{ "Event": { "published": true, "date": "2022-06-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-06-20", "timestamp": 1655769781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0f9ddb62-3652-4cfa-81d8-04aec70c0772", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52be6d52-f0eb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655765403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765403, "uuid": "90fc03a6-19da-4a49-b472-800c3687e087", "comment": "Malware payload (Mirai)", "value": "46694d76e53225e65f8213519ba44145", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765403, "uuid": "caaf899c-e79c-4df8-aba8-eccd58b51e3a", "comment": "Malware payload (Mirai)", "value": "0058aff1db7f17a2b675528d0a3d156196ae1bc38dc26fec9ca7e93d62409bc1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765403, "uuid": "3800febc-7032-4489-b07d-d932b615f03b", "comment": "Malware payload (Mirai)", "value": "068c29054d42763b9fea35403b932e6c07a5600a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765403, "uuid": "32ddefb2-3be5-4f3b-8a02-be3726ad96cc", "comment": "Malware payload (Mirai)", "value": "2c676af680ccbb39c74c7f8a19d836828e0348bb713e309cf58cc2c2ed13f5067dfb67aa1cf19271b9c7a7f54ed13a38", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655765403, "uuid": "48ff1338-a131-4a35-ad89-a54577b26a05", "value": "T15AF34C46EA818A13C4D727BAFAAF01493332A7A4D3DB73068D185FB43F8675E0D63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655765403, "uuid": "88f36528-b247-41a6-9765-a047be3e2b93", "value": "3072:PrMw1NvN7yglJuM5tf9TXcWioEMLBpOxSUnfQBSB5qM/97vzV9:Prr1NvN7yglJuM5Z9L4oEMLBpeSRBSBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655765403, "uuid": "22672fbb-9f66-4b01-80a8-401b8bad9439", "value": 160675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655765403, "uuid": "b4bd0f7a-7a15-484f-9d5b-ae21d54c45d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655765403, "uuid": "4a23793d-e672-4f17-96d0-0fa543879887", "value": "cutie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d399a6-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722075, "uuid": "9627f434-bf40-4bb6-939f-9c394b1ee52d", "comment": "Malware payload (GuLoader)", "value": "ceff0c3fe4ebdf578270e7bc3738aa33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722075, "uuid": "96c613d2-ae39-4c14-9bfe-b15747845541", "comment": "Malware payload (GuLoader)", "value": "008c1114b5f9768216e93f1ea9332db6051d02551991e38ca49f9c5631979dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722075, "uuid": "f220bbd3-b0c7-4691-bcd3-dfbdc5c9c5b7", "comment": "Malware payload (GuLoader)", "value": "9b8a09dc1d8848b1882e62cc0b7adb6b14fdf394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722075, "uuid": "0a64175d-ed07-419c-a52f-2d2e7d128c11", "comment": "Malware payload (GuLoader)", "value": "2a4ca49f58ce90ea4f925634ea2a8f003f8f52c3655a90a5e7abdeea6cf9376cc7d2665de941b5202f87e4021b2395cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722075, "uuid": "85557a51-eb9e-4c1b-8ce3-1907055df1ef", "value": "T1D9E4C0A2F6915882C82A1B7059BF4F042261FD949EF2175E29DC73293EF31CB115B9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722075, "uuid": "76009c52-25a8-453e-9021-a9d663a366cb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722075, "uuid": "ed03173f-0557-4d7c-8653-47d161f0a370", "value": "12288:uYqpoZBQTy1a0fGn6ZIsBMVnTQhulrgb1WleBtCwI4T+bt:uYCxTy1DGn+CnEcKIwCh4Tkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722075, "uuid": "4f3ded6d-8aa0-4d47-8420-b6f2377c017a", "value": 664082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722075, "uuid": "40190bb1-08ca-44ee-8472-8333fbe4ebd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722075, "uuid": "e9fce3cc-64f5-48f0-9be3-62e8c4b6e97d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8980ca-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722067, "uuid": "676f37c7-ada4-43ec-9b26-21e3e6fc7f36", "comment": "Malware payload (GuLoader)", "value": "5ffac71bbdfc60cf381f5e6bcc192034", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722067, "uuid": "cea4f922-a21b-4cdd-9893-5625c9a66481", "comment": "Malware payload (GuLoader)", "value": "00c4b9f0b2ce0891998293d69b7d99e610454a3e0d5628943ca827bbb61c0032", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722067, "uuid": "20120980-a31e-45d4-95bb-0175f06acb30", "comment": "Malware payload (GuLoader)", "value": "02c1a07522d6f1347b3d8ebbf416f31392e3b214", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722067, "uuid": "a2abc793-a10b-48c1-bb16-6d73d546ce74", "comment": "Malware payload (GuLoader)", "value": "8d4739b1a4c7fcfdb9decf07f4506ca68bed713955c40b00ba71e5e813265af534bc2960d9483ad52ba2e85ca68a3f35", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722067, "uuid": "fe9e19d2-33cb-4d5b-a445-4f6018e082db", "value": "T1AB74F8A5332595494EBD4015B16C971A8F601022A3DAD7B1071AE3F9C7A2473FB3BE8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722067, "uuid": "e6b6e788-11ef-4b29-8447-d7ebd77b0a48", "value": "1536:TvblcErhSdx338knf6Naw0pPVAuwNslMJuH6ubwS9S5RzjtI14kCnk57Ah1:r23tf6f0H/39pfAh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722067, "uuid": "165ec3f3-e3f9-4b6f-a53b-5455e3e2c70a", "value": 350770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722067, "uuid": "08036674-6f21-4d49-b285-e2b99a989dcc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722067, "uuid": "39aff8a7-529f-4d17-899c-b5028f0853ed", "value": "CONSTRUCCIONES ROCACE S.L. OFERTA 200622.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2159a5a2-f05a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655703043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703043, "uuid": "b4013e67-8067-4fb7-a64b-af766713af8c", "comment": "Malware payload (Formbook)", "value": "524b11bcb40793d1a06bcb28492284f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703043, "uuid": "1f032e37-5309-44c9-bb39-2246e9d06b8b", "comment": "Malware payload (Formbook)", "value": "018d694ebc8fb0766559ed2d5ac00451b8366595d6281d3d01a7858bfe3f4e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703043, "uuid": "2ef84d39-bc86-43e2-86fe-aa89a067cda1", "comment": "Malware payload (Formbook)", "value": "0198fde6a8d14feb86cdfbdd0edc62622d86e6be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703043, "uuid": "1090233e-bc1c-4b99-810f-885c571b337b", "comment": "Malware payload (Formbook)", "value": "27ea3b5a9c14a896ae53e9c3167bdbf2f9740fa0d879655ec97647d6ecf2cb4765d996d5e84a408ff6b7aa412ca71876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703043, "uuid": "800b0986-36c3-4748-9a9d-10fc6d4b78a8", "value": "T12514BCF36BD8C9DEDB586234F3421E1703516DEC68D6A23C1FDE7A29C630A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703043, "uuid": "9ea424c8-9f41-42b0-9b3b-4f21eff3a854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703043, "uuid": "827c2c1f-2080-4133-898d-65c4cf05a4ca", "value": "768:5whRiWk42Ahp6kELfMaCChd7ntnR+iEiiiX8n8nsMGGTdjt+++Gvx/bb2exNEzA/:5CiL42yuSdwlOVhhJRYXswGjV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655703043, "uuid": "252f49d0-903e-4e31-b3cb-a56b1644f8e4", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655703043, "uuid": "1cc4e072-82d6-42ff-ac52-196209b3722d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703043, "uuid": "0c60f9df-f9c2-4879-81f4-4396c2b39517", "value": "SecuriteInfo.com.Variant.Strictor.273382.3714.790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0dedccb-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655747630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747630, "uuid": "af5ac0d6-b330-4bb9-8429-eac5a52f2ab7", "comment": "Malware payload", "value": "b3420e3544f6d67f9a918f10e0bd591c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747630, "uuid": "65ac241c-a4c3-48cf-a7fd-5a12b3311422", "comment": "Malware payload", "value": "01d14c58acdc8a46a28f4cff81589ff50b8a1843bfef8174fc4f7e734df5a190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747630, "uuid": "13689d06-8405-41e0-89f5-4744362221f7", "comment": "Malware payload", "value": "88a687940401d898f2336271542b491c0c439986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747630, "uuid": "f938ac17-f751-4d72-a8c4-1fd95484a340", "comment": "Malware payload", "value": "ce6fe913ad024a9fed0bd6b55e7d6476a98ff550a88ae3d2a15b30387352361ee748021921f10d02b03324f9541a92d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747630, "uuid": "5a977de9-91b8-444b-9816-cae5a2a9383f", "value": "T16E744B44EB918CBAC921633B89D7D277623CBAF44763DB476E251934EA132E15FC9302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747630, "uuid": "e7804dd1-4556-4162-959b-eca1ad283499", "value": "ddb8da8ce9f6d7c99471e82a46c98901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747630, "uuid": "925f83a2-9adf-4038-bc07-b571ae6db0b4", "value": "6144:ehf/YQjRZNwMYORbpB9l2mFYmfyVQhAyPl3/2:ehBLKMtt2yfyVQhAyPl3/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747630, "uuid": "60cf3f2d-d707-40f9-9c5a-144484eef8de", "value": 356694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747630, "uuid": "8dd45f67-0e14-4774-9080-97127d5ea9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747630, "uuid": "2062bbad-528c-4d04-8440-12949ecb3b13", "value": "01d14c58acdc8a46a28f4cff81589ff50b8a1843bfef8174fc4f7e734df5a190.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c609d00-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742763, "uuid": "0ec753c7-4db0-4bb2-94b8-be046820fc75", "comment": "Malware payload (Mirai)", "value": "7a43fbaf81a12ed8941d6b091fabbd3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742763, "uuid": "3ac2b4b6-bbb9-43c9-9b40-a69da2851236", "comment": "Malware payload (Mirai)", "value": "02bdc7467cdac7c7494e77138a5d652072efc9d24e682f2d3324ce8d825fbf4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742763, "uuid": "59d1524a-9557-4373-ab2b-25aac12e712e", "comment": "Malware payload (Mirai)", "value": "e71b49056743b14693949b421c143e3a8b775448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742763, "uuid": "36d4fc8d-3f83-4da9-84d1-ab5ba40199ec", "comment": "Malware payload (Mirai)", "value": "db896b64b27c4865a0cb5c841395af904b44ce487e4b19a4f3d3504f7f741f8aad0eb0f32bc4296441929b131164e399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742763, "uuid": "7e090e0d-78f0-4123-b4f3-72259dfef8e1", "value": "T10013F1E7D5C5DAC3F9BD217B88A96E4C1E50B12C2A44A0EA8EC432704B7967E54097E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742763, "uuid": "8b0817d5-2fe1-4845-bce0-d47b9b3ca230", "value": "768:C1Kws8EBO+Hw1sI62H36KaEufuVuMmfsgLEqrfDmWCfujlnbcuyD7UrQRjqZ32aP:CLE8+Hwuyu4tgLhuupnouy8ryM2MXTIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742763, "uuid": "7e53d28a-12b5-4592-99f6-205188a360c6", "value": 45256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742763, "uuid": "db1a2082-88b2-4336-a6a0-c9149497a301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742763, "uuid": "73a0e73b-51a9-4210-bf5e-2252f3033df7", "value": "KFS.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d5dde8-f056-11ec-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1655701680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701680, "uuid": "777d0669-92b3-4ca2-a447-a5724a93cacd", "comment": "Malware payload (BluStealer)", "value": "67383481458bb6bd63fc3b9086bc8f2d", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701680, "uuid": "3c418c57-e00a-4a70-98d0-cce146d16403", "comment": "Malware payload (BluStealer)", "value": "0365280eb3842ba84e01d192e38be3e5b6357a6c8e178955928e7639f2b8f442", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701680, "uuid": "d585e850-5864-45c8-b59f-9e2530f44c3f", "comment": "Malware payload (BluStealer)", "value": "8493c45b4c02284ddf80e0304fff1e7a529ca6dd", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701680, "uuid": "f560a19f-ec62-43e6-8e36-6f02a69ea34e", "comment": "Malware payload (BluStealer)", "value": "4dd3d7a4c96f4cc8473d26bd07141cefb18b42e1b111f242756bd70e572b196c7e808b96ca76118d37aa2529b6d97177", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701680, "uuid": "b8fdd1b4-f8e0-43b5-9273-ec74b22093b5", "value": "T1FE14BCF36BD8C9DEDB586234F3421E1703516DEC68D6A23C1FDE7A29C630A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701680, "uuid": "628b6283-220f-4f67-b87f-242aa40b3f49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701680, "uuid": "2558c7c3-0426-4ec8-a748-cb6a02098d0e", "value": "768:lZRXRL42uhp6kELfMaCChd7ntnR+iEiiiX8n8nsMGGTdjt+++Gvx/bb2exNEzAl6:NXF42QuSdwlOVhhJRYXswGjVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655701680, "uuid": "26192af0-72df-4edb-b958-87ca3b6322ea", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655701680, "uuid": "90f189e7-2a89-43ae-8400-5ddf7d4c9c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701680, "uuid": "7e5b3b4a-84ce-4563-9c27-8094cabd616f", "value": "MT_013224617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979d150d-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742756, "uuid": "cb4804f2-7a07-4e4d-a5be-d9240fe3300a", "comment": "Malware payload (Mirai)", "value": "32a719e953ed14a082eeced251afbc5d", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742756, "uuid": "f58d69eb-cc12-4557-ade6-3915c3982667", "comment": "Malware payload (Mirai)", "value": "038d0c6d4f6bc061ad764caa2128d13c8b8943e5a35e9f2c33c996a0992e73d7", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742756, "uuid": "b82dfe4b-9b50-4e14-bb6b-c59def3164b3", "comment": "Malware payload (Mirai)", "value": "3bae8e421d1a5e90a6d1363c4e5e1c3f8155bff9", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742756, "uuid": "ef815808-df2a-43a9-b27d-438940d7df33", "comment": "Malware payload (Mirai)", "value": "dffd170066a66e67935a90289597a8792322ea40081488a2048c66ef40dfb76875528efa6c4d8a52da6e9a035ac4abf2", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742756, "uuid": "7e1c7184-cf7d-4c7f-899e-1fe278d5ad39", "value": "T12A6302A393BAC9B5CD6D09B5497047473F177F34CAB61B48D100838968E6FDE0AEA0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742756, "uuid": "8cbc1322-d659-49a9-93e3-1d2bfe9cdef8", "value": "1536:th91p+kUDVMaKM75zHdExA4ZK/Ih3HqgLKCz+7JfWiMy1:3zp+lJMah5z9ytH5LNWl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742756, "uuid": "457cb6f0-38c8-4dfd-8afc-9698b1a8f938", "value": 67460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742756, "uuid": "2c81a741-8e6a-4d96-8dd8-d280ea2a1f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742756, "uuid": "8c540acb-ef3d-41fc-87a7-4a978346605d", "value": "KFS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f461d27-f034-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655686907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686907, "uuid": "f88ed608-3434-4769-9eb8-9ce3402d37a3", "comment": "Malware payload (GuLoader)", "value": "67bc5dedd044ed1a1b4ecbd882f18657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686907, "uuid": "241feb3d-9a14-4451-9001-895b0209a21d", "comment": "Malware payload (GuLoader)", "value": "04981990b3f26930c6923bfe8285240e6bd3a8b5ab1d6a713a8aa87ecb7474c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686907, "uuid": "657575f1-af7b-4d56-a3eb-0029e57772e6", "comment": "Malware payload (GuLoader)", "value": "4a7a02ed3f82ac23ab4b7121d6f4acb3d28509e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686907, "uuid": "b109ab75-2453-4ccf-9cf0-e324e9bd5553", "comment": "Malware payload (GuLoader)", "value": "a5d60fa3723e3a1573f9431a19067655a045e84673eb0ca73022394907dac111a60f779662f0474ea97b13e08a3f8b20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686907, "uuid": "09d30153-668c-4dc7-a2c2-41c7fec57701", "value": "T186F3E14252A0C0A3D0A233734937AD995BF77E213C70661B6B2CBA197E73593951F31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686907, "uuid": "8f3de392-9538-4310-b5b5-beff53181c37", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686907, "uuid": "280a0c9a-fdfd-4d4b-93bb-64c45776fd7a", "value": "3072:S1NjcVVnLpPuJsYebmTD2F9LhwDicOmiJMCfq0bddFVe6Mmzo6TwWi9RHaAr:iNeZKsYoJPaDiqiJfV51e6H8+wPBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655686907, "uuid": "dcee9622-7f93-4fab-a7b7-30e77402fd5e", "value": 165180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655686907, "uuid": "f3cb3d05-1ca2-42b2-8107-60a7da01d023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686907, "uuid": "35c9a69e-ff26-4795-8d19-93c8f3ec60ee", "value": "JP181222006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48bbf04-f0e8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655764252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764252, "uuid": "8c3bba6d-e8a1-45ee-99af-6d81e0b3dbae", "comment": "Malware payload (Formbook)", "value": "ba748857809258b6284b8808b5970362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764252, "uuid": "6eeb4aab-118f-424f-96b2-b83713ed9457", "comment": "Malware payload (Formbook)", "value": "049f9e87ced5e64d948562a171161d2a807f90f35337261bebdce170e78ea5ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764252, "uuid": "75797015-05e8-443e-a67d-a4e1f4140d8e", "comment": "Malware payload (Formbook)", "value": "b79ba291dccb372c28611e80985b3d88ffd2664d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764252, "uuid": "57c8815c-110c-49e5-9323-f23889a1fff0", "comment": "Malware payload (Formbook)", "value": "f29f78cb3fd9fbce50ec64731498e7986185c56193663cf292e4de0537c36d81ca0728438299c389f3dd17fc1bc78d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764252, "uuid": "a57aaf23-0b98-4d77-8f64-dfb084df1b9b", "value": "T188B4CF07B66C1B0EE67A87F1717A017007B46F6B6251E418BDCAECEE1971B0C5981BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764252, "uuid": "cdccd140-4814-49e1-904d-5cf79999d889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764252, "uuid": "9cb8ba82-4721-47bb-ae44-72e5dafecf8f", "value": "12288:1T9JXCLgAKTbCfCYI0gKUZCjaQL4wIBSBDmvmbQ:4a3CfCigKUIja64doIvmbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655764252, "uuid": "3b386d8a-7785-43c0-8125-99da6f2da12b", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655764252, "uuid": "0522d616-89b6-4bfa-a9fe-48d441776f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764252, "uuid": "0b6f3924-3fd9-4e52-a4f8-fab6cfce9c7e", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.19722.3011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d948319-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655716351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716351, "uuid": "e1df71a9-7461-41c4-bee0-639a2f8388f8", "comment": "Malware payload (AveMariaRAT)", "value": "aa367c81f112480144cf0989afb5154c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716351, "uuid": "199227e8-59ca-4f0a-b584-fc600460bb65", "comment": "Malware payload (AveMariaRAT)", "value": "04b4caff05d22778ba80fa20b63c2cd8244857548e1e5c8b11db3890d60b07fe", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716351, "uuid": "3d1be61f-e9a4-4796-84d2-f4fcdf2119a5", "comment": "Malware payload (AveMariaRAT)", "value": "0211d125d58362ea115733560d1e8670a101bf2d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716351, "uuid": "e043c408-7683-4219-bfbd-75e468d53b00", "comment": "Malware payload (AveMariaRAT)", "value": "3d3fc611af8b13d84e03a1a556af5f5be1406440beb9b0ea2981cfd8ed4c8af581fdd1ef2e49ebaa2beb341c2e27dfcb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716351, "uuid": "f28c26e3-2771-48a2-8002-0d2e349427c6", "value": "T16563E02377A0AB4AD65FDF7805C4402DAEED1D06164BD32B65AF360C2870EBB3265B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716351, "uuid": "aa221d1a-50a6-45f7-aee7-f735ed762651", "value": "1536:RnCVfYZYFxAzBnw0VEMJ6TiHQcUpoA03Xjx1lc:RnCJAzBnpmMJ6Tiwp0HjNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716351, "uuid": "fcca816f-83b6-427b-ae7f-2621f94db339", "value": 73368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716351, "uuid": "25868aad-b685-47e8-9596-f48fcfaf3717", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716351, "uuid": "6bc8c1c5-9683-43c8-b227-74b9706c9214", "value": "09876543234_P-ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a411aa-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761804, "uuid": "69916f77-c07c-4285-92e7-2b3f4d90a841", "comment": "Malware payload (Mirai)", "value": "f56d351b2ee1be23af12eaaf38baeb07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761804, "uuid": "2772b2ce-b7bb-4b70-9982-990912614d33", "comment": "Malware payload (Mirai)", "value": "0514ad3425618ae32fdba9f8caf2c1284d2b6c3013126564501a5745de5b0720", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761804, "uuid": "d11048d1-b864-42df-8f6c-906cb05fd78b", "comment": "Malware payload (Mirai)", "value": "fe2b19f758bf7653b40f508d53c44c7ab1da4ac1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761804, "uuid": "5e09ea8f-e57d-473d-be5f-20eca26c7c5e", "comment": "Malware payload (Mirai)", "value": "0fb6351512baaa31048f52430d0ee614f62cddd4df7aae33f6c498538cd997e858922b0110c81f7a9f957783e8280dea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761804, "uuid": "96eb14c1-5502-4030-9b80-f1415ed0fb2f", "value": "T145B2E17DA175DDB6E991C673B9F5EB0740D894A0C724C6D253A26847312731836337DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761804, "uuid": "6a0cd1c2-e1e0-4f5c-8de1-9f0b3f56b6ad", "value": "384:MKlcnZ4Dj8/hG1HHVuXH7b3XXACvsF0qDUTJ6p9HHHyRZbS3yQ:Vi4j8/hGJHVMQHDU96mfbdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761804, "uuid": "dc3566ff-e82c-4efa-a6c0-ebff17d712b6", "value": 23624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761804, "uuid": "eca68bbd-ef78-4a91-8b94-7ae12e0c9038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761804, "uuid": "fd28825e-50d4-4908-82b4-6ae8b328e94f", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02749eab-f093-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655727473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727473, "uuid": "e6d4d918-c683-4813-aed5-018ff107f18f", "comment": "Malware payload (Formbook)", "value": "6c5b7b2a66a695e75c0f353bef32376a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727473, "uuid": "cd49d20d-b3e0-48c0-98c9-8e7185a203a9", "comment": "Malware payload (Formbook)", "value": "051fe8798f9cf3a60b5baa9a37207237f1fe0520eb9e1461d5b877409d486703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727473, "uuid": "d554c86c-30b7-4397-abe0-c43c80be7ab8", "comment": "Malware payload (Formbook)", "value": "db0fa6146d938dc2b7a9323bdc6cf61ab316d222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727473, "uuid": "6e1aeb76-c50d-4f1c-ae8a-7e4a0dd373f5", "comment": "Malware payload (Formbook)", "value": "3957b92b57a4938d7b01435cd0a78fbfcfce798197584e32720c4bf97217f50d382b581edf6c17e479f711db30f2d83c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727473, "uuid": "30c3e691-dfaa-4cfd-9472-b54094c1aa13", "value": "T113B401043A785662DD3DC7FC44F2A000A3FC6422D266F7AD4FDA71DA9C67B428B50A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727473, "uuid": "f630e1a1-e7ad-41ae-b053-d43d1ded1edc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727473, "uuid": "a739ffbf-38c6-41b9-92e7-9772d2cc9343", "value": "6144:ZNHhmOWLN2NSlLC1x2GhNY2qQN9PfmA13G/TuHi92gbTUpD8trfdfG7CFaxAnTF4:D2iN3PbYL9PnUl8lNGjindCYB6ERUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655727473, "uuid": "f342edd9-f4f9-49df-bb9e-98ad8f479fdd", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655727473, "uuid": "200e46e0-993d-485c-853d-939a42389fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727473, "uuid": "344c426c-c8d0-4c9c-8b48-064b0f3ed700", "value": "Shipment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d9dce7-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655722137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722137, "uuid": "11429b8a-ec49-4e87-8438-1d246a4223cb", "comment": "Malware payload (Formbook)", "value": "e5c40bb4d08cbd5b4d9689948a08f13e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722137, "uuid": "b065abf2-f73a-4116-bc77-c4e9219f31d4", "comment": "Malware payload (Formbook)", "value": "061e5c0cdfe1dc4b26c998fad35740fe1ecb79ca496f7810cea5b0a77f5b53b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722137, "uuid": "1ce63f91-e37d-477c-9d4a-cc389fa5e4a4", "comment": "Malware payload (Formbook)", "value": "89a34ae2f502d78e8259ac375b6080b5056da225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722137, "uuid": "fa73aae9-267f-461d-bd0f-81a365131a74", "comment": "Malware payload (Formbook)", "value": "8c2dbf09fb27de192f62d39d184b7071d1b35c56a7c9afcb5a4a4ba75e3af4d06738322a1c730fd0499db02e0ea82380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722137, "uuid": "789f216a-2105-4afa-b635-ec4d3c0d2040", "value": "T1FAC4DF032D79B622E83987FB05A6614C03E96C2EBCE6F75B4ECD71DAC6737014611A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722137, "uuid": "2768ffc7-d1a9-44b1-9481-a578c4438617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722137, "uuid": "6a17b312-4309-44b7-9bdb-8437ec9307a4", "value": "12288:v8K2iNOcbMW8/InxmsZiziiDsZnEAH1oE2:0K1BbMW8OZiAZd1o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722137, "uuid": "edeac103-05da-422a-98fb-888d008c9f15", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722137, "uuid": "4c9ce683-9e86-4585-bbba-1d8f75595972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722137, "uuid": "5393c39d-3360-4092-990e-2038e735c486", "value": "OVERDUE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0897f0-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655733668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733668, "uuid": "cc7dfba4-d631-43cb-991d-99748f6d6f51", "comment": "Malware payload (GuLoader)", "value": "3e40c9ba384d475d8a64fd0e95370db8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733668, "uuid": "d2e44985-075a-43d5-aac8-22c1bcc6021e", "comment": "Malware payload (GuLoader)", "value": "0625bbdb37f86cae066dec948f5ec4c8b41d8ca3f87b3197bbb5a43c60b8f649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733668, "uuid": "c33cd87e-8052-437f-b941-ece0be168364", "comment": "Malware payload (GuLoader)", "value": "141c7ecd8f0cc19b7fb300137915fcc97eb53c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733668, "uuid": "7f68c6f4-dbac-4b93-87f1-bf483bf1ce6f", "comment": "Malware payload (GuLoader)", "value": "c5a4f3472cced2538b8f6b3e8174861354b6ae562b79460c2a651cd776147ef2d5f9d5d42223dbe777b5a54c3411db94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733668, "uuid": "153bbd0f-26be-4eea-be90-0c3160865054", "value": "T1FE24D0207798D857C866027294BAE3B126F1EE143498A50332E07F5BBD375F2950B7EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733668, "uuid": "694c4367-428b-49d3-a97b-5c67f8354103", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733668, "uuid": "c8aa5aa2-d901-4fdd-9fe4-09f99ea2149d", "value": "3072:+fY/TU9fE9PEtujEZasvlx+LBEFxAVLSaVVglblRwN/sAw4zj9lE/JCvFzYy:oYa6nsvlxsB+yV9+LwOAwMj9CJqEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733668, "uuid": "6c889872-4091-4b80-9043-93234c03e5a5", "value": 226499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733668, "uuid": "1647c85d-cc9d-49c0-a60f-a2c029f858f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733668, "uuid": "2140e549-289d-44ad-853a-04e9942dee47", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48861d0-f0ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744629, "uuid": "e0521f7a-acb5-47bb-aa14-73f50568eeda", "comment": "Malware payload (Mirai)", "value": "6e376917ece4c3495d2a6a6e52fddcc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744629, "uuid": "c40fbb08-210e-4d43-8956-65a1ceee6b38", "comment": "Malware payload (Mirai)", "value": "07f6650be87f6c9cf3d7bcb8520ff53a05bb9999dda8943c00ce700bd11a23ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744629, "uuid": "c37f9caa-e37a-4332-96d2-cbf061912bba", "comment": "Malware payload (Mirai)", "value": "11a0d9b58cc78d037d09e809ac42d661589d8be2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744629, "uuid": "2cfa7a5a-4065-4aca-bbba-daae2d47e5ac", "comment": "Malware payload (Mirai)", "value": "ea111ad0ff6cfa52249487ab99dfc839837b916cf5a5483e2f83535f74840c2349acafbb2b1e4df84479e22227b71a4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744629, "uuid": "b897f021-1889-44d0-87cf-a1d6cc4d2d66", "value": "T114D3198AE7408E07C0D62776BA9F424533339B64D3DB73065928AFF43F8679A4E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744629, "uuid": "c00d7ec4-af2e-4baf-9b97-ea1aabec1406", "value": "3072:3NoplwaQWThUPxZxQaeZ7NPse7O3Ergvvu+C2iNtpQM/9aNT8:3yplwaQWTsDQaeZ7NPs539WmiNTQM/9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744629, "uuid": "bae603dc-88ec-49d8-9765-6fdc7555e2a6", "value": 140490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744629, "uuid": "afae90c4-afb2-4942-a9d0-08f1ab9d2c70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744629, "uuid": "8e13f5ee-6a3c-4907-8cde-10f6d99a2e72", "value": "Hilix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6738ed7-f088-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655723077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723077, "uuid": "00a0018b-6c18-42bf-ab43-c6e6eaa8dfd1", "comment": "Malware payload (Formbook)", "value": "e6c54d23ab7b85a0c4a65a25ed003b29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723077, "uuid": "8f384d9a-474e-4ad3-a911-545bf416b929", "comment": "Malware payload (Formbook)", "value": "089fdb9024c9f8436e2c2a7e0e8734266fe5d65bcdbaf99fac4a26b0879b29d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723077, "uuid": "36e0795d-a165-4d80-8d5b-d9ed7393e817", "comment": "Malware payload (Formbook)", "value": "c6eee6b678c43398e40b9f43d39d9b4f0893b03f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723077, "uuid": "9ea03612-4a45-4c36-9659-6edcd725745a", "comment": "Malware payload (Formbook)", "value": "ea7578c33d1dee63558c2cd092a57bf85241d1edb95436f8ce4e763c8be3e8552ff4481a9b970a91d852eedfe4e2a806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723077, "uuid": "7a445db8-c051-40bb-8f6b-087d396a4d53", "value": "T1FDA412047ABD9712E836A7F064A3829887B15179A0B6FB4CDFD0A1DF2C3EF009591727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723077, "uuid": "2e7a407d-48ea-4479-a952-06766d26f7dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723077, "uuid": "637490f1-72cc-4540-9fd6-133429279e92", "value": "12288:cHOgdiXMkBnEYJMIQzuEQmf2yg0HlMF1PQqYaZ:cHOqiXMunjeTdhHiFJQva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655723077, "uuid": "25a4e0f7-0ed8-4393-a48b-c4bf1fec9197", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655723077, "uuid": "19d6e605-5861-4250-bd51-624df8dff773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723077, "uuid": "8909c7e2-01be-461c-a978-56fabf6f2866", "value": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043e\u0431 \u043e\u043f\u043b\u0430\u0442\u0435.