf6-bbf5-d0140fd42dd1", "value": "4dfb16a3bb7c0426072d5413090eda8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef027176-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1690527842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527842, "uuid": "cdb2cd6a-1dd1-47df-b536-08c6ddb759b5", "comment": "Malware payload (CobaltStrike)", "value": "cab4bd08b14b07b862d597f2b569bbc9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527842, "uuid": "1c6a9429-0cb8-4638-a77e-07b585c3e447", "comment": "Malware payload (CobaltStrike)", "value": "be5a1fc634d9f97548e6cd03ee099aa6892789f666e8a3c4808dbd9a0183c5f7", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527842, "uuid": "7522d18a-dc8e-4bf4-b36a-6d6597b64d11", "comment": "Malware payload (CobaltStrike)", "value": "33f8832af27170e28afe8dfaffefd8daef466d94", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527842, "uuid": "3d5c29ca-ac37-4404-ab50-600fdae1f301", "comment": "Malware payload (CobaltStrike)", "value": "a02fecfbff287ffa1e5f4454bcee814e9c13c59989c55b05b639973bfe3e675de857689d1fbe18ab46968a72aaa09a12", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527842, "uuid": "f01a828d-1a65-4ee1-8682-cd10be8a106b", "value": "T18BC5AF57BC9A90B8C0A9C1388A75D292773178A9033223D77FC4AABE1F767D41EB4354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527842, "uuid": "41e6d571-434a-41db-8c8a-4f9a4bf1682d", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527842, "uuid": "9ddc5419-1ce5-4e9a-bf41-63297421c4ae", "value": "49152:S2th8gr5Xrb/THvO90dL3BmAFd4A64nsfJlC49THZpI7xUWvpvg+DeJxb1J:S2t6Q5IJ6e3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527842, "uuid": "3271f37b-f9dc-4ad5-92c3-e7f13e02674b", "value": 2720424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527842, "uuid": "40118cfb-35f6-4c67-920f-d8ca7a516478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527842, "uuid": "a48c2c17-bcfd-408c-9374-aefadb52d28a", "value": "cab4bd08b14b07b862d597f2b569bbc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4f9486-2d29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690536881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536881, "uuid": "5ac14f28-9e70-43ad-ac7f-d2f1d34915e8", "comment": "Malware payload (Mirai)", "value": "e7d0fc1412111aa6fb263f5c08519a0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536881, "uuid": "ba77b9be-1083-44a0-9d14-b9228d18febf", "comment": "Malware payload (Mirai)", "value": "bf87b5cda6b06f8c8211c2815b452e950b0456aa63b2a3e2a85550743dba9ffd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536881, "uuid": "185aba0d-6de0-49ca-9717-4b6672b12049", "comment": "Malware payload (Mirai)", "value": "679c419008113e023fa69e6cb0109ce327cf6814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536881, "uuid": "9629ec77-ef60-41f1-a0b3-695dc5ca1603", "comment": "Malware payload (Mirai)", "value": "0ba60553a7ea9c3653438c437707acf06c47ebc785ca4eb1413faab3e4898cf0890fc86ed796e81abf28535db196fdb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536881, "uuid": "68a9729a-afa6-401d-874b-8a25b748cc10", "value": "T11283A60ABF610FF7ECABCD374AA42705259C640A21A53F35BD38C458F64B25F29E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536881, "uuid": "ecfa01c8-d6d2-41a9-8247-300a8d9b7563", "value": "1536:PkxMXTr8RE9t5/iynKXRh9/6PZoQ3aqZKk2Q2SrzN8m6fZYURRA1O3nSI8:PAN6PZf8m6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690536881, "uuid": "a76a4515-9b82-4ecb-bb7c-d8711777a205", "value": 88280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690536881, "uuid": "8584caad-ff49-4fe6-ac1e-24fddb96ffa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536881, "uuid": "826cff86-f930-4172-9e24-1185b4d75caf", "value": "e7d0fc1412111aa6fb263f5c08519a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f92b39-2d1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690530354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530354, "uuid": "aeeba699-c265-498b-87c8-960c6372a776", "comment": "Malware payload", "value": "23c47f81199222919d910df1de5e9544", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530354, "uuid": "e68649b3-912e-4209-bb2a-59c60eae2b19", "comment": "Malware payload", "value": "c1b73bcb9aeef5236766255e1f22edf72a539be38a5257dce1dcea651babf14a", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530354, "uuid": "e547823e-c16c-4f27-8ec4-d387888c859e", "comment": "Malware payload", "value": "2531e65e0eef1913e7fae5f063550baee049d90c", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530354, "uuid": "78a0d828-a62d-43f7-bdcb-1b70f3d4a959", "comment": "Malware payload", "value": "0328971e1b2315eadec04c2d35979391d86c537e2e690314bf279f97eb129ea65a9bdcde5d7663a05b603b1f69d2e9bd", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530354, "uuid": "d79ef9f9-0b12-4702-ae56-37ee26cbb437", "value": "T19EC46BF476D07BC70F75294DB3CF81B23D54B457F0ADAD8626CD0D1E928029899BAEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530354, "uuid": "f97c62b0-7819-4493-9940-99980aebfe6b", "value": "12288:PZTwaHan/5MeRUki7VxO6L2/vGHTFi3+36WVj2z:P5TanqeRRi7VxO663eTAWVCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690530354, "uuid": "dc47e870-78e1-4cfa-8dc6-3f1060dcf938", "value": 566310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690530354, "uuid": "a0ec320e-61df-406f-8e89-eb83caf704d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530354, "uuid": "9f254a00-422b-4119-a884-99f11dcf2c57", "value": "izyywyjzjncblkfampkodrlowlxsneepwvpegpgwiyjewdazgd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a61b10-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690534056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534056, "uuid": "8be5d211-f310-485e-9508-51884f139c0a", "comment": "Malware payload (Mirai)", "value": "8591f0616e7e0051e949e8dad960fcad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534056, "uuid": "f2362f38-069f-48f3-8808-4fc15849bc31", "comment": "Malware payload (Mirai)", "value": "c25b5135ef93b0de98d3a6a1a7b20f0ecd8a17ed9c8d9a5554b566411653ffb8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534056, "uuid": "1a6daa41-78bb-49fa-b87c-0d39ef74ac5c", "comment": "Malware payload (Mirai)", "value": "90b1ff5c0a398eeb808e4d0cef9737f4ad4d0915", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534056, "uuid": "60d2c905-0023-47ea-b7ed-bdfeeeb10b1d", "comment": "Malware payload (Mirai)", "value": "44b63361d7b4547d2d851f8df66d3984718cc06e5c2f68bcaf82291d98edfb1d07c0735eb210d80e9eb05bf002b8c6af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534056, "uuid": "b5b4a73e-1b5b-456c-b877-83b59bde6b28", "value": "T12513F646B8519117C4D51B36BA0F439A37329B40E3EB33038E2AAF709F5BB2D1F66651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534056, "uuid": "98c605e0-3580-4f18-9cc8-8aaa12c2b210", "value": "768:s3dsGO2otdtv9ncd/hSi5ptjcjXg3sf2+LyOL1i0GQf:eXoftv9ncd5Sqptjcj5Z+OLAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534056, "uuid": "1b6276f5-0d70-48da-89fb-06b2a3ecb05f", "value": 41554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534056, "uuid": "e4ce51b3-677b-4f25-83f3-ca0e77f2ea48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534056, "uuid": "278dc0f5-efd7-40c3-aadc-012d3951e515", "value": "loki.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d775dabd-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529521, "uuid": "daa5637c-a1da-4a40-9ec1-9e1019814637", "comment": "Malware payload (Gozi)", "value": "f046b4887b3a6abf72049e2ab80a07d8", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "second stage js", "colour": "#A566A3", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529521, "uuid": "7b1d5523-d1c9-417d-b124-bf00931d4d88", "comment": "Malware payload (Gozi)", "value": "c32b7acf86f0a0f86fe4dc24904a4f915ff345f2a6d583e44a75ea6789e75b66", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "second stage js", "colour": "#A566A3", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529521, "uuid": "9145739f-bead-474f-9558-f32f4f3ca3d8", "comment": "Malware payload (Gozi)", "value": "b19840de71b7607e28eeb5a4fd681a55e59f188b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "second stage js", "colour": "#A566A3", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529521, "uuid": "e36ebe71-fb9f-461c-a123-6b0473fd197f", "comment": "Malware payload (Gozi)", "value": "b32825188d68c83596e894b16b04146d33826578e0092b4e73342690d32e1406a743215973adcb702de4dc3f2dbf1dc8", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "second stage js", "colour": "#A566A3", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529521, "uuid": "47ec15db-1482-45fe-82e3-ff003cc25353", "value": "T1F12543176F04BB3C9645C20A1A764C59FA5465A93A01359C3B4F9378231B728B3F8FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529521, "uuid": "97292c6c-23ec-4f37-8a28-34f8d7cdaecb", "value": "6144:Nyev18fHd52Kh+lqwNJTBETVgQ8dY4EdtSOqqM3Ns8HbmMgXfX:rdiATNfEVEu4Aqf3NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529521, "uuid": "a364ae42-8746-48e9-8033-6a325afe17e8", "value": 1055356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529521, "uuid": "1f7bb38e-d64f-464f-bf47-6456518c27b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529521, "uuid": "9fd70df9-2b19-4084-9182-347b5aa0daaa", "value": "MySelective.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8da1c92-2cfc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690517443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517443, "uuid": "4409b55d-1d06-4b1d-a4d3-372ca312e13c", "comment": "Malware payload (RemcosRAT)", "value": "8faff6ad78a596fe3f0b20dc4ffb24ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517443, "uuid": "b4aa236e-40df-4ba9-9535-9eb7f4abcea9", "comment": "Malware payload (RemcosRAT)", "value": "c68b7153fdf0f50387d3d594f00b361d3b03b0c1efa12ff741a11313b92ff9c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517443, "uuid": "2aae6546-5e72-4c7a-918f-3e7162381d67", "comment": "Malware payload (RemcosRAT)", "value": "03d279e15f1d29494eefe9db399c9bdcca144aca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517443, "uuid": "0958ebc8-c595-4ace-83ed-266b79ab8d88", "comment": "Malware payload (RemcosRAT)", "value": "8016d8f52d5dc5dc3d794a9aa35ac3f447efbffb80b4c7a3ed9c4ca51358d9f4b9250187a28ff144e025a2e78b3ba8cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517443, "uuid": "4f4deff6-45c4-4b3c-919f-0f622865f9cf", "value": "T15585872A38AA100DB261AD5C6BFCB476D15EF7F2223A1CB74DF7054A1112DF1CB9D226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517443, "uuid": "3899f006-1fd0-4967-b7e8-9ee00cd4752e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517443, "uuid": "410d10c7-5c71-4570-92e3-210fc15728ae", "value": "12288:FjCMsOUCuN1lXtsGG4iDv5Gap4YWUNhL8ULWjDWzIT/PLysbgK3c8hT2s1NXk3Qg:AbybOjaQP5gK3ci1ObuyfdZBOhHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690517443, "uuid": "81611770-60f3-4d1e-9918-b35fa2763015", "value": 1769984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690517443, "uuid": "d22ed3c2-0ee8-4a0d-b617-947077687343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517443, "uuid": "2c2537a8-a524-42fa-8e9e-90dd2d928ccc", "value": "8faff6ad78a596fe3f0b20dc4ffb24ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4181088-2d95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690583256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583256, "uuid": "cf506961-af32-4ae6-bdaf-ce172fda7e4e", "comment": "Malware payload", "value": "57770c738da83088a809887396a3871c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583256, "uuid": "f8b3ec80-2674-43cd-bdae-8b3e035206b8", "comment": "Malware payload", "value": "c71ec48a59631bfa3f33383c1f25719e95e5a80936d913ab3bfe2feb172c1c5e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583256, "uuid": "053f35bb-809d-46b7-8530-49833703011f", "comment": "Malware payload", "value": "f38fd42c2646301053618a2cf87fd52c41ff2ed7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690583256, "uuid": "5a01aabc-40af-49f3-98d8-27a52c9eea12", "comment": "Malware payload", "value": "ac75fba6dc8d77edc7d2a0ba949ead0309d9a5722f8e8130336b8f5ffb3eed389aa36e63a61702ba93dd63bebdd62e55", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583256, "uuid": "9c7488d7-27c1-497d-9ae1-8930fc3baa1b", "value": "T1482533E1B3B05E25EF2117F3355833B5362F9928D22B5E5372AC6744B687CB8862424F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583256, "uuid": "78773f47-82e6-48fd-a8a3-50cb5e0df1f6", "value": "24576:SVyPO7Yjt+YUZNPldkWIK0szxpWNHKZtmxZAatoUCypgIY:6s4Msz3WNHfYatPDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690583256, "uuid": "c8595bd9-7efb-4ec3-9219-2533d9c4545a", "value": 1038690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690583256, "uuid": "487fb349-1d2c-4b14-9ca3-1e065db82bc9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690583256, "uuid": "8f92d3e7-88fd-4301-84eb-26d16cb614c6", "value": "Note.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1930ba-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690526787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526787, "uuid": "7b74eecb-949d-4399-802b-adc58fabc042", "comment": "Malware payload", "value": "b68f83bb31f20c2f85b8aedd166a2daf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526787, "uuid": "a04bd307-f80b-4dea-8216-33249a7bf13c", "comment": "Malware payload", "value": "cb86f9e7cdc963c94211c00ebb3fed771fc7aa2c7eafb1194bfb4938350a6744", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526787, "uuid": "1c30e939-a45c-4ec8-8a0a-063170be5bdb", "comment": "Malware payload", "value": "8778865e3a1575dcf1851f0084657a510c02db00", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526787, "uuid": "b36ff9ff-8ce7-4d3b-ac09-56cdc994afc5", "comment": "Malware payload", "value": "6abb73de75c617d63cb60df55a7863d494438900bdc5a5b351da343f5a282288b94aafe8629fd89144656efc1a203da3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526787, "uuid": "ae69cded-319e-4315-9de3-ca71b733e22e", "value": "T150C3B547F3936E29D02F0C781076539C4E7AACFF1D19A22761D43EAC3A705A0EA16F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526787, "uuid": "53b8bb5c-18e9-4045-ab4f-2b6830db2642", "value": "1536:7jwI7zVl3DAdc1U7p2EHNR9qu7zA9/8GDAlHX0+DQtexrt4EZskogUot/gUEAkYw:7jpzVec1atRUidZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526787, "uuid": "aecab3a2-6691-457a-ae1d-a8c744105643", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526787, "uuid": "47bb23d9-ec5c-4316-9a51-9c8b327de036", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526787, "uuid": "2de4a057-a70a-4d26-a0a7-ace12127d72c", "value": "Sirishak.NET(Resume). (2).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe362cc-2d71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690567626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690567626, "uuid": "4cb8d6f1-107e-4442-95a5-f4ce9cb9e21e", "comment": "Malware payload (AgentTesla)", "value": "aa128939e4e20c03152ef9461e79511a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690567626, "uuid": "e255879c-1ce8-4dcd-bb58-ad2de2c1138a", "comment": "Malware payload (AgentTesla)", "value": "cc1d4152635a034a03b6da09d779ce2ed39a567dfa0566fafe6cd52d1984c30e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690567626, "uuid": "d68fe3e9-5a42-4f71-86c3-6d43d4d888fe", "comment": "Malware payload (AgentTesla)", "value": "d249e6d1022bc8566472320d79109974f11482e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690567626, "uuid": "f72ca9bc-3482-4249-ae6b-3b7992dec400", "comment": "Malware payload (AgentTesla)", "value": "e2aed3475899c0020a21b07327d9f6917f960190eec935af10afc3ae6c079d4ffdb1c2417fc89eac07ca1cb3f2cd2441", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690567626, "uuid": "9035ae1d-4c2b-45da-890d-fa3885ae3625", "value": "T1F0D42201B4F85B6BE5ECC7F60622524527B0DC797402E7C84CCE5AEF9F91F28166292B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690567626, "uuid": "b638c86b-13a8-4ed0-a21d-aea7a3511014", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690567626, "uuid": "c5763199-086c-4f54-8157-817b92a6d020", "value": "12288:s6/SLYaVhzN9rEojgRKYoQYTQa8X843M0u52pZu:sDYaVP9rER85Zcf7Buh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690567626, "uuid": "21603d18-46f7-41bb-8845-b745a9d6f83d", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690567626, "uuid": "f6859480-a200-4382-9044-7b74e35e809d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690567626, "uuid": "d87813d7-fb88-46c8-b642-e79bbe71833d", "value": "bank_slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0334018-2d02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1690520113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520113, "uuid": "0e3d5f8f-b370-4e00-a35f-14260530e670", "comment": "Malware payload (CoinMiner)", "value": "b56676093945f3c0c4676803cf7e0d50", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520113, "uuid": "48cb3cc2-c3f5-48e4-8e12-597397cdeccb", "comment": "Malware payload (CoinMiner)", "value": "ce7a9a4a88a1a9f154bb4e0650864933d87fd75bef94ec000faf24f75d0a308f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520113, "uuid": "41915b51-59ce-4a23-8cde-b0e8417c2745", "comment": "Malware payload (CoinMiner)", "value": "3609ef39bb991df1f1e7d9b7c5da45407460b440", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690520113, "uuid": "15acd650-839f-4482-bad5-678bf6f00de5", "comment": "Malware payload (CoinMiner)", "value": "691a18c42663c0cc809c306e6c4cdb0678a251ebbe070e4586d67dc1bb5a08ec7e9cfc38713f672aff01c585b01ad704", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520113, "uuid": "416e4655-666a-4b96-a37b-34b33dfaef34", "value": "T185A6D08FCC5A3C6AF9343A387691D3A3EA5502C6367D0D610931F8552599CBA73F28F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520113, "uuid": "d0f69ebc-4f42-4b5a-84df-c2095d7394a1", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520113, "uuid": "a662aa8a-585c-464a-96e4-7264fa3833fb", "value": "196608:8Q9EVu0I6h00r8jBYHob4t+6c7vdFjoRfkq3N6Zs83xH:80uu0LLYjA1uTpq3NDYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690520113, "uuid": "e41c44f9-9cc0-42d6-b9bd-485c53c88d63", "value": 10397184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690520113, "uuid": "6bb0b37f-c7d4-4c61-be17-0ef31745f46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690520113, "uuid": "9ed130f1-d363-455c-90d1-b6a8b56c0b89", "value": "b56676093945f3c0c4676803cf7e0d50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8083259a-2d52-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690554286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554286, "uuid": "346bf1b4-daf6-45f9-a611-0ee421e0c80f", "comment": "Malware payload", "value": "5e664961196fc61d2a188e93fbe4b4c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554286, "uuid": "4c2fa834-57df-40db-b6bd-7ab36c164929", "comment": "Malware payload", "value": "cf9635e854291ea0fe4a1dbf494d2b1ebdb2a89b4b321db264fcca47c0813781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554286, "uuid": "13aeff40-1f66-40a5-89be-889e64a69f49", "comment": "Malware payload", "value": "bdfa395eea9240893b1426499d0967fc581b6ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690554286, "uuid": "8104697e-bc1b-4e81-830e-7cc09653d6ad", "comment": "Malware payload", "value": "18bc61d355b8a09443f2bfd704d21b53d428fa895e4c0f52ca0a451ceeb972ad32b46563a7fc993099c4e00264977929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554286, "uuid": "91eba80a-1e6c-472d-946e-e8bbebe33803", "value": "T1BF56CF5437F85E27E0ABE277A5B0041267F0FC1AB363EB0B2591677A1CB3B5058427A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554286, "uuid": "49f0f13c-045f-463f-bf85-9d2df8d827c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554286, "uuid": "19b9b750-f7b6-47d6-ab0e-013df3649af5", "value": "98304:+Gh5ziNlRUaub+MPDrc/c+NmXnKyFrsqCtHj92AYawl1WPOl6NVLkJ0xWNzR166X:+3NlqaubXgUCqCZBjxy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690554286, "uuid": "5a4fa5ca-265b-4f0a-8b71-5b2a9d02cfa3", "value": 6351872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690554286, "uuid": "180f8db1-c534-4df3-b3ea-8add040bda79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690554286, "uuid": "0429ea12-f4c6-4e87-b00b-b7b0b8508b6f", "value": "OperaSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f78b5e7-2d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690526635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526635, "uuid": "fe0f84a4-fa03-4e88-9e52-6970d1d68e31", "comment": "Malware