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee43d701-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730445, "uuid": "154e13b6-41bb-4c9e-a6dc-7dd7f6f9404b", "comment": "Malware payload (SilentBuilder)", "value": "0e169153d98dbb0018c905eec24a9d4a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730445, "uuid": "af829bd0-2f57-428b-b9e5-8cfd4b0a11bd", "comment": "Malware payload (SilentBuilder)", "value": "090706e6733ee8b6d3ed150945844c842476e7ecfbbb6f21c0245c8e8b22e506", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730445, "uuid": "9fc44222-f182-41d0-ac65-aa70b3182e2e", "comment": "Malware payload (SilentBuilder)", "value": "3ae567b511fe43673c4cc57bd8e3779e13f2002d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730445, "uuid": "1ffbc70c-08ca-4a1e-a137-d1b40f80c149", "comment": "Malware payload (SilentBuilder)", "value": "19d9dc5ac03d962ac8b69a328191a598dc902c8fae2bc694d0bac290f40f1a18651621c9b1cca8e21fe76ce5b2c5fecf", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730445, "uuid": "0bcc8514-259d-44ed-bd65-d22b4a360c89", "value": "T12F733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730445, "uuid": "24f58cf2-53df-4a37-b6de-15538d24fc97", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBI:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730445, "uuid": "7cd476c9-2fb8-4e40-bc3e-efeda43e761e", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730445, "uuid": "73cc622e-ebea-4874-85f2-84c8dac82c59", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730445, "uuid": "5406b5f0-2238-4534-a256-d82bdc64bf69", "value": "100962960039742958.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03472b4-f0a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655736864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736864, "uuid": "271d8739-d45d-4478-b055-3b2364e2110c", "comment": "Malware payload (Loki)", "value": "c18274076a03d4bc5b9037bc6038455c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736864, "uuid": "e8570509-3223-4453-a00a-ea72def3391c", "comment": "Malware payload (Loki)", "value": "0945b49559377324f496f93205b755d10d1f8bff045006e6d4ab17fc78e97f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736864, "uuid": "d84406da-7922-45bc-abce-d39f4fb7dbec", "comment": "Malware payload (Loki)", "value": "45fa9a1c0e91b0f6db9f8e6d851b416c5c17663c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736864, "uuid": "4c484ef9-773f-4c5e-89b9-8ca966a3300d", "comment": "Malware payload (Loki)", "value": "f21a6ec4612dbf037307a40e978e0ea69283d91068ef842229377d14d7ab71fb047c67e5cada44331237ce7b23f0d3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736864, "uuid": "582a858a-701d-4c8f-9f86-1b70678659e5", "value": "T17B94F101B67C4B62ED788BFC85E2A24093FC6427911AF7D94FDA30DF5823B458A51A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736864, "uuid": "44b4796d-9f30-4bfc-8cfa-12d0ffce46c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736864, "uuid": "16b5a5d5-ca6a-4adf-a129-7de1b3c41a24", "value": "12288:rU2iNGr1BErCl9yMb27GNSjCH08fM7TH:rU1E+uAGvH08fiTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655736864, "uuid": "d8eac3cf-b812-44a3-890e-3ff8407a5c9a", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655736864, "uuid": "9ff7135b-5e33-45e9-873e-63f0a2515285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736864, "uuid": "b73d0875-6bd7-4502-8f2a-c56656665308", "value": "swiftcopy3469068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d1599a-f052-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655699618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699618, "uuid": "90c15844-e938-4c77-9d43-371679177c57", "comment": "Malware payload (AgentTesla)", "value": "8ee1685a421f1062f1217423f1dd1417", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699618, "uuid": "25dbc697-012d-474a-b771-3b40358dd1e2", "comment": "Malware payload (AgentTesla)", "value": "0b3c90ad745f5606c883bd8fcce32a3d7ee5c2c21ff025998c46439b435254fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699618, "uuid": "38dd6bdf-91ad-4531-9fd3-683beb4b4a93", "comment": "Malware payload (AgentTesla)", "value": "5b7ebe89d3c174f2c161b11f8b162a4c9c98d2c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699618, "uuid": "1e853a96-30c3-4f85-88a8-d990034c3496", "comment": "Malware payload (AgentTesla)", "value": "01e36a883370d89dcdb7b634c1437736adf9eecedbb0c82cdf0b30b10a378bb1b7f4113a6dfa0ea2e6099c5979a1d290", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699618, "uuid": "513d47f5-200f-477e-9ab7-217fd45aeb94", "value": "T12D154A0267CA5F2BE2BDB33A3174540843F6F9D61650EE8E7D8565C804F7B809F91B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699618, "uuid": "41335fc9-6783-4e17-bfd4-b1dbb834ed2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699618, "uuid": "bba50cf2-4e31-4cd3-b11f-0700a8a235a0", "value": "12288:mPDPf8Vb9T4fSxC3TuOsd0wj3fM1r46BYYfB+oYIhQM9xmS3G1DMq2F2:mPDPfmbUSxmIjurLnoLGQMXV21mF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655699618, "uuid": "41f7291b-60a2-48a3-854b-c21192f1107a", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655699618, "uuid": "833aae60-00a7-4325-8f72-6b1820eb1b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699618, "uuid": "5b908088-2299-497a-b72f-af880bcba67d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.628.20951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600fb9bc-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655743092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743092, "uuid": "a9c5ae9f-3afb-46e6-b0d7-5c20049e793e", "comment": "Malware payload (Mirai)", "value": "a2fae962185c6e7726fc1aa6b7d85725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743092, "uuid": "4739022d-3b6f-4ef8-8edf-fbe8ac348905", "comment": "Malware payload (Mirai)", "value": "0b4d98e25dc1faa9c086ed7ad82d17f2d5daae340bcc1ba82694b9b77bb6e7ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743092, "uuid": "c665ec0c-066c-4f7d-b100-b6ed1312dc5e", "comment": "Malware payload (Mirai)", "value": "2595a99002a0b90f75a4f418748a30a9c006fecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743092, "uuid": "6fb01a4d-9007-430f-8580-5e1246517237", "comment": "Malware payload (Mirai)", "value": "21452326c0a3c889d77e255a4fa186f27f441d7d93547bf769ea8ed352bd45309c11bc767d062c3cad906d0641554e36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false }, { "name": "src", "colour": "#6D1CDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743092, "uuid": "e05d1d78-ee7c-4ff8-b900-3fba37129793", "value": "T163934D0E963B2E1EC0D0623691B3C375B2D7668E21ED82FDFCF52E4AAE10D4455426F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743092, "uuid": "01d39d02-8ba7-4433-93a9-29ee296acefa", "value": "1536:lENzE6S8n7+lwW4jn2I44UEeQqLxFfkedPPGONZqyekCx5YOfeFR:lBG6H4UbFFf17RekQ5lfyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743092, "uuid": "f08fe59d-97b5-43ee-a230-3e9aa93885e1", "value": 91456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743092, "uuid": "4cff52e2-6e2f-4fe2-b356-6509b063ff8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743092, "uuid": "b561aceb-3d85-46dc-9bef-2f1573fef52a", "value": "zz.spc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b155fa8-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655726333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726333, "uuid": "51298f28-47d8-45df-8469-12886c19f4e3", "comment": "Malware payload (Formbook)", "value": "589aab6acdd434cc3b6ba8aa5123706b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726333, "uuid": "0d9f41da-7250-4ef1-8563-f129f8bd875a", "comment": "Malware payload (Formbook)", "value": "0bf82ae7d8ed992fd02d696ac9e330f2b4a5f6eb082f29e2a99ceeff831eaa4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726333, "uuid": "99b285ed-461e-4a96-b8b6-761d77386010", "comment": "Malware payload (Formbook)", "value": "a27343f998c29933b79a85444d4a4d2d32fcdd8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726333, "uuid": "f7a86a4f-84b9-4e54-9d01-a5295162f71f", "comment": "Malware payload (Formbook)", "value": "0c92cdc6824c8acbd5fc2db6665678c790b8116f2628cdcbda56adfefede673649d3e8696cdf48e518ec76b455017467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726333, "uuid": "983ec30d-f608-48e9-a4db-ab385c4edeb3", "value": "T17FA4121569689B13C6F7B7F884A70295D7F34139D893F24C9DE120DDACBAF408A42B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726333, "uuid": "36b967cb-7100-43dc-a455-069fc7933a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726333, "uuid": "cea05b21-f55f-4d47-ab7a-34d97e71df96", "value": "6144:DMh4wNE1cr+HJLuMH6MlubtOGUVy3OjSMyxG01Ud1gHwDLp14q1yXxDLVRhrYt2X:CQcCHDlmt6YOYDykHCLX4RJVRhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726333, "uuid": "2b002912-dadf-410d-85a9-ca8a65c82a45", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726333, "uuid": "7561e4cd-5a50-4dfb-935a-947e966d107b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726333, "uuid": "7f0b44f2-0ced-424e-b9f8-345c35da5b5f", "value": "SecuriteInfo.com.Trojan.PackedNET.1389.11031.28214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17b41b9-f0cd-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655752758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752758, "uuid": "03da0a03-5e7a-49de-a8ec-963af3d7fedb", "comment": "Malware payload (AgentTesla)", "value": "a309594babd4263c676e1b2cde8a24a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752758, "uuid": "035ac0a8-2863-4ac9-a532-f50c76af9af3", "comment": "Malware payload (AgentTesla)", "value": "0cf8aeac532cc3971c258bdec24824d281268a2ae99263026c362c86ea1466c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752758, "uuid": "a305e8a4-5243-4825-8188-bed528283c2b", "comment": "Malware payload (AgentTesla)", "value": "9340fa2d5f5bdf47dd83f4082f5b22ca2f0bb1c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752758, "uuid": "15e5f5cf-4d2a-44fe-8b88-e0431bbaebf1", "comment": "Malware payload (AgentTesla)", "value": "f57559b1406e775c35fd5fe4625a90e1043ed167a2958c1418bd21b2a3ed02b1ca3f4a46ca8fdba0b86263eccd44864e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655752758, "uuid": "65573fc8-6d9a-413d-a61d-81d7ca73eeb8", "value": "T159A4021137EC1726FBBE9BF69D7149200379BE762C26D38CCDA921CA16277008654BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655752758, "uuid": "b3c67457-be08-465b-9568-901ef57044e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655752758, "uuid": "83d865b3-60bc-4c30-b424-68f1136ebf41", "value": "12288:hjm+rC6eiJODJlIek8W05aSDgX+VNc1DIn+C1nnGp:0+mDVWkDsyO1DIn+Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655752758, "uuid": "be0bc5f4-585d-4fb2-be58-d7f12ba898ed", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655752758, "uuid": "2df62daa-0abc-4309-aea6-b02153764c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655752758, "uuid": "dbced37a-38cf-43ea-a9c0-855e9635d4fd", "value": "oka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0576b144-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655716311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716311, "uuid": "fc5fb189-4919-416c-874c-6d07f70411ac", "comment": "Malware payload (AveMariaRAT)", "value": "3188a5c5857a847ba4dbb44da8b731f6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716311, "uuid": "1a1435de-e505-4176-b2ad-8420e8d15e6a", "comment": "Malware payload (AveMariaRAT)", "value": "0e4ac33d0911a7639666cf166a337f3b2392e9c6e51a8c1b838561f02f3c008b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716311, "uuid": "1c077719-59e3-4e0a-9a67-a6b1a46e040a", "comment": "Malware payload (AveMariaRAT)", "value": "9538fd630717e3ce07ef500f112cd7b5e3cef4f7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716311, "uuid": "87455eb0-d45f-437b-a0a4-fc5ed8e5a8ad", "comment": "Malware payload (AveMariaRAT)", "value": "aaeea059b749e9dc7d0a3be152e427203b0b0f8fc3939421e9993b5bbe5f3e355f3775acf8a1a217ea1b55df2e428190", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716311, "uuid": "aa5eb042-95f0-45fc-b3ec-07d67328d3ae", "value": "T11214E01E7A866F12C5AD097FC4E7A7950331E922838FFB033BC985611D973EA9523943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716311, "uuid": "d3f30701-33ec-4fae-96d3-22a909cff7be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716311, "uuid": "8b15c847-0283-4bf5-9b8f-38697ff98803", "value": "3072:Yey/z4RYHjDA3sKXMQpF6+6nqK2QDsybKHc7V8F0P3CuAerbtrt:YeyER248KXLF6+6qLGp8F0P3Cstr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716311, "uuid": "667f1dff-1dc7-4453-a65c-86f5a9e3579b", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716311, "uuid": "efa60ba7-9af7-49c4-aa2c-16230437396c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716311, "uuid": "70ca6de2-18d3-421d-a173-af0c23a2fefe", "value": "ComprovativoExecu\u00e7\u00e3oTransfer\u00eancia_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae84896-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730440, "uuid": "515ed795-6e41-4af6-98fc-e722e0885ea3", "comment": "Malware payload (SilentBuilder)", "value": "afb10fa0c98ca3dc4dd8941d7945b570", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730440, "uuid": "559c8d3b-2f9e-4b77-9076-a5469b7cfe5f", "comment": "Malware payload (SilentBuilder)", "value": "0f162df614c7d6463708c2799173933b3fb4387cf8b87e63fdd41bc52b5f776b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730440, "uuid": "df59f0fa-515b-4464-ab65-0484f40e6031", "comment": "Malware payload (SilentBuilder)", "value": "d9c1d26d473287a9d1d853e28b1f6724cd6ddcad", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730440, "uuid": "4d9c61ac-26ff-4ec0-8fbe-e5288528820d", "comment": "Malware payload (SilentBuilder)", "value": "d5f7545f62c2cedf210703e6e0fc4fe5b1ada09e03879d80fe5ecdf9b35aecdcff6ef2723c03372daa6f8a5125a6fb76", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730440, "uuid": "5ce836f5-3686-42e7-9d3a-4c034626ea64", "value": "T18E733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730440, "uuid": "3974bd22-5e12-4aed-8d4f-009545002c9b", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBM:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730440, "uuid": "e64235bd-0041-4292-90a0-d2f6bbdeb561", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730440, "uuid": "a6fad585-61c9-4888-84e2-40313c6b18a7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730440, "uuid": "eb21e300-6ffc-4f7b-8511-0875428c94a3", "value": "09509985422679026443.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277960be-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655716368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716368, "uuid": "f36c85ac-8c7d-412a-bc45-c71eef39660a", "comment": "Malware payload (Formbook)", "value": "22e0fa1af69bce34ae6db284248231a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716368, "uuid": "f3ee337f-4704-4ade-be27-405baa6fe16d", "comment": "Malware payload (Formbook)", "value": "0fb1ed273eebef5a4de0a4e3cf1d8e1a2a897ff195bc1348d2a00995fc473958", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716368, "uuid": "0ee31174-edbc-4c48-a8ba-4822a2d611ec", "comment": "Malware payload (Formbook)", "value": "6b5888b353dd35301e61f25a7bff0e932a4eab85", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716368, "uuid": "477582c5-2d17-41e4-9c17-0183aa75ee98", "comment": "Malware payload (Formbook)", "value": "c0401ae9b741f1bfb4210e220724992d3324af90af1c6553946262709273704878df6e2d5636f928b07fc749669151c8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716368, "uuid": "21446708-435c-4fd7-95c0-5110be49c443", "value": "T14963E037E63ED4B9D2D48934DC5E64650AE77CC73444E0E968A2370B68FB6E808C4A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716368, "uuid": "9852e9db-e449-4455-83fe-8145b4eba5df", "value": "1536:pod4VA+Bm1jnwKHCx6dAPqLzhY0hnT/PF0B3YU4w66QQh5:poynBmxnwKHI6dAPqBn5T/90Bb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716368, "uuid": "b28fa5df-504c-48f2-930a-8a7e5702a5dd", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716368, "uuid": "b1c9d4ac-4f24-4fa2-af3f-f901b1ef6d8a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716368, "uuid": "7089b08c-6872-4c94-8faa-4b40ca4c55a4", "value": "\u4ea7\u54c1\u6e05\u5355\u53ca\u89c4\u683c062020.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14af48f9-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655716337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "49905c98-fd7d-4a4f-ba4a-da90ee5090d9", "comment": "Malware payload", "value": "08d39c3eaf854cb7600c38b6b0c25ac6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "fc4301b6-d1f4-48b7-bbc6-9b3d9308b7d3", "comment": "Malware payload", "value": "105cd193218f02d68a838cb99ce158e5128e136c321cf9155b0d96523259fe29", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "540dc777-3f4c-4513-892a-aacd1651bddb", "comment": "Malware payload", "value": "c3c903285b633b7b2e31259481c124afb383fc23", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "a56794f2-45f8-4661-9bcb-9069dc99330f", "comment": "Malware payload", "value": "de2614535e10bb18b594ffcae14ee28e869ebc87b4839bbfc2a018dae2a0cbb5d6f8940869eb4a847c350f70cc2fa16a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716337, "uuid": "8bd85ba8-49e2-4b62-b145-cbcb2a6b6525", "value": "T1C644AFAAA049E7FDE96F4031938126451D3ABFEE837B800E9B87F51B78391F88554CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716337, "uuid": "ba6448fe-ee4a-4394-bacf-d5f00b570420", "value": "3072:98Fh26SbnWQo6ZgUy7xEFCEzDZxYBqzbFrxeCjhcZ1geFYTkIjCOH7xt4Lax+S5l:hbnWQPi7E13IkzRjevgeaNjCOHkarM7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716337, "uuid": "5a86a240-96ab-4989-b4a0-71c87343b0f0", "value": 261704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716337, "uuid": "0388af09-8d74-498c-86d8-ffc443e62737", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716337, "uuid": "80c533c4-0229-403b-b874-fff01abc5f1d", "value": "new urgent order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b70569-f054-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655700709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655700709, "uuid": "b5e310b6-0d27-4a8d-ad86-f1c3818c6de1", "comment": "Malware payload (GuLoader)", "value": "f626d39dc5fca1c296adaaa0f716aad0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655700709, "uuid": "4845f730-fd87-4916-95fe-57253946d79b", "comment": "Malware payload (GuLoader)", "value": "112e2d46f7169c8c00956b113d26d6edadfe453dfbe1bf95fe786fe39f587370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655700709, "uuid": "7e22fc2a-78ec-4a37-9be8-e718a303522a", "comment": "Malware payload (GuLoader)", "value": "62a375ac5261bf8caee8eff16bed9575fe33110c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655700709, "uuid": "d42421a4-48dc-47f6-8999-5d396773e1a7", "comment": "Malware payload (GuLoader)", "value": "0ff7bd23d293c969cc54fb5e04067cde4e3e319fde1dddbfaf902bef2e1bc5a9cf71f567950784f7acc63805345ad0e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655700709, "uuid": "8b1e2ffd-60b0-4fb6-956d-35e884786c62", "value": "T160344A40E94DECD5E7D8C5B3B83A9B110575BADB92F8819F2265371466B33C3207BE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655700709, "uuid": "a7efe58a-8c64-4fcf-afd1-76dd059d48d6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655700709, "uuid": "c268d651-69e5-414b-81d9-0eb1304756e7", "value": "3072:R1NjcVVnLpPulry8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hFDO4rQ6ZQY7j1lQA:LNeZrCvq4C0rpsjv5/rkZocoQoUokhs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655700709, "uuid": "6508c3ab-e63a-4099-a246-7f8846a49a06", "value": 247760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655700709, "uuid": "3bff1193-446f-4065-b9cf-e8ab03aa2921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655700709, "uuid": "607e1a0f-5d51-4a8d-ab6b-bd989c74046f", "value": "112e2d46f7169c8c00956b113d26d6edadfe453dfbe1bf95fe786fe39f587370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36649a8-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1655747607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747607, "uuid": "27ce0f79-9cb3-440e-8809-a3ac7e45099b", "comment": "Malware payload (XFilesStealer)", "value": "28e120b6558d92d0fecf3b3ede1c6495", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747607, "uuid": "81f6aa5e-6d6a-4edb-a88e-4315f2bf7bd1", "comment": "Malware payload (XFilesStealer)", "value": "11881702372ebdeb3b2386a3dd1a6e8f40374867317ffcd23b74c892502cc6af", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747607, "uuid": "34e51129-9a71-4688-ada9-f5a4a1ebc112", "comment": "Malware payload (XFilesStealer)", "value": "357181c56636f4c0003c6a59f659e212ba66a791", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747607, "uuid": "e2befacb-5c8c-4e35-bece-d1b8a7a02197", "comment": "Malware payload (XFilesStealer)", "value": "9a1304890e720f3abad8318e11547ec5a6fb871112341c4530ab74fcfd89651da44e47a2130731c0b6bb0a6c6c3968d5", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747607, "uuid": "47ab1d38-9e96-44e5-8a86-e6b378bd91bd", "value": "T17DC36A03EB55874AD8A52F31FB90435109F0AD53E8028E3B50D6FE7B5960BADE4C1DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747607, "uuid": "cf92a57d-bc4a-4f29-9ca5-99a66503848e", "value": "768:DoE/bXIAA1Gxh8HUqPMpnrK18yGG2G4FIlnihJ/xY2+X3utw:DoobYP+8HZMVKSyGG2G91ixw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747607, "uuid": "1e4084c8-aede-4a21-b6d8-3d47cf0626da", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747607, "uuid": "960b0536-5d23-4337-8ba5-7aa8ee59f081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747607, "uuid": "1fc7b671-37b5-447e-ae14-226f5779d538", "value": "11881702372ebdeb3b2386a3dd1a6e8f40374867317ffcd23b74c892502cc6af.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ea3a27-f0ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744623, "uuid": "e808a4ec-9fcf-4997-be9c-e7759f9033d3", "comment": "Malware payload (Mirai)", "value": "518abf7c2c6bf7d67993592445adfd4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744623, "uuid": "ee75080a-2724-4555-95f3-a1496c6ceedc", "comment": "Malware payload (Mirai)", "value": "11e45fdd38b5c701d57b382951f6d7a853ebcde0f492cf8e2ce8dfb77fe2ec27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744623, "uuid": "20ad70b8-ec1a-4c02-87ce-c640ad68bea9", "comment": "Malware payload (Mirai)", "value": "1191be8a6a9142418a5fd1b8f9d4fa7455b4f151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744623, "uuid": "c88b5fb8-3de3-463e-9558-102e5acc70de", "comment": "Malware payload (Mirai)", "value": "ae61033055e45192df4a68b4a82a6c1cbac485b42910a5411eab73b8a3f1bafaf1fd45e22f12c307a15d94cca27a21bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744623, "uuid": "4e18375d-232f-4613-abae-8e0d8412693e", "value": "T12A63089AB8819F15D5C511BAFE1E028D732307B8E3DEB2139D206F6063CB96B0F76915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744623, "uuid": "1cf2fb50-6dde-4619-b3a1-bba836c350e9", "value": "1536:VInmxV4lo699rkHvqTNo5P+7adqzlI6iiZNxm8L+65jY6:tjko09r2vKotSaKZNxm8L+6hN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744623, "uuid": "4fc79af2-fa00-4769-bb2f-1a2fb4de61fb", "value": 71060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744623, "uuid": "cdd9b23a-7dd5-4a7f-8398-95ccbf9159e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744623, "uuid": "2b9a892f-7444-41e7-85b6-5bb4e667d391", "value": "Hilix.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff814c8-f085-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655721509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721509, "uuid": "86acb7fa-23ed-42bf-a0db-898ff62df6b4", "comment": "Malware payload (RemcosRAT)", "value": "5406c85c3756e100153771c3e5375dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721509, "uuid": "c126b6ce-7224-44ef-a698-66608d8ce097", "comment": "Malware payload (RemcosRAT)", "value": "121dd806963977a4c80e98a91e1bccf577d74da295787f7d61ef22cc1026822e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721509, "uuid": "2ca94e51-1cff-4540-be07-908acdd2539e", "comment": "Malware payload (RemcosRAT)", "value": "352b751dfeb0098b3bdab7141dc2907a36d35d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721509, "uuid": "b267ff58-7398-4f21-aaab-d834bbfcb657", "comment": "Malware payload (RemcosRAT)", "value": "3b206b3a49e1aa2cbb684e0c3cba8d747e91313ea938bab8d12488527a22bd6404a8c740b13c81add82771f7d497fdaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721509, "uuid": "6ce96984-494d-4aa4-9556-a8b2e3332524", "value": "T150F4231856FD9F95C4F37FF5888241899B71892E9452F20ADEE261CE8CDEFC049C1A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721509, "uuid": "e14c8f2e-be8a-4865-83c5-a693e2103b80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721509, "uuid": "98a60a1b-7412-4bcb-b181-24c495cef225", "value": "12288:Xaqe57U8z/n5n9IV653iqPC8ZNZFeJL0jlJb1rHbU2fhixEZluQa/:Xaz9UK5qVwHC8ZzFlnbRUghRHuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655721509, "uuid": "23a740a5-a705-4c88-b2c6-c118be118ef1", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655721509, "uuid": "660a7f00-4a76-4c73-923f-9d6d0b27d74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721509, "uuid": "dc957b5f-971f-41da-a7d6-68f68dce03b6", "value": "#PRODUCTLIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e72b0b-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655761803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "ed6a4399-b1d0-4480-96d5-9774eb20a685", "comment": "Malware payload", "value": "d2ea8a498f47a5127d72a1dd32ce3de7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "e9376ec3-6203-45bb-914c-7ba682ab8010", "comment": "Malware payload", "value": "1233ae9e89ffb77b247aeb998e453a83bc96496aa171e0fde8322199f779cbc8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "5fb12201-74ee-4404-885e-80501a2b6a77", "comment": "Malware payload", "value": "f2b35236e65e22d0f6473f90e7fa9235b80c8dd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "4de79ab3-199b-41a6-8cb7-60b1e6cedecc", "comment": "Malware payload", "value": "d8b84e104fafa111b491267afe384f431453ec7acbddff58d4e5379fb5a43e3fc62a83a040fab447618f41ce24713e20", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "f72614bb-c0a8-4a05-b9d7-5ef09adfa699", "value": "T1503319816380C6F3D26200B61896EF670475EB7A62A098D7EFC51D31EA35245D327BBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "573648dc-8a89-465e-85e6-1ad988d8ada3", "value": "1536:L1DJM/LrePbKY4Y03JOARSqSNbyz/0R7G682A:5tiLrejiYKJOARhgb3R77z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761803, "uuid": "f6222f23-4916-46e8-af8f-5cb1a1ae6b4d", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761803, "uuid": "40bc7176-d38c-4d76-a867-e17e989c9ffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "e04b6bd1-7ec3-4fac-a7b5-b78821f5ae7a", "value": "boat.x86-20220620-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdc5ec2-f0b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655740429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740429, "uuid": "e8036cfb-26a6-4a8a-87bb-1322f7986d23", "comment": "Malware payload (njrat)", "value": "bbd6f65d6fb22b84eca97988bcc1f051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740429, "uuid": "29ab29ba-acb0-46fe-bfcb-0d6796bf640d", "comment": "Malware payload (njrat)", "value": "1237139159067ef4bee54311da8b913f4feb86d00fb94b7c8a6ba8744cf1b684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740429, "uuid": "2b17785f-619d-4e6f-aefd-2a4a3a622dda", "comment": "Malware payload (njrat)", "value": "2b2b5b6721ad0f43084484c6dab84fd8d73af46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740429, "uuid": "8e4b8dc1-aa72-413f-98a0-a4c40a966505", "comment": "Malware payload (njrat)", "value": "89182e65caa845ddd294d510b3c2d847d003a78e35670cacea898ccffa2a69c8cb6b581b0bba881a145a9a9e328f6243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740429, "uuid": "a85d58ad-6e17-46ac-b701-f4b0ffab2592", "value": "T106032B4D7FE18168D5FD057B05B2D41207BAE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740429, "uuid": "6670d333-e5eb-471e-9bb8-50a132d862a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740429, "uuid": "15bfef7b-4e53-41fe-85fb-b1bdbbede20c", "value": "384:RSSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXD:IS7TZ38fvCv3E1c1rM+rMRa8NuCMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655740429, "uuid": "2cfeed44-f5ec-4708-9a08-3b8f2fa0bc06", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655740429, "uuid": "edb8fcbb-1eaf-4d06-8b58-fcfc436b4ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740429, "uuid": "bcccbe55-9d52-4c8a-ac30-f24fb94c9419", "value": "bbd6f65d6fb22b84eca97988bcc1f051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d02a8aa-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655743006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743006, "uuid": "698f9b9b-1601-4c74-8311-67a38ceb7c8a", "comment": "Malware payload (Mirai)", "value": "02efc50d7489da2056cc1b1998f5c8df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743006, "uuid": "a4b3468a-9c2e-4fd3-a2ac-3d692b2f9d03", "comment": "Malware payload (Mirai)", "value": "12980c21ca17307e74505e3c4c41669545e3e5bfbaffb3ff9a577c16db2b7a25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743006, "uuid": "a9dd8889-a1d8-421e-8fdb-f71f01002e01", "comment": "Malware payload (Mirai)", "value": "8e4e10bd56b2ae3102ee3ee0c5d7943d85c26e36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743006, "uuid": "f63202fe-c3ed-4079-b6d1-613d59183468", "comment": "Malware payload (Mirai)", "value": "890566a8f110a98b1feea1b6cda97c76fd0d84b69d8b7a308fe2f68287e8beca7ccf1f3ee0fe5859af49e17d47ed3e57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743006, "uuid": "8bc5edfd-d676-4c99-b7fc-e138d4ba608d", "value": "T1B0E2F13591D49722D8AC6A7B88CFD44D3D60C14D311A24F0AEDD787ABD65F2C6F2828A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743006, "uuid": "7363f2a9-d538-440f-b8d4-ba318ece7943", "value": "768:Ys6YkaH2DZPYtBhAE/7NGA98q96nl+YVWERJycg5nbcuyD7UGQRjc7:mYkaH2DZAWG7YAe5ln7Mcmnouy8GyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743006, "uuid": "0362aba9-2bc6-4407-ab86-6895c5cc5a35", "value": 34116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743006, "uuid": "f7726074-2935-44dd-817b-a69aa4323579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743006, "uuid": "ae88fd29-82be-4af3-ba93-4a1c308055d8", "value": "zz.i686.