payload (Gozi)", "value": "117dc29bb97feea7e270cdb5af9b08b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526635, "uuid": "384a9642-3a0c-452c-9460-3b33925a561d", "comment": "Malware payload (Gozi)", "value": "d0bef454a49faffb1607e1f20c91b1ee2fde7b3ddec800e83000158fa8bea386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526635, "uuid": "6d4e4797-a62e-405c-896f-d621385a0a9c", "comment": "Malware payload (Gozi)", "value": "e331d9dbc7d412e62d85e00422fac2e265bbfbd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526635, "uuid": "61cfb312-c834-4f1e-a3cf-ea6dc7d302a1", "comment": "Malware payload (Gozi)", "value": "94e8b45345ea00967f881e5bc310bc07fcef8a8e6133ef97edc9c6cf685d922b1ef0f215da87fd407edf4ce1957c8313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526635, "uuid": "e7dedce2-dc6c-4c81-9eb5-a8d7df2a90ba", "value": "T198643C1352A1FC55F5264B329E2EC1E83B1EF9928F1977AA22186A2F04731F1D373716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526635, "uuid": "29bd762b-0d00-4680-9fca-54c373f0f72b", "value": "a5494563fbba88cb05fb13a72779b2e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526635, "uuid": "b7755733-42f5-42ef-8e66-b5c979bd7e8b", "value": "3072:5JW7pz/a1Gd2mLjKaL85YWvhoRDmPsXW5L/Qg+f0fdnQOBo:WpzgGdtaagThQDmkXcL/Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526635, "uuid": "94fca007-2762-4f34-b9c0-a4cc5d42a3f6", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526635, "uuid": "f1da88d4-a206-454d-b0b2-d2bb0611a6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526635, "uuid": "664379d9-d213-4789-b79b-85ce02925731", "value": "117dc29bb97feea7e270cdb5af9b08b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49d2137-2d41-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690547098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690547098, "uuid": "c4903e72-fe62-4917-94ef-000b039681fa", "comment": "Malware payload", "value": "3affbe6f0688c8a598fef9d8bcef1c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690547098, "uuid": "73dee0b6-b705-4678-b718-e6975e1d5062", "comment": "Malware payload", "value": "d191af7816640acd232d85dff54294cf0890d15d6d5d2c0fdfaa95babccf9a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690547098, "uuid": "46be27f2-1407-4289-920f-3b40b42a74ee", "comment": "Malware payload", "value": "45b63e00c568632d21828d652ee538085ad64e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690547098, "uuid": "fc7c0228-074b-486f-b00e-26ffe6975730", "comment": "Malware payload", "value": "10ff4870432807f48bbf8fa089cbc008a6ef074d838111e804fe4354145cc6c401e1f118610c3128ceda2890b45c5b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690547098, "uuid": "db4c2595-04eb-4c37-9948-3b4b3a84a8fe", "value": "T1C6A633A049586CE5F9A2C23D4C364054D552792703B2D9AB0BF9CADA1FEB3F53CBA740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690547098, "uuid": "8a7a03a3-3f1e-40a0-b59b-f5a465414b11", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690547098, "uuid": "1e07b66e-7d3e-476e-9896-69d31c7973c1", "value": "196608:Krl/fcBDzf4LBIP6tdQmRrdA6lkaycBIGpEonEz64HIPZtQ:yfszf490SdQOlp9N74ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690547098, "uuid": "fa5d2719-0245-48d2-b514-867a826aaaab", "value": 10348611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690547098, "uuid": "63988c70-2b78-43c1-a133-8bd5e8706999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690547098, "uuid": "af13faa4-5d63-4ff1-9f84-2ecd6ba47e9c", "value": "hm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc7c8cd-2cfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690517724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517724, "uuid": "edcc958b-192a-45b2-afa6-18b6546da089", "comment": "Malware payload (Formbook)", "value": "a0bfccb8cc68d350b02287d70507e70d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517724, "uuid": "cdfb4e39-ff33-4464-8a67-86453b1c077c", "comment": "Malware payload (Formbook)", "value": "d587be51aa8da3d6ec72c1c3ad9c24c04c5ef97d4da7f8edb9c0ae04f6e111ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517724, "uuid": "de4271c0-8006-48a2-870a-a2296345a3c9", "comment": "Malware payload (Formbook)", "value": "3b274838cd098c2f26ece2928300fe4f1e24a9d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517724, "uuid": "78746cec-46e0-4896-be8e-25a7cf673549", "comment": "Malware payload (Formbook)", "value": "d73f3ba0e6c1509fd4580018df5329f84d681d9d20024650971dec7c68ba3d8d1c2208f5cde83ee09b49ead706f86736", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517724, "uuid": "a70d3b35-a386-44c0-a6a4-76540c5ef82b", "value": "T177542365F174DD27C4C006B8A8BA6D737D62FA2A40526747F7807B4AFDA1762C81E3B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517724, "uuid": "83dbae92-19db-44ab-853e-e731b60cef27", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517724, "uuid": "8bd81664-67df-4ca1-aa58-16ce17d47b10", "value": "6144:PYa689fXW3LMiiTEqOyYKFEZWAQoAALLg6UM6KYUvjuyT2XH9PDD0:PYS9fXW+TEqdXkLg6YUrui2Xd7D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690517724, "uuid": "ca04ab55-f8e7-4af6-a1cc-312c0720acfa", "value": 281510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690517724, "uuid": "63fe699b-375c-4817-a0e7-0a8628e1c48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517724, "uuid": "e8dc58b1-0661-4cb5-acaf-daeb9e4fb9a8", "value": "a0bfccb8cc68d350b02287d70507e70d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2a5839-2d85-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690576102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690576102, "uuid": "4ce7d560-9254-471f-8d1e-e30e51b6029b", "comment": "Malware payload", "value": "5e777d56b3c53a36fc97e4a3def6d48b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690576102, "uuid": "ec21b05a-11e0-4cc5-bc82-9b8ef88831a5", "comment": "Malware payload", "value": "d87a34f514868d5c385310bb7fc6b669216288553b57608b81163a425d8067df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690576102, "uuid": "2af615c9-6ac9-43cb-8963-acb0a3e7ec58", "comment": "Malware payload", "value": "78016474268f8670d9c80b0ab2af9b496e0a5eb4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690576102, "uuid": "c8aeae1a-ba35-4ad1-b28d-1cd30679e08d", "comment": "Malware payload", "value": "90d50272cd0b522f781bf47c2ecf6832141cdf4e55ea213e7030d1630672a9e7085023bdccdbe605ab6f086f5ab16e94", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690576102, "uuid": "02b33eff-b5bf-4eac-bc33-5c9e9d9821b2", "value": "T1DAE34B40A7C88D75E5BF21BC0460AA315F3979319B1F89EFA3C44D5E4E28AC15E70DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690576102, "uuid": "420c5b84-c5ae-4830-876c-2e7f49f7db18", "value": "ebd55336bdc5be19befeedc718bdcd6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690576102, "uuid": "43c405e4-bf1f-4cc4-b490-59afb3191960", "value": "3072:osftgesY6VFTfb+4r6kYNqtGp1cRYBbNQuktLwPKePv9Hg69U:oy6VFjb+c6AGp1kW69tLwP/X9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690576102, "uuid": "b6be33ec-b2f5-491f-ab35-3a087eaf41d6", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690576102, "uuid": "b2bab77d-267b-4a6b-ae8c-152729535bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690576102, "uuid": "3047e22f-29b3-433a-8a10-b8d58d045260", "value": "SecuriteInfo.com.Win32.PWSX-gen.11044.31173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ef850e-2d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690534060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534060, "uuid": "b54af641-5e46-4ff7-bfd9-6dbf13316a67", "comment": "Malware payload (Mirai)", "value": "38214ee8a8add498e4fb6e497b5d24a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534060, "uuid": "16921025-45f9-4511-810a-031661ecfc82", "comment": "Malware payload (Mirai)", "value": "d919f9cb14290433a2f71781515858ff64a075cabacf86243b2ce3de047c24c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534060, "uuid": "9706e0a0-dd5a-47ba-bd64-bbcbbf05ee14", "comment": "Malware payload (Mirai)", "value": "d3ed81267347547f511e2d3f426a0c52140c4169", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690534060, "uuid": "05eed4c3-3f82-43b6-a70d-ff8c35739453", "comment": "Malware payload (Mirai)", "value": "875a83a566e167688188e0ce2f00c6839a220fba3bad360da52443f4ee327ace063916b59625b005d4f774a08346d36d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534060, "uuid": "f4ae4497-c975-4c32-b0a7-2b2f2ae15c0d", "value": "T1CF13074AB851D117C5D51B36BA0E439937325740E3EB33038E2A6FB09F5BB2A1F67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534060, "uuid": "75dee351-f3d0-4a1b-9106-d7900cea673e", "value": "768:9IBg7RJWZXouncT/h0G8KLjAjXT0NKIM9Q0GQf:hQZXouncT50G8KLjAjtrWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690534060, "uuid": "cf4cc237-7b3a-4de8-bff1-27d6db72f1fd", "value": 41554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690534060, "uuid": "d0864c28-7e72-40e2-9132-4464b8b30b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690534060, "uuid": "4e35f809-e4b3-4b59-a8f3-7715c614e1fe", "value": "loki.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad275a04-2d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690585284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585284, "uuid": "2744cc48-4385-4f20-920b-753f84c489d9", "comment": "Malware payload", "value": "36ba8797c3cb2685cd5804fa644de703", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585284, "uuid": "e06c05c4-01ee-4baf-84d3-373835cad1eb", "comment": "Malware payload", "value": "da280ce882e6cadf7c640ca3bdc5d1da10c654669a24f802257df1753c2202cc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585284, "uuid": "74a0fef9-fcdb-4dc1-8a99-92962c7cf625", "comment": "Malware payload", "value": "c57d91431d6c600080477a46d076a5e12295b2e3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690585284, "uuid": "d4343896-3102-499a-8afa-f84abf4454b2", "comment": "Malware payload", "value": "9771052a9e2cafec28c092e76ff0f17e781ffbabe741a523af6cdd168673fc1869c9401fcba680e4e631e1a67df68fda", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690585284, "uuid": "165ea2f7-0ac6-4c4b-9936-c64af32b77b0", "value": "T19225335F2F834A71089FD510846C1428FD45EB7E8D9937A8A6A0D6C9CEE02775C8C6FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690585284, "uuid": "c4ddc4fb-21d0-4a7d-b2e8-5424ff0dc70c", "value": "24576:M8mopYIzLALLKWM+zia/0TZjPx+IetjExXuRf31LEl:xm0wbOKqybKxXyf3dEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690585284, "uuid": "e84b2874-a63d-4d20-8e31-ccc113c19c47", "value": 993840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690585284, "uuid": "bb6013f0-625f-4ede-a900-790a6093c543", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690585284, "uuid": "b3dbf85f-ec80-4a99-bbf2-6a820e7aa351", "value": "11272933382.