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8927d3d8-f07f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655719109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719109, "uuid": "2e94dd8d-3488-4087-9cd1-34a507251b0b", "comment": "Malware payload (Vjw0rm)", "value": "b34c9083eed5a3f38346fa1bf618745e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719109, "uuid": "ff0eabc1-cb39-4729-8f75-d0a0c5f80458", "comment": "Malware payload (Vjw0rm)", "value": "12ca249e9fa5ed956d072ec466416fe50cf35c4c6c481ce19e07a52ef31e1a8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719109, "uuid": "df1f7f4d-74ed-4251-8ce7-509cfc58584f", "comment": "Malware payload (Vjw0rm)", "value": "bdd94f1f3509a6507b280d06a240c2df1c5a37e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719109, "uuid": "0b84fa33-dae3-4398-b444-6bb1c8a3806d", "comment": "Malware payload (Vjw0rm)", "value": "aac9ef5d6f8febcdd03891d7cff106b21cb2d38ec74d71f229c38ce5fbbaef9e2ef8f48b043497856aadb37544bdd5d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719109, "uuid": "559ca2c9-5e8c-467f-82cb-ec3212e03a3b", "value": "T1D184E040E7C42BB9DAA8150BD0BE160E83F01346D91664CCBB36BA176FFFF889217655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719109, "uuid": "d5172b05-fe47-48a0-8ecf-94b4333d540c", "value": "6144:wU3CQP55kYWIY7GBwqs5XmN7ZyAfY1qX/E1IN3Vjr0/3tp0ZmFuTh3P91dlD7As:+f7kD6qPjy3bUVX1dlDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655719109, "uuid": "85827541-e20a-4d8f-a86b-11f984f70268", "value": 384095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655719109, "uuid": "6f1ef9ac-299f-42d8-869c-fb874d455205", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719109, "uuid": "bf8ff8e8-c539-4ae5-943d-7328db2384e1", "value": "????????? ?? ?????? Ref. No. MS-DGP-220137.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe059cec-f09d-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1655732190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732190, "uuid": "c702cbba-1159-4204-8aba-45b872b26126", "comment": "Malware payload (DCRat)", "value": "bbbddaa9da11a7075d909b82a6a84923", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732190, "uuid": "4de04a76-5260-4bb6-a16a-0d3e9134a1fe", "comment": "Malware payload (DCRat)", "value": "132061ecc922628fdf86038d740ef678172a54fe61a0b8822ae3834e8ecb15b5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732190, "uuid": "005c0926-e841-41c3-989a-5868c6ed8943", "comment": "Malware payload (DCRat)", "value": "80ee336b76188ab97bcb70120fbb14f838f8ca1d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732190, "uuid": "0d84ce40-1263-4c88-bb86-879451131801", "comment": "Malware payload (DCRat)", "value": "78a7e3b78c5726d44a2f43bc1c07404936a1e0da93639b7cc8d2d8edc58af2990ee405092f1805a9f893152b7e93b605", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732190, "uuid": "7ebd1c74-58ec-471b-87e7-4e9cbd6673f5", "value": "T1A1E4F002FA85D872CD512C75C515A6F12539BDE0CF289EABA3D43E6DFA331D0EAA0513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732190, "uuid": "8733933d-e95d-47f6-b0ea-3547306c085f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732190, "uuid": "cde721e7-5325-461a-84ff-2cfe101d11b4", "value": "12288:xzxzTDWikLSb4NS7ITCwDX0D6TShGcbmCL0FkKh/wyUFLJ5:bDWHSb4NdCw45hdskGZUFLJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655732190, "uuid": "4581cc05-1be2-401b-8a97-3d78dc1d9d7c", "value": 712199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655732190, "uuid": "9deecf1d-f391-4390-b5a5-19ebdf0d023d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732190, "uuid": "6c09804b-4649-47d5-a056-758dcdccaffb", "value": "bbbddaa9da11a7075d909b82a6a84923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a34008c-f041-11ec-93bb-42010a9c0043", "comment": "Malware payload (FormBook)", "timestamp": 1655692294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692294, "uuid": "c8e15265-e183-4a7a-908e-867c287e5efc", "comment": "Malware payload (FormBook)", "value": "33b660cc3ce2ca37210782ca30e394d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692294, "uuid": "bc414ed8-797a-4a0f-b5e9-7b958cf93dea", "comment": "Malware payload (FormBook)", "value": "13239def87e50bb67b3650f3de9b5fd48eb391277960b2d480966d1fa51f15b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692294, "uuid": "a36942b8-b71c-47c1-975e-8d0ad56bd723", "comment": "Malware payload (FormBook)", "value": "f12abf5f129bda535202deaa57de12a4a915e722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692294, "uuid": "305c730b-68d2-46bb-b60c-f72b2fffe099", "comment": "Malware payload (FormBook)", "value": "40008e705fed6bb2441b4ba4636ebe1afe70cb98110cca57a3a5b3cddc2e2d00cb018ab01de633a091a67768a8b8941d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692294, "uuid": "b0cf683a-7eb5-4c7c-bffd-e9d487cb27f0", "value": "T148A412286EBDA732E0BE5BF80591457187B56B3AE423E61DCED450CC4CB9F244AD1B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692294, "uuid": "bc11be8c-8ee2-461f-8a03-e5f5c10e0904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692294, "uuid": "9fc3b24e-befe-4f23-beec-a45901546ae7", "value": "12288:bPuJR1cmtoE2WYumRc1nWiEp4ynQSBOEop1:bPKR12E2qUQS4Eop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655692294, "uuid": "d1cef612-46c7-42e2-9d8f-f1784bb2fe7a", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655692294, "uuid": "7eb91adb-1f0b-470f-bda0-65f7426c9041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692294, "uuid": "37753a03-75fc-4d3a-8928-c8458599daa1", "value": "SecuriteInfo.com.W32.AIDetectNet.01.13102.10437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb17a88f-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655716294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716294, "uuid": "9077ec53-e929-4f36-bbc5-5135b71531df", "comment": "Malware payload (Formbook)", "value": "290e3081c48b78d03046c34ed73248c7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716294, "uuid": "e0eb40a6-bb5f-41ff-a61b-20632b356680", "comment": "Malware payload (Formbook)", "value": "14a205b84909c713e56c7e91b52818f380c6846dc7742d8cc5784246e3d98ee5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716294, "uuid": "25bcbb9d-1fc7-473a-9e09-4c77f11dae8a", "comment": "Malware payload (Formbook)", "value": "db501782eb1628739c9568d176b7e1d3c71f4ac2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716294, "uuid": "3e38a216-e9e4-483f-8e8d-c8867d0edbd8", "comment": "Malware payload (Formbook)", "value": "6dd53ee4a241f7cd302c0cb747d0afa3641aaa49fe3214a86efc77789588cd6f3f6aee1e06299d5b45964e0745465fdd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716294, "uuid": "1e9d1cf6-32c8-4cf5-900b-27594d4125f2", "value": "T11063DF8837D37462E04E72F98B37D621262EAFC6DB554B86339CB78D1C7D6C09DA2418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716294, "uuid": "c4d80789-8dcd-4c2d-a72e-9ab3bf41b46a", "value": "1536:rvzGIRAeGivqPLkFYc1D4Dq1DeE1lwPiNcfcoMXyyBd:rrGIW1ivqPQ3cq1RDfNNoML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716294, "uuid": "ab49b545-e84d-419b-9270-33766954270c", "value": 73272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716294, "uuid": "5cbce67f-06fe-4a48-8195-6aca4bfc2460", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716294, "uuid": "87337b34-23ba-4ce6-b107-7e5d9aee441d", "value": "Order Specification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcf34c6-f05c-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655704168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704168, "uuid": "e49433a9-d214-4cda-afcc-58942f7b736e", "comment": "Malware payload (SnakeKeylogger)", "value": "26ccbdbb25f558d575ac596a0267e56e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704168, "uuid": "f63078e5-464b-4d75-88c9-8479086b7090", "comment": "Malware payload (SnakeKeylogger)", "value": "14a7eaa06d5c2d80ee85770c391bc78b0df4469b0fe467b2106f7355dd982ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704168, "uuid": "00e84373-6c12-4954-8ceb-263d0295deba", "comment": "Malware payload (SnakeKeylogger)", "value": "5a75beee3793a43aa011ef8bc016b4c2c4aa0120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704168, "uuid": "ea3734cc-a74f-4103-99c8-a9fc8058e166", "comment": "Malware payload (SnakeKeylogger)", "value": "f15ad0ac0b396b1a997e4e4883e94ea187a3cebf9ef7506610c866879844bdcf9e9bbfb216e386621746dfbd50a6e532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704168, "uuid": "01f415f0-6592-4e83-a9b3-7782f0b86ad1", "value": "T1E784120566FFAB93E5F66BF809A2421693B1E53ACC82F185CDC154D950BAF04CAD1B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704168, "uuid": "1a67fec5-1516-4522-af4b-6169319d5a76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704168, "uuid": "6484cfb0-cd88-4fb2-aeb3-ddeb1492e774", "value": "6144:+yj0PwwSMzMd3g/naIkIMhKrEb1KcwGbEQZ7Ij3+m6cJ2XYwAtG7JZ7EQHPdEh:IYwi+nUIMhPxJmGC7LtkZ7EsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704168, "uuid": "23595c6d-e110-4482-8c78-106be6920959", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704168, "uuid": "2c70e4d2-8fc8-4787-8a3b-8580b33fc81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704168, "uuid": "d6479a86-7791-4bf1-9d25-690a3b6b554f", "value": "RFQ 11054.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce49cf1-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733530, "uuid": "4a4210cc-e921-4f48-8c5f-f5f4ed284bc6", "comment": "Malware payload (Formbook)", "value": "62e0d75168635953e8f6ec3676e5ee5e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733530, "uuid": "e7ca8a60-bf42-42d2-bcc8-374501ba54c2", "comment": "Malware payload (Formbook)", "value": "14b387257fae52d4311292395c98846292179cc26d29a5865b1e702dbafc781f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733530, "uuid": "d9aaa6b6-4f7c-4f9c-9a7c-8df3c082b5f5", "comment": "Malware payload (Formbook)", "value": "e0d80f2d4c6f91171a42acaad942377413ad8e49", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733530, "uuid": "9b1fa392-9580-4566-b4e3-f8fba7bb4745", "comment": "Malware payload (Formbook)", "value": "d25cc0ec65d82425a87229ba5a1f4522dd5509c64da4eb294a417b322500ed9356048ee57b2df6b21a34949dbb99e21c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733530, "uuid": "2ad39444-21f2-49a7-abc1-442bd5cd1186", "value": "T12C63DFDDF5194220F1DB227E351F82A9792E1CB5DF7589721594F2AE02B1C800E3CB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733530, "uuid": "fd14164f-b6ce-4941-8906-b3dd96e4cdc8", "value": "1536:381ItXJjfnfGEj74+ItHIr8jKMu92bTXfEqxdpkD4BHnn6TLK:3jhRj74+ItHIrZ92nXsadSD4JnnmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733530, "uuid": "60ffafa7-e903-4266-99e5-1897681157f5", "value": 72776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733530, "uuid": "3b7323c9-a881-4173-97f4-68ca76950f3f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733530, "uuid": "10af8987-d273-46dd-8b20-93c6b1ad3515", "value": "Purchase order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a5422c-f082-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655720316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720316, "uuid": "042b7439-e7cd-4633-8766-695ef5a636b3", "comment": "Malware payload (AgentTesla)", "value": "2b765c0913373d7a4903d4d1424a173a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720316, "uuid": "9856343d-f9b4-44d7-9462-92861fd28464", "comment": "Malware payload (AgentTesla)", "value": "14bceb51bf2cf320f4a8f54a3d2bb42c90ceb01b479d94218d1f35b18129a87b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720316, "uuid": "4c9ff909-4e82-4b61-ac11-8529eab3dbe8", "comment": "Malware payload (AgentTesla)", "value": "018232c831eb422cb7c323ed75adab65125b223b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720316, "uuid": "46f8bba4-5881-4e5c-a696-c210fe1c5d99", "comment": "Malware payload (AgentTesla)", "value": "b209a4138c4f04a5cc75cb15c225ec9d526c5c9a3a6d61c25d8b13cfcf362253f80317b53218a5af26653cdc002c1564", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720316, "uuid": "3c431251-48fd-44b6-896c-3dfad9fe602b", "value": "T14F450200A9385262E83A83FD85E2725053F86423D256F7A86FCD30DF5B77B168B51727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720316, "uuid": "634fdcbd-4d39-488c-ad37-13ab7d0c9adb", "value": "12288:Y2iN3tUtZpBtY4nmwQ5kSaf2wudFZarAA+LuCgHqX8qsr98QV:Y1dtU3pvqQ2wSCkA+LuCStr98QV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655720316, "uuid": "c3347eb7-6836-4a5b-b7a7-af40c1e3b2d7", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655720316, "uuid": "ef58d389-e9f8-4c52-82d3-1a25530519bc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720316, "uuid": "f19b5bf3-357e-4761-a001-57a7a473ddc5", "value": "PO288000174652900_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb2aeda-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655716219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716219, "uuid": "0faeb621-eb6f-4d48-8096-1a3089068857", "comment": "Malware payload (AgentTesla)", "value": "04acfc81a3972244155ea250ff4bbcff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716219, "uuid": "3993ff99-5bef-4d34-9514-7ab6dfcb97a8", "comment": "Malware payload (AgentTesla)", "value": "14e52523455a55d237cc47848f653861e0d189fc95d58b478e15ea874e3cb880", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716219, "uuid": "919cf35a-3056-4ca9-9d82-8f6df3ea7a04", "comment": "Malware payload (AgentTesla)", "value": "3d0e2b245576070fdbb81ebeeaa2830109988518", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716219, "uuid": "39e0fc3e-d5b0-4f66-ad74-b4efe531f4fa", "comment": "Malware payload (AgentTesla)", "value": "14a37bf075d4af536904dab39971d7b757eece92d8ac0aefb3881607dc47490eb7c36df9d8d918942214b410061be922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716219, "uuid": "48479d23-aff0-41c5-a1dd-70e4cd99e95e", "value": "T1A863E0F669E943E0E061C97F40679CDF8FE3ED10662D72E86067371BE1F482E2485962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716219, "uuid": "930c37af-b1ef-482a-8cc6-7f10b3d33f03", "value": "1536:RZviX9V+iEKoLZlJfvdzfMB/fqM/PpLJVwwRZB69V2k2a9r:RZvC9VHEKuHVfM5fp/PlxxoV29ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716219, "uuid": "737ed7c7-9fe5-497b-847c-7ab48ded4379", "value": 73288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716219, "uuid": "33fb18cf-a04c-4584-bfde-a1eb08709ea8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716219, "uuid": "eae91fce-8019-4711-930c-38b906425844", "value": "Quote.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05090b0c-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655709868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709868, "uuid": "6ace919f-cd39-483d-ab22-a5a4ffa12729", "comment": "Malware payload (Formbook)", "value": "779c83eb8844ddb4a2b5334c93001725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709868, "uuid": "011eb945-6541-4d4d-9f22-67987fd02629", "comment": "Malware payload (Formbook)", "value": "15ae236a475273493b068d6f265b967750ad90d83003fcbef50fb52be92fadc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709868, "uuid": "8b311a08-2663-430f-bc3f-9c62a067deec", "comment": "Malware payload (Formbook)", "value": "666bb07b84a6f75a1acc82382c87e9b1bc41f4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709868, "uuid": "49bcc1f8-1da9-44fb-b26d-c2f053572f92", "comment": "Malware payload (Formbook)", "value": "407d36afb552b42e3f79d51af7d2932e900cbf8cde0b9a0f3360346cb94a203cac27fbd791c07c935d944de977e401ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709868, "uuid": "73a9d51c-8b4a-4f23-918a-cdfa6501731a", "value": "T17534F782E9006674EE68AB346A33CD3507127DBD6D79942C24E97D4B3FBFAD36025423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709868, "uuid": "a0d40923-bb0c-4957-8a19-44020fce04e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709868, "uuid": "ca7aa106-a381-486e-bca1-acfb8ee20511", "value": "6144:21gE08tYLfZfE2rdm4Vz0Rpppppppppppppppppppppppppppppo:x62rdm4Vz0Rppppppppppppppppppppm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709868, "uuid": "fbab0775-694b-461f-bbcf-defd5a6ab6cb", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709868, "uuid": "c9c2ba89-435a-4846-8893-68e2062ed188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709868, "uuid": "396f2ba0-b181-432d-8376-7bfa6e7d6f18", "value": "JFES _Corp - Quotation Products List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf067331-f087-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655722662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722662, "uuid": "0c3095c9-4f6b-468f-bb59-0cb934a75852", "comment": "Malware payload (Loki)", "value": "8cc6528238785dabdb576075aa89f9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722662, "uuid": "d950e07a-55b3-4225-b20b-adc513f57cf1", "comment": "Malware payload (Loki)", "value": "16dafa7272452ac8c050ae3f73f63f070351266e593e9ecb2d8ba31b5c7ec985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722662, "uuid": "d1a30b5e-8b10-4b78-87eb-a1a918790054", "comment": "Malware payload (Loki)", "value": "b5401584d22195714663fd1770ce6b81ccda08c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722662, "uuid": "d37ecd69-1176-4905-9e41-d0cbefcb0106", "comment": "Malware payload (Loki)", "value": "6ab9538a46eefef2216a72064835d3d7be92933568f0e3ff163a465b17e3d46d4b7010b4ce469799f1035378371eab51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722662, "uuid": "df9ca0ef-6ba5-4aff-9eb3-ff6b706b3b6c", "value": "T15D8412046679D722C4BFABF895A7414487F56A2FD462F21CCDC230FA6CB8F048A85B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722662, "uuid": "17a79804-ca13-491b-8a4c-b7951c8b3de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722662, "uuid": "aeb25f94-7982-48e7-8904-e56ef2596f12", "value": "6144:JxUf1w+PUH69kI14r5Q2T8PkY4iYfR3LCJMPcMtpNvaPN/K:r+PUa2YXJl4iyJOJMTzNvYtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722662, "uuid": "a923f41e-90b8-433c-b2d3-bed674a24c26", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722662, "uuid": "2d1f28e1-739c-434e-86ce-2abeb3bc94f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722662, "uuid": "e2e007aa-691a-4970-9e60-5287fb6ffd44", "value": "SCAN001_REMITTANCE_HMIEC_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedc55cb-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655726044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726044, "uuid": "a100fe5f-75f1-4134-a3fc-2c3275e02f8b", "comment": "Malware payload (SnakeKeylogger)", "value": "35a18f304116ecdfcad41fd5bca31933", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726044, "uuid": "022acb6d-3792-4b9b-894f-9a6af3f8d278", "comment": "Malware payload (SnakeKeylogger)", "value": "1769dc1848cd852413a7192e8f4cfcd953ebe275e6270a40c1b5f548fa2b46b9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726044, "uuid": "fae93da2-6879-4ce0-b5fc-4fd1c202a64d", "comment": "Malware payload (SnakeKeylogger)", "value": "45aa1255535f864e9bcbd38f16ae6b169a06abdb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726044, "uuid": "d714cb7c-adf3-4405-ad79-c55f3036cc37", "comment": "Malware payload (SnakeKeylogger)", "value": "9f7fc445bcc95e83a5d0db715d6fb0114c5e6627b4a7ec5a2ca011629559178c9e2ae26e77d2ae05f5d53219251d5852", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726044, "uuid": "917499e6-a4b9-4219-be7e-7cd364ab36b1", "value": "T15EA2E13B800BC109013C1B8CEC5FE69BAB458656E5575629F06D2DE7A89EF1857C3CD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726044, "uuid": "967598b6-8fcf-4239-ab33-fedec2f0bcaa", "value": "384:aSC54bxZ7rZGmCXPjc0oGIxYNwSRW40Kw0Q/XayUPmoVUzFR/jY7y:dC54bEmQ5IQwCW4Q0YUJVQVs7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726044, "uuid": "bf7e5e67-ed76-49dd-a798-aa79b15e11b5", "value": 21502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726044, "uuid": "7e1f483b-9b03-4cbb-81f5-073037c1cd54", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726044, "uuid": "d928ac2f-611b-4500-880c-f607974d582b", "value": "MV HIGH SPEED.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0337a0f-f0de-11ec-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1655760030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760030, "uuid": "c10e97b4-81c3-4d54-af85-714884e1ad1d", "comment": "Malware payload (SVCReady)", "value": "e2237eac90e20fe703806ad6b8221597", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760030, "uuid": "455213bf-e416-4764-a1a6-56cd79e0861c", "comment": "Malware payload (SVCReady)", "value": "17f0487ceadb25c4d72e3861ab850c601ac0c4c09a54b103c9074ca86014f4f0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760030, "uuid": "6360d4f3-80d3-4ea8-9a7e-32a3a575e307", "comment": "Malware payload (SVCReady)", "value": "e18a0dea6b4a10046e3b50d6ab910868c4c52574", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760030, "uuid": "3b63fccc-ed33-41cb-99b2-02485b32a999", "comment": "Malware payload (SVCReady)", "value": "ccfccb26584054be9ae1e5bbbacdba2f1a416c75562448abf1727e512f9296e6bbc5ccf10e7b28040d7d210da07f5efb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655760030, "uuid": "03e38db3-6b5b-42b7-8d97-97f27d4c1bd1", "value": "T1F8D533FE238969E3EC6F8EB665B942253B7C9664F3225C09B462F709A19015F3D1D0CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655760030, "uuid": "b2e7c4d4-834e-457d-92dd-c3f7afdd664b", "value": "49152:E0UHEyprXORWzA39Defi489DlZnhCmQyI+N1CuIKrBvmOxOeyXnotumVcnySXb5:E0UHEsM39Sf989JZno4PBBvVxOCgnFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655760030, "uuid": "a21bfd46-f7b8-4e23-851c-be1dcfd7ad39", "value": 2748010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655760030, "uuid": "7402812f-3f71-448e-ba35-ce3f7e279666", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655760030, "uuid": "ff3070b8-4de7-4819-9733-d67ee39d3a66", "value": "bikealma_document_20.06.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1310c84f-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742963, "uuid": "826e60d8-69e6-4696-b982-4ecc2cf6acc6", "comment": "Malware payload (Mirai)", "value": "fa3e8293352af82dad2c9891a6ded6b0", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742963, "uuid": "5bce4e4f-e5af-44cf-b1ec-705cbbf321e8", "comment": "Malware payload (Mirai)", "value": "18612f5778d0f3f7d63021249faa0d3edaea2d0a9e1dbebea504abdc3e1c1010", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742963, "uuid": "9901dac6-ef1e-4a65-a08f-958626d3c836", "comment": "Malware payload (Mirai)", "value": "dc5976e02c0eb58c623d0739fc0b7a275b369ed5", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742963, "uuid": "7f175d09-db3f-424c-81b8-96907f44226c", "comment": "Malware payload (Mirai)", "value": "8693eba3805709af64b497201b70368bdfed942c92e2941f552a37d711a366171d791d61895dfd57c890c5e70eb4a504", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742963, "uuid": "ff2552ba-2979-4558-945e-97d3776936fb", "value": "T15223F157755866D1CB727D39E07D840374162EB8D77BF02264EE2818FDB400B2E9BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742963, "uuid": "813adf70-eedb-4389-9cd9-aa50c1b56b20", "value": "768:PV/aHW5K7euylqr40QdqnQXuFWWcNGYjSSHo70Z+9XQj49xxv0aIRAC/UQrY9q3u:Pk25KzyErDQdqnJFFbcP4Rf9x50H7BLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742963, "uuid": "2b086693-44a5-4de6-abdc-07a694d5e625", "value": 48520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742963, "uuid": "844f9531-b12b-4ba7-a426-e2da7cb4ecc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742963, "uuid": "1f51592f-4d6c-4d3e-b446-40851cde243c", "value": "zz.arm6.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086eeb9e-f08a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655723617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723617, "uuid": "54a7c731-df92-4a70-8391-9ca37870f710", "comment": "Malware payload (AsyncRAT)", "value": "9ab123927ce671e63898114cd3dda771", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723617, "uuid": "5dde3d1f-c7f1-4c0d-bf83-5141e485abf0", "comment": "Malware payload (AsyncRAT)", "value": "18b908584ec934801fc1f739a6c9ed8928d31766108c5bc1c1141c4040a2d824", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723617, "uuid": "449027ec-7666-4bfd-a005-d027af4a0f5b", "comment": "Malware payload (AsyncRAT)", "value": "f0fe89c6a3b697375c16ed83fd7601f82bb9f933", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723617, "uuid": "ad92961b-3435-4f84-8fa1-de3390038c6f", "comment": "Malware payload (AsyncRAT)", "value": "88c796ab3102c5627d581c579d7458bf55700e0245038c177488aad0cbae252d9dcdfa691baaf4cd74fc202fe5b12535", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723617, "uuid": "51a7b14c-3c17-48cf-8b54-39aa61e3bdd1", "value": "T18FD42AE2B514C0A9FDBE2BF55467883011F72CBD84D1D20D7A9E3BA18BB2341059BA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723617, "uuid": "e30e199f-d339-405d-9a15-aae61acc74bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723617, "uuid": "6465c44d-d2f4-4411-9712-c52fc1d79730", "value": "6144:flixumRAkNC6G8882GhNiw/Du375H+xniixITs7NGDRQR2uWO44Ic8v/DwFA4Ltw:62iN1irpWiixITLN4h8vEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655723617, "uuid": "c82deaed-7781-4b59-9bd3-a329458763b2", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655723617, "uuid": "97358862-7756-4bff-a9c3-702848236c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723617, "uuid": "74f1b96b-ef85-4b03-abed-36f77c547550", "value": "Payment Proof Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9e0007-f0a4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655734949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734949, "uuid": "8459f0cd-bbd6-49ce-b2b2-bc934d497fc7", "comment": "Malware payload", "value": "396e2345cba88ef4e50162096d2957fd", "object_relation": "md5", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734949, "uuid": "065ba868-7d25-45fa-bd7e-749aad5a3f7e", "comment": "Malware payload", "value": "19c51bb1b78d4146d78f4b824ec17a781b13f8bd4bd1c9612b1776c7540f3cd0", "object_relation": "sha256", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734949, "uuid": "377f00cc-f90c-44ea-b3f8-fefc462dee73", "comment": "Malware payload", "value": "a067ef80e3dce8376e80d4b6e84d21095343b7a6", "object_relation": "sha1", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734949, "uuid": "fde856c7-283a-459b-bd4f-186b8b3b8b38", "comment": "Malware payload", "value": "77a6951e15b70e5895e4683b4d956c7af5545eca5c606d40fe217d6c9bbf8d1a5dfddc740e75d8a67d9755336463f8be", "object_relation": "sha3-384", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734949, "uuid": "aad53076-c17a-4d20-a76a-7a8c2aab66f6", "value": "T1CE82E143D6CDDCEDDC639F02039CA74A60FA1D18B159871072960068BDA7EE1E8ACEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734949, "uuid": "7fc2598c-2fcc-4fd6-96e5-01acb02e66cf", "value": "384:TuiUpyW4Jee4GPsyWqyff+FEboGhEVN4vjt2H1rNbgbcr8B59So:TuPCJaGPHy3+FUmVN4vpqg28d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734949, "uuid": "30f86b27-e911-4618-90cc-e14c7d2bbae6", "value": 18128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734949, "uuid": "db853b42-16d2-4b53-9b44-38bf3f6ba293", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734949, "uuid": "55bddfb7-145f-4c95-bbbe-fbc4e299b365", "value": "Dettagli-41993982.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2375864a-f08c-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655724522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724522, "uuid": "eadd7d45-2ffd-407e-ad18-577dcba12841", "comment": "Malware payload (SilentBuilder)", "value": "83587779081de3594a3918f4cc3ecda4", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724522, "uuid": "f743e3b3-d111-4dd8-a94d-03fd9c36e06f", "comment": "Malware payload (SilentBuilder)", "value": "19dc079522ee34597e17e76de94a3eb72ac27252e0beee03f0a81f29a1d5cc81", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724522, "uuid": "b23517e8-fb5e-426a-9e07-b2dfc46e2e7f", "comment": "Malware payload (SilentBuilder)", "value": "d3fa7041786c2c4e9c566c4b1263855ed05b91bd", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724522, "uuid": "c947862a-aaf4-44c5-8aa4-6480f229ec5a", "comment": "Malware payload (SilentBuilder)", "value": "0d66181c111c0a15f8d242c8e137c6a093f0c7b40b988cf4e067119d2c88c3560cd853f7d444068fe064a04873df5780", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724522, "uuid": "cc56c4f0-c589-4573-ac9e-626acc695938", "value": "T1A033D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724522, "uuid": "af02d23b-707e-4a4a-bfbe-baac23377ca8", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvK7:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655724522, "uuid": "862844c0-9618-453e-8d8d-6befef1e8b32", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655724522, "uuid": "a12e3fa1-28f2-4a5e-a079-d9033feafc19", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724522, "uuid": "e4b46224-2cef-4705-9089-c8f90e479612", "value": "Details-912889.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055a94c0-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655745087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745087, "uuid": "12005bb0-d4cd-4902-b7e4-d3cba57e2ed2", "comment": "Malware payload (Heodo)", "value": "df1b0e3b672963e9b74b543c19c11a3e", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745087, "uuid": "e08e5003-1faa-466d-b30f-4862b8497e5a", "comment": "Malware payload (Heodo)", "value": "1a90ac78b4f5da0035476a2748a765793788efd28802eebb0f31ba7617101c09", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745087, "uuid": "02b373b9-d2a3-40ee-ae7a-8840669358fa", "comment": "Malware payload (Heodo)", "value": "2cf71539999d9e77fcb8497c13165ae0bbe661ba", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745087, "uuid": "65b48f99-6e02-43c3-a3cf-69fed61b0c4d", "comment": "Malware payload (Heodo)", "value": "c973f192f634170ebb5a54d31a22577f195832323211e2840cf0f7e5118e372bf39720ce8d89103093c069564e0c4713", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745087, "uuid": "c873b214-92e5-45fd-b508-8e761d6a725f", "value": "T10A948BCD33D343A8F96FDA38C9274672F935FC094320660E03A76269EE2F355952961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745087, "uuid": "545d839e-e1cf-4f92-874f-da4439a695c7", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745087, "uuid": "7c41374d-ca01-478b-a855-fe731b7b05e8", "value": "6144:9B1DTNJh/8WsVr6ql3u/xSQEN3pFG7xScw/SLFpnU0ScKiEfzl:9vpyaA3WHxFNal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745087, "uuid": "db625909-babe-43e0-a2c1-7802bbd8fbdd", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745087, "uuid": "7d53ead3-6c84-4104-aefc-2e2cdeba952f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745087, "uuid": "46f2dc4f-e087-4d4c-ae2b-d8e457bbdb2c", "value": "sPp.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3f3cb8-f034-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655686930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686930, "uuid": "8d6a58c0-a07f-4043-8100-a8a9570a8674", "comment": "Malware payload (AgentTesla)", "value": "7e0b3830503128dc6a578d853023fdf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686930, "uuid": "22007a83-d5be-471e-834a-558cf64326d4", "comment": "Malware payload (AgentTesla)", "value": "1af39c75e494854e7be024c4aced0877ce692acffa51447d21af77c077486054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686930, "uuid": "7663c236-46d5-4303-b1fd-9fa6ba2fd839", "comment": "Malware payload (AgentTesla)", "value": "2fb5508eced1748bd8d0b4c31fa02437f48f29df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686930, "uuid": "5610aaef-89ea-4ae4-9d83-01c45be386e2", "comment": "Malware payload (AgentTesla)", "value": "480fa8dffd5b669e72f11ecc83ef61ff1b3f87de6d5e0508b6661b861f8be3ef2007edcd8b2a5276b03bff6e04d7542b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686930, "uuid": "4f8c6c9f-1199-4cb9-bb42-9eb80c7e1c1a", "value": "T10F155B0367981F26E1BDF33621B5440A43F5F5E31692CF9F2E914ACC26E2A815F62727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686930, "uuid": "144b53ce-818a-44a7-9525-9ca1d3f095a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686930, "uuid": "8f3a5585-d336-4be7-9055-3cb291e098c7", "value": "12288:ly21vHbJEw9x3uo6GuzAvMEDuJOPsXr/yRzMuo0OImb3kc0O99pSG4gz12w3RyaM:lbnYSgJg8DyxH/iGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655686930, "uuid": "acb83c1c-7ed8-4984-845d-24f5adbf43c7", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655686930, "uuid": "a5a62ac8-844f-453c-bab1-aa263a400629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686930, "uuid": "4e3e4c41-6aac-4470-9fa4-928465949a7a", "value": "Claim Reference No MAR048780314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42993744-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1655721997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721997, "uuid": "a6978135-efb2-4992-bebe-b64cee688fa2", "comment": "Malware payload (CobaltStrike)", "value": "d8b8d437fea749651f647133013c2e58", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721997, "uuid": "b516e755-eb9f-442d-b668-972228fda0fe", "comment": "Malware payload (CobaltStrike)", "value": "1b779efc0b5b86952f7ff7ee3d6fd72c1a7b941f5a55641c72ca7dbd18f250ae", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721997, "uuid": "e7e6694d-6ff5-4264-81c5-e26f628f013e", "comment": "Malware payload (CobaltStrike)", "value": "63679e5724a59622c4d2727c6d5feb86169db598", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721997, "uuid": "b77f9e6d-f740-4f5d-8870-f059aa65eb7b", "comment": "Malware payload (CobaltStrike)", "value": "4b1efb7a6966b656cb9cf2ad71d0ce95c86ae66700e702e815c17c4a7963d88be37921253186d6fe886d8963146d79e2", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721997, "uuid": "6fa53fe3-c436-453e-a409-3480e5cc23a8", "value": "T183746B473F5869ADD211F126E62AB0C235E0B62F94A98AD4B7F1D0F518F816138F43E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721997, "uuid": "8a93c9c2-f291-4e99-825a-f652a0044bd4", "value": "6144:vXCjcs0TZ7zWPmqSAwCD7MLe16NIEH4JkGNtxWdiEZGZEZR6lzntSgDXe:vXC4s0ZvWrfwLe1bzJvtkQEZ5Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655721997, "uuid": "3a4d1473-e00f-403c-8b46-41d3b0c13ca9", "value": 353291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655721997, "uuid": "70fa5324-30bc-4d5a-9f09-1b7edb4d17f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721997, "uuid": "373b4d95-9ffa-4951-9694-5a451fc580f5", "value": "cobaltstrike.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce053be3-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655745424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745424, "uuid": "f9f62def-42b7-4aab-950f-2b1cf40b4048", "comment": "Malware payload (AsyncRAT)", "value": "1cf021f46f41be6100a8be0f95a6ecf2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745424, "uuid": "9331d144-4a1d-48a5-94f4-8a44ebafdd4f", "comment": "Malware payload (AsyncRAT)", "value": "1bbc12bcad8f98a555d42b478b62f24a6df2f40cf1595c286b77f13c57a02fef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745424, "uuid": "dca14194-2b89-4c49-9be4-7997e0439c0c", "comment": "Malware payload (AsyncRAT)", "value": "2c221ef43855fcb4dd15ca87d0123c775eddd668", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745424, "uuid": "bc15b18c-dc63-44ee-897e-8ba83d6fcaaf", "comment": "Malware payload (AsyncRAT)", "value": "f70a5a1bedfbe322c305e4deb3cacc0a0ec397244170e9a5270016560b446f86b1870ab1cdaae92496afac6a17eab931", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745424, "uuid": "ac087a46-c224-4e47-930a-261d90be341f", "value": "T1CA231B003BE9827BF2BE5FB4A8F26105467AF5633A03D94D1CC441DB1613BC69A52AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745424, "uuid": "cd2cfa7d-1829-47e5-b822-36443cb3ec22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745424, "uuid": "81f4541e-b91f-4cf0-a76c-c00c995b0716", "value": "768:SuAHPTgoRzbWUnd9rmo2qrXY+2DFfWiwjbdgX3ixUH7hefRXe0LJ6KcDZnf+:SuAHPTgG/2x9Ii4bKXSmsfRendnf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745424, "uuid": "b812e58a-2ef2-4ef9-90d4-efbf175a8cc7", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745424, "uuid": "3fe8c96d-3ad1-46ff-9216-17095cb78b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745424, "uuid": "57822651-7d9e-4f93-b8a0-d6939396c1f7", "value": "STOMACHEE.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c5846f-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "b30eaee9-9919-432e-9447-b5ee8bce16fd", "comment": "Malware payload (Mirai)", "value": "9934fde043641c17e2c227fbdc67e2e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "37c1d27b-ccd0-4c17-b0a1-1fd66c60f3ea", "comment": "Malware payload (Mirai)", "value": "1c8738d2033fce3bd78d26555025b6f6ec96195ef77a76e0b50f05a04ad18310", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "e2aeaf8c-1475-469d-b285-59af00dc4636", "comment": "Malware payload (Mirai)", "value": "8b7be4a754029b924fbb8a8ccca42c234bff5a0a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "60f025a4-9357-408b-a6da-48102ebd7e6a", "comment": "Malware payload (Mirai)", "value": "066766bc6d89c79a5542c7c6d8b1f948d6063597e6f6f0e0138ddc38b3bb45df76edc2c7bd6d1983443a8bbc01ac31d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "affc8f23-d5dc-479b-957c-13311ffab9a3", "value": "T12603F150D123BAB01F701E33D4598130E7DA6BFCE0DB7399235AD3748AE562A1A7D488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "e59ff106-21f7-436e-9e43-b124f7e48976", "value": "768:6aoM9zdlBnlNvG+GCvDZDYgu86yfC7jit0OQdXawbhzDpaUt3Up:6LczvBnLGbC9UlEC7Gt7Ea80h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761806, "uuid": "674a88ab-ff5e-4065-b52d-ef27642c51b1", "value": 41056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761806, "uuid": "ab1ff494-24d4-45ee-9137-c7166fc0ba57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "20330dd8-ebeb-47f0-8b5a-331abf2d9bbc", "value": "ZG9zarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c33c7a-f0ae-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655739102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739102, "uuid": "7beb0968-f49d-4328-9c7a-30b3a8bd7231", "comment": "Malware payload (AgentTesla)", "value": "9bc68ed4218d99cab22fb897b07b597b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739102, "uuid": "a565d4b4-1aad-4926-bbc2-da2341c93682", "comment": "Malware payload (AgentTesla)", "value": "1cfd60d4d7ce4e4dfdc8f467c735c33d0aefd83281cf62a38f36b0946c88ff91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739102, "uuid": "26692526-8a68-45aa-8aba-fb84b8eca792", "comment": "Malware payload (AgentTesla)", "value": "afd7323f3a49ed71f91f754cedac3a43085d30ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739102, "uuid": "2a12eff6-da5d-4242-b000-f37158ae0cd8", "comment": "Malware payload (AgentTesla)", "value": "58bb9648c2c4e32912915a1a897a8cfe6b5cc63b00c34777eb1fbabe972c777e69f014cccf024c09d8c50f224bb05746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739102, "uuid": "2f253c9d-5831-4458-b02c-9c5654c2f607", "value": "T108A423182AFEDB46D57BDFFC94D340906BF2513A9683F6049EC161E924E2F508A90F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739102, "uuid": "6963cf0a-2818-462e-86c4-1a77d14468f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739102, "uuid": "0e21390f-e604-4d69-a016-8bccc1d462aa", "value": "6144:VZ07wzpV+3yevHMqZgQYJJFHYUIGMyYX7F+Wmi1DehY9BgTONzoUGkIdlVBuInz:91V8y4sggQYnFtIfyYXx+pWeeLu3TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655739102, "uuid": "b705faaa-59e9-45e7-82fc-6b9d5d138222", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655739102, "uuid": "bb63ff74-1e28-4a9d-b712-c35f28e6fd8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739102, "uuid": "d4a7485d-2525-48e2-ad2b-232d3a169165", "value": "processmax.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9aefde5-f080-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655719674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719674, "uuid": "fd071fd2-46f5-44bc-bfdc-c1e0aef09eb4", "comment": "Malware payload (GuLoader)", "value": "81cfa7c91e41e2104e053fcc708f5d89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719674, "uuid": "7531fbf7-9869-4643-ac7a-512a76234ba7", "comment": "Malware payload (GuLoader)", "value": "1d9b3766643a2c2c96c204c41c58e58dff83a066027419d614043a5db490a7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719674, "uuid": "e65253a4-7e1a-424a-87b3-22d69cc9a424", "comment": "Malware payload (GuLoader)", "value": "459aea0667adfe2d723deecc2f0df9cbe48a6bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719674, "uuid": "a48426ee-5fa7-45d8-aa70-57661b4144a3", "comment": "Malware payload (GuLoader)", "value": "f46460179fc6bc86fde2c4d0cbdd91b6c7f79d72a97302b3fd607a3404807fc91e168d104737c699ac1f9c4488c8bba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719674, "uuid": "a9de687f-433a-45c2-b6ca-6932a7e8c3ed", "value": "T1AC24D02137A8D817CC6A0A7245BAD37526B0EE052584E50732E03F6BBC376F5950B7EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719674, "uuid": "dd192f3a-9246-49c2-b015-3184a1e478ec", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719674, "uuid": "8a35c61c-cc57-46d0-bdd6-929392922b30", "value": "3072:+fY/TU9fE9PEtujEZasvlx+LBEFxAVLSaVVglbnxK2cat2rb8/Ep24nSCg5:oYa6nsvlxsB+yV9+xTcTnpc35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655719674, "uuid": "298d0d46-4654-4de1-9378-afd2424bfd81", "value": 224978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655719674, "uuid": "640b13bc-37a3-44ab-8386-99f573463d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719674, "uuid": "427c457b-2e2f-4d76-9103-9a2349d33d87", "value": "Dekont1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a7fa7c-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742719, "uuid": "0ebee4db-74d9-4f2c-ac34-458a5592d462", "comment": "Malware payload (Mirai)", "value": "0c160a0d65b8a81392a47bf80dc17f6e", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742719, "uuid": "571f4c09-f495-4102-86f1-6246932b5bb9", "comment": "Malware payload (Mirai)", "value": "1e75ecae21024a7f8cd1ad1fee1c5615555aeffbd67179cf57f648668bf26735", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742719, "uuid": "58f27798-4729-44cd-a8e7-e339ccc3b32b", "comment": "Malware payload (Mirai)", "value": "4c4c02388fa465451d6367b423b9128a40c39f30", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742719, "uuid": "83cd7ed4-aeed-446b-9f96-b8723c46e3b4", "comment": "Malware payload (Mirai)", "value": "d2779caa8284c7851b39ccea75e5b7c2fb1f4f5850309d3303379c59ce3dbe445cbe3a55f0b2d213684eb8e3835df663", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742719, "uuid": "c928b5be-d183-449f-9201-f85f58374de2", "value": "T1B32301104019F719C86000B2EB1DCB272B1BA17866FB39FE395C0A7CE6E7459F176687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742719, "uuid": "aceed8a0-c3af-4313-aa8a-0803bf4dcc5e", "value": "768:+3mNYN5dazDuOTSTsIyxNlqf3br+54RqAVHMs3Uoz3BE1neQ:AbN3otI/CIrz21F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742719, "uuid": "9fff5d07-2927-483b-adc5-aff7e364f37a", "value": 46472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742719, "uuid": "cd23fa10-9679-45c2-adb2-3d89d93853ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742719, "uuid": "cb443fb2-dfdc-474f-9fb0-1aeca3ba3019", "value": "KFS.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac46ad85-f049-11ec-93bb-42010a9c0043", "comment": "Malware payload (a310Logger)", "timestamp": 1655695975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695975, "uuid": "b6a3689e-51d5-4d95-98de-1fc56104be09", "comment": "Malware payload (a310Logger)", "value": "fa6573bca6fe84d8ab8761a824451ebe", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695975, "uuid": "e6a35ba6-e444-4964-8286-86d449ff3a40", "comment": "Malware payload (a310Logger)", "value": "1e76e9fcd780bb0cad1d97965e44fdeb4cbc03169761642fa17f8cbb8e18ad7b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695975, "uuid": "14e1aa7d-6455-4988-8b71-82b9787d3243", "comment": "Malware payload (a310Logger)", "value": "15f41f4026258b0d75790cc7112b20e6aaa5a1fd", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695975, "uuid": "f86bcb5a-faaa-42a3-8c6d-7ff4b1123af4", "comment": "Malware payload (a310Logger)", "value": "5856c59f62a1ca79beed2d110e7ce03a98f44ec6ede80dc7aac7396ea43d580c8c43a248fe6033f0e68e7d67ba9c496e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695975, "uuid": "258238bc-499c-40cc-9e8b-080b5596f8c7", "value": "T1E214ABF36BD8C8DEDB586234F3421E1703516DEC68D6A63C1FDE7A29C630A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695975, "uuid": "ce0e82cb-446f-4339-92c1-bf447c1ff80c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695975, "uuid": "d87b606b-6b78-40ce-a2ad-2762c2b77e76", "value": "768:+nRDNyC42dhp6kELfMaCChd7ntnR+iEiiiX8n8nsMGGTdjt+++Gvx/bb2exNEzAZ:+RDNn42XuSdwlOVhhJRYXswGjVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655695975, "uuid": "e3209686-2da0-488e-8587-23e4501ac124", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655695975, "uuid": "96399a6c-65ae-446c-b093-37bbcbb9a036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695975, "uuid": "4d92eb1e-109c-494d-8229-2c64db0f9747", "value": "SecuriteInfo.com.Variant.Strictor.273382.3027.17271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee4d5af-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742956, "uuid": "b4f03d93-ad71-45d8-814c-6d75e4d3e6a8", "comment": "Malware payload (Mirai)", "value": "2fa3b0c04b58c2e033ea85ba72112363", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742956, "uuid": "51daa48c-59ba-4768-90b7-85fd43bae5cc", "comment": "Malware payload (Mirai)", "value": "1e888cab0f00feef0f0680e6cec4ceca9635cb57bdd7305bef05d6c7eeec7628", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742956, "uuid": "869fa5fc-6c80-432c-ae15-63180132b1d3", "comment": "Malware payload (Mirai)", "value": "db5e39d233384eb43e4d3c3c36b012fb9050b934", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742956, "uuid": "a6c01979-02d7-4516-9761-44101f8ac66c", "comment": "Malware payload (Mirai)", "value": "ed341012f53a540872c8569459663f9d37811e40ccbb1e8153ed2b4d91fc5b2a8e2b7e73a7783fbb223e5de92ecabf73", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742956, "uuid": "cf1dcbcd-a424-43c3-bbbd-cfefcea6a00a", "value": "T1AAD2D0640014FDE3DB711D75EA2C9B8227DFAFE8D1360352261983348EEE00B66B1F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742956, "uuid": "8b5a6d0c-7061-44a0-a096-cec23ee30d72", "value": "768:oOuZIEPEtT8rBEfxnW6x+0+eko9jp+6As3UozAi:o3PEN81EfxnW6x+0oGjFzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742956, "uuid": "a9582085-1cde-4801-8f65-0d8b548f0e8c", "value": 28904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742956, "uuid": "c850e98b-1e3c-4a9d-a479-69f996f35ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742956, "uuid": "234ce7ea-f4ea-4da0-bc90-cbb15c5c6b64", "value": "zz.arm5.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cf690a-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655716340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716340, "uuid": "034aee9e-ce7a-413a-bd49-8fc13ce917ad", "comment": "Malware payload (NanoCore)", "value": "91ec404f7dfe5fd8f2ea2de282c3f310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716340, "uuid": "cab90021-132b-4b67-af97-af90c985c6ce", "comment": "Malware payload (NanoCore)", "value": "1ef109a6ba2603ffca6505d6ab80a79b69b18b772b72d2fddfa90e05e86eb60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716340, "uuid": "cb03d8d6-2a16-43fe-8ab7-f0c73ecccdc0", "comment": "Malware payload (NanoCore)", "value": "0a43d38460dc791577817f65160744af0c13942b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716340, "uuid": "b54ed729-dcd8-4d41-80a9-12abb98493cd", "comment": "Malware payload (NanoCore)", "value": "737948806cbdbf0427099606b1e255a5b009723960cb47fa3d8457c2a7e053732f09e8ee8c5e1e7d12e378b626746f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716340, "uuid": "881e3707-4a7a-40e6-8469-a9cfe5391779", "value": "T14E54BE82774AD5DBE0E21A361833D3A95662AC005E51DA0F2B8E3F5F2E33FD16E15781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716340, "uuid": "76e452b5-5901-44f8-995c-428af3a09e98", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716340, "uuid": "c5df67ac-986c-4f0c-b1d0-0cffe366ee01", "value": "6144:RbE/HUq4Rbmx0KG1IKbGk+Q5S7aqgtwTrwTc8QBq0W:RbuLx0l3/ZKTawTrqSAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716340, "uuid": "249befbd-9fe5-4b4f-b67c-63db9c0d34eb", "value": 291150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716340, "uuid": "190f244f-43e6-47cd-a265-ff46f1ecb768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716340, "uuid": "6a49decb-e7a5-4994-b161-7139b72cfa9d", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38c08f5-f059-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1655702859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702859, "uuid": "fcd2270e-0a83-47e8-87b3-e6c3ebb2aab0", "comment": "Malware payload (Smoke Loader)", "value": "4e8e39bac82e4fdbc2b3f9b9fa25f50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702859, "uuid": "df5119e6-2c6e-4a06-9e49-d7ad5c3ec4d6", "comment": "Malware payload (Smoke Loader)", "value": "1f747d15764dd7610b18123374df7b519fe5d5ce2ca2d5124c21bb2eb13d9b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702859, "uuid": "b807bf2e-3875-40ea-8ff1-0e39960470cf", "comment": "Malware payload (Smoke Loader)", "value": "c3758f940c241df36464d13d1357b4be588af3cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702859, "uuid": "72f994c8-631b-40c3-9c1a-8c73abeb6a45", "comment": "Malware payload (Smoke Loader)", "value": "eed48dbeaf6b5f062fd62585d21cd74dbc87d461a18c590e18d5dae8f5655a4ae23935d038244c9744a39883c71592bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702859, "uuid": "05bbb07c-8998-49d8-add7-3fe6034764bb", "value": "T1327403EA313B451EF0E1AAFCA491504C05A6891D6C5EA5AD4982A171E4FEF8C4F0FF73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702859, "uuid": "a9ab44cf-c214-4f52-a696-370ecfbc8df7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702859, "uuid": "84db85d1-8b88-41da-903d-57ce582efbf5", "value": "6144:HaawPsHpqFoj2RDj+eW2PvrDKx0Q/EsbNUr2jx8DGXgqS:HaFypqFzW2HrDKxvJjxtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655702859, "uuid": "32b86747-d0f6-4159-b031-52b93fa2ae82", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655702859, "uuid": "56d887f0-d6de-4198-b7d1-057ed93c0c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702859, "uuid": "768bde35-bd40-47b2-98f9-76611d187589", "value": "Incoming_transactions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f36f9a-f060-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655705786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705786, "uuid": "18ea96f9-b6f8-4bc1-80dd-411dd4b5ebfd", "comment": "Malware payload", "value": "783f850d06c9f1286eb9b1bda0af0bce", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705786, "uuid": "5b1feeb6-15db-448c-ac97-3b6694b793e8", "comment": "Malware payload", "value": "211a1f74eea68ebe7178d90f0df0446a87cdda865145c397b7a32e253086139e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705786, "uuid": "b288cbec-05c4-43a7-93e1-8bfa051d3b67", "comment": "Malware payload", "value": "08011884c9bed126b4cfbadad4a4be5063805230", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705786, "uuid": "9cb3aa57-33db-4520-b52f-fdeef9b46c56", "comment": "Malware payload", "value": "1daa1311db2240120fbdc95a31879c584e548915f4d1248ece4fdfc7ae39c18f3829ecc030aca6f27ed1fe649ee9d5d8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705786, "uuid": "fe2b1929-003b-490b-b1b6-881771f2f929", "value": "T11D428D33C7074835D0ABBAB870D95483EA75CD45E9D2A09F3A94E2D04CE26EB1B0778D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705786, "uuid": "01d0eb1e-b722-40a6-bda0-9e43bde60b06", "value": "384:Fkv41E49wKxhpp+gX6eILI7RMobB/P/sQGwZRB98PG0S:evyE4aWfKetlV9PDXgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655705786, "uuid": "cc3fa285-cd0b-47f1-94f9-b023d475784b", "value": 12519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655705786, "uuid": "6ed4119b-80d8-4c10-af58-f961c3759657", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705786, "uuid": "2ff1ed65-8b35-432d-a4c5-9c8fbc1ef9f7", "value": "211a1f74eea68ebe7178d90f0df0446a87cdda865145c397b7a32e253086139e.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ef9103-f0f2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655768524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768524, "uuid": "e7ed00fc-bf7c-42dc-9752-d469acc73271", "comment": "Malware payload", "value": "6543d00f2887e56f295f4f65511a5d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768524, "uuid": "748dcf32-37b5-4900-a972-103ed308af0d", "comment": "Malware payload", "value": "21ac35763c63f7a9e25e54d70935bda158822c60f1dea84b8dae41014f6188bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768524, "uuid": "5a3b2223-b458-4288-89a0-34fe08eb1b5a", "comment": "Malware payload", "value": "ce460086b7ac002cf0c3e445ad67db8d9b05184d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768524, "uuid": "6a368e14-2353-43a5-82c8-6ed330a9481c", "comment": "Malware payload", "value": "ce70d45999ddb5a9b582232e01312a72f831146112c99be7d7f2482ee2fe4240f0c3be14843d766bb3d77445eecf68cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768524, "uuid": "65192b00-916e-4174-a2da-17949344f0e5", "value": "T1455438102B2ECF9AD1DC1374DF61A203AAFA9F0527036777546CBF56386AAC123C59E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768524, "uuid": "b9fb307b-e330-4b8b-8f87-ae145f61cf5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768524, "uuid": "8c3a23a7-6177-48a9-a7d6-168e0cecc022", "value": "6144:b0EgOxA6X/TTzPnS9H5EoTzBXaDabwvDNlS:QOxAQbT7SPz1aD6YJlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655768524, "uuid": "45e21b81-2a2f-435b-b9eb-ef3b0956618b", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655768524, "uuid": "5974b2e4-6d30-49f5-bd77-9e9e8d3f2808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768524, "uuid": "ad8067a8-2983-4b57-be96-a3b3c71605fd", "value": "SecuriteInfo.com.W32.AIDetectNet.01.4738.21473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8821d02-f0c0-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655747186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747186, "uuid": "1b391571-ebc3-45f9-b0f1-357938362ab5", "comment": "Malware payload (DarkComet)", "value": "949573ea355757e37f217798fd335478", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747186, "uuid": "6ea26af6-3205-4547-9dff-3cb96d7b093f", "comment": "Malware payload (DarkComet)", "value": "222e2ddd2cd5cb4156b9d1845c833d644d8a62d367004a271f6ec290a8aa2fb3", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747186, "uuid": "40403c7e-9b03-4b3e-8f37-65cb6a1b4a8b", "comment": "Malware payload (DarkComet)", "value": "ba103d18dd84409cd2cba837ae64d42ec75613e7", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747186, "uuid": "642faa65-0de9-4081-9eff-9251accd3a4c", "comment": "Malware payload (DarkComet)", "value": "42bd146a6b3c9c46bb23ccdd4e79afe69cd567db849f4b84dbdc1d2a7d31afde757d1592f6be9d30d727139a7bd96012", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747186, "uuid": "450065e0-f824-4f49-9570-5de0f5b4e325", "value": "T1A5E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747186, "uuid": "f77264a2-7b22-4d76-841e-83e26d9ce8b2", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747186, "uuid": "eb6950ec-7a4d-4540-8454-134547ce221c", "value": "12288:29HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ha:SZ1xuVVjfFoynPaVBUR8f+kN10EBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747186, "uuid": "11bd8584-fc72-4577-bc20-d77579038acb", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747186, "uuid": "8bf8e476-3dd7-4bfd-9abf-9966c9d43bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747186, "uuid": "633aea1c-37b4-446e-8877-b1aee576fd43", "value": "ZulaHax.