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10414ed0-2d1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690530905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530905, "uuid": "d4a0bde2-4b93-40da-b0e1-6d7a743451b2", "comment": "Malware payload (Formbook)", "value": "ee7ffdb25715a7d06ea45d441cc4cc51", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530905, "uuid": "b67cbc52-7051-46ac-a592-f3cb289668ec", "comment": "Malware payload (Formbook)", "value": "daff63d3c3cdaea875f13c1b9b64a156e8fc1e162e10a8151c1198b763c84454", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530905, "uuid": "de040d5f-24da-4d42-a1b3-6b44589d6475", "comment": "Malware payload (Formbook)", "value": "4d519e64b2cf1a13ecf363c29365052270a85884", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690530905, "uuid": "e8ec6d15-d1b5-47c5-849a-e8c194f1a2ad", "comment": "Malware payload (Formbook)", "value": "c0c197368afdd0c2d776603035097856121b205d94fbc90fd54e6d83004953e8e0e6dff1d2054cc59e97be41f70f02a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530905, "uuid": "1144a11a-58ae-473a-94a5-00601a993739", "value": "T194D4238EAAD720B334D53DB0612B7A549FDA5EF05380762BA11227370C6AE743A7711F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530905, "uuid": "17de76bf-9994-4a06-a464-203fb31217e6", "value": "12288:2rQ0BOOx86AuaBndgxN9RmGsc3Ybcszj+xZIMISS5ZsRg5:2r/os86AuaF2Na63Y4aj+JnS5ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690530905, "uuid": "559fe88b-0dd2-4ffc-a544-ad36332391ff", "value": 598287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690530905, "uuid": "1ddf2dc2-bccc-4b1b-9505-0cb15952b050", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690530905, "uuid": "c30500ff-f953-4e51-9852-58321747474e", "value": "Invio proforma pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d27c4ab-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690539087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539087, "uuid": "6db2f8e5-1d99-48e7-8de9-edae034f4b8d", "comment": "Malware payload (GuLoader)", "value": "85d329d9fd31af517b7bfc62e90dc974", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539087, "uuid": "28a62b7d-4cee-48ab-bac2-6ed1cb3687ff", "comment": "Malware payload (GuLoader)", "value": "db43407e966ff6ac2fe4c209ebb39bcb01b24b605e150ed07803522b1d399e1b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539087, "uuid": "6611a6d1-d085-4e46-ad71-8c50bebcaec4", "comment": "Malware payload (GuLoader)", "value": "7523aa673f986c26877ef2c868fd7931aaae56e6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539087, "uuid": "892efb0d-36e4-47f9-a0b5-c908fd3d5cde", "comment": "Malware payload (GuLoader)", "value": "9571d9fa7d968617186962f6130ce0916eecec14929b9dab939ee21ef84cd605fcd9c6ccf18dffabe77aa1aa14a89461", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539087, "uuid": "0fb19605-50c9-4c5a-aa85-a55bed32c869", "value": "T1C174239DE6FF7EABBFD539CA151B1CED2E602114C175085502F06E8CBE9A9608636FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539087, "uuid": "21ace6aa-5d59-4751-a9df-c18c68ac96c0", "value": "6144:7UlMq56FNnZzw4ufXjqF/kHpODlWQD81LyQKxRMyL38thM30iR4QF6bg6gu:EMJNF/9DjA1SfL8thM30XTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539087, "uuid": "d77229e6-5862-4fc9-a5d3-77ac86c08ac2", "value": 355937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539087, "uuid": "263193bb-c7ec-4182-917b-ecd3c2d75ee3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539087, "uuid": "f2a8f319-25bf-4d3f-a312-a66ebab1eaf3", "value": "Remittance Copy_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc102c7c-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690545393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545393, "uuid": "115f3c73-a07f-493e-b959-ddc89c04df60", "comment": "Malware payload", "value": "1d0de187f6cdc490fb899277eca12c91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545393, "uuid": "2dfe21fb-93aa-44ad-837c-6ac263c47c89", "comment": "Malware payload", "value": "dd1037398d91469c64f93201e67163b6d96b65a7a5bdede9aa3b91d972966f5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545393, "uuid": "d9d70b88-95ce-4792-951e-f39de7719d10", "comment": "Malware payload", "value": "d33406522ad59b336f711584acb34c49ad10dfea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545393, "uuid": "6f4743bb-65d2-467c-8b23-d00374fabe6b", "comment": "Malware payload", "value": "fa11d8084cc1c864c78d57a178d31f22dabf2ace9b028698162ed658703539e32b1b54e7e592829a6a0b5ea742334396", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545393, "uuid": "c3f866eb-ac83-45f4-84e7-4d26a73c87c4", "value": "T17B232B46361C0953D0A76DB42A3F57E0D3FFADA111B4F689641EBB4B8274D32A046ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545393, "uuid": "35eb7709-2658-4d79-9d1d-2f4114ed2aa5", "value": "768:z5IiymFmlfF+d9DXNZpmmqeDI0rNQ4sZxgfnHNII2g5/w:PybEZYqPrNJntIIXJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545393, "uuid": "215f1752-2703-4896-88c8-b9d1a68fc3d3", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545393, "uuid": "2c6a8b46-cbda-44b5-8987-4e95cb93a6f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545393, "uuid": "584c50b0-5c56-4816-aa75-f11de5a05616", "value": "1d0de187f6cdc490fb899277eca12c91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4759dd2-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LgoogLoader)", "timestamp": 1690527798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527798, "uuid": "06f6f01e-a3f0-4f86-9bad-a3db1dbf030c", "comment": "Malware payload (LgoogLoader)", "value": "b4fd2f6ea8eb477d5a35414f7c196719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527798, "uuid": "ad00f985-8b23-4ad6-9a4d-3e53eff6f8ba", "comment": "Malware payload (LgoogLoader)", "value": "de823b703cefdd77b5acbe06b19e8d0f844d0930f9c3609237d1fbd15a73c9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527798, "uuid": "016e5870-5d43-4dc6-b20e-2b6b5f2ece23", "comment": "Malware payload (LgoogLoader)", "value": "061cad3050117c5956b4b701e5f6e396aa696067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527798, "uuid": "2a288877-eba7-4dad-803b-ef0d30cdf2d7", "comment": "Malware payload (LgoogLoader)", "value": "a600c4e15dfe0ba018dfb1ff90abeed3fb04421ce7e9d1ff18718f6a70932830421b19555870e5f98b8b8eba875f7ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527798, "uuid": "ca31db09-dfbc-415e-84dd-a378dda59cc3", "value": "T175C4CEC213EE31D6C1773D38B67061C6DAA8326BB812DF2F9B582157867D231E54D8B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527798, "uuid": "304ca03b-2cd7-4bb0-bc64-4ef582fd24f4", "value": "12288:uVIjEbiFS+LbnoBnQqmi8feE0H/7v6r13BnbNxk+4ivuqY4J4:uVIjEWFS+LbKQq9dJORRAcbY+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527798, "uuid": "15fdee63-6f1f-4fd9-93af-fa29e30030bd", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527798, "uuid": "3253146b-db34-4e84-9a1c-de6bae660066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527798, "uuid": "0dec7f22-1d92-416f-b8c9-db962d119b51", "value": "b4fd2f6ea8eb477d5a35414f7c196719.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726ff07b-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690527204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527204, "uuid": "6a9a58a5-5900-4bae-8aa5-94222b8a1d8f", "comment": "Malware payload (AgentTesla)", "value": "c2d148bbbbd2ad65ddbb2c8d8d182711", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527204, "uuid": "6ea4ed33-81b0-46a5-a6cb-643eff36ed00", "comment": "Malware payload (AgentTesla)", "value": "de96b58170192186f3f118155903287e871cd7c2950900645367527129b375eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527204, "uuid": "604c3b06-3772-4a59-8307-523c6aa7b392", "comment": "Malware payload (AgentTesla)", "value": "b99fc454dd29e5d97d009b2d9ef7a0944edce92e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527204, "uuid": "29cf1fe7-c3f5-454d-b5ef-309b03631f0d", "comment": "Malware payload (AgentTesla)", "value": "6616284a0a6b1fc6e45dcd18d7baaa95be955fbc28d1f4f3e239a5316b7a8ed577ab7a22a21d677e8a78792422f7a7a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527204, "uuid": "12d71ff5-521a-487c-8762-7845666bcf92", "value": "T15CD412521CD34B31D85E47B28C641B4D9336FFF81ED5DB08A9EA58889E073358606DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527204, "uuid": "93572098-baf7-48be-9e61-4ee92f291228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527204, "uuid": "d291eab0-3602-490b-bef3-4766ac2d2c42", "value": "12288:vbO5HcDoE+0qvHTMXfBepcaiY4Je0cR7aviz7ij0CwVyvUtbO5:zOyNkPTYfBEcaiY4Je0O7avizOj0CwVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527204, "uuid": "04dadc14-ffdc-40ae-8796-89265e199bd9", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527204, "uuid": "e789e159-50f8-4c55-9307-79fa1edaf894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527204, "uuid": "f2adaa72-7a44-4f3b-b09b-be776d12159d", "value": "Factura comercial.