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212c3549-f038-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655688440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688440, "uuid": "aafc0cc6-1c32-4bd5-a6f3-7f0c53377a66", "comment": "Malware payload (RedLineStealer)", "value": "7b8ad57019805469fa7656395b25a4f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688440, "uuid": "39d9f397-e66d-4019-aaef-6b8ebbcb69c2", "comment": "Malware payload (RedLineStealer)", "value": "22696addf1f91983f1e91b07c907775c2b37b438eccdc615b3dfbf6e0d733963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688440, "uuid": "971573f0-ef2c-4c13-b36b-cb4cf5a4a4c1", "comment": "Malware payload (RedLineStealer)", "value": "75e4e87979472022e95a369b059934293153fb6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688440, "uuid": "24b93610-a1db-4257-8d9b-8b13014460c1", "comment": "Malware payload (RedLineStealer)", "value": "92279551babf97259098f72e40f6d077d7e7013c72666d4fdedc6a724d6140bfe50d6273748aaa23226d366fb8c27537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688440, "uuid": "c7f413d5-4f1d-45bf-b191-fe5f8ea0233f", "value": "T11E856B5143F8CB22E29F97779C6608969776E007C096AB5D6F8DF8F12822784FD86703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688440, "uuid": "f42afbba-7762-4d5d-b204-058a203fbd36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688440, "uuid": "74f2e721-21c7-4ab0-83ee-a63a581d12bc", "value": "49152:0bdC0Urc6CrG275oBY0VZBbR8Bd0SXZHJALbEosGtKPhb8C3DBM2Vx31CE2w4zxO:z275oaB+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655688440, "uuid": "4fe055e2-3c01-41c0-a91c-b134627c45c0", "value": 1708544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655688440, "uuid": "d9166cd9-6d1e-441f-a5f0-1b26ece29b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688440, "uuid": "b3bfc469-d4f2-4d5c-bb86-f561a39df350", "value": "7b8ad57019805469fa7656395b25a4f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62947b4a-f084-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655721192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721192, "uuid": "c88823ef-7fc7-4fc6-9f82-dc949ff41419", "comment": "Malware payload (Formbook)", "value": "4802026a214aae2fb9c737de69d5c0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721192, "uuid": "d4c62897-3999-4e23-924c-101fa3fedbb6", "comment": "Malware payload (Formbook)", "value": "22819b7abbce8a721dc8771b60aef43ba1cf9e0ed986b619675dda36dfa53b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721192, "uuid": "5322cc73-39e3-4703-8c16-749fc2628c55", "comment": "Malware payload (Formbook)", "value": "a9874f483343647e5d86309f012b2bc85fb045c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721192, "uuid": "d1079f89-14c8-4998-ab88-31326a4fac9d", "comment": "Malware payload (Formbook)", "value": "9bc310f3e441f1403dac13175dfac5898efe9a055d951bad110269c06d749e983b5b3a9985c63882f4f43c64908c5613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721192, "uuid": "92887a33-ce92-434f-8a6d-38866e00e192", "value": "T1588254EA53444233FFEA6633C4D211E0A31BC2895B738F4526A5652B0B6FB847787367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721192, "uuid": "8df5afd3-7ebc-443f-ab72-11dbbdc2b59b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721192, "uuid": "e791a035-2683-4537-976f-1bb6896d389d", "value": "384:1lh+xZRiDd5dU0YSEt/f8ELHFDPM20req+KiJL2wi:vYxZRYtJm/tHCOiG9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655721192, "uuid": "8aca2fda-bf47-4ca0-b26d-02d4168e6fec", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655721192, "uuid": "7be2a4e4-67bf-46ca-9b87-08941564b238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721192, "uuid": "0e4a863d-93a8-4210-a043-beb5fc14913f", "value": "SecuriteInfo.com.W32.AIDetectNet.01.16626.29400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae6d9b1-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655734091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734091, "uuid": "dadaba48-94cb-409f-b99a-46128974a0fa", "comment": "Malware payload (Loki)", "value": "284ccecba26fdbed97b96e3ec7af5312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734091, "uuid": "8d431758-db11-4efa-82d5-d778ce5437b9", "comment": "Malware payload (Loki)", "value": "229d9cac3c110add80a7cc2480e366e396867f52df48497aaacab2e345f73f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734091, "uuid": "5d16543a-a6c3-4614-ae0d-d08ee4b18522", "comment": "Malware payload (Loki)", "value": "a739f4dec926173c6289ea9af6333b935d5f8edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734091, "uuid": "e029214d-40ae-4fe6-be16-51ca5247b050", "comment": "Malware payload (Loki)", "value": "ea28e4fdb10bd640442a34567afc2dd84c4f56b1458f3956d9338a672002c25b5d232709e79ebcde018546dd93ce09d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734091, "uuid": "ae16fc21-f0cf-44ca-b1b7-1a37ecb525c5", "value": "T1368412467B7AC362D23BF7F986AB5052E7F181265063FBC8CD8120EA0CB9F918595713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734091, "uuid": "b20e59f5-6cba-4f88-8557-1160af70b316", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734091, "uuid": "a2bc200f-7fbd-4021-ba83-c3b2b1341afd", "value": "6144:ZVl/GwXCndY4zIrpPwILf57vfwnY8zN3IZDCSLPemRwinRrOM+:XSnpzIicbwY8zN3kCSLvDFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734091, "uuid": "444c1be4-0d8b-4904-94f1-df7d285f21fe", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734091, "uuid": "9863ab4b-4184-4a8b-955f-dcd48138b09f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734091, "uuid": "0462ad37-c90d-4518-b14d-3bd1beac020d", "value": "284ccecba26fdbed97b96e3ec7af5312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d984a93-f0d3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655755006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755006, "uuid": "caa94fad-411c-4132-8671-adf5bcd89419", "comment": "Malware payload", "value": "d3bddb5de864afd7e4f5e56027f4e5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755006, "uuid": "1111c424-8e01-4b22-861c-05149f83dc68", "comment": "Malware payload", "value": "2318ae5d7c23bf186b88abecf892e23ce199381b22c8eb216ad1616ee8877933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755006, "uuid": "c3a8562a-c71c-4fdd-88cf-c6da2c555189", "comment": "Malware payload", "value": "ebb0e34f44089fd4cc750b5fe0dcc14f6bb85a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755006, "uuid": "cbcd4db6-00ba-4818-9f76-46a1175d8570", "comment": "Malware payload", "value": "741996e481c8df891c18225823cab4f17654287795113c15ab029e66d657690531d5435141871e040492389fce6896e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655755006, "uuid": "27348197-9014-4e06-9fc7-9af7fe6452fd", "value": "T1CC46332857E6168AFA721D782471A05189F97B55EC31CB8CF3C2320ECB6790ADB36D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655755006, "uuid": "a226acce-89b2-4e26-a2d4-83bf67d2f0af", "value": "98304:TtClVkoOSfJNp8FUcwti78OqJ7TPBLYVrsk9N8ivyhAdsPSQx3UGgdN:TlobhH8FUcwti7TQlgVN8iNIShN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655755006, "uuid": "fb08ab2b-e0d9-4a73-903c-121a90219012", "value": 5433824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655755006, "uuid": "d0d991c2-da67-42e3-ab0c-7cf5169c6ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655755006, "uuid": "40bac64f-b94d-4b01-929b-4790bec74820", "value": "docx.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0a620c-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655715946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715946, "uuid": "7b750d90-4e2b-4b59-9e00-b830867bf785", "comment": "Malware payload (AgentTesla)", "value": "02f720553c47b8ef1339633b46938c0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715946, "uuid": "8ce545ec-4228-4fa0-9d6c-7d116a1acccd", "comment": "Malware payload (AgentTesla)", "value": "2420d12497ff960adee4da998ddba3d2055da891931943ab065e3c543a0fd042", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715946, "uuid": "7621efb4-8b3a-455c-a49a-b611ebce27da", "comment": "Malware payload (AgentTesla)", "value": "128454e7efd6ccad08fc536e35ee0f097994ad68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715946, "uuid": "0c4ffb1d-b090-4847-b25d-6eedb8541c31", "comment": "Malware payload (AgentTesla)", "value": "169b6eeff3ea857009028388f5ba61ef86d5d4e957f9962bbe217ef7fc30a494620633de811aba0e1547237a28ce1fe4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715946, "uuid": "b08b1e91-3dad-4f6b-a94e-c23169fb8030", "value": "T13F349D4376009BF9C9A64F32F52FC59023709DEF5711472B33DAB7256CBA39B892A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715946, "uuid": "a70d704a-7bac-4355-88d8-4b19a5337dea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715946, "uuid": "07b6c764-8bd1-4827-a567-8b6ca6933984", "value": "3072:rkmlIH7BE8BSBbmU4Xc3dYHB9UTi97r3TbEpWRd0wrhoqV1aVPAAj6m5CH5SF53u:gUIR6xkcNYh2TiRfEgRdrVqAzvHG4zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715946, "uuid": "659112ae-808a-4cdb-8893-e0049fb6050a", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715946, "uuid": "741d6faf-ff43-4b10-af49-ccfca6c78c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715946, "uuid": "42bc5ac8-aeee-4950-8390-574830198f8a", "value": "02f720553c47b8ef1339633b46938c0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ad743f-f0c4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655748519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748519, "uuid": "fbea52bd-0792-461b-bc76-d82c3e8365aa", "comment": "Malware payload", "value": "9e73f48bddf4e021a9585a33cef182c8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bomb", "colour": "#8404FE", "exportable": true, "hide_tag": false }, { "name": "bomber", "colour": "#B04758", "exportable": true, "hide_tag": false }, { "name": "cmdbomb", "colour": "#0AF7F0", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748519, "uuid": "8ec7952c-4553-46a0-aef3-28dbdf630c09", "comment": "Malware payload", "value": "243e0afec71d78720ed5e6e95a2e2bea4bf20287cc79f60daf86c8ebdf4232c6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bomb", "colour": "#8404FE", "exportable": true, "hide_tag": false }, { "name": "bomber", "colour": "#B04758", "exportable": true, "hide_tag": false }, { "name": "cmdbomb", "colour": "#0AF7F0", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748519, "uuid": "56393fd6-fe24-4919-ba2d-ba7c6d1b02da", "comment": "Malware payload", "value": "f89e2560cb5505148b1e335702da9ee72c9c203f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bomb", "colour": "#8404FE", "exportable": true, "hide_tag": false }, { "name": "bomber", "colour": "#B04758", "exportable": true, "hide_tag": false }, { "name": "cmdbomb", "colour": "#0AF7F0", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748519, "uuid": "b853e552-a471-4ad2-953c-a8b876be8526", "comment": "Malware payload", "value": "6c3a433afc8ebfa6dae4fdebb36df505a243f1c2f59ffbdd85ae5b02eb91718cfa17fdcbd8c1893484443120e6b746e1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bomb", "colour": "#8404FE", "exportable": true, "hide_tag": false }, { "name": "bomber", "colour": "#B04758", "exportable": true, "hide_tag": false }, { "name": "cmdbomb", "colour": "#0AF7F0", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748519, "uuid": "2185972b-70ef-4c7e-bf4f-845872289cdf", "value": "T13B90024007021C55FF618D055520E905670B460B90CC761194109C482E2BC5019C1901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748519, "uuid": "e8149232-f21f-46a7-ad26-e3a4cb441141", "value": "3:P3HeRsWYHqYYssYAHz3neRV:P3HeRsWvY81jneRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655748519, "uuid": "cfed013f-936f-4c64-9063-7d8efd670de7", "value": 56, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655748519, "uuid": "5d74e4f5-12ae-48c4-aeed-054deb0b70c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748519, "uuid": "a55ea9fd-19bf-4a25-a3b9-dd72b7805562", "value": "OVERFLOW.bat.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87677d90-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655704503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704503, "uuid": "d87d1a27-40a5-482c-9fac-9f5c7d61ff3e", "comment": "Malware payload (AgentTesla)", "value": "db51435d3c5f384f2609d2dd7dc08efc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704503, "uuid": "b3f9a2b3-8a64-4063-9cd2-faaad276a19b", "comment": "Malware payload (AgentTesla)", "value": "246632ca09725b8011aa130eef5a9d3b7c311e11ca99374a6c26c31776150b06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704503, "uuid": "9d337a9f-f9c4-4fe7-ab4e-3f90542f4ee9", "comment": "Malware payload (AgentTesla)", "value": "cb32cb32ee55572572a157e24afbfc88541285e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704503, "uuid": "4d732743-a07e-4cf1-a86f-00ec3a8cc21d", "comment": "Malware payload (AgentTesla)", "value": "b3bbeb2e0386382354ff06bcbd3e45ba3a5b7e063278bd5d7a15f8d5b1c9ae572f7f254e201b91ae7226e46f34b8f7ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704503, "uuid": "baed0abd-ef9a-47c6-b5ac-a9fa00531171", "value": "T1C3A4F1103AAC7800D99BCF7591A1C5588136DD8FBD63F01B2AA33DCFBA35B429261B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704503, "uuid": "19c9cdb7-21eb-4076-8bc1-988d91d844f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704503, "uuid": "c3212fda-efe7-4719-be55-815f020ae529", "value": "12288:h5AqzAX2glmc1ix88HX3MundeWXUeAOJRHjxg2sk:her2CUxVXckUWXU8C2sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704503, "uuid": "ff2bd515-f0ff-4e11-bae2-e18cda55f798", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704503, "uuid": "3efc5356-bfa8-4b3e-9ecb-73eb9f16084a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704503, "uuid": "d10157f4-cccb-4d0c-8a86-29478a5444be", "value": "4500995888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29417ce-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655704683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704683, "uuid": "3b2d46fe-db44-411f-bc9c-6474ee37c60f", "comment": "Malware payload (Formbook)", "value": "d5a0368b56f847f752cb5211316298a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704683, "uuid": "278b1dd6-8053-442f-9a96-cf724ae2ca01", "comment": "Malware payload (Formbook)", "value": "25d92375393afe6b1c651fc1dc839887086a9329f0debf6b93411afb9e23e129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704683, "uuid": "4d764525-585d-46f9-9b85-ffd96bd39470", "comment": "Malware payload (Formbook)", "value": "0f0be4ed03cf1ee08a9f3ace3c46794db346f3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704683, "uuid": "e2bf7d26-641c-4a04-ae3a-aca282655700", "comment": "Malware payload (Formbook)", "value": "c8a25b52e025684150fea066868aac49f1f43ab692ed02e67849a0f2e902cf3620dd1d938f36e0074cdad1574826207d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704683, "uuid": "640f324e-3f38-48fb-acd4-fb424893e4e7", "value": "T151E4594CB22C31DFE446D635CA682D249610287E725BC3D6B0633A5FAD5CB939A334B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704683, "uuid": "8fd1c057-bdca-445f-a287-75cf49b458c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704683, "uuid": "9e7a1d1d-e3e5-4a7a-b405-6adefd78daa7", "value": "12288:fAndR43l4IPJxzsTDgN1PGCgL07R93qsc6s+HQiuOWY+:V3lPPbzIgrDB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704683, "uuid": "32e35bd4-b390-4bc5-936d-bb4ac86667b2", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704683, "uuid": "843c333e-ffa4-4882-8dac-c0ff6af05b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704683, "uuid": "ba092cd0-6764-4dad-b54a-412ea288423e", "value": "Copy!!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0305776-f0a3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655734744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734744, "uuid": "32c2b6a6-5391-4865-ace3-cf757da6a88c", "comment": "Malware payload (Formbook)", "value": "ddcd45a61c4ae4e1c77699cdd061ac9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734744, "uuid": "fe6cd9e3-c4ea-4761-a9a8-16c90f1c1610", "comment": "Malware payload (Formbook)", "value": "2638f88d825d044a15cd54bdb12c01a47e50d679abcd314d1f982bb44eb5e8ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734744, "uuid": "9b9c47a9-1a07-411b-b372-d70f4f3bb1c9", "comment": "Malware payload (Formbook)", "value": "db9dd9875c387221a9c1ac89cd06f011ade30930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734744, "uuid": "94641f4e-9fa1-41c8-85ff-5818d05086b4", "comment": "Malware payload (Formbook)", "value": "52dfea28b56d647ac60c53cbc80b9e8a30c8963833b5f7044799bef4d53f3bdd2ac2eaf03f60a7193fecc0670c92e8e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734744, "uuid": "a7f1b64b-2e6f-4da4-be98-6e5124a3ef81", "value": "T17FC4F1507278D893E26821F2D49BA0F017B67E26FD82E2EF2D85BEE439F57D21105853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734744, "uuid": "5d46aacb-6e7d-4721-be9d-0543211da2a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734744, "uuid": "4ef35b64-ad03-490e-9a6c-2188845226a5", "value": "12288:VwaxjdrBGm2CjMO2XZm5jau7w15dDkAxS+x0RmJbFZWSJuWAvYACH2m8EMT:dXrBGnkjau74dwAk+uReWSsWGYAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734744, "uuid": "9bbbb0b8-af9b-4d5d-abbb-d8bdb40aee80", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734744, "uuid": "5ac9da6b-009d-4f9c-a80e-21c68c804ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734744, "uuid": "814b2ad1-bf50-4e16-893c-0c2cd6cd48bf", "value": "shipment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962caba3-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655746619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746619, "uuid": "786fd595-4dc7-4dbf-88d9-29066725b035", "comment": "Malware payload", "value": "689259cf63e18995ed6b210b6e20f684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746619, "uuid": "f93300a8-8207-48d9-a6f4-058f145dea74", "comment": "Malware payload", "value": "26a68054778bebee3afbd1891de1a4bb65ad13ad3d6f62afb86a4a83ca6873a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746619, "uuid": "56fd400d-5f1b-4a22-b36c-aa36a0d9c7ec", "comment": "Malware payload", "value": "a7412023984f88e862886130d04e46e7805d8f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746619, "uuid": "9be8861a-5dd5-4a4b-87f7-e60232288166", "comment": "Malware payload", "value": "d74c80de1a86f43069b1d7588d05d04a8960ced10a28086b5a3d6c828bf7271b8699e035f7fd35d585a5ad406d3895de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746619, "uuid": "c827924f-0358-47ca-bd49-bc83726fb92f", "value": "T1C552D708E3EC4633E91E97BC85E6874217B1BB37D201FBAD25D8A0A71E977490E10367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746619, "uuid": "c16f7817-55bd-4b7d-8703-fb236c1731a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746619, "uuid": "1c2f44a9-458c-486b-ba58-d45c393b984a", "value": "384:XUmPWkJoQe+SO+OUVk++mxEEGdEPEUFlNb3Y:XvPYDbnROeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746619, "uuid": "43c1ce2b-8b16-4968-8de2-b98d3d87c868", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746619, "uuid": "6aa1d380-6fe6-404b-aa95-aa01860fc9e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746619, "uuid": "f782123d-6866-4f11-8bc6-a5c1ad63cc63", "value": "SecuriteInfo.com.Trojan.Malware.300983.susgen.21690.8202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560c8b6d-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655726325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726325, "uuid": "a07cb885-281b-47b0-91b9-aba602995b63", "comment": "Malware payload (Formbook)", "value": "c52ecabaed16aba5fac89d694e7508dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726325, "uuid": "5dc53218-ab60-4da9-b002-e99a11f1748e", "comment": "Malware payload (Formbook)", "value": "276c6876c250e5ebfd761d05937f5a48f7e4c9a6851293a77ab9bf683c8bbf80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726325, "uuid": "b437dcad-41c0-4cd2-a798-640833a25194", "comment": "Malware payload (Formbook)", "value": "492c8828a332dbcc0f68d5ee5b17d9ae994b48c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726325, "uuid": "9755ee8d-9b89-4148-8e35-32c11d3acc52", "comment": "Malware payload (Formbook)", "value": "5bc89e2c0f7141571cb7663e0dcb8a198a955484fc6a5ad3b0308c7873746f26f1024f126a1860f388f8563e1b3f3f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726325, "uuid": "c05ac0bf-c316-45fc-acb6-9366022e046e", "value": "T12E54E01B379C8E00C469AAB1C4CE083913E5EFC77E7297563F5962681E823EB2D495CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726325, "uuid": "bbe674ce-2da5-48cd-84ef-cceba00db861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726325, "uuid": "7d502b2b-ad69-4cac-b7de-eede785e5536", "value": "6144:hz6yLUr8SGytKZtJAbi3LLHddD7FhqF5TNE:IgoytvLL9BFMFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726325, "uuid": "70537a75-2e12-4efd-8fe3-43407aa29c6a", "value": 280248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726325, "uuid": "f4725f15-8e57-4bba-9a21-23d3a4d66ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726325, "uuid": "30fc0b05-1a27-4000-b390-f948bddc6d9e", "value": "SecuriteInfo.com.W32.AIDetectNet.01.32118.23153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a344bb-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655746616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746616, "uuid": "656514e8-5aca-4be6-a09f-4826394d03e8", "comment": "Malware payload", "value": "4f4ffe55d08d242d9b54ec21f01549de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746616, "uuid": "05f8007f-94f7-48e9-b40a-54eaa999751c", "comment": "Malware payload", "value": "27d5408961dba9baf42c42b2574c863ccf523ee98fb0648559b733dd52fb37dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746616, "uuid": "070f6215-53eb-4ae3-95d8-bd53d4270202", "comment": "Malware payload", "value": "4792ee54fadeeb6bc8a26982b1bfc8fa58cd1d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746616, "uuid": "dce057a3-7e23-4435-a410-8118d24dd38d", "comment": "Malware payload", "value": "1b22f99d45a82dc88b8efa1d5665c4a7644c4d39c9ec1aa52f11d060231edcf347976ca1fe9ceff8f46c3743247f86e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746616, "uuid": "06a40486-4f81-4d25-8d1a-2f6bbd2d87e5", "value": "T12AF48D9D721072EFC85BD472DEA81DA8EB6474BB430B4203A42716EDAE5D987CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746616, "uuid": "2fd619c0-8d5f-4f4f-8275-b70ddae4350b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746616, "uuid": "12d0434b-6a81-4b8a-9c53-fa7e53509513", "value": "12288:MBJafKribwZrPVx212MoAm7z3BQiGSCjEJ/AWa+eBqX0zjkkHEN0c0mWmm78hbdg:gJair6crVukGEN90Pc9nZxAFK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746616, "uuid": "2b1f2ba6-499f-4eea-896b-08930860e6ac", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746616, "uuid": "90305d1e-3d2f-40e5-96bf-2a4044fd3e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746616, "uuid": "b8471f85-eeab-4c48-b006-f17e69228424", "value": "SecuriteInfo.com.W32.AIDetectNet.01.31205.15465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef937e66-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655730448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730448, "uuid": "cf35c7f5-d993-4801-8d51-9699d63e8629", "comment": "Malware payload (Heodo)", "value": "fcaab1c8902877bbf6af57d3a34a0652", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730448, "uuid": "59b88c31-3b18-4221-8c4f-643b6c584f03", "comment": "Malware payload (Heodo)", "value": "27fa507e2430775d403256b4490e906c1838c0e12fcdb8bff73b4563cdad0a85", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730448, "uuid": "df0bd075-bcf9-4c32-b907-181bcdd4081d", "comment": "Malware payload (Heodo)", "value": "11f3803a45f2b1cef8f4b3950ef4eba80bc34b19", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730448, "uuid": "a0040560-b499-4946-9f52-e770379a6164", "comment": "Malware payload (Heodo)", "value": "fa20a05027578da192eb47c17ccdeebf47b595ed0b5258408faf81c8097ab7bbf3d8f1e69fab18571e6c488a24852d6d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730448, "uuid": "119aaff3-532d-47c2-acdf-7222628831ba", "value": "T1BD733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730448, "uuid": "b764517a-f065-4309-a2bc-5371a31bb09e", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBs:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730448, "uuid": "54808dea-130d-4708-b636-bc9c69110f75", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730448, "uuid": "563adf86-ab59-4adf-a997-70e49bee8d88", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730448, "uuid": "5733145d-f993-43fd-90b3-7e8362787de4", "value": "2022-06-20_1056.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebd07a5-f07c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655717991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717991, "uuid": "fcaacb5c-48bc-45d8-838f-1fcdaed57dd1", "comment": "Malware payload (Vjw0rm)", "value": "1a78c6c4ea92442d7da8af8d2557e0d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717991, "uuid": "4a1d20c0-8deb-42ed-9006-294a4811cf1a", "comment": "Malware payload (Vjw0rm)", "value": "288f91b613ec105cf8d9576e056b6c504c859c842b3b17649d103308040bd82d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717991, "uuid": "dadf71a6-5665-4725-944d-11793c2b2df0", "comment": "Malware payload (Vjw0rm)", "value": "410764bee9220b5630ac46f7a1c5c36c93b742c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717991, "uuid": "2f6458ef-3d00-4dcd-85b9-4059ea04e0ce", "comment": "Malware payload (Vjw0rm)", "value": "a593abe4165f3d3b207317a59437f28be24b3008f6f958c351fa1b33c6b048af8d75e0d6a8dd1a9dd6a00178c0e60cc5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717991, "uuid": "5b03c943-74ac-4503-885d-78f4c6ae1179", "value": "T1D1D2F790F3D234BDE66B3AF715AF040E62BD54129549C080F969C5B53BB1F88CA27F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717991, "uuid": "6ebe21e5-edc1-475b-a0a2-0e4c825d51e6", "value": "768:zDVQKCPd0pmkXdVwM1Nlbb1bqIgN8pGEsKez8fd1L5gNLulD+N7ZQAmU:zDVQKCPd7kXdFC8kEsKi8fdKBXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655717991, "uuid": "50190d0f-43e0-4802-ad46-87e43bc631a2", "value": 30949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655717991, "uuid": "ae1de74d-c433-409b-8e57-201d56b7411f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717991, "uuid": "1a2bf5ea-f418-43fd-8293-54d9b8ef8019", "value": "JUclMnXWGX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff87e7fa-f04d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655697833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697833, "uuid": "7d5aec5f-5dc5-479e-ad03-1c8558517878", "comment": "Malware payload (Formbook)", "value": "5c7d459438f5f309c7e4fc01df8830bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697833, "uuid": "29f5710f-e573-4a27-a9ff-d651bd8fc07c", "comment": "Malware payload (Formbook)", "value": "29b3e1a681ed31baaeaca791e42f48f77ce234920a9782b5d3f8c2fbcf4e518e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697833, "uuid": "d317c876-5d68-4bc9-b5da-0d355de149e2", "comment": "Malware payload (Formbook)", "value": "0b960bd178be7b88bc545d169ca6b90939fc24bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697833, "uuid": "d97f7c3b-2145-4087-bbdb-174d9a51e5b3", "comment": "Malware payload (Formbook)", "value": "645d8d700b8a8e8c7a12a4d687d563f4b8dbd0f9283a1ed158e6cccac21cc4ab2c7e8b72acf555341fdf7c88924ca521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697833, "uuid": "948090b7-464c-47d4-8e86-efa5342819ae", "value": "T1D4C48D9CB22C74DEC85BC27599A44C64EA10706FA72F511791630E9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697833, "uuid": "a7c9a5c5-3365-4ddd-acda-b5c0f21360c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697833, "uuid": "bf914dde-0f3c-468a-9d7e-82aa2554898e", "value": "12288:8d3G7Xu1dpys6E6zHPnfaalUsTe0IIjHm+82729Gk3:neRysczHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655697833, "uuid": "5cb33317-3807-4304-a350-145e9800ba5a", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655697833, "uuid": "0d22d17b-0a36-4f9a-8e3d-7da2fbe18c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697833, "uuid": "75390560-d10f-46e1-a1ee-f8db2e4ab98d", "value": "shipping docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9190eaff-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655746611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746611, "uuid": "27be2dd4-1ab6-406c-8c64-15a2be2ca162", "comment": "Malware payload (Formbook)", "value": "8489934ffccdac1956a3b4cf1b380b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746611, "uuid": "a7c0bf13-abb8-420b-9b6d-8f99875ef0b6", "comment": "Malware payload (Formbook)", "value": "29c2e96c75c881fda4383b8e56db10d74c007d2ffb3cd4c4d3801d30589b0c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746611, "uuid": "7c355f09-d32a-4d2c-9e1e-aea8aa597dcb", "comment": "Malware payload (Formbook)", "value": "54c22835b47f09bf5fc0fdddd240ec2a7e6ab4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746611, "uuid": "9c76eead-20b6-48a8-b587-6d412036380f", "comment": "Malware payload (Formbook)", "value": "8657c68e50eaa0aabb4e0f36639a25faea4e269225896baaac9a86122b41a6093024ebdfff8cec80079164d04b5e8051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746611, "uuid": "b90dd190-890e-4c92-85bd-eb5fd2248f54", "value": "T1C7C48CAC36107ADFC867CDB699942C64EA612477930BD213906319ECAE0DAD7CF142F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746611, "uuid": "b7069e48-8ed6-4f6b-a9cd-f68914add66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746611, "uuid": "910d1878-206a-4fe2-a382-b23ac4567b12", "value": "12288:qqwiDduy/kzi9IrUwpZayo+cgSHKQRb1gPACp2HEGdDifG+OVuSfGaZ0TgCF7:qqTx/kzxwyofb14x2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746611, "uuid": "f3befaf7-825c-4a7f-96ed-6ce50966d4bf", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746611, "uuid": "396d48ac-9756-4cda-95fc-4c37b2e75c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746611, "uuid": "72c5d0b3-0122-4a90-8279-8b8b1a6baeff", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7055.22965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f67f3f4-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722126, "uuid": "4dbe4984-a3d5-41df-be36-7fdc4072ba2c", "comment": "Malware payload (GuLoader)", "value": "dd2c3dbba1b41736f8f730a83e25a2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722126, "uuid": "56861ff5-b73a-4ae5-a89d-20115d601d6a", "comment": "Malware payload (GuLoader)", "value": "29f269d06f4e4ab0a44e4740a719ceb9e40187cebecb3701f9773da32d8de9c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722126, "uuid": "0776fab1-8ee8-4aaf-a4cc-ba24b8e0884b", "comment": "Malware payload (GuLoader)", "value": "aa95034f6e968047a3a02dbee198ea6a3adcf31d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722126, "uuid": "ccf41aae-44a8-46b0-b963-f71695753830", "comment": "Malware payload (GuLoader)", "value": "6e9984f7a013229f4961ab326cdb266cf10134851d3f8870fd9024b9c605fdc121128962ed479e9a67ee37a0198e8863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722126, "uuid": "bd6a5efa-f7c4-47d3-930f-944419d3d0d8", "value": "T1CA24E03077A8E817C86A067184B9D37426B0EE153494A91732F03F5BBD376F1990B7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722126, "uuid": "25d60f83-ebcd-4dc6-b8d1-804b3bcfb39e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722126, "uuid": "b7250d37-7f4c-4cfa-af80-6564a48dc6dc", "value": "3072:+fY/TU9fE9PEtujEZasvlx+LBEFxAVLSaVVglbmr+3R/BrSIgsyeUlDI+7lEsz5G:oYa6nsvlxsB+yV9+c+OS2hdJCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722126, "uuid": "074adcdc-4622-43b9-8ecd-84ce1b567fe9", "value": 225642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722126, "uuid": "a934ee5e-2f69-41bf-b442-d08ad0aa3efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722126, "uuid": "fb1a3d8b-2248-4be5-867d-b382f6087ce9", "value": "Ziraat Bankasi Swift Mesaj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02545416-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655709863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709863, "uuid": "ea728878-423b-4f96-b2b8-b07a4d6ba9eb", "comment": "Malware payload (Loki)", "value": "57c1ac064f6f4acc336fec7aca99df57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709863, "uuid": "d3bd1169-27be-4af5-914e-5a04c9ed50c9", "comment": "Malware payload (Loki)", "value": "2aded97001a294861a40aeb90f80c066fbf29e24e17fafc9195e39c4341f8f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709863, "uuid": "2cc2cb39-a3f6-4af6-a260-f45b6125d5c7", "comment": "Malware payload (Loki)", "value": "56c9b50f4cda50c527e74a266ba660f1a54046d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709863, "uuid": "aec1e436-672f-4052-9f22-4b17a49892f1", "comment": "Malware payload (Loki)", "value": "60e03c37c1f47d63f5f0f7daa99829fd0f04a8b4b165e56fef94abeace2a204072dc9a57718f3fb386ae80d15b8c02be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709863, "uuid": "b95ef4f2-9e77-4085-a025-3d19e40320a8", "value": "T10AD4121133E81B27E97E97F7AAB564140BB1FA263535D34CEC9630CF4A2B7285A10793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709863, "uuid": "58a99351-2d66-4568-9479-0945c7d54d9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709863, "uuid": "426f9e9e-5e82-481b-b11e-882ada5198f0", "value": "12288:Rajeqr0oRoWiSh+oFOQRZU7N7OSE/1RBo15LXrdMHuMn:6jTiShnFOQjUZk/1LoPLSuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709863, "uuid": "2465c407-a2a3-44c9-9f83-d84c48a69333", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709863, "uuid": "fcd66167-bac5-4a5a-8f2b-2898e49753b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709863, "uuid": "ef136d55-1e8f-4cef-b5cd-7c04033e2acd", "value": "AE2JGSK6AP6GxNg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18bbf4a-f087-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722613, "uuid": "11661c4c-d950-42a0-97c4-b77d732b7bc3", "comment": "Malware payload (GuLoader)", "value": "75252733d1175085148840361cd4be2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722613, "uuid": "c26b6f59-a081-4e66-9c6b-5b72e3f0a0b5", "comment": "Malware payload (GuLoader)", "value": "2b11fe6cd6b070785ce266a84b9e8cbfb697c3312ed91bd9026b91045d77d0ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722613, "uuid": "68473408-9e39-4497-b05d-c3c5321d37ee", "comment": "Malware payload (GuLoader)", "value": "7522fe070a0761ce6e3a672ec6a41266d36e6d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722613, "uuid": "7aa7497e-c2b1-4cfc-8a40-15f9ae711a00", "comment": "Malware payload (GuLoader)", "value": "c9294e1d740546b22766bbafebefb0b08444b71aa49d9b73019bf2892af9119d2a9499955c851805682ccb0ed42dc560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722613, "uuid": "18197a2d-e950-4cef-89d7-67a7f82f0bac", "value": "T1C6F3D00073A0D573D4B146315C36DBB6AEAAAD3169A09F4B23503F4D3C72E92CA1E71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722613, "uuid": "e3e38baa-97af-4f2d-a02c-0e66b8a28c00", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722613, "uuid": "0c2a556b-4ce8-42f3-9197-8c8fd4241ecc", "value": "3072:gbG7N2kDTHUpou/Bwl/i4O9jbHRPSrzge3RuYTOQgl+xLxqd:gbE/HUHBjJHRKMkRuYPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722613, "uuid": "afebc1d0-2b61-4f99-96c1-08b4df803071", "value": 167408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722613, "uuid": "69c1b97d-e5f8-446e-b7be-15d6028d365b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722613, "uuid": "80fa0af7-843c-4af1-8732-e9e33617e022", "value": "2022-25-02_1424.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1b7a82-f080-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655719381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719381, "uuid": "bb52e1a4-6423-4bd2-975e-0b9c3b5fcd07", "comment": "Malware payload (Vjw0rm)", "value": "f2862159a6e80713e03cf09ad149b4e3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719381, "uuid": "6cfbd1e3-fac4-47bf-92df-b2fa35b850d6", "comment": "Malware payload (Vjw0rm)", "value": "2b4db73f2e681b7f7d5b0b4cee46453428c4dd3c9c94070ef8840fc73a54d58a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719381, "uuid": "370ff430-ef71-404e-bc03-66e6efade0ab", "comment": "Malware payload (Vjw0rm)", "value": "740f32542b8e53908e02f3db0234736648085236", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719381, "uuid": "a930f598-dc60-41d1-84a0-89a8c1f1aa90", "comment": "Malware payload (Vjw0rm)", "value": "2a75de8c6c573c9388e4a5a974ad9fb1475d23179ba405a7f6986c6f32186148b5295f24107f7efd6b9f0dbb024af05c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719381, "uuid": "feb3feb4-d698-46d5-af86-841e17339ba9", "value": "T129E433D768A166BE4352221011F636AF700CFEC2D8D61259EB1023E3ED59BC14E6B7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719381, "uuid": "50d518af-3487-44e4-8889-504fe1918a01", "value": "12288:0dy3te4t6BxynTZkpLnTSTg9tYUonQPL/1BKDpFawu+JlNXKWxuSQwX/eY5:0dy9etBxyTZ+BYUonwb1B+vad+JlNXKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655719381, "uuid": "22354809-300b-496e-b5f2-9941a80bc244", "value": 663477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655719381, "uuid": "a2580e07-cd96-4374-bb01-f1696efd283b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719381, "uuid": "3956c950-6278-4f0b-a7a3-3df0d4221e08", "value": "justificante.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77b1d62-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (WormLocker)", "timestamp": 1655745440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745440, "uuid": "87a4da00-8718-4118-84ef-5ea19cb30046", "comment": "Malware payload (WormLocker)", "value": "8dbfdceef1cfc70bca2a5689fcd4ac8b", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WormLocker", "colour": "#A87811", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745440, "uuid": "71b55da0-93b1-43cc-b4c4-b6430c43e8d1", "comment": "Malware payload (WormLocker)", "value": "2bb33dcf7b1cab47af0c3e93bb09414e0e282b3894832b30fee7844b31a30c74", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WormLocker", "colour": "#A87811", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745440, "uuid": "d8a565c4-15ce-4e03-a8dd-7cb81e1982ad", "comment": "Malware payload (WormLocker)", "value": "e38aa732894ff2a8eb51fb1d9dbb75b3531fae19", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WormLocker", "colour": "#A87811", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745440, "uuid": "db2e00f0-710b-4e58-a7ca-3448260f3ed9", "comment": "Malware payload (WormLocker)", "value": "8e2cfa298319acda618b851084aa96a1a2004aaba88def0002c131ecbb8cafd97d6c95073e2b02186f9b3faac60ce3b1", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WormLocker", "colour": "#A87811", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745440, "uuid": "7fa447a0-6ba7-414f-8093-3cf634848c9e", "value": "T1E1036BC636EB4369DAB947F214B1174187BEA01B9015EA1D7CCD21CE1F37B41B262BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745440, "uuid": "e34d7ac6-770c-4359-8d57-c410acd8d51f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745440, "uuid": "0cbd57b3-c036-4094-861c-dc56f6da30ec", "value": "768:7/ArcbebEPKi3bX7tErKLcLTvchTS2vAbVh0oiDInWtYcFwVc6K:2uDii72aCTEh22vAbVh/iknqwVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745440, "uuid": "d1a183bc-f195-4bb9-b166-fc5698fb1dbe", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745440, "uuid": "70730e8a-ee37-4647-a77e-a4311496011b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745440, "uuid": "94bfb113-fcd5-4682-9c96-4abc2d6a7b69", "value": "WormLocker2.0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24c927f-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730452, "uuid": "b76f82ce-ab7e-42c1-acc2-9cf1f35e24dc", "comment": "Malware payload (SilentBuilder)", "value": "d5a6351e607d655fd4e43bf9e26a80f3", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730452, "uuid": "bf721373-6d31-4ff9-bb46-7ae1db79d074", "comment": "Malware payload (SilentBuilder)", "value": "2cab1e58d91e0365b42325cfbe6fadb0ce17d8d2c14b7ce104377ff12e1b2eeb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730452, "uuid": "35afc96b-15b3-4ece-8b67-7af743e69c61", "comment": "Malware payload (SilentBuilder)", "value": "461e48052e4a5abc0c348e168ef870c3a7fff6be", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730452, "uuid": "aebf47e3-7162-408c-b5f1-ddc1d95906f9", "comment": "Malware payload (SilentBuilder)", "value": "e79a4da6c0b8819eae99802d5f6c9e62cf2913d5f459b1260d710f185ea706e01b8d37d6fc135243b69e154d878f8125", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730452, "uuid": "488f54aa-8ea2-4a34-90be-6f5e69c99628", "value": "T114733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730452, "uuid": "1655cc73-5f7f-47dd-b15d-b7034fe7078d", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBY:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730452, "uuid": "3cd23d24-20a2-4174-825c-6e3bfa54cd96", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730452, "uuid": "74de6973-8b23-4a10-a3e7-cea0330fa787", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730452, "uuid": "ed1a2b55-7822-4df2-9c1b-33e1993348d9", "value": "75235485376513380645.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65037958-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655710029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710029, "uuid": "cfcd57fc-80db-435f-839a-c2e07547f8a9", "comment": "Malware payload (Formbook)", "value": "8c811bf30d65c42143604c3a4004ee8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710029, "uuid": "c9c3c3e5-6f4a-49f7-adde-f99a0030429d", "comment": "Malware payload (Formbook)", "value": "2cdbcb8ec339711a3c5b4198c5360b4e606cdd1183019d73a10d54a829685563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710029, "uuid": "f6ef327c-db62-4840-be38-bfc98dd7ae19", "comment": "Malware payload (Formbook)", "value": "692f3e90c07babb01a6f6c4d156101f3afbbbb08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710029, "uuid": "6dc3bd55-a72a-48e7-8362-e5534ff4291b", "comment": "Malware payload (Formbook)", "value": "bd07e7cf03b2ae70e93ebb2c9f1e508327fcc5a4fa8d05a548b425d4805ca6ca042899fe0392857c8ae9471675734722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710029, "uuid": "6ef80968-a3c3-47a4-a654-668b35683557", "value": "T199C49D9CB61C74DEC897C27299A44C24EA50746FB31B8117A1630E9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710029, "uuid": "f1610f07-82a7-457e-b267-417aeca484aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710029, "uuid": "8f407c0a-9f6b-4010-8442-488c95121c83", "value": "12288:okXhoeSz8Nr5cQC90fvUTJ2NWPZmsnfkoUAdZ9EvzLbmQPPcCtz8eRZy:BnVr5cQc0nUTJBZ9sXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655710029, "uuid": "151f1c13-93b1-4f2d-b62f-8286f63f8377", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655710029, "uuid": "4ea7a4f5-5ed1-48b0-ae4c-2857e9af916e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710029, "uuid": "041a306c-7bdd-4580-a1ea-f9050119180f", "value": "PO#102895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f741ce6-f0cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655751788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751788, "uuid": "e15f13a3-0e99-4ca1-8ef6-367d21e2bfd0", "comment": "Malware payload (Loki)", "value": "f20bc86f58cccf73fc36eaf1748432bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751788, "uuid": "d241e33d-3e38-4b10-a619-679cf6283270", "comment": "Malware payload (Loki)", "value": "2ce942180eb91d5277a90a8b1041b7661fe403901225cd9789d9e1d0d6738c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751788, "uuid": "6b8c86b4-ffc5-4c0d-bcb6-113deb768ff5", "comment": "Malware payload (Loki)", "value": "902c6b41d92380f725da4a0bea5331f1782799b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751788, "uuid": "6eb63e44-1264-4912-bce9-8fa07200b90b", "comment": "Malware payload (Loki)", "value": "0421e68571103e2ece1092cde78635f42628bcb63225e431ca0814ddd1852636e8b2a625a26ee11a593fcc84269ba36e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751788, "uuid": "733f67a5-e3bf-444d-b823-67620bfb0539", "value": "T19AA4F15069794766EE7DC7FC88E2A14143F86032911BF7AD4FC670EE9C73B428A90627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751788, "uuid": "ee968284-5a92-415b-9765-b434b506fa2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751788, "uuid": "484d3684-267a-4368-b08a-d529cec3d12a", "value": "12288:a82iNtcu+OPP2wRvkaHMhkNMllDunyCEC1:71P0OPPnKbkNulCyCEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655751788, "uuid": "b3781d95-e0b0-4daa-80e2-0cc4e374d1f5", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655751788, "uuid": "6c5e3c16-7e12-4159-bde8-af8428dad368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751788, "uuid": "df91a912-798f-491c-ae07-68823a0416b8", "value": "WIRE INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215d1d7f-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655715069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715069, "uuid": "30f7a2bf-7d07-438f-8d2e-c013c0fc1473", "comment": "Malware payload (SnakeKeylogger)", "value": "9091e564be662df4006385042579a23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715069, "uuid": "036fb8f4-bd7b-4349-b6f1-3e333c61ce0f", "comment": "Malware payload (SnakeKeylogger)", "value": "2e0ef71a482c6474db7af54e3664d7fee598c346700e5b7f4ab200acaef4fd20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715069, "uuid": "0c3c1605-5d91-4bf9-9b7d-929e35f71cfa", "comment": "Malware payload (SnakeKeylogger)", "value": "7951eec539a50dbb38c5a326725149e246f6d471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715069, "uuid": "3509f4dd-f136-479c-aef0-565bef1a9025", "comment": "Malware payload (SnakeKeylogger)", "value": "01b378cdfd9dae053a8c534385060e0ee830262683861ab6aff3be66299f153723736cf210a9ac693327aa8fa5585c9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715069, "uuid": "f09283f5-392f-4219-8d55-5771343685d9", "value": "T13CB4E05032B4CA92EA6923F2C4BE94F017B57E56FD81D26F2DC03ED53AB67D20209617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715069, "uuid": "02428131-d3ee-4bac-b779-c5991ad23340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715069, "uuid": "ee50d21c-b3f2-4acb-b174-818c2bc42914", "value": "12288:CGAjdrmWwsodDnSEY/8Hok+QpnQ1jiBz:YrmX9Y0FWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715069, "uuid": "e4e91a33-ca76-4778-8d08-0fad7023454a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715069, "uuid": "d8bc7aed-cb90-4b77-afda-59b766133163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715069, "uuid": "b59c619e-41d1-4498-96de-314f1bd8f204", "value": "REMITTANCE FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cae3c82-f0d3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655755219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755219, "uuid": "bd0eace5-9d66-41a3-8980-85c8c1683128", "comment": "Malware payload", "value": "f9d7e7336fec4b19db22175f55a5144c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755219, "uuid": "d5b4e05e-0732-4a8d-afbc-d4d82cf6659e", "comment": "Malware payload", "value": "2e3b5e32da47c76886cb7a09f18d2143cee83e766e846c136ced459a5f9fa0a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755219, "uuid": "e73283e0-2441-4f15-8930-2481e4360e7f", "comment": "Malware payload", "value": "b7522b691e900c5142946d40735ff7e335817cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655755219, "uuid": "654a5e7e-2367-41ba-aeb9-8fb17d50d7e2", "comment": "Malware payload", "value": "9e377fe245b045dd19e63af01eb0a1267f133c6a4cdcbddcfcf4ea725581cfbc71e5ddb8a25889b1ed1eb4e76aaacbaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655755219, "uuid": "87290219-f31a-40d4-ab30-448c66d84d4e", "value": "T160B401437AB95B0BD6BAD3F69776204447B4396DA221F1184DCA70EE2872F044EA0F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655755219, "uuid": "3796daa1-62c4-4e6c-9b21-615d2da500de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655755219, "uuid": "fe3efc66-7dec-4d3d-8a98-cf68fa2e0a85", "value": "12288:4itNn/95sfqs3mUlkphdel/RzB7FXt40UaIIStgm:N95sf8lleTz5F9405Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655755219, "uuid": "ea39d536-4de7-4d31-bc05-4ecc04ba0705", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655755219, "uuid": "73c02c38-418d-4f4f-9eac-f3f85fcecdf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655755219, "uuid": "1c6e37ac-bbd1-4713-9834-3fd9a9813b98", "value": "Mensaje Swift MT103 - 06202022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d90d71a-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744671, "uuid": "382fb11e-5938-4852-9e16-f581fd628602", "comment": "Malware payload (Mirai)", "value": "6a287fa5d384ceeb38ac7fad228c1488", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744671, "uuid": "949b5c8a-1ae3-4561-9e91-be14a591835e", "comment": "Malware payload (Mirai)", "value": "2ee38012de559055fc1bcf8f44087ac3614de987eae08ef15ab0f7c87fa2ed69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744671, "uuid": "17e96935-5066-4827-a113-50f25f31ca83", "comment": "Malware payload (Mirai)", "value": "b4dbc745f429ee15961f55b6404e127b37348650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744671, "uuid": "fdeb902c-788c-44a1-ad79-45e1b83738dc", "comment": "Malware payload (Mirai)", "value": "93bf9ccff7003688a1bed4fdde7835cb0f747485f7d63e8f016bd6c61a0373aef1c090d7756c18606319afdaa9ac4c35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744671, "uuid": "4b8be8b6-c7ac-4441-88d0-1b308313b037", "value": "T18873E716FB810FB7CC5FDD330AA9065125CC965B26B43B3AA534D918B60B64F5AF3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744671, "uuid": "3baa6a71-eaee-441f-b65d-a24a936ef5f8", "value": "1536:bBbXPqYRPjplRF8TBfuOUqXZACm05WcB:bBbXPqYRROUqXiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744671, "uuid": "77c2e203-b765-483c-9391-254114c53e6d", "value": 76372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744671, "uuid": "bba7415f-5866-4f9c-8b69-ddaac3118cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744671, "uuid": "3613727f-9b88-466b-a68c-a38d634ab970", "value": "Hilix.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1c7a68-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742792, "uuid": "29435be7-54e2-4b86-8a68-6bc84af62ed3", "comment": "Malware payload (Mirai)", "value": "f54a2243c6afd642a0875654abb7ff11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742792, "uuid": "6331c270-a0ac-4fac-a26e-0a953fdfcf79", "comment": "Malware payload (Mirai)", "value": "2f8dcc5f1bdebcce0408dbb5fcc1601ae9ad4d9fce01d0398eb78f44f8a7390f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742792, "uuid": "22266511-9dd2-4f70-a816-8aa5934c67cd", "comment": "Malware payload (Mirai)", "value": "4031e715d1281c8c7eb1958f064fa2ec450c71f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742792, "uuid": "7440ec7f-3c09-4802-98b5-5d0406521ee8", "comment": "Malware payload (Mirai)", "value": "4d30853cf5cecc71f0253992d4ae8cb75b65923a1f680a987716b96d011251fa007f0eec0dc33eb51ea9428949794bbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742792, "uuid": "828d47c8-2925-4b9b-a2aa-c3d92eb40dbe", "value": "T1DB2302CDB64A0785C7CF6D7941CE0751A4A7F97039AF68CE23838968D8671EA5CE02F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742792, "uuid": "79fc75a5-13d0-46fd-bd9e-af8127223140", "value": "768:wJc/XyYfrPxSz1zb4En42aXm0qt2qm7kDf5NPPz+sA3VnWRLWD8idZ:wSy6PUt4EnyXjqOYDnr+sAlNhdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742792, "uuid": "4cee6ac7-10d7-41bd-a428-d7f4998d4d6a", "value": 49740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742792, "uuid": "59b06ca6-398c-4009-9c95-753390b75ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742792, "uuid": "bf507983-79ac-4226-90fe-b28e552ae421", "value": "KFS.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66cd6cc-f0a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655733358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733358, "uuid": "92d11e9a-797f-4384-bbba-314ce8fe31d1", "comment": "Malware payload (SnakeKeylogger)", "value": "ba839d78898df6e7111a992cc87e912a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733358, "uuid": "dbeb2ae8-44ad-4ede-8df0-150f0d7a2fd1", "comment": "Malware payload (SnakeKeylogger)", "value": "2ffb5c6a12e6d7ce8f369ee7bb62242ea57321f79216dee21b4ce569f94e4267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733358, "uuid": "6c1c13e7-3e76-43f4-b0dc-d2d47d05bb8a", "comment": "Malware payload (SnakeKeylogger)", "value": "2ea46ab06db2c18906e2970cf7eb0c1d8c341e9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733358, "uuid": "68f42fd0-67c3-4a92-866c-f1c5b18914e5", "comment": "Malware payload (SnakeKeylogger)", "value": "4b807a8783fab7f24c7af9f8c88c2f60f9af86e96aa1ab5fdcea2acb0d52e60443d214e14d465a3dd9d473ed7dd41d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733358, "uuid": "a1969d3a-a24f-48a2-890e-86f1e26a0119", "value": "T17954012057DCED73E9EE5A362C30610043B3AA674B13F7EA1705E81A1596758C8B8BDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733358, "uuid": "6cd6440f-879d-42be-b94b-0580a2d276d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733358, "uuid": "505be77f-9c7f-4a17-acb5-66b95cd03183", "value": "6144:cleY9lSSxmJp1s8LPrOlmPNdCQ/WSNReZ+UWe58YqiuAH/28fWm3z7B:ccqSSSHsszOOdCQ/WfgvAHhOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733358, "uuid": "f0d20ab4-643f-4c3a-846e-4b52b276964e", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733358, "uuid": "2732522f-0420-4c43-9513-772e3235b2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733358, "uuid": "0f791ce5-6ddb-4039-bf23-4f7bca28835a", "value": "ba839d78898df6e7111a992cc87e912a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffea89b3-f069-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655709859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709859, "uuid": "7d4ed410-90b7-4385-a229-0ccec7801e57", "comment": "Malware payload (SilentBuilder)", "value": "40d2059058db0e3c31e1ce94f11d0b12", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709859, "uuid": "cb7dc66c-f848-4134-ad67-9decf35e1d8b", "comment": "Malware payload (SilentBuilder)", "value": "319544891277f9c37d2f521a9cd070c37af3ba03f7416a34d58643b11dd3bee4", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709859, "uuid": "393eb42a-a5ad-4b6e-a6c4-1c5f552dfe4b", "comment": "Malware payload (SilentBuilder)", "value": "57c0d81b173c18d27bca3fda078b9d4a66dd5665", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709859, "uuid": "807b25b8-dc96-4c29-8b6f-8b4522738c78", "comment": "Malware payload (SilentBuilder)", "value": "e08d8e9e2b5ea7ca2a064fa596051e7954234b786b73df9456085758571f96a87f0e4f61ad59b5559a127310de0ef011", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709859, "uuid": "9ce0a4bb-cd14-4c11-bb39-2fc726a46c18", "value": "T1FF23A446BB5AC85DF914873448E747EA7323EC314F6B0B433669B3256FF89A05A0325B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709859, "uuid": "3ee2e6a6-ff02-4f90-9cf2-c433e283fb9f", "value": "768:hDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VmQs7iqj/X20eu22:hYKpb8rGYrMPe3q7Q0XV5xtezE8vG8US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709859, "uuid": "c94d0495-77b6-4f0e-bbaf-9cc7858f4df1", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709859, "uuid": "b5f4451a-4f16-487a-b702-835e87788fb0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709859, "uuid": "1738323f-84c9-4274-8cf4-2b913d7e0fd2", "value": "1003491190873446683.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9607a34-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655733793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733793, "uuid": "fea637e4-f372-4cc2-aaf8-321cd35d7fab", "comment": "Malware payload (GuLoader)", "value": "d2526a36ed3e5d34c02d73cbf779c5c3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733793, "uuid": "c136d282-a222-4eb3-8a5c-6583eb4e45b1", "comment": "Malware payload (GuLoader)", "value": "31ca785a0f3ba5d97d804eeb72aed8f1e1d9793e22dfc6c2333f82c1e2921b6e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733793, "uuid": "d4d9aebd-96d6-48c3-ab8b-6b6749601cc1", "comment": "Malware payload (GuLoader)", "value": "2222d74e6734efc46eba674537d5fcc2286737ec", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733793, "uuid": "cf42fc52-5f24-48fa-a7de-36ba281cfdc2", "comment": "Malware payload (GuLoader)", "value": "a28e9c0a999d3a5f7932d8b64c70efebc9b3a5b4e1e06d2672d4bd2711d80b19bd9ab6b3923f42e19db1fecff17d0aa2", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733793, "uuid": "6b2390c1-b35c-4058-a666-b35eb13f0de2", "value": "T133D3D3D475A40CCEF8B49375B21EF5553E7EB9675DEC20285F3209FA8B224E0893689C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733793, "uuid": "46785a15-0dbe-4336-8c94-8992a369f4ef", "value": "1536:k/fa01r+J+BJhSneGrl04hoT5KykwhpujvtkTLz6LLpl9Aood1o3nFPDNEN7tb7d:Ho4hw5u+XaCA3//oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733793, "uuid": "496c25b0-c6cf-4eb9-afd3-cba15cde169b", "value": 135898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733793, "uuid": "da45fca2-a5ed-4b44-955d-0c9655754bb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733793, "uuid": "50100d32-53b7-4260-9ea9-2751d4863ff7", "value": "SUPE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bc7737-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655733921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733921, "uuid": "23bb57f6-9f95-42c8-b9b2-d0aaed7f397c", "comment": "Malware payload (Loki)", "value": "d85d402ad0e3d1c023d51d6742dc8884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733921, "uuid": "ffb7af0f-4bd4-4777-a3f7-4a528f97314e", "comment": "Malware payload (Loki)", "value": "33b40ae2d66894908f606c6b9221cb6cde7995fe7d9006c8ce2f410cb0f0de31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733921, "uuid": "69898da9-8d97-4738-a5da-0cffaf4b431b", "comment": "Malware payload (Loki)", "value": "e370de54137e5b73f845eb5ce8900fb6f5f8c96c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733921, "uuid": "9e326cf6-e388-4b76-8f04-7fa014855476", "comment": "Malware payload (Loki)", "value": "51ff8ad136807a0d56f4e6852c01ee9c537f148f7322110fdcd184264cf0ec5f236570e494ffc4308e4d15b3d05199ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733921, "uuid": "ed06cec6-a339-4d2c-8ea0-7c44d470234b", "value": "T14784125A2E7D8322E4F7DBF059A2445883B6996AC4A2FE0CDDC120EF407EF8445E5717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733921, "uuid": "bd77cc80-c8b6-4470-b276-21d1a77f9298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733921, "uuid": "b5136220-94e2-4282-b5a6-5dd91444de88", "value": "6144:fVZ2wSSMU30WDxzow8m+/iKyAjTLzFgPEZdup1QxLf+20dkl6L8H:RSikWDx0w8mWbnTLzFNunQxLG2Q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733921, "uuid": "cece2744-020e-47d2-8122-7bf6a608019d", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733921, "uuid": "7730732f-aee1-41e6-9c33-e5e2132eee96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733921, "uuid": "13a5c232-d40c-4753-9203-9229e6a8944e", "value": "COMMERCIAL INVOICE, BILL OF LADING, DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdb5b08-f072-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655713315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713315, "uuid": "57828fa3-b601-4a85-a4a2-59b93020c2b5", "comment": "Malware payload (AgentTesla)", "value": "c444e6d3b20382ff7d17fcef6bbc6117", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713315, "uuid": "ba7a8c05-b93a-4605-a518-af63fb72cc92", "comment": "Malware payload (AgentTesla)", "value": "33ee1c01176257b51097da3555ed05fee9d75277d8e0c6b2dc6eebf2cc231113", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713315, "uuid": "a4aee49e-481c-436e-9451-6e404337eecd", "comment": "Malware payload (AgentTesla)", "value": "6e4ef287a9ef2e598da3689b8eb11e995cde39d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713315, "uuid": "61821610-1d73-4fce-b70e-e3118053b773", "comment": "Malware payload (AgentTesla)", "value": "8311bab977c8d986dd9d7590055c29aad151d083e2da0019aa97eb16a5e3833b8d812d1de8e5a3fe4bf20c891f06002f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713315, "uuid": "aae18247-8635-4848-af98-5ac4873ffc76", "value": "T15E157C0267C95F27E2BDB33A2174541C43FAF9E62250DE8E3E5552C914F3B805BA1B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713315, "uuid": "dd8ebec7-dde7-4440-ba80-cee37e779f15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713315, "uuid": "1b201aa5-4f00-4920-b459-09884843848b", "value": "12288:98ZMbFVvb7KBzmpiQcWauOsd0wj3fM1r46yxxdq5w3p8lP8Gb5xf3tJj/eA:98ecWhjurmxEemk2bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655713315, "uuid": "66171f2e-c5f2-46a1-a194-84873605adf0", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655713315, "uuid": "a849d6d0-9a05-4f29-a80a-f5068a382540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713315, "uuid": "d5bd8640-eef6-4b1e-ac5c-b5df8fedab74", "value": "DOCUMENT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1f3ccb-f05b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655703442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703442, "uuid": "6f51cabe-82cb-4fe0-bade-e87d2d391c29", "comment": "Malware payload (AgentTesla)", "value": "36c88c39e1cfecb88f9226cef295ea22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703442, "uuid": "46963219-6b97-44df-a1fc-8f7989317c42", "comment": "Malware payload (AgentTesla)", "value": "348006a34eaa99088cf258696c553729c497581b4afe62a5d43effac6e5f2576", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703442, "uuid": "ebb6a548-0209-4d51-b139-20a28b54af82", "comment": "Malware payload (AgentTesla)", "value": "47096fa53283eab7b1f21b34bd09581520330bf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703442, "uuid": "93083d05-0790-4b95-bd68-74ba38a58fc8", "comment": "Malware payload (AgentTesla)", "value": "c453de8fbc33ec55663fb96e0c95531ea8afb226642b96c0c5841a561bb260c4352c1cdc6b8c9e3cce8a6bf9b4a51b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703442, "uuid": "98c1e080-8d1a-4e81-902f-5641a77ed163", "value": "T1DC8423DA1A18ABEEFD164CFDA59011F951C139EE6B134F5427DF704E0FA4682F8AB204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703442, "uuid": "38522851-64d6-40bc-b07b-1c68dabbdd4a", "value": "6144:wBj/iwwyc8VeIsoNBtZ2bRHEoYRTcoW3pXrp0fuvHWVz4CkiOD81UjSpy:wB7iz8ZtBtZs6HTX2vHo1jOD8xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655703442, "uuid": "fc834344-a348-4ce0-871b-8a6fd6cdabd5", "value": 391881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655703442, "uuid": "7f9637e1-8265-450c-8ec5-b4ba41244b39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703442, "uuid": "54ecad99-36ea-4271-bd2d-6925ebf654af", "value": "documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec758dc-f07a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655716917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716917, "uuid": "41211653-e319-4af5-beba-6bf4916497c0", "comment": "Malware payload (GuLoader)", "value": "0dea822d1d8e2fb4130122a16ac48e5f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716917, "uuid": "6ebb5fd5-9fa8-46b6-9a32-c7076c6fcf0e", "comment": "Malware payload (GuLoader)", "value": "34e4ba5d0386bbdf2e56e363d384c54098e40b881f1b27136de895d8b11fab83", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716917, "uuid": "671f3897-a81e-4a82-a31d-f1396bff3d88", "comment": "Malware payload (GuLoader)", "value": "b870fd2448fef8479d0e8f8410bb7ebc4cea07c6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716917, "uuid": "ba7049c9-4034-4044-9b2e-67e81d39ea82", "comment": "Malware payload (GuLoader)", "value": "eadbb9a4fed3b97ea6321bd28c85497f54fb728c2f400ec330e7f32ec0901b8eafecc8806d5da541d0355f96313dc452", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716917, "uuid": "1d89f92e-f03b-4c09-9a3a-b46041f81727", "value": "T1EBD3F8F6BA198688F818A181749CFA4D1D3835A30DFCC0572B3F11AB37DB39651A58DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716917, "uuid": "b6ea4eed-5900-4e06-b3b5-46c131e9e6d8", "value": "1536:ChOxEhAK42D2ID0yazfmGMrZ/uajS/HmNWKg9a9bWlpa7p2Mw/vmmMJkjATrDw:SgKgQOauUS/u8UTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716917, "uuid": "c0a67c69-b84e-4dd4-8088-c59f9391ec8b", "value": 133466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716917, "uuid": "c4d40d3b-afd8-41ce-85c8-faf02d7c8f30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716917, "uuid": "0801382f-2c55-43f3-9793-6e607b635ee4", "value": "BL_HDYDEY32.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c7922d-f095-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655728336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728336, "uuid": "c2ff15c6-fa99-48e5-b92c-aff5a8be6e88", "comment": "Malware payload (AgentTesla)", "value": "7ae81f5b27fea8efd879d9dd5005c6d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728336, "uuid": "fa572c61-d364-4376-ba7c-d147726d14a6", "comment": "Malware payload (AgentTesla)", "value": "350a28f6f31bafc7f905f66803b537b82e8e79fd82cf729389720a1f618b0032", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728336, "uuid": "866a11d6-0e53-411f-b5b3-ed561bebf45e", "comment": "Malware payload (AgentTesla)", "value": "30a0f94b14ae056200c610a70a28a60d25a046a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728336, "uuid": "02c17c86-4acc-42ce-bb07-3a0c326995d3", "comment": "Malware payload (AgentTesla)", "value": "6a3803578e45310ff22adb2c868ecd50783c252da02ff3249000d3dd0734b939d0950b0d6a3ebfc6ad24f8db145bf291", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728336, "uuid": "c4c0c9d2-c331-40c2-b49b-8591fb0dcbe7", "value": "T1F7B422542F78D322C43B5BF19AE642458B70862EE8C2F748CFC575E628F9B940D82B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728336, "uuid": "85c4eaa4-b536-4003-b30f-983454b7642e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728336, "uuid": "a3fde035-0c9e-4e12-a26a-6f581c98fea0", "value": "6144:QlZAwZLL09KIBJufj8wJ6ElrkqMEjGeRAxEdxJWy03PMoSNoVx4Cjxuu5nl4c2Q/:YZf09nJsXA+rm4Gl4pH1exnoyUy16jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728336, "uuid": "7a24a3b7-f2cb-48f3-a4c0-5cf327849a00", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728336, "uuid": "3e7912b1-f1cc-4dff-a33c-623ccf252e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728336, "uuid": "a8ff5776-8b9e-408d-be9c-c5ef3882aea4", "value": "SecuriteInfo.com.Trojan.PackedNET.1389.18583.4932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14494703-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733516, "uuid": "e2ca32b0-6102-491d-a0db-b48593520f38", "comment": "Malware payload (Formbook)", "value": "640e5685557ebc1d95889a76b7b8dd9f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733516, "uuid": "beed0f10-1cbf-4d44-a35d-b96a322e6b04", "comment": "Malware payload (Formbook)", "value": "3696f69acc6d062da238ff6fb323d6e82e6d9e1bca82807ca4e72a8c3dbb4c43", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733516, "uuid": "047584a1-47c8-4173-b2c8-ebd04c3da7e9", "comment": "Malware payload (Formbook)", "value": "1502b96daebc50d58d64a3d265708fd34b5f25ab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733516, "uuid": "d7db4c68-d876-49d7-b2af-a2fc9e8e8c9a", "comment": "Malware payload (Formbook)", "value": "0e574559c82c502827f4a38eb65f804a493c18e0b1c04e0fe33052d21d2b6349a0f8be073b4f4f6305da75346abdfcf4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733516, "uuid": "ab887b0e-6987-4507-99dc-536bfc81ac9b", "value": "T17D83E1ADB32DE402DDE294B8E45998A8A56C5F49DF0782C222C3FD4B44337535867C9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733516, "uuid": "0eadcba4-d8cb-4715-8052-3794e0a5ae06", "value": "1536:LZE/BTX16qua4kzyZdE2zuZrX38UVbRDclVE3oqGhjPLWJbLP:LZE72a4kW82zmrtZRqVE3ohtD6bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733516, "uuid": "59d8c275-5638-42e9-b135-5983a62d447b", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733516, "uuid": "25dfd100-40fe-4395-9010-a42617d1b915", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733516, "uuid": "ad34d626-a751-4a04-b2ec-1f9282bee15e", "value": "SHIPPING DOCS_INV_PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010fb901-f064-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655707284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707284, "uuid": "3b830e96-4f2f-4543-9f20-a96e6b3ab6c2", "comment": "Malware payload", "value": "901cf2241a92d2a163f6a0e93d927387", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707284, "uuid": "c5ca05c2-9fb1-4a7b-ad57-3fd6bae37038", "comment": "Malware payload", "value": "3846cd7fde972f5a7af554add7b24722468bbf9ab03fe50f66696458bf02fa93", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707284, "uuid": "4762492b-5f3b-49d1-95e0-fb3135b1f93c", "comment": "Malware payload", "value": "6c0d523334648434961d1aad5648ba25dcc32a7f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707284, "uuid": "14323fcd-ae7d-460b-8c25-6b71edd237ca", "comment": "Malware payload", "value": "ad92d24a6e271288b8d3fa881dcddbd781a76d5fbcac38a65c59ae0def4f7e4450f582949c5755b93be488816dec5cad", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707284, "uuid": "b179e70c-8d01-42ca-bad4-751929e130b1", "value": "T19963E094BBEF9561CC5604FB142AD96ECD76AD0A42DE51F63083B324BC7860D0BD2F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707284, "uuid": "445c1f18-694a-4381-8e82-39039dbf0587", "value": "1536:Mdq4t56T4ntQD9u4zenKvZCysYrTkJZGTzrWUTSqiMhluD2VcC:MdhTu4KDcDKFTkJYTzXiMh4uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655707284, "uuid": "ba9a1ee6-eb8f-4ea3-84c2-e4a15f3214e0", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655707284, "uuid": "94c56621-584c-434e-aa2f-a286ae5d313c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707284, "uuid": "aae1badb-ddde-4b7a-a120-32428ecea7a6", "value": "00155423412.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e050034f-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655716249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716249, "uuid": "779676d7-6eef-4106-bcc8-76c0e43fa8b2", "comment": "Malware payload (AgentTesla)", "value": "5bb0d68333b7ced98097a3c6ca5946dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716249, "uuid": "4e9e30dd-d493-40a5-80ee-87a56b4431c2", "comment": "Malware payload (AgentTesla)", "value": "385789b1226fc6c4703962cd654bcbaf9a210102e0bba96fcd224c8e7f108b0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716249, "uuid": "5d585ffe-fb11-4956-b440-8968ef7c3a65", "comment": "Malware payload (AgentTesla)", "value": "35ad1faf3cf8f38b1165516f14125420cbdd85db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716249, "uuid": "b34b623d-f9ed-45be-8836-4d40cf1382db", "comment": "Malware payload (AgentTesla)", "value": "e190b66b7053b4f047c25b396060d9c7a9be0dc2fa438b782d7e23eb77e9e0679ca208da8400ef71d6b25c18600995f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716249, "uuid": "c4fd92ed-3529-4d23-92e6-946cb0c1a4bf", "value": "T1F063E0D5B97730E5C2465B3B6CDD503695F84E7A9D32FC9820B03E9BA8717C08E105EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716249, "uuid": "ca48da9a-89e0-4aad-a478-1c7c2df9faca", "value": "1536:U8mJcWfnShvfjGIgzM0+4f3KfN6c1sKxF2bsAv3WcLaBaSxWEAfCI7:U80RK1bjgQrZNxVAGB2qI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716249, "uuid": "6bf36f6e-a0a1-40da-8e2f-2c72f1bc5e09", "value": 73336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716249, "uuid": "6988a6d5-2f79-432a-8c37-8bff50928a68", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716249, "uuid": "536faca2-e68d-4865-ad8d-c39b62099777", "value": "draft HBL & MBL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085b00c0-f0a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655733066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733066, "uuid": "5f9ce122-a6a1-46a2-9693-a1de74614f46", "comment": "Malware payload (AgentTesla)", "value": "febfa0a259a3226a5a76a88368151b74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733066, "uuid": "700bc356-82f8-4264-beae-643f97cd1b08", "comment": "Malware payload (AgentTesla)", "value": "3858645606690357eb19de60bfd97881c6d9e45e3f4cd48fe4e7f3d366aa5a2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733066, "uuid": "6fa76a2a-b3d5-4d0d-ab49-c9a900edc4a0", "comment": "Malware payload (AgentTesla)", "value": "3654bc1442a6b4d41427aeded373f81a7a87a0bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733066, "uuid": "7292dab8-ebee-4555-96de-b98bfe6e7cee", "comment": "Malware payload (AgentTesla)", "value": "8b62431cc84c408ad677f36cd5b20527e0258ac4c635ace7b90e31c35c892bd8b1d1c786826a1792e064b73367f0faab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733066, "uuid": "3605adfb-eb9d-4760-9a3c-6d6672c8b88a", "value": "T15EA4CF04AB6DF8E2F9BBCB38507054159B218D4FB8A3B41D3E9F795E3E3534101A29B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733066, "uuid": "194e98cc-1a3d-46d0-a52e-db269e289433", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733066, "uuid": "f00a8c3d-dd03-4339-8074-75f8ebd6e19d", "value": "6144:xE8Ix92WYqKWlnSxPCRry/1B++fC9Ft6kPcHx/UgkaKSOhl79NWBSOjIu4h4:xECqNwPaU/fCtXER/UamNKSOj746", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733066, "uuid": "2199f0fb-977b-4b02-bf0e-d111357fa24a", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733066, "uuid": "5ea96a60-e22f-4680-9a5d-4c83eb1c84cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733066, "uuid": "de7e88f2-a1f8-45bf-a1c1-eb8ab3dbd5c5", "value": "Purchase contract a total of 9508102 boxes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927b92a7-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655722131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722131, "uuid": "81b69fef-1579-4c26-a6df-33ac87e4b8dd", "comment": "Malware payload (AgentTesla)", "value": "5b8fa280ce310ed5cdcaa701bbb1815a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722131, "uuid": "30e1190b-f1c5-4b61-975e-eb2aaa18f172", "comment": "Malware payload (AgentTesla)", "value": "387a765e811e6e32560ac2664259463d0a59284b34dbc43bdaf3bfcca250bd4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722131, "uuid": "20eab8b4-10e8-49ab-94fa-e8936bc5c8d5", "comment": "Malware payload (AgentTesla)", "value": "2270513608c91801187cb5a4246b0526f76be4f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722131, "uuid": "ca06ddd5-fa22-438c-9253-3e7311f67f99", "comment": "Malware payload (AgentTesla)", "value": "770637d13e52aa346204eda9feeb52288928b09838f35dd36fc6e98740b00740f4f3f3f717c2721bc604cf1d420b6c6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722131, "uuid": "a13185fc-a5ec-4f6a-a654-73c9a1b02296", "value": "T166C4F14165394A62F97C8BFC44E2A20453FC782AD2A7F7AE4FC571DE5823B468B10637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722131, "uuid": "fdd631d2-0b16-4805-89ac-2dd45dcbf30b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722131, "uuid": "bef3e716-e202-4c6f-a095-d136929eb91d", "value": "12288:n2iNsqlbi8XkpNO8V/e0CleuY9S/7TmN+pzmVJ9I:n1HvXkbV/e0GejS/7TtzAJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722131, "uuid": "a43a5bb2-d4cf-4cb1-af10-7046c920ba9c", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722131, "uuid": "59d475d5-e438-4ea2-9998-31f01322c36e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722131, "uuid": "003c5aea-875e-422a-b016-a84b7624e6aa", "value": "\u00dcR\u00dcN \u00c7\u0130Z\u0130M\u0130 VE \u00d6ZELL\u0130KLER\u0130_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035da679-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655709865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709865, "uuid": "3d742491-4d6b-4c86-933b-ad633b7cffe6", "comment": "Malware payload (AgentTesla)", "value": "4a379a01a8c5d8c9e692c805f4cc4c23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709865, "uuid": "8bcc563a-6d97-439b-9d1f-9046f2e6654f", "comment": "Malware payload (AgentTesla)", "value": "3997abf6f79229232e6850d05a6b7820a7475a8419db4a3a18fe57a2632956eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709865, "uuid": "cd7bb42b-0ba8-497e-a8d0-a14b37071edf", "comment": "Malware payload (AgentTesla)", "value": "87870d4b8bf067d25c0653bf5bf9b95ea5c17bc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709865, "uuid": "086c8a58-7b09-4209-9066-57607d35fe8c", "comment": "Malware payload (AgentTesla)", "value": "52a0af8cb010e9f9a3a9acea48b2ed6aa65ae736b660fe474d30a2e873ecf89685b50fcac123eba4fb23de31cf4a2985", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709865, "uuid": "304039cc-1b11-4af7-a848-ba64a5e52561", "value": "T1AD15690223C44F54F6B9E33A21B5901943F6F493D794DE6EBD9548CC1933FC24AAAB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709865, "uuid": "d7a2e3eb-5568-44f6-99e7-ae795168f576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709865, "uuid": "fe6502ae-f7c4-408f-9e5b-084790e9d8f1", "value": "12288:rw5a/ASwkaLiQ3gzrnSbmCz3xvZX2s5RgKNNTK2xykIf//FweVrEc7RP:M5a/A1dLFgzriFIOg8DyFH/vEcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709865, "uuid": "0993d181-024d-44b4-bb1b-2e6c1ad8a586", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709865, "uuid": "36f005c7-ac2d-48a1-ab4c-9f486ea96e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709865, "uuid": "820b96d4-7169-484b-9b27-ebce38d27bad", "value": "Claim Reference No MAR048780314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ee3661-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655734181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734181, "uuid": "687d67c5-5847-4192-b198-99929abc8f87", "comment": "Malware payload (Formbook)", "value": "5bec1fc847c595a94fbe7efb0695c640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734181, "uuid": "141ceec1-86a0-4c90-b07c-e3ee8e9a45ca", "comment": "Malware payload (Formbook)", "value": "39a3f149c23d6a96537aa6efeeedcd2dacb5d92103c736c115ef37a3054a6aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734181, "uuid": "7e22d283-4931-4d56-b72f-fb320acd4586", "comment": "Malware payload (Formbook)", "value": "9f37ae30983b62b6101e4a0808b7200312005dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734181, "uuid": "3ced075b-7091-4efa-ba56-2e5f209f0039", "comment": "Malware payload (Formbook)", "value": "c6958e7d3f54cc0efb20d9b7c1ddac9be9e2dcd91a63ce7ec58dad4cca4b99611bd69f06e1dc0a8823545fa85874390e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734181, "uuid": "a6024b74-0999-4889-805b-f07d40db194b", "value": "T17144E05B73C49B00D1ECAD35C4EF41141BAAEB833973E7593E4A53AC5B423A2AD44ACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734181, "uuid": "e8f06301-1f0c-4ce8-aa9c-c280a679e02f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734181, "uuid": "182a75b9-0006-42ee-8351-9565f6c6c7eb", "value": "6144:S9ri0xgdlWR6CDISokOxJCBOHbQzXZErdEC/Tv3aMP+xzxxhR:So8fHokOjyLJEpTvaM8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734181, "uuid": "0f32e0e3-37e9-4c15-b9a9-3e23315e84e1", "value": 275480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734181, "uuid": "056bfa88-8b97-4edc-ad11-88959a239304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734181, "uuid": "61ae3290-33c6-4590-bd3e-552f900e5874", "value": "5bec1fc847c595a94fbe7efb0695c640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9428379f-f034-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655686915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686915, "uuid": "e64f7938-ebf8-4a19-97be-7f276a4d529a", "comment": "Malware payload (AgentTesla)", "value": "99e952ecf614893188e8d3cc449c9af2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686915, "uuid": "6fe561e6-f9bf-4640-8c69-00279c39875f", "comment": "Malware payload (AgentTesla)", "value": "39d4ec1ba402cd585c3ce6fb42411ee7d12c88c1507b786ff99ea929497c1f47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686915, "uuid": "bbeb3dca-c15c-487c-b6e3-436cf73855a1", "comment": "Malware payload (AgentTesla)", "value": "65c17d53ea7b5f39bf8c6a1ef439648ed5936798", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686915, "uuid": "1c5607e4-6026-4453-8408-5a587b56a52c", "comment": "Malware payload (AgentTesla)", "value": "a5d769596d11cab90d4217247e35992ac03d67bbe21c4e250871a90ef1570a6fbe387943bde42f1f7c580c6b49d8f0ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686915, "uuid": "b96c2db2-2c17-491e-b427-ec70be5c6504", "value": "T1E7256A0223844F64F6BDE33A21B5501983F5F4C3D780EE6EBD9548CD1963FC25AAA726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686915, "uuid": "ebd443b2-2ee6-4080-8a73-a4219ba7cb2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686915, "uuid": "f9dbf3f8-1dd5-4b09-9a19-f13ddffeb7ca", "value": "12288:Qrue0SbmCz3xvZX2F5RgKNNTK2xyPIf//FdP5z59C:cTFIpg8DygH/Zt9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655686915, "uuid": "64c397fc-2a31-4db8-9b49-98247c107c84", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655686915, "uuid": "9c8cb6f6-8dc0-4629-aa32-b10dcba3eb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686915, "uuid": "d986ad7b-c915-4bc9-9f02-f694b4d66ca1", "value": "Claim Reference No MAR048780314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc4f2b4-f075-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655714956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714956, "uuid": "7a4e2cec-dd39-4fea-a218-4c1c77e91ec9", "comment": "Malware payload (SilentBuilder)", "value": "2bf0764ff73298d99a582d998f030642", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714956, "uuid": "1b758f6e-188a-4d5b-867c-04a6e37231ae", "comment": "Malware payload (SilentBuilder)", "value": "3a0f856caec4a5bff5adaf38d833f69604caf2a1a7be2c3b7281f0768290f3e6", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714956, "uuid": "282e3350-a50d-403c-9708-affc00eebb95", "comment": "Malware payload (SilentBuilder)", "value": "9f3bcf953b0f95ac528c23c40c2a3aa04ef81c31", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714956, "uuid": "f7b5aae2-fc21-4023-9d9f-2f7e0fe82a52", "comment": "Malware payload (SilentBuilder)", "value": "e1b3cc26cc75487ba3b8f571a22d95bff6a51a77b742bb84ed242a572f445f6e3a4dd064f5dcb06aa2845996019d2a72", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714956, "uuid": "c4f6c458-8d01-401d-a764-2fb033c2ea7f", "value": "T10A733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714956, "uuid": "f83ac1b3-d0be-4ddb-ac6d-f3ff5c32e332", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBs:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655714956, "uuid": "e4ff54c8-72c9-4395-9491-af128ec88f39", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655714956, "uuid": "7abfdffe-76f7-4bfa-a7f7-d4d78d0b52b6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714956, "uuid": "84a7abf2-b54d-43ba-b568-20fc8d22fc2d", "value": "Fattura 11155.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b827a24b-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655726060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726060, "uuid": "9af231ef-5c8f-47ba-a2eb-e4f45b11b6cf", "comment": "Malware payload (SnakeKeylogger)", "value": "a9107f2420eb78700404025f393afbdc", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726060, "uuid": "acb0b0e0-189c-4ce7-80c0-895ae41ff795", "comment": "Malware payload (SnakeKeylogger)", "value": "3a6219ab431b02b4d10181ea96528821fb43bb3d10dfdd4f8acab6a71fdd7cc2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726060, "uuid": "d66ce914-e9e7-44b2-b8a5-e89e86f60135", "comment": "Malware payload (SnakeKeylogger)", "value": "0e74806d87241d15f1d736e6dd174735e4d4d926", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726060, "uuid": "1f11a545-935e-4151-9161-fb9758e6939e", "comment": "Malware payload (SnakeKeylogger)", "value": "cc0f1c61403175bd3b459366629f4c4e1ed5f709ff5702820756b4c50702c7fdd6ac2ac5e38b6dd9975831e16e00cf3b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726060, "uuid": "dabece67-028c-4e36-a762-60e8ee62dd91", "value": "T1EFA2E17B800BC10D013C1B8CEC5EA6AB6B498666E5575629F06D2DE7689EF085BC3CD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726060, "uuid": "05e1b050-d404-420a-9d0b-65e395b6716f", "value": "384:oSC54bxZ7rZGmCXPjc0oGIxYNwSRW40Kw0Q/XayUPmoVUzFR/jY7Z:fC54bEmQ5IQwCW4Q0YUJVQVs7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726060, "uuid": "7c643acf-7238-4efe-ae8d-03ce9eb08ad3", "value": 21502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726060, "uuid": "0d69f82f-933e-4f3f-866b-aea126c63c01", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726060, "uuid": "92896f2f-1fc6-4b17-8d4c-c116273cf8c7", "value": "VSL DOCUMENTS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8b2484-f081-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655719943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719943, "uuid": "cd1d0b71-8eef-4946-93a8-21844839da91", "comment": "Malware payload (AgentTesla)", "value": "80d60511ef8eee2411416e0971ef8938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719943, "uuid": "6eaf4ae5-b5d8-45ea-ac86-87fc3528ecba", "comment": "Malware payload (AgentTesla)", "value": "3ac853d23956f9d1e7c6b4c88528940ef12b8d94beaa3ff1091e293eb98c7e0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719943, "uuid": "8426f15b-a233-4d2e-9083-6ab1d9fa8b36", "comment": "Malware payload (AgentTesla)", "value": "88fb012d8dbbeeae92e64ec54b471f830c011a8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719943, "uuid": "1a459dfd-6482-46fb-ac80-154a1c423ba5", "comment": "Malware payload (AgentTesla)", "value": "38e2f87909039b74e8e5b0bce6d5f2c9e3c106b67177b4deda54529fc68ec448e0e334c146b79e6628832466c1d7ac48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719943, "uuid": "af4f664f-a866-452d-a55f-7141f63f28a5", "value": "T179A4124A633D8752E87F67F952A30884C3B5A126D893F71E9ED534DB18B374483A630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719943, "uuid": "c18fdb42-c13a-4c3a-84ce-566d5514ba65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719943, "uuid": "15984a98-17ac-4a1f-9fe2-0660ad076701", "value": "12288:cR7j0Khp4tU3Pdylzmx7NyM7N5FTFGvX7ok9q8nssAPTjI8:830KoaPdylzmxxRj9AvX7ok9qcgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655719943, "uuid": "ccc0425f-9ee1-4b4f-8c80-1c922571e3a4", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655719943, "uuid": "c733df3a-371e-4735-8011-017f6033bed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719943, "uuid": "24499f37-c587-4cdf-8fa9-e98535a1f197", "value": "80d60511ef8eee2411416e0971ef8938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5093cd4e-f030-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655685084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685084, "uuid": "3f39f72b-5f53-4925-90a4-e1e1778e5d18", "comment": "Malware payload (GuLoader)", "value": "4e6919df0388c94b6408ad6b98a2f25b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685084, "uuid": "fa749bd7-a5c7-45d5-87f1-9f0a0477eafd", "comment": "Malware payload (GuLoader)", "value": "3b2ca6adb60ac4884f1db4b38493ecc88d8d4be5fb14016b97ab6399b1817235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685084, "uuid": "75be964b-c4f1-4574-86e2-61a6f7aa446d", "comment": "Malware payload (GuLoader)", "value": "cd57bac690a854261225471e737ef9103dea0209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685084, "uuid": "7559e6f3-c895-4876-9e1d-1211a8684219", "comment": "Malware payload (GuLoader)", "value": "c15afb2a73426c1689dcb2db078380cc4e37fb5d3c9084f03a33c8259ee8c9b856943f712d21a9541c8db20d2c21fdb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685084, "uuid": "58e87c98-6752-47c9-a8b7-4a2ed319c8c3", "value": "T180F3E01077B0D1B3D4B286705936DBBA1BBAED2559604E4B27403F5D3C32B83891FB6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685084, "uuid": "37a165b0-045a-40dc-8911-3fafd403c116", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685084, "uuid": "9c100d5c-a996-4897-b7d9-33e3ce529cb6", "value": "3072:RbG7N2kDTHUpou/Bwl/i4O9jb14P1wPU7SAvL0FMHXBF0uqp:RbE/HUHBjJ1equL+ExF0uqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655685084, "uuid": "aba7d777-f1bb-4c73-904a-0c4ed233949a", "value": 172744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655685084, "uuid": "4098cc78-c27c-4b2d-b974-9478e0ad2236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685084, "uuid": "92bf841c-250d-4352-94a2-4d1f5c608c22", "value": "SecuriteInfo.com.Trojan.Win32.Sonbokli.Acl.14073.10745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ad7c80-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655746613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746613, "uuid": "1861f64f-62be-4d42-85f6-6d7b4659dc15", "comment": "Malware payload", "value": "c2efbb02a3f4526dad18893816766d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746613, "uuid": "c0eb482d-5c5e-454a-bad0-152e6ca3ce7f", "comment": "Malware payload", "value": "3c8066e6a7cec22c91fc09a693a983d81899274c9dd152bea9d85e2549dcded6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746613, "uuid": "8d33c4ff-d8f5-43d5-b05a-722e4d0b1ed7", "comment": "Malware payload", "value": "e68ba967cacb70013d434a904d5aaeab2f5604cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746613, "uuid": "ffc075d4-a2ea-4e0a-b996-d205118d266f", "comment": "Malware payload", "value": "e18d9b0b93da2658f080d35974a1a12b2885f92a495e2c49296008280c57cdff3fe590042d845816b11301613aab2077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746613, "uuid": "7ace41d3-e765-47c6-afc1-62bb31e6192d", "value": "T196C19441E3E8933AF2750B71A9B353012771F3619D974B2D25CC662B5E23A064AB3F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746613, "uuid": "cd4e13d6-400c-4b63-8e3a-1137a34e2978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746613, "uuid": "6c7a7eb1-68df-4aac-b168-b8713e9a9926", "value": "96:6XBdmW0omFC6iJSYXqDVAjuW2zoAAzswv+QzNt:+BfgF5gRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746613, "uuid": "fb3daa42-8356-40e3-96fc-7a640a913bad", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746613, "uuid": "cdf11751-1863-4adc-8fa5-93351a5bd799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746613, "uuid": "ce2a4f25-e5e2-496e-b230-4966b9286461", "value": "SecuriteInfo.com.Trojan.Malware.300983.susgen.23326.16923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0d7d0c-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655715388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715388, "uuid": "208fb94a-7c82-4440-ab50-3dedc06e1f6c", "comment": "Malware payload (SnakeKeylogger)", "value": "1e0331fd8d8ba1f3ccf29c7a014d9e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715388, "uuid": "b8eb8abe-13a8-485a-bcb0-8175c9e764d7", "comment": "Malware payload (SnakeKeylogger)", "value": "3e438a0e856a9e14aace08e4462097e25d8c0560df6962004aaeffcd45e3c386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715388, "uuid": "5c3e688a-659d-4ca2-a5fa-023222d1df1b", "comment": "Malware payload (SnakeKeylogger)", "value": "2a4d25eb4df57844a76fb1572dd62a97c6e3d669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715388, "uuid": "5e0eed2e-3c6d-4f7e-9b27-f6a0f0b1fa0f", "comment": "Malware payload (SnakeKeylogger)", "value": "0cdcd1b5c5caffa50900c7cb726af72a26010437efea31580d66f3e1e31e67eab31df751a8e625cc5fc25f6dab683d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715388, "uuid": "eb2d77b5-8784-4c49-aef5-01eb267fbaca", "value": "T1F2B4D12027B8C719D5BFA7FEF03454240BF9751B312AF3AE5B41B4C91992B828537A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715388, "uuid": "f127b82b-8318-4721-a601-450bd1a1d167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715388, "uuid": "8ba05aa9-dfaa-4c0c-84cc-22b427fc9c79", "value": "12288:kF+yQVWoBOfcFklyOu8cT8wn2uwS1GSgHlUbdwp:5VWMOfcFkly38Nw2JaoFcdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715388, "uuid": "ff5a59b1-71dd-44bb-8679-99dbc0d1c66a", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715388, "uuid": "cf0cf3eb-a4f1-4e93-b27b-adb33246e96a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715388, "uuid": "ed4b5d3b-93ee-421f-a5a3-5148f86aefa6", "value": "1e0331fd8d8ba1f3ccf29c7a014d9e9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8e83ce-f07a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655716918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716918, "uuid": "4d18e72f-5fd4-4c85-8133-4e56198e787f", "comment": "Malware payload (GuLoader)", "value": "d34486adc81036cdda0d5c210e5ae8bd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716918, "uuid": "33e501e7-9624-4c86-94fb-771b42e70fe2", "comment": "Malware payload (GuLoader)", "value": "3fa365581fed4671dea84c1d84163ee8275a52b4677c6b5e3f0763fbfd0eb959", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716918, "uuid": "0c994022-2ebf-4b5a-9152-1f72027b60c6", "comment": "Malware payload (GuLoader)", "value": "e937eda3b903e3e6d5f9fbcfb544d732ec350d03", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716918, "uuid": "8456fde8-a233-460f-850a-a4172de52f33", "comment": "Malware payload (GuLoader)", "value": "905b6938902ac620e101683336c7da8f8dceda3fa2c6ec4fcf43c6bd624eab5b0230f3b52fbdf921f5899eeb87d7ee9d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716918, "uuid": "f6b9286f-9d6f-4159-ae81-535a8b8443b8", "value": "T122D3E7EAF8285082FD84B9447900F2679E36F2274DEF0509577766D8CF2E8788A1DC5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716918, "uuid": "39b9cd24-677d-4bb9-b07f-45fffefc35e6", "value": "1536:PsacqxcWN5TseoOCxhbHCpXR4xQaeEjd5VaW6TaosycCyN7deYycQfT/nPlhR52p:PL0OcAqybUZ/6s3Ro7/VF2FBZF6/0Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716918, "uuid": "4b13b589-2bd5-435d-9c19-454852826735", "value": 137127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716918, "uuid": "4bfeacbd-167c-40f1-954b-e3aad34c6dcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716918, "uuid": "6012d865-220c-4f24-b918-6ce44c4b03d5", "value": "DRAFT_SMK9484855_7484748474847.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1543161-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655716277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716277, "uuid": "ba917942-44a4-44ef-9754-b585dde8b7fe", "comment": "Malware payload (AgentTesla)", "value": "da2141ed8124003d75ef7133180bfb7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716277, "uuid": "37a0f63b-2235-4695-add0-4a3cfbe7917c", "comment": "Malware payload (AgentTesla)", "value": "3fee2b2045cb25e9d179db87b372620e071acec013c64d0e48079e8f5fe34478", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716277, "uuid": "79403ba9-2e6a-42fb-9bd3-4826e938f731", "comment": "Malware payload (AgentTesla)", "value": "d812ab0d728671bef60db37843402a4dc9724a9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716277, "uuid": "5f64584e-3bca-49e8-99d9-a25cc8982463", "comment": "Malware payload (AgentTesla)", "value": "6037e579e1a10cdec9418c769dbff2f12f5adc6f23436efd5536abd59eb6a4c6ac558b66d6f8a32d2a2a45513eeb31dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716277, "uuid": "8184504f-97e1-4da7-9bc7-c0d16febd3d2", "value": "T11583F2821E988BC5D2E3AA7EC4A98B878F775CD9483413C6CD127B870F38C4A5F5D11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716277, "uuid": "c43fdb62-69d8-4865-9e58-e6381f2b768b", "value": "1536:4aiRECr0lkrxnttuKzOQ9RNz/1lCjvg9UsBiWT3Z3ubN:4ai2YFjtuKCcNzNlCpshTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716277, "uuid": "633f920b-07db-4f61-9cf5-f401eeeacf74", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716277, "uuid": "641147b3-b385-4151-9883-9ef757741dec", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716277, "uuid": "10bd5545-1e3e-4316-9542-720b470cceb5", "value": "Payment due date.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2320eb9-f07c-11ec-93bb-42010a9c0043", "comment": "Malware payload (WSHRAT)", "timestamp": 1655717943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717943, "uuid": "32413ce8-53f7-4364-9b66-12c8dbe0f447", "comment": "Malware payload (WSHRAT)", "value": "2eb194e1b54695a5c2aeb82b95807606", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717943, "uuid": "aa3e877e-542f-4159-82eb-5f2535c16a9e", "comment": "Malware payload (WSHRAT)", "value": "404dfe7add02b2973a45f43d425005451c7b6ff688e5177dd7c7606a1a7320d6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717943, "uuid": "87f563b7-400d-45e4-8321-b541ea3f4425", "comment": "Malware payload (WSHRAT)", "value": "f148013459520d855a4177d980b3870ef1d6b8f0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717943, "uuid": "80560957-f33c-4154-adc9-3f33c656da30", "comment": "Malware payload (WSHRAT)", "value": "a53285135e46b2368ae52e6e52c94d2116317aaa245c7f03f3d9f65fac2fc7c1c22fcb4751cb222b7a16e636f00b2a82", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717943, "uuid": "e17b46b9-21ff-48cc-8ed8-78c70b281cf6", "value": "T19052DA4BAA8D8D3A8B3192914D07100AE7D0428B221675847EDCD8C57F3556ED3E3AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717943, "uuid": "85652fb6-4092-44e4-97d0-d2e592586143", "value": "384:9zzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:9zxqagRYwZSGECXCgMmsgV/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655717943, "uuid": "6f6b9afd-60ef-45bc-80da-9fbacd301332", "value": 14273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655717943, "uuid": "58cdeaee-f2e1-43fa-8567-1cae6ab6c020", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717943, "uuid": "4faeb9d0-9991-40a5-8404-8a021e5097ac", "value": "hmmm.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971b46ec-f04c-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655697228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697228, "uuid": "58704df1-1aee-4b2e-bc36-e3af8073cc7d", "comment": "Malware payload (GuLoader)", "value": "934f2a7575ace0a41aadf1b5571cdbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697228, "uuid": "730c4528-df69-4a15-8eea-1dc11ce202f8", "comment": "Malware payload (GuLoader)", "value": "40893a636e1d20f5e4c030c7865879528cb93965b1bccc979d3a80b58b0e10cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697228, "uuid": "f1d3fe10-ed54-4e8e-a194-a383ec0606cb", "comment": "Malware payload (GuLoader)", "value": "0ae3cc03692b0e767dbae13ea6fe9d309551ff91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655697228, "uuid": "4de50748-e17a-4312-9f85-85a814fa6590", "comment": "Malware payload (GuLoader)", "value": "577d99e58e1e8b416d001c1ebc9eac1251623a791c7a5484ac03710091e2253acb6cb30d119a59ffc60472d755654865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697228, "uuid": "aba733b8-b410-4fe5-8940-a6607c5ff899", "value": "T150946C472634DE92FA3E3DF2F9191A6A9F4F3CB2416E35059335738812B2A631F1D192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697228, "uuid": "c2adeae0-3d70-40c2-a3a2-fe18865414c5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697228, "uuid": "bc80a2dc-ee60-47b9-96fc-b6058efb2dc4", "value": "3072:tbG7N2kDTHUpouNq8WJQjsAjdbRPCWONjSesP2mI57lK0UDH/F44Cu8m27M2:tbE/HUw8WJQjsANReuhe7c0W/FfCu87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655697228, "uuid": "5c2bf483-3a65-4819-adc6-fb727bdb859c", "value": 409605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655697228, "uuid": "40c29032-caec-4927-b364-26a852608f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655697228, "uuid": "c33aff0c-cda9-411a-8413-87976022a592", "value": "Payment Advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb90429d-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730441, "uuid": "2e66808a-4257-4ebd-a06c-d02d354e0eff", "comment": "Malware payload (SilentBuilder)", "value": "fb9611d8cbd98fbb8c866d5881cd432f", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730441, "uuid": "04f5a4cb-56da-4af3-85ca-82937510d023", "comment": "Malware payload (SilentBuilder)", "value": "40db5d445d924341628549798397697488b297c155b9f1377fe764bacb10380c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730441, "uuid": "80be31e5-381f-4a4e-98dd-c4821c1a9ea4", "comment": "Malware payload (SilentBuilder)", "value": "f81250226b18867b305816a1b805317ad0d62859", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730441, "uuid": "5f029b60-5907-4bf0-bd90-f97dfeca7657", "comment": "Malware payload (SilentBuilder)", "value": "3b5841c7017eba9f1921803961d0256de0cd4d7d10e79ffb374cd3de96b51ed04daa7f9e8754c1fd201bc5e7a39a7472", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730441, "uuid": "d250cd9e-70d1-4729-a411-8b3b0477a9f8", "value": "T1C2733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730441, "uuid": "eba9d7db-2860-4154-bee2-e45f0d478820", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBs:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730441, "uuid": "8088e39a-5ddb-4afb-9586-6c89cb7d77f8", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730441, "uuid": "ead69d58-1ec5-402a-b20f-23475d98fc38", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730441, "uuid": "15f7ae65-aec2-47dd-95f6-238ed3797c62", "value": "10004013730441587327.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d2e056-f0c6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655749388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749388, "uuid": "8a3d922a-ff6d-412c-b02d-6dbd3781b839", "comment": "Malware payload", "value": "ae3593cdc6d4c2190cf1b8f95e6ea411", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749388, "uuid": "a6d25c83-f2b6-474f-88ac-37947f11eb21", "comment": "Malware payload", "value": "40fd7a4fd13cf4057de10b3eb1d89a596786f403bde6e79f3539fedd51af68de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749388, "uuid": "bc6fb82a-8ec4-406f-8607-8cd979f46bac", "comment": "Malware payload", "value": "1a45872a660920484139b35f572c5871e4df5608", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749388, "uuid": "86fd2cdf-e76f-4387-ab2e-88e9ffb2943a", "comment": "Malware payload", "value": "93ebac9a90bdc4b26da7ffad510c6f8c65a3eff623fe91826c0ef05d4d0ab1b39cb7b48ed250e5ea8a639d32fe472de8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749388, "uuid": "4794f82a-3748-40c7-b448-bcadf0f80d93", "value": "T1CCE4E343286C5B23DFBADBF014155EB232F9389571D8BC6664801C97F429FC2879EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749388, "uuid": "ef5bdbb5-2342-4d36-847e-3b875db6305f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749388, "uuid": "77ee9e08-1588-4217-919b-f3a9a7ccb020", "value": "12288:mS91vu3/OkxStrlrxjxnsviMxhp2Fr5qFoJw4jL:KvOKUNxNgi432CFoJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655749388, "uuid": "b3ca8308-7e31-4b02-8702-198d36b6e4fd", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655749388, "uuid": "4f914303-2e07-429d-a4eb-563129d5c9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749388, "uuid": "2b892d15-ee9f-4a58-9026-70fbbf94a13c", "value": "Purchase ORDER 20TH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6787afab-f02e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655684263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655684263, "uuid": "e8034c76-507a-4c4b-8f66-0efc3ea37255", "comment": "Malware payload (AveMariaRAT)", "value": "944f35041a178c4ab4d7344ff67664cc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655684263, "uuid": "461e2bcb-cb21-415e-8a33-4ac09da57ba9", "comment": "Malware payload (AveMariaRAT)", "value": "411d9a87969af5f4a8c061816339ac5563feb055b75630c031bc300d8f5a47ba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655684263, "uuid": "4373dc1d-e7ea-4566-a565-aecfb0deddd5", "comment": "Malware payload (AveMariaRAT)", "value": "07f503ca3dad638307bb894bdb2b799bff91388f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655684263, "uuid": "89c18113-4666-4972-8502-bac6faa9118e", "comment": "Malware payload (AveMariaRAT)", "value": "8b3b5bb5c96f21567159de075c3e0dd3d61741efb942a3c3da0891ce8270794c165f708fdeb46a80d65def43a7522615", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655684263, "uuid": "c9e72cce-b45d-4cd9-a0e4-ab7a7fb598b0", "value": "T12B14E01E3B89BE62D3DC4C3ED0C3669247B4D436424BFF0AA2C1C6695C5B7D68A1718B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655684263, "uuid": "10b0f7ed-694c-4739-9a71-e2e2a915d6e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655684263, "uuid": "0574cc46-c0db-4e28-b04b-29706a3b4828", "value": "3072:HkaAnved/WGq2a5I7v9LkcGciZyLJ9EOBg72JQScflXfBNroI7RI5Y:H5+vepE8AcHiZyjgtScflXfjHiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655684263, "uuid": "fd7ac3e0-03c2-44c8-b482-62a9b3ad5988", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655684263, "uuid": "2f1e8f44-fcc0-40fb-852b-dbf79f0db7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655684263, "uuid": "c1a3b208-8488-40b7-8221-1cddda7a99aa", "value": "RFQ_SCT972673_TM Agreement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359fa201-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655733572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733572, "uuid": "aa2ea42a-6fd6-4f3a-975a-032afa894d59", "comment": "Malware payload (GuLoader)", "value": "6037349f8abaef0d8b60daf01ff2e1c2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733572, "uuid": "f759fdac-8ec8-4daa-8454-9e7ca735b86a", "comment": "Malware payload (GuLoader)", "value": "44015879ca68df9b47209c3050e347176b6cfb2ffc6c2ca9842fe74cb3a31495", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733572, "uuid": "9fe4ced2-e03b-449c-b78c-021010aee4ec", "comment": "Malware payload (GuLoader)", "value": "d973ba9bce92c86fcb1a8055c9c6f2389852ae23", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733572, "uuid": "d4784f5b-3a0a-4a13-b65a-b084801704c5", "comment": "Malware payload (GuLoader)", "value": "f118ddc2eb67c3bde6a689df98753a307497f7fabb8e00a60148561614234f17b968da9ae7a8b0c7cad30fc53fb93fa9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733572, "uuid": "3dce0183-c4c7-40df-a086-a4b6cedf1a33", "value": "T1A883D0282168BF86D9A7C7BCB9723925D7157C8C591C2B8B2685320736FBF418443B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733572, "uuid": "ef6d53b0-2498-4514-9935-057e69a494c3", "value": "1536:eTnHP2NYUucxEds5+aVrpTZ0ymizQdVmILKp7huA7BSm:eTvWYUucxEds5+4ZLSXm97Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733572, "uuid": "491e27bd-189f-4d7f-81b6-af43808d4576", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733572, "uuid": "9c484163-f428-4111-bed4-e87869c9d07e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733572, "uuid": "84e07efc-5eef-45e0-91d4-24d5e653cc49", "value": "RFQ SIBAIRQ-PD-GKH-780.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0759ac03-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655716314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716314, "uuid": "5959dfbc-9ea7-4193-be39-aeede3e16924", "comment": "Malware payload (AgentTesla)", "value": "8d4fa21419c1f71ae246be22950557ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716314, "uuid": "6ae59732-4e9b-45f1-86ac-62d90e82ec19", "comment": "Malware payload (AgentTesla)", "value": "44dd93bf639107764bffec1a2d72574ce2458f0d89c994f4b0ed629093ba9b0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716314, "uuid": "0b2da29f-8e91-4584-b76a-8968a470051f", "comment": "Malware payload (AgentTesla)", "value": "cce9cc94be09b0fb872193b0ef5b22dda310fd99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716314, "uuid": "458e2e10-9866-43d8-881c-3c0eede48042", "comment": "Malware payload (AgentTesla)", "value": "d9aa736e86d741bd6965386f3f8087a0982638fb41fb1c94d63e12815d1ce09526edff112d8854c15a3249f6f75e2499", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716314, "uuid": "8376dd76-e643-47f0-81f7-e4f5710cd0f7", "value": "T18CA41226A69C626BCFFC44F69455A44883B08132624BF3E16DB165D16B8EBFC87053F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716314, "uuid": "0c989faf-3eb9-45af-a0d0-37858c81a7fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716314, "uuid": "81445772-61b4-4db4-b00e-596077aa9ed3", "value": "12288:3hJj05F6wLV/mBO5sh803Q+02UtUU2pCqVBa:yLVP5sy03R6UbcqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716314, "uuid": "b0b943c7-21cf-474a-b856-cd63b3b23a1d", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716314, "uuid": "166626be-b6b7-4b6f-bf1c-2482f1c61440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716314, "uuid": "64cdedc9-c4af-49b0-a50e-261558c4386a", "value": "DOC3443234545343089489389478478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19ff065-f09b-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655731176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731176, "uuid": "49cc1f55-cf23-41a9-ac7b-67be68ad124f", "comment": "Malware payload (NanoCore)", "value": "88e3eeefbb87b4534e3715ef59f81173", "object_relation": "md5", "Tag": [ { "name": "32bits", "colour": "#5CFE1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "fake av", "colour": "#70E39E", "exportable": true, "hide_tag": false }, { "name": "fake gamehack", "colour": "#D416A6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731176, "uuid": "0aede63f-6679-4942-8dd3-2e1541cbde59", "comment": "Malware payload (NanoCore)", "value": "454a0228ab3aca978bb8da603e1f1ef783d2247f95d186f2f46c5e050d12ece3", "object_relation": "sha256", "Tag": [ { "name": "32bits", "colour": "#5CFE1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "fake av", "colour": "#70E39E", "exportable": true, "hide_tag": false }, { "name": "fake gamehack", "colour": "#D416A6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731176, "uuid": "8cba80ba-7f6a-46e3-9471-426d4e94e277", "comment": "Malware payload (NanoCore)", "value": "471e2130d96d02a018cdf877d963c98a631246cd", "object_relation": "sha1", "Tag": [ { "name": "32bits", "colour": "#5CFE1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "fake av", "colour": "#70E39E", "exportable": true, "hide_tag": false }, { "name": "fake gamehack", "colour": "#D416A6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731176, "uuid": "0777d970-5d6f-4c1c-9a13-330b3573d5be", "comment": "Malware payload (NanoCore)", "value": "6c35bc7c0790dc8e2b8ca055b5c22f7693251940e52db29de0cd7cd8108c8d6f1f5f8106556950fa723fda5461b0a5cc", "object_relation": "sha3-384", "Tag": [ { "name": "32bits", "colour": "#5CFE1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "fake av", "colour": "#70E39E", "exportable": true, "hide_tag": false }, { "name": "fake gamehack", "colour": "#D416A6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731176, "uuid": "182438bc-ccd2-4d6d-80c3-db6e78018db0", "value": "T18D14CF1677B84A2FE2DE86B9702212139378C2E398C3F3EE58D854B69F167E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731176, "uuid": "8c787e89-9437-454d-a8b6-8edf04665e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731176, "uuid": "be037429-3369-436e-baef-f78a9bc1306b", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIvXcZVg9FMMywQakxalJR0:QLV6Bta6dtJmakIM5LVgLMMywQVol0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655731176, "uuid": "436dd0c8-bfdf-4894-a7d8-b5f231987e54", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655731176, "uuid": "88e34491-1e3d-4692-a7ec-d2b130488822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731176, "uuid": "d5d2ee49-4202-4284-a968-3b8402ba7055", "value": "dQwwXsTxxeE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abcd3c8-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744693, "uuid": "44d43087-1c6a-4510-b5ac-37ec38461f92", "comment": "Malware payload (Mirai)", "value": "b4ca1d35dcf04885ac589c28068384c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744693, "uuid": "a676036a-359d-4564-b635-c096aa12bfcf", "comment": "Malware payload (Mirai)", "value": "461c9dd4aae5afffd05c257282710800f9b579203105a191d2a93d1c6b4d4283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744693, "uuid": "2e9ad8b9-ab36-40fd-8fc9-d7018f6fc329", "comment": "Malware payload (Mirai)", "value": "758718ade4785ad7ffda217fa9049b9a7245845a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744693, "uuid": "ac8a21a4-c0d2-4fef-afef-7969fb44cbc7", "comment": "Malware payload (Mirai)", "value": "06159ec2779bf924dfb9d9012b421e91381912e0e47abbcff3eebdc2bb3fecc837ce4e9cd05c4d18d4bf5f856d9c1c90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744693, "uuid": "08d38a40-6749-42af-9260-573c0df3d9dd", "value": "T166334DCD86C3DCFAFC1609715037E72B46B3E52A71B8DA8BC75D9436E846A00B127A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744693, "uuid": "98233dd2-820e-4827-8bb5-3b509dcf3e11", "value": "1536:ofmJYNkbfY8oRP+XMGGE7lKNMtfoTVC0+TvWWBPSJF:ofvkbfY8yzGn7lKNMJmU0tWBMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744693, "uuid": "f3ccaa61-524f-4827-bd4a-7a3ad65e2c86", "value": 50768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744693, "uuid": "eed0883b-f9c8-4c92-89a6-1bd0bfaa06bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744693, "uuid": "2973f37f-9b27-46cc-adb0-005b911154ac", "value": "Hilix.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cd18c0-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655730460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730460, "uuid": "cd4e4eda-7531-41fc-b518-64ffecd04aa4", "comment": "Malware payload (Formbook)", "value": "cefd23893943a163d427242bdacd0c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730460, "uuid": "17ffba31-6bc8-4168-bbf3-8d5108da90e3", "comment": "Malware payload (Formbook)", "value": "464844ea4cc4d58808b0d116697384cbdd567f328734b521b14e48e488770cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730460, "uuid": "e9cacbac-94e3-4e21-82c0-f779dd7effc0", "comment": "Malware payload (Formbook)", "value": "6732ea5eee78906adb4dc199dd10ad2edb3260cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730460, "uuid": "d307854a-3130-42e0-81f5-2f838b4aac34", "comment": "Malware payload (Formbook)", "value": "c7d1d8a644fd846b5b899d99e13acb53a1bdad448746871a38a69ed7fef8c54396978078fad83a4f86a4eee05b12a3b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730460, "uuid": "43a4dc42-c156-4709-a3a0-2cee0bb554ce", "value": "T1FA25AE61F6918437F07329789C1792A8592B7EC32E79B94A6BFC2D4C1F372913825393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730460, "uuid": "a91625ce-5791-467e-9121-caa39a73474d", "value": "6bc49b119ffc99d9e27364e06b706e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730460, "uuid": "196100f6-b886-4554-b771-363dad9834d3", "value": "24576:mArq7iX2O7Zo+r5E1kBiKvyJsPFtZd52EUAEc:m17+7rTPdtZ9Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730460, "uuid": "19565901-bfa3-4b95-9e34-6727a61c826b", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730460, "uuid": "07783a18-21c6-483a-a78f-b2c32824304b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730460, "uuid": "38e1689f-4f99-4983-a908-55ec0d9d5627", "value": "listi\u0107 obavijesti Prijenos pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fac5c9-f0cc-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655752361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752361, "uuid": "a06310e4-5731-4468-8d11-cf28ff642cbd", "comment": "Malware payload", "value": "59c4d6f4c78fc2f88bfb4d05fd0f6e13", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752361, "uuid": "f3165c42-b7bc-49de-8a56-523c7ee28f9f", "comment": "Malware payload", "value": "4721f3172192652bb553bf782832a9d6b21843095cfc04263d1f4cb71c2e34ed", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752361, "uuid": "13a44ebd-4b90-4cca-af11-bea23d46d591", "comment": "Malware payload", "value": "c7e7f5be1434b2b84780aaec0d07ca1b8d50e4ac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655752361, "uuid": "193f0b5f-6e83-43e6-b30b-12705b70e666", "comment": "Malware payload", "value": "aa5738b5b8a448deabb6f4666b5b039a5f9cf50280effe1be8902aed3dead1bee079ea0c7bd37c92e52f06757881c013", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655752361, "uuid": "3aabce21-d040-4c8b-9d2c-1785879f6c9c", "value": "T106D5338261C607CC2B1923F579DE668AF4DCBD2D060F07DDA559690870ACEDCA7AD2C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655752361, "uuid": "e745903a-df3d-4931-8419-86f5cc3d5f46", "value": "49152:jKxUQCB9Lrb8QOtBQcW6vuyud2yvQDHfAbx562W5FlefYJw0kyuJbqHeoWtWN2L:j4CBNbRaVW6vMfI7KxY2W5FlldrCPoXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655752361, "uuid": "4602db74-f397-4394-a91e-b1ef47bac5a2", "value": 2745449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655752361, "uuid": "c2044506-9226-4802-8f66-07cf3c39b3f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655752361, "uuid": "ab32e18b-d468-42c0-9201-a9387e74d62f", "value": "almabike_document_17.06.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19da4fe-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730451, "uuid": "e51467dc-090d-42cd-8c55-36b80113832c", "comment": "Malware payload (SilentBuilder)", "value": "c9cbf09ea2e79aacba27c5aaf875884d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730451, "uuid": "6649ebc1-3a07-44bb-853e-31a7e53bb92d", "comment": "Malware payload (SilentBuilder)", "value": "48a59cd27d7410304be7f79ddfed5c2728f29b0c3fcf4133e9847fd52688d980", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730451, "uuid": "6a795b64-8983-4bb2-83a3-2260cb54a8cc", "comment": "Malware payload (SilentBuilder)", "value": "da4e406137998e54f5a71eb0450840cafe70173a", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730451, "uuid": "8577788a-32f4-4871-a0ed-8b262b0afcb6", "comment": "Malware payload (SilentBuilder)", "value": "5d367e128cbc2bdec0c7607e03c8a3407f82220ac64bd0d6ef8b58a72b2dc42b6bc1880a1cf3a1626f06a8c3b3556103", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730451, "uuid": "cdb44132-9305-4a05-b6e3-b90ab5695fc3", "value": "T1D2733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730451, "uuid": "7f46f330-df1e-40b1-9abc-5645714446b0", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBI:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730451, "uuid": "fb106566-9b85-4bb3-878f-c44dd189f62d", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730451, "uuid": "61a7e278-e841-4a34-893c-a73212400b3b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730451, "uuid": "cc8a2265-4ac1-418e-ae79-99bee201b5da", "value": "4757018218763875.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57a9b18-f09e-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655732471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732471, "uuid": "fd7dfafd-aaef-4f40-8d01-8b16ca2574ac", "comment": "Malware payload (NanoCore)", "value": "3570c3ec25085575b50b8481499831a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732471, "uuid": "647b7dd5-fb1e-4ed6-b412-4d006c0acf65", "comment": "Malware payload (NanoCore)", "value": "48ed2b7e0dc99d1beac1d3491e35f6053320b2e66858f609b5ed012508ebb391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732471, "uuid": "b0ff9e44-d853-4a7e-8c0d-3dee7ea40196", "comment": "Malware payload (NanoCore)", "value": "d916896fafc9ce31cd3c28c778c8b3bc1da8f6ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732471, "uuid": "6ceb7e53-1026-44ab-8fe0-007ea8fa8c26", "comment": "Malware payload (NanoCore)", "value": "30a29a376a735eeee59ee2c7f84d8bde658a116c42e8f8d04534136b10fc336153acbdbae767efade7b76e6085c937e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732471, "uuid": "3a7c316f-ecf3-4f73-86cf-30369bc87f9f", "value": "T17914CF1677B94A2FE2DE86B9702212139378C2E3D8C3F3EE58D854B69B167E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732471, "uuid": "0d3105ee-93ad-46e4-801f-5f5d791769b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732471, "uuid": "72f62967-7bf2-498d-a0e5-459e3e47a00a", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIqpcZVg9FMMywQakxalJR9q:QLV6Bta6dtJmakIM50VgLMMywQVol9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655732471, "uuid": "56a205d3-f228-4613-afb3-eeced727d0b7", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655732471, "uuid": "b1389169-72ae-4fde-a8ed-d9b3717e4476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732471, "uuid": "46ccfdfa-d1fb-4591-911d-134d50e10426", "value": "troll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57297fd1-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655726326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726326, "uuid": "9e5d0925-b1dc-44ae-935c-cc2d0f15391c", "comment": "Malware payload (AgentTesla)", "value": "27cbfe9438d2302189aea072b7cc455e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726326, "uuid": "fc09a19c-12a2-47b9-8680-4134e0ce3e65", "comment": "Malware payload (AgentTesla)", "value": "491c0c49924d05da37712d0376a31a4e69ef82fe47dbc215afc7f06369b1e139", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726326, "uuid": "6a3d1cff-c27f-4561-a783-52bb4a3de1f