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21cc015-2d28-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1690536330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536330, "uuid": "ad807f40-5114-44d1-b42a-99e1d77b2cd2", "comment": "Malware payload (RemoteManipulator)", "value": "5543ec7918879f075e2714ba2aa7995b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536330, "uuid": "93b8de87-6ce4-40e0-bead-474c3bf942fe", "comment": "Malware payload (RemoteManipulator)", "value": "df3c28e2ab0948020e93b8850dfc16b842f2ed5ce7ebf18c5f536c0cabbae2d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536330, "uuid": "6f3f7ac4-2c63-48ce-abf6-d2dd0512dd0a", "comment": "Malware payload (RemoteManipulator)", "value": "e72fc9f9fa3030ecb9e71ee81d9b1f301717db0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690536330, "uuid": "412b5129-4415-4cba-934b-474bd619dfe8", "comment": "Malware payload (RemoteManipulator)", "value": "d468b42ce9c1401d9dcde263183347f93ff28989aaa43072e9bc138ce117c45c7371c721d3de7e1a050b42b4755d96fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536330, "uuid": "9f5dbd86-af30-4710-abd9-9f74e206e281", "value": "T19B073347FBE64418E8FB467A09BE4B14076ABC9C5617A78D0358F13ADCBA34198B43C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536330, "uuid": "08919fbb-6c8b-49b8-84ea-74bd8e9eb68e", "value": "51d1f6a548cbe091a440204f9bfeb14e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536330, "uuid": "b78924ca-64b5-41ba-b801-851fd9718263", "value": "393216:s4wctNG7SXLKhzMEOzMjjZlguA44g7Li70+VVuNcPN/S6nr2tAj:VwJGLYPnzguA44gHZUNK6noAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690536330, "uuid": "2dfb5e1f-51be-4475-a7e2-e7c498fd572c", "value": 17917488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690536330, "uuid": "d6378c7b-4bc9-4ef8-ac3f-6a3dc53a020b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690536330, "uuid": "cf071b27-47b2-4b9f-8603-63a92927de2f", "value": "5543ec7918879f075e2714ba2aa7995b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb34a05-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529555, "uuid": "1474cf4a-65d6-4497-ad48-f035c5cbbcd0", "comment": "Malware payload (Gozi)", "value": "48998a0626c0d6bb5ddb1c58ffdf7c7e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529555, "uuid": "b89eb506-f93f-45fa-bd8f-8f6719d9b192", "comment": "Malware payload (Gozi)", "value": "e1b114a4164c97be800fac24ce1e1480958a4a247e9256f2efb66849dde18755", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529555, "uuid": "8220faab-4f7d-4a76-adff-337b68af0e84", "comment": "Malware payload (Gozi)", "value": "d61c0fc14a9f47547386ee99e195fff582867e19", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529555, "uuid": "41b4b633-5597-4229-bff0-71163729e09b", "comment": "Malware payload (Gozi)", "value": "e6e2e42da40e5a6639457d7ca3989f752ddda32a764d5489995a4c3bbb9fb0d09891c8ce2a9eeca03c99cb9b77f7797a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529555, "uuid": "8c9f4bf0-9316-4855-b8b3-4fd6ff17d7b5", "value": "T1CAE26D4D972D706AF1B3A6788158B1072A34B32A0724B5FF45A1DA7C0D633C5DE34ABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529555, "uuid": "ca8f37cb-07bd-4a4e-aa7c-b73a92948249", "value": "34340c2c4e9aa6ef6ad12bb695fc695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529555, "uuid": "3a5a2591-0eef-4a8b-93c0-5b030b27999b", "value": "768:MoV31vkO9YmckVPxIiTAqMwwyg2ulzxAfv5r6wD1Pe3pU:MkYmckVPxIiTAqMwm2ulzxAfv1Pe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529555, "uuid": "4b51a1c8-b9f2-4a07-bbc4-a76679dc9e6b", "value": 31496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529555, "uuid": "2a5cff53-2762-4c7e-aac2-34fa87ac1b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529555, "uuid": "322b48b3-e236-451f-a200-04a6fdb0f7cf", "value": "oxGJ0JDl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21f5ca7-2d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690550960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550960, "uuid": "f85e9dde-a72f-4f60-9703-02c5302280d2", "comment": "Malware payload (AgentTesla)", "value": "a5d46206473c7fe486cd1a25bfa85bec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550960, "uuid": "412a10ab-849e-44ec-8746-8ad4eacbbecb", "comment": "Malware payload (AgentTesla)", "value": "e219e0c0a2e353d69cc502b5560506d182a70a1340ecb415339a5645644256a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550960, "uuid": "efbc7d28-2494-4ce6-a792-d5bd3373bbb4", "comment": "Malware payload (AgentTesla)", "value": "12371d0e271f5dda7b04b15b7e231cbd12a2d4ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550960, "uuid": "71f5b345-1658-4573-aca9-d459c977daec", "comment": "Malware payload (AgentTesla)", "value": "fd782b7ef520684afd0b625138a9468282e9ffef2cf453e67e6b639f3b0295b54804a0295ebea43cd58a7d92a7074cf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550960, "uuid": "24a8d17b-5bbf-4c29-99e1-b3f6a785917a", "value": "T1DCE4F051F2681F9BD43653F94825A2045BB6BB6E113CD6085EF6B4C722B2FC10E46F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550960, "uuid": "c3c4a072-d781-4c11-b53f-9656abcb05cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550960, "uuid": "444ffbbe-ce1c-4bcd-905d-343b7a1442fc", "value": "12288:aAbgjjvFx2SBV290YFHW0oPL+nO0lxUxtfPFtO8fa+RNiZ:aKgjjLBV2nFX4cO0LUfPFkd+ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690550960, "uuid": "56000290-b078-4e03-900b-05d988a275bc", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690550960, "uuid": "fb93fab6-2809-47de-8aa9-23e96a737e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550960, "uuid": "1d49871f-dda1-4f4f-b687-a5290fbe68d6", "value": "scan20230717_16422889(1)pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc975c5b-2d11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690526523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526523, "uuid": "bb09f48b-78cb-4f1b-8dc9-8ab637cb6812", "comment": "Malware payload (AgentTesla)", "value": "360abac70ece50536e9c0cd0491d6ac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526523, "uuid": "14fae6e3-ca62-447f-89a0-c51ec4cdc087", "comment": "Malware payload (AgentTesla)", "value": "e2c427b3d0609e2e6cddf2f0a1b9d0109591e8e70919c9601b9d7d327963e5b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526523, "uuid": "69c7a1c7-5895-40de-981e-b5500b7383eb", "comment": "Malware payload (AgentTesla)", "value": "38c2287c7dfb0944fd90262240081f090dc62028", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526523, "uuid": "2734afda-0848-43c5-880e-d58ac342d88b", "comment": "Malware payload (AgentTesla)", "value": "b4ba883f6213527a6c39fcb65637fa0cb2a9324af95ffc422ff9379025a06ece82c9e0535aea660728ac4c276292ce44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526523, "uuid": "1a802849-6c8f-4ab2-af30-c3854c8bc711", "value": "T131D423B7B602800FEC2DD5B2C495B3C691E2306E29DEF65C0AD52B19B3A75A3D63D443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526523, "uuid": "23bf27ea-dd41-46b4-b9e9-b2486c9dc69c", "value": "12288:z4Ha3ZaKQHQKqFmDY22DsI0gzDGzZ6wy463dHb+DxCAMBinTOYdmYobcPRpG:z4Ha3ZaKQHQdmY2tHg2li40oCAZLmYoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526523, "uuid": "c35f5a9d-925e-4d80-9214-e92eaea67fe3", "value": 620553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526523, "uuid": "be6b04f9-f365-422b-be90-0d1713791200", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526523, "uuid": "501d4008-6c33-4cf1-ad10-e0a07cfdfe40", "value": "swift copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a7c6f9-2cff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690518465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690518465, "uuid": "f591e8ad-1831-4d22-94f2-367b48da8270", "comment": "Malware payload", "value": "309d714c7c6c4cb815360b1826f61d42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690518465, "uuid": "279254bd-1c29-475a-b446-4bf7b46f2075", "comment": "Malware payload", "value": "e3839db059dcae482e934cf33100d5293901196e276c2d332a18ad5d964ac707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690518465, "uuid": "d824f067-3ca5-40cf-a13f-b802eaa40519", "comment": "Malware payload", "value": "24e07ebd5224e460ee35a91aec432ea2a78e6986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690518465, "uuid": "68d5ccf8-850a-431b-92da-00854bd20948", "comment": "Malware payload", "value": "24c1dfd48cf0de55427eeb2d39e84df4755754cd41d5e8ae7b6992b926d664c23558e92172cd959169110a0ee57703c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690518465, "uuid": "4f2ba0ee-2dd5-492c-bc31-3efb12dce828", "value": "T149840805BC427F05C46243FC8874F349693AE6667E1998EA5EFA0280E6BF51D089773F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690518465, "uuid": "cb503e96-06e0-4678-935c-5161f3a1ebfc", "value": "3072:G0eS4LOHZ6XnEvFQ032WJ65Ams2J1eotgdgfa/Fkzy7bs71OPd2TBfEv/:G0e7UZPvVWSowgfaSy61OPd2TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690518465, "uuid": "ce656063-fd32-43a2-8346-78e129d7ef13", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690518465, "uuid": "50536c3d-99df-4093-99f8-ff8371aa4822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690518465, "uuid": "d70450cd-074e-45bc-9099-457115ab1ae2", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.10172.30191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf57b6d-2d0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690525503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525503, "uuid": "7fa57694-0eb6-41c1-9bb1-9c807b83dde2", "comment": "Malware payload (GuLoader)", "value": "71bc10004d1b0408375de806d4530983", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525503, "uuid": "10b7fb84-6e61-4eec-a4cd-b022071fcb0d", "comment": "Malware payload (GuLoader)", "value": "e507395aaccab20998986f9faee7d557014aa7fc9adf3a856d54b52962797a4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525503, "uuid": "59d3f3cd-3fc6-4be5-8b33-e2dbec1e3e30", "comment": "Malware payload (GuLoader)", "value": "32d4424e9b7bdd3b92446c65d7a57f262eb9d52c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690525503, "uuid": "cc575682-cc17-42ec-a923-9f86ea0115b8", "comment": "Malware payload (GuLoader)", "value": "c5d69eba6bad376f39e63aabcc0c947f81358af15b1398f9321b869fb85eca1aaa69c67f71abea4da954aa62bbdc9b6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525503, "uuid": "fde42475-3c00-4f17-8f53-e8f051455d90", "value": "T1EB94D093ED9042A7D4080839D697BB2425F68C7DAB5ACF1313D830267FB6192257F36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525503, "uuid": "546d13ab-b2e2-4ed1-ba03-a1b9b0c21bd5", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525503, "uuid": "a0ac32ec-1d42-4d5f-8305-1ee3d47c9620", "value": "6144:6Be337n8xkABZYQkh6IdqIk4FxcXJ9KCiexJEII9otc3iGFGC8:37LABZYQkh6IdW6wKCpxJm9o+yGFl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690525503, "uuid": "cd2673f1-8716-4f62-ba97-8cdb70d769e2", "value": 430320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690525503, "uuid": "b0b67312-7b0b-40bf-a967-7b6f0c4bc112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690525503, "uuid": "8a3325a6-85c1-4ec7-a48e-ae0885b43991", "value": "71bc10004d1b0408375de806d4530983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8387529-2d3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690545387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545387, "uuid": "915592ba-fabc-46e0-9a11-e6c7d5f6e5ce", "comment": "Malware payload", "value": "ff6ba6d077722fb8fd095e485be49674", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545387, "uuid": "52c1b07d-bcd9-4636-afa9-e89eb632ef99", "comment": "Malware payload", "value": "e67f560e6082f7a5f15fa5d57b2a6fa94f7f683dfec2b48fcb19010b75e7f9fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545387, "uuid": "af5a288f-920e-451a-9143-c06bb9656956", "comment": "Malware payload", "value": "ee7fa096446aed66503c03a1306bc155443cc6dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690545387, "uuid": "2fd95075-cea8-4335-9211-d8b46ac77226", "comment": "Malware payload", "value": "fe72aa46e37a8b62b9c4377c46325f071e4b306739960b2438a318de0f092b7b74b27933068888292a828a33a4784477", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545387, "uuid": "97eaeb7f-9614-4e34-aa87-15faa06e9c26", "value": "T1EE232BE6B405BE7DF91BF73F88134809B131A35411A35B3A53E6BC639E3229D4922F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545387, "uuid": "b2e9ba8b-bf55-4f9a-952e-d22fe33757ab", "value": "768:9V9bQqBb0VSeIUYxaDE/O0UgfN+dV+bUktJZoiK3sU93vu8N99LZ/G1UC1sKZRYU:pbQ6oVdkyoUM6iK3sw/u8NDdG1UCuKfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690545387, "uuid": "156b7c64-d5c8-47bf-a7dc-004edf2c9332", "value": 46888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690545387, "uuid": "c67fefd9-be0e-4257-8476-0330a5726967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690545387, "uuid": "d88b4d6a-a803-40e3-a8d1-321a3e289701", "value": "ff6ba6d077722fb8fd095e485be49674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fde00e5-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690539091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539091, "uuid": "abbb113c-b8b6-49cb-be4c-74ecd840e41b", "comment": "Malware payload (ModiLoader)", "value": "65220900be23e86c34b45f7b2ff857dd", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539091, "uuid": "8a627ce8-601b-4e99-879f-9ddc80dda037", "comment": "Malware payload (ModiLoader)", "value": "e7487b31db997eda2104ea1121fb4cb252dfcf4a5a04dcc46c4a874480208a6a", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539091, "uuid": "1417d290-56c3-4883-9cea-34d824e15a7e", "comment": "Malware payload (ModiLoader)", "value": "d923b9b8d1439e235c4c7e1d3d271f9f8f90528f", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539091, "uuid": "b2481daf-02bf-4be6-a3c7-e1d696c4f5e7", "comment": "Malware payload (ModiLoader)", "value": "f43491351ef26c650510ae554a8e10b052255ef082bf71e23315126e296911a4e624acc39ca1882174a3ff5165917d19", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539091, "uuid": "1dc16d2e-14dc-49c9-9407-269ac436394c", "value": "T13694233C24DD92C0780EBCEEABCD04EE3C942B16E6467929F742F0C97B49E455815B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539091, "uuid": "3f12210a-8497-47c2-a79d-6b691ab3b679", "value": "12288:udv5OaqA9aSHIaqXmHf67XpopNWYFrmHy5:uL1f/6epNWYFSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539091, "uuid": "6e9c1588-f357-4fb1-a9c7-61a070697755", "value": 434609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539091, "uuid": "765e63c3-b281-4038-be82-503ba1c8f6d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539091, "uuid": "4d401818-f9a6-453a-a84c-aa4ee23e1b07", "value": "U prilogu je potvrda narudzbe_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4993531-2cfc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690517436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517436, "uuid": "c4586142-da83-47f3-aa3a-15c478798c9a", "comment": "Malware payload (AgentTesla)", "value": "370c0660c08162ab7d2a8737cd3ab1e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517436, "uuid": "e389aad3-e664-43b8-8cd2-0a46d53bc8c7", "comment": "Malware payload (AgentTesla)", "value": "e861fe12d7b0d6d722015418a078caa0684fc3a57da6cb52f2925b42c7719fca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517436, "uuid": "f63a2a1f-e733-4a1c-91be-3a01bb3f1c81", "comment": "Malware payload (AgentTesla)", "value": "54db17557bca96c5daa1da70c2460a32928dd69a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690517436, "uuid": "96081acf-eb95-4e21-8227-580a023ea31a", "comment": "Malware payload (AgentTesla)", "value": "8a1315ac81d4171fa6efdb75af4e3386215d81b20842c71f7a3a49c21fb5ecc72bac5b100eef57dc2ad13cdbf9804449", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517436, "uuid": "9191232e-27af-48f9-9b18-da834c3bac27", "value": "T147D412501CD04E26E84B8AB29CA11B1CD37AEFB51594CF14E5E96D803E1B73A8683D7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517436, "uuid": "af8f7750-d384-4aec-ad0f-0fa14f3055ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517436, "uuid": "e55ae350-4560-4181-a1b6-e8bea4484eb3", "value": "12288:tbO5dbozNgrXSKavVX8VY7bn+PUATj5IhSbO5:1O7bozN8X9GVMVYPnIRTlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690517436, "uuid": "d2db8c07-3472-4e78-bb61-394748bc1119", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690517436, "uuid": "597ed323-77eb-4dd7-9eaf-808165b082fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690517436, "uuid": "de763797-c90c-4027-bba7-23da7c99f37d", "value": "370c0660c08162ab7d2a8737cd3ab1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b77727-2d14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1690527820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527820, "uuid": "4fd53e0c-580e-444f-b283-08b29abfe9b1", "comment": "Malware payload (MarsStealer)", "value": "d3200ead2ec8b95511ae7297fcf735a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527820, "uuid": "e51f0b50-0bac-4afc-b5f7-2541f9774fa6", "comment": "Malware payload (MarsStealer)", "value": "e9b384736a5c030a77a92078822121eccaa4042d756cfaff989e7a486e0ec375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527820, "uuid": "e5c873c0-fc38-43ff-8ba6-71f0a3f61ba3", "comment": "Malware payload (MarsStealer)", "value": "d6d39896054f3f919c595b77b159691fae48128d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527820, "uuid": "03072cf9-9364-426e-897c-a15df3e019a1", "comment": "Malware payload (MarsStealer)", "value": "5df3aa179927f6a583939a7239a1e9d3bf63e9a20b438f7e3521b24408b615aea9b7197acf969582fd431ff087c31016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527820, "uuid": "dcce08a2-b77a-40bf-b6db-c9afb4f8dd0f", "value": "T1EC645D5392E17D61E5264B368E2EC2E8771EF950CF597BE622286E2F08B31F1C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527820, "uuid": "74969212-bd3f-47ec-bd3d-5ddc4b3f53bc", "value": "b882663a63604a8f377b23a82216e7c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527820, "uuid": "06a97ca6-dc57-487b-8694-6b893ec5a116", "value": "3072:NPxrM22QhXLhfYHR9W1uJ1BWsYgivfvOQtxP+aO:1NV2+XtfyHJ1Yi6fv1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527820, "uuid": "71182671-a9be-4965-b9b3-7f8e66469097", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527820, "uuid": "25f5296c-d5d2-4621-a22d-418a82850fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527820, "uuid": "1403ef18-f30b-413e-a6b9-c11f445228d6", "value": "d3200ead2ec8b95511ae7297fcf735a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcffb0f-2d11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690526233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526233, "uuid": "09baa3b6-281c-4380-985a-c36e9dbd65cc", "comment": "Malware payload (AgentTesla)", "value": "339d18f83c1fa01c99798e00fb5b884a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526233, "uuid": "b2d67329-69bd-4c19-a855-a949cbbdd8e8", "comment": "Malware payload (AgentTesla)", "value": "ec7d100b0dadc5c38ecb39309a02e826bd167ad25a28f4cf8b0d8c52aeca7018", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526233, "uuid": "f058a139-1c13-48dd-9068-0e52ae2eb197", "comment": "Malware payload (AgentTesla)", "value": "ea9af2be0a1da0d6e68be3134d48e3f64d5d32b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690526233, "uuid": "5a40c029-1b86-4a0c-b993-4deed5e114fd", "comment": "Malware payload (AgentTesla)", "value": "ed48b49ad055c60a19cae2e9d062ebd042c2d64d20bc36c6eb0ad523d5b8bd721eb1a0809a9d2e7dc7c9919cea411475", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526233, "uuid": "3e4931a6-be20-4e0a-99e7-2243c8b6c4f4", "value": "T164E4222158910E36C34783B21C903B4D63BEEEB926A0DB19F5A86DC86E177754316E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526233, "uuid": "b463ba12-a8d5-43eb-a618-455674682905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526233, "uuid": "e7c49031-8131-42f9-b3d4-f3ee742246f3", "value": "12288:4bO51bO5IrSz1YqNrZpNrD4eCCmx2RG5uX8i7jxZlFBU3p:GOrOyU1bbH4l75g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690526233, "uuid": "ee1edcaa-5acd-47dc-8db9-6fc4da6c240a", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690526233, "uuid": "66333440-3971-47d3-a709-3dcdf8bfc059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690526233, "uuid": "6c498e9c-2f38-4430-a10f-e745de182e2e", "value": "DHL_47433003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8818f2a-2cf6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690514839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514839, "uuid": "810f669f-958b-443b-8cff-1b74ddad47c0", "comment": "Malware payload (AgentTesla)", "value": "fabe75f2b61443a65c8b87f933d3afe7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514839, "uuid": "9a39bb73-4131-49db-9010-08c344c60d92", "comment": "Malware payload (AgentTesla)", "value": "ee858a17d787e31279091138c83eea1ab9c48d04cd7ab79caf5a6f3e4d5f7ace", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514839, "uuid": "b420ac81-756b-4e9e-9104-9986929bf411", "comment": "Malware payload (AgentTesla)", "value": "6dfea8e2c33215f3de7238ba06568a9a19ff4f43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690514839, "uuid": "65c8618d-d6fb-4d6f-831f-7c19dcf3ea4c", "comment": "Malware payload (AgentTesla)", "value": "2ec7a1c14b8278f763ebbd26c0e31c48df469e4174872800190b066e4606bd796141977f8f9cd21ca8c6a7c580fe6b28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514839, "uuid": "249acb6b-895e-4c40-90dd-4567824f8d93", "value": "T19CD4228124D62B3BE57CCBB1586053297739F29A3450F644CCC234DB9EE0F2AA568F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514839, "uuid": "acb8c011-b90d-4b2c-a4b8-6b75bc1399d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514839, "uuid": "d661bae8-ce26-465a-9ee8-17667e4693fe", "value": "12288:lKwjNrvsKahN06zjXNBGluiB8BP39Jgs2/an0Vp6H9TchD8Dpn:lhvsKGN06zjXauwCfTWa0Vs924", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690514839, "uuid": "09b7c0d2-b2d0-4586-816e-3f18d6a61f17", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690514839, "uuid": "1f6a3bb5-64fa-44d1-834f-78e834211e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690514839, "uuid": "7da35936-f24d-4749-9afe-280bf9698a03", "value": "SecuriteInfo.com.Win32.PWSX-gen.21663.3196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c2bd5c-2d09-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690522780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690522780, "uuid": "023e39e2-eb6f-4986-b42a-32a95e20c39d", "comment": "Malware payload", "value": "62472c78b3ab085422418e49dd2aa11c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690522780, "uuid": "e5afb53d-968e-44a1-9810-275047ddd68d", "comment": "Malware payload", "value": "ef256556b6749f441874b9d86e2c35c693fdc6d358ce2bb58bb2ba2e2cd939d5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690522780, "uuid": "0c82c1ef-a337-4a3b-96a2-b5de296392ae", "comment": "Malware payload", "value": "8b8480bf32ab1188926d5dfa7c8b5f81e1d798d3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690522780, "uuid": "a254a0f7-afc7-4b01-8c5b-7d965b1d7c72", "comment": "Malware payload", "value": "b6e57d49446c6fc09426be5fb66f1118073aad0ec0822b37e1fdfed08d8c3c66c7b5120c38ff04f20b00adb2c2c69f5c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690522780, "uuid": "1cffd637-b635-41a3-a9fb-1503bc417482", "value": "T1CD56C09AC3FDA4BBD6F49CB9C02823879ED3E4605841D1F1434EB53968B5E24EBBD205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690522780, "uuid": "1a52eb02-0dcd-4125-8576-59532189b011", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690522780, "uuid": "0033bdf2-7137-4a8e-a7fd-9fe1b6363c43", "value": "98304:wvwPndUBiFUg37BdTNJsl1cHZMjcXW7afr02BlDXFqv+nxRZWP/iSMgCW7owLCyy:wIPndf9uBGLfgWxR8XEguyk6QIOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690522780, "uuid": "dde362fb-d6a8-4ad4-a531-cf734842445e", "value": 5986304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690522780, "uuid": "a419058a-bdda-4511-96e7-3dbef0f66b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690522780, "uuid": "fa907c7f-6a00-42b8-a961-4eb9ce4174fc", "value": "62472c78b3ab085422418e49dd2aa11c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e173ddd5-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529537, "uuid": "9558550b-ef97-44ef-9fd4-0f8a7da40b52", "comment": "Malware payload (Gozi)", "value": "4406fceeb2803aebc2345867a9ae292c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529537, "uuid": "b778b222-73cc-47f1-9ece-58565cc9297f", "comment": "Malware payload (Gozi)", "value": "f04715827e5453b33ba6fae8475b8c45150b27cc1361441648c46d13025283d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529537, "uuid": "6f11077a-1856-43d6-8544-c81b97e7892f", "comment": "Malware payload (Gozi)", "value": "e530f6f86d568cebf9ce8b09391763a33b5dd152", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529537, "uuid": "beb8c851-8da5-4f46-b7d5-d8858a99780e", "comment": "Malware payload (Gozi)", "value": "aac5f18eee9551eebc5737a55c7c8312ec6c4a92778b4d45780c57a8c608b0aacf443bc81f68f75dd13d96c26ad1b724", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529537, "uuid": "bcbabdb1-168f-4123-b871-da083000fd20", "value": "T1C0B51ACCB41310E4D62AB9B3903F39777264232D366C376BB380D614DAA37D89526BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529537, "uuid": "768152b9-3ea2-4c1a-8ddf-137fc008e571", "value": "2040608358bd331a7563b43255e14cef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529537, "uuid": "859ba476-4f23-42f9-ac23-2193d9705025", "value": "49152:zc9IJxGbYcDnhX6hwQDUwHDdBS1xaQPswrawjF0NYSzvR5xHGy:zyI45PswrawjF0NYSzvR5xHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529537, "uuid": "7e7649f2-e6c1-4b83-9940-64bba83f59b1", "value": 2493896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529537, "uuid": "c6d59d8a-4c8e-439d-833b-d3b78883d76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529537, "uuid": "bd4e719d-f762-40e3-9eb2-7b9dd98b2f88", "value": "iiis12211221.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927c9318-2d79-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690571066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690571066, "uuid": "7137f46e-f75a-4644-a956-74e8d7ba3625", "comment": "Malware payload", "value": "864b3c8e64ea774b3d6589749989fe2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690571066, "uuid": "f8848ff1-0631-42b5-acbf-b606a817eed6", "comment": "Malware payload", "value": "f226f0ac4fc6ca6fd54afe8831c11092ca211b7acb2ac7de5850ce143dca2b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690571066, "uuid": "db060d91-3858-4fc7-bde4-668adca22ee1", "comment": "Malware payload", "value": "828f195781b66d4338ae8edc5b6e86fd60e860c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690571066, "uuid": "31782890-8f0d-4717-8075-15378ac79a8e", "comment": "Malware payload", "value": "be2ee6cdaa03ef7dfa1dba847fbfdc52d0980d0bd1b9bd053d03e2ec7dec9b3e1321ddabacb9b292eb08a754f64707a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690571066, "uuid": "5259ae36-7530-49e7-ab42-f176a9f2e768", "value": "T1FAE208067BE94219D6BC1AFC8CB313214772E3438532EB6F5CDC88CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690571066, "uuid": "b45444da-dcd7-4c69-980c-20925db42907", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690571066, "uuid": "ac713da5-7c53-4195-8cae-f147dc002bc7", "value": "384:60bUe5XB4e0XGOPnw0Q0mS03AWTxtTUFQqzFYwObbh:jT9BuVI55dBbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690571066, "uuid": "b2e9c298-0ea3-4293-87b8-b3e8e681388a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690571066, "uuid": "8d74f048-d5fd-4afa-bc8d-07aa914079c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690571066, "uuid": "d9bb6e7b-a900-4850-aae0-ecc530dc384c", "value": "xVHCrNssqwFw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173de7ab-2d2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690539077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539077, "uuid": "dcd06125-fb5e-4229-8f61-e6025e5b06f1", "comment": "Malware payload (AgentTesla)", "value": "d4c8df09dcfba97a30b64b931791edc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539077, "uuid": "e6767f7d-6a1b-4d70-b545-74cff1b61f4e", "comment": "Malware payload (AgentTesla)", "value": "f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539077, "uuid": "99498b4c-c10f-4d3b-9ede-90ff1c092c09", "comment": "Malware payload (AgentTesla)", "value": "d8f63c650caef24e8e2fe14bce9651bf0e0d3284", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690539077, "uuid": "66436576-5cae-4d46-ac0e-1a0ad617f35f", "comment": "Malware payload (AgentTesla)", "value": "6d2f4d455869efa51014db2db373d63a017f4c0df901a8c0d337e7a531b57545e1deaf5bad6a0ac9d14237c57bd052e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539077, "uuid": "dd962a49-07ac-4bc4-b4d7-357ce3cc23c3", "value": "T1C8B3F707BA8ED9F1C2486B3AC1CBD01603ADDA96F373D60BB54E23561A033EE594564F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539077, "uuid": "2e9416aa-be2e-4c53-b9bb-8b3596cde112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539077, "uuid": "769d8b30-f39c-4a24-84b4-60b9ed26d474", "value": "1536:xMwSOJx44VvmKil0afZKKK3A3VL+o0nHi6TWKxp9KQqex07H0l1RijBF9PbKt:DHVvoNfZBD3VyokHi61RbGH0l1wF3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690539077, "uuid": "5c5f0efb-f209-4150-9eb8-ad827d78a182", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690539077, "uuid": "8b38056b-07cc-4e51-a282-1dec4a274cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690539077, "uuid": "dd690cda-c237-43be-89be-dbecffa5858b", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a371a1e-2d17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690528908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528908, "uuid": "4bd540c8-5669-4396-bd5b-9181fda3c20e", "comment": "Malware payload (DarkCloud)", "value": "9783e4a037d84e80e61c0403863465d8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528908, "uuid": "65e5d303-fb0a-41cc-864c-88b0fd83f388", "comment": "Malware payload (DarkCloud)", "value": "f3ce039a3fc5a7f12e2c5e2d7994cc4359ba725d372eb804c8eea91f3fefe687", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528908, "uuid": "602a3edb-85e2-4729-a176-775773ccba37", "comment": "Malware payload (DarkCloud)", "value": "e2cf56c5622add9d99125ec468b468adf84333dd", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690528908, "uuid": "9cbcc8dc-db70-4911-9093-c7d36939714e", "comment": "Malware payload (DarkCloud)", "value": "30a5f1af41e68668c414f6118b2636cf1f12b915ba9ccf08363a3b76d579a3391ad5760eb5b06fbcbecb92f662defcb0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528908, "uuid": "664a6bf3-021b-4839-b1cb-c34ac3b2bc9f", "value": "T192250150B2B95FAAD57BB3FB1655661007FA68BE662DF3490DC930CF21A1F010A01FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528908, "uuid": "29510fce-eaa6-43af-9bd5-3b3b650f9360", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528908, "uuid": "5056dc66-0b29-4f5d-9634-12d106851c11", "value": "24576:RPQrgS1XcV5AWZDmYkHeLCdxL4GBOGSf1amK7cBpBObo03:RPQr1/WcZvdF4sOr27GbObo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690528908, "uuid": "e2103a33-d4c8-43cc-bd59-4ad556b737ff", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690528908, "uuid": "dd6b7c8e-7dc5-4d8e-850c-ff569d479ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690528908, "uuid": "d593431e-eb84-4ae0-8a99-b6d90118949e", "value": "INVOICE.pdf\u626b\u63cf\u4ef6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0da5c5-2d49-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690550388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550388, "uuid": "e803da80-6a82-490a-afcb-72a3ae72f525", "comment": "Malware payload", "value": "3522c02b54a69df3c48526bd85d59b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550388, "uuid": "5ad72e3c-153a-47ca-8e91-b3a62ad05f17", "comment": "Malware payload", "value": "f45cee13ea0aef62e1d508f876abc1016e000bf04c76b4af440ab342e12c3435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550388, "uuid": "044a5310-4ac3-417e-8139-5633f0312de6", "comment": "Malware payload", "value": "55c383bef439ed348b37e0c4817868857e3de454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550388, "uuid": "5784ce5d-172f-4fd6-bd0b-e5673e712564", "comment": "Malware payload", "value": "e49e64cf0abd577057028094c9b0d9079316e425dea34f1bc4f0b1be03cc42949848ff859f585492da0ac12c7d5fd083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550388, "uuid": "d7a5540f-278e-4180-9816-97fc1d0e733a", "value": "T11A95910176F95B59F6F30FB86A7AA621487ABC6ADE11C7DF1261500E0D31BD08970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550388, "uuid": "79c76554-9eaf-4654-b85f-9346064447f4", "value": "53569622eb0b50e97d025b0cc8e9ae9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550388, "uuid": "d52f902d-4ec4-4885-aab9-e46decd7ceb0", "value": "24576:YV42RANbMdiwmH7gH49dfgeXa6NThf3EHYRebcHSVdY7MA86/h2xN:FbMdiwC9dfg8a63fuhcHSjAYxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690550388, "uuid": "91b03f09-3614-4922-82fd-b7893fbc5cbe", "value": 1907200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690550388, "uuid": "1869e5dd-d4e4-414b-86eb-1966d0c43557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550388, "uuid": "b345641b-4c7b-404c-af0d-573da56b58b8", "value": "3522c02b54a69df3c48526bd85d59b46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db6276b-2d13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690527196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527196, "uuid": "991e048a-325f-40b3-afd8-ee5df26c877b", "comment": "Malware payload (AgentTesla)", "value": "86f868ee6b51fd447628e3016b9233e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527196, "uuid": "83c59645-9d9f-4f9e-ac92-48f78c7b33eb", "comment": "Malware payload (AgentTesla)", "value": "f86fe4dc355d0d5e7e95a13271222177de883d2c69ecd80fc19a315e0a2b1723", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527196, "uuid": "6793b740-b35e-4d47-ba28-38498c115078", "comment": "Malware payload (AgentTesla)", "value": "005aeaa40b5e3bc2d7277b039f8b6c165e259201", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690527196, "uuid": "3f1ad920-b727-46d7-95c2-2b83b1e7968b", "comment": "Malware payload (AgentTesla)", "value": "07e617e08fbaa0eb6129984f945964b56f195f6cd20a4a7153a320ae7e0ed570d121c726f3b161983b6f6e48418768aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527196, "uuid": "ec5c529c-2345-4cbe-a9d0-81c90b730283", "value": "T171D413505DD2452ADA9B43B30CB02B7CD3B4EBB92A90DB1D58F82D846D1B7340256DEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527196, "uuid": "f9ff89fa-3de1-4dd6-baf7-a5a5b66f4ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527196, "uuid": "016ec056-9403-4e6c-8dab-a125bb4aa8b9", "value": "12288:fbO5WbO53nhavxfGjbv4O9jrCWngXwHOv1YuNNFSN:jOiOXYIX4OlWguvak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690527196, "uuid": "7c704510-fd78-4618-af4a-fca2051b067f", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690527196, "uuid": "2b6573cf-ff40-49c6-b54c-36aade097bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690527196, "uuid": "159b118f-7f57-49ce-864a-25af7d2f6755", "value": "DHL_DWE00495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6c7737-2d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690550841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550841, "uuid": "9c62e903-fda6-4c28-8a0d-f0b05769dad5", "comment": "Malware payload", "value": "7f08688556141ca5af138eea9be4cf6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550841, "uuid": "83109206-c1bd-47da-be8f-76aaca30add6", "comment": "Malware payload", "value": "fae323261261b10eb46ea6f51fcc2c5cd9e7a3118a04f90288bd518de64fe1b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550841, "uuid": "e8f53ce6-544d-4d85-987c-0cde010c0047", "comment": "Malware payload", "value": "7fb610995ab081b1db02c7aedc051f2dae83e753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690550841, "uuid": "ddbaedf6-978d-47ca-8fa7-937f5700e6ed", "comment": "Malware payload", "value": "eaadc37c37f05e27358237f0d65b7523bff64c3476c2a09039021ab889239ababe6dc64fd25e49081ad3ec96b87f5029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550841, "uuid": "9cf59855-47df-412a-9278-facc7d9637c5", "value": "T1FBE4F1A2B043A192E92C49308845DE6576B2BD6077D0DFF332B0BF6F397A2D14B1165B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550841, "uuid": "fce5133d-4007-4fce-8269-b07bf2e1beb0", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550841, "uuid": "aaadff82-9395-4fc3-94db-d500994f7757", "value": "12288:YnhIbWcFTcjxusePS9yLSoIF7kBbBnTPz2Rx05Ora5svQA:Y+TTcESAL2F7c9Dz2PQOTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690550841, "uuid": "989766fc-df3b-4d59-9576-bcac1bcd3202", "value": 689448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690550841, "uuid": "e08d3e1f-0b6a-4562-9fbf-174c210f9d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690550841, "uuid": "e58750ae-1e5b-4d5b-9e5f-f2fe91e10146", "value": "ARM06PI0000001190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a770e451-2d18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1690529440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529440, "uuid": "f6280e01-244b-488e-81cd-5974534b66c1", "comment": "Malware payload (Gozi)", "value": "db9c98b036488b1eb5cdfaa5bc9b2a30", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529440, "uuid": "9d53c072-0072-486b-b4ec-ffa48f4d7c88", "comment": "Malware payload (Gozi)", "value": "fb3a1cbbe3fde4466d51a418f466f64e423d50d9be581ecf33cae89e9e585ecc", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529440, "uuid": "9b9dc319-ce2f-40a9-9471-f21a59c6aa27", "comment": "Malware payload (Gozi)", "value": "c59c5b07dbecd68089de57bd5195824ebec37f7c", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690529440, "uuid": "018c9a36-5761-4a0d-9832-9bddcd43f6e2", "comment": "Malware payload (Gozi)", "value": "ff4bba37bd667be63d1a36b2d7e9d6d735db4c789d4e5686826c8d2ebcd74e7ca379953472f69e3e2db3aa808b0c8be6", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Intuit ITA", "colour": "#CBBF15", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529440, "uuid": "61eaf3fa-2420-40fd-b23d-35f53a77a38a", "value": "T1289423DCE5325F4C5796949AE84D20FA9F501933A5260FA9E693B4CCBFF403E3908B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529440, "uuid": "7e643162-958d-4411-afe1-e44b9765f026", "value": "6144:PbaqLay+AMfH4zrok8Z54kI4VFAC92oLM4BIXmkDJ4i5YYoh818:PGqfMfQUfsk5FAC92oLpit5xohp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690529440, "uuid": "bfa2ead9-0488-4575-9ac0-218e5e2d9954", "value": 412154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690529440, "uuid": "8e57109a-b208-4970-af02-42cfed33b1f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690529440, "uuid": "6685d755-df06-47a4-b64e-f10e9ca13eae", "value": "Inv_7272023_3678762205.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c749aed-2d3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690544723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544723, "uuid": "b35f3776-faa3-490f-aa7b-c474a42f5435", "comment": "Malware payload", "value": "9fe0d4b1930df5a5c0584be1cc3c6e83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544723, "uuid": "3b16c9d2-fba2-42a1-b502-0445d51a5a55", "comment": "Malware payload", "value": "fdded36e0b9b2a7a6ccf57a73bb922cbc33e8f8c9f3cc8c927d6a0bb3a59202f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544723, "uuid": "f37a8690-d6a4-4883-aff1-164019473dd5", "comment": "Malware payload", "value": "a626adbe5cd61765a469490800ff3f568595621f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690544723, "uuid": "e6fbae50-4e13-4469-ae99-9fb05143dbaa", "comment": "Malware payload", "value": "82f2a1d5297e8bafc9b108367e6f6f0f6d80a156d0b8d7887e00364d3f7b7860cf530fbc8fc3f871ce34b818288aa0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690544723, "uuid": "1707681a-faa1-4281-b516-e222d7111f8d", "value": "T132B423AEC0D31B09D4C1BF7915A1E561DF1A4C6A053A589C0B8EEDB8B0C4BE1762DCDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690544723, "uuid": "57679d87-4eb2-4368-a0fc-56ba32ac0cfb", "value": "52d5086abc1dabd2119b92104f1111a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690544723, "uuid": "18e53184-4198-4e04-9ec3-dd8523260db7", "value": "12288:sdtPZOXQoadZmzi7t93uITjLF2FOx345eWWj14ybO1jlp:sGQoadai7D3uITjIFOxo53ApIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690544723, "uuid": "2c402b58-1331-4c43-bf47-944710b97baf", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690544723, "uuid": "42ba68ae-d181-4877-8af4-82776df56832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690544723, "uuid": "2ac53055-5c56-442b-a63d-cb0e9b1390f5", "value": "SecuriteInfo.com.Trojan.GenericKDZ.98125.20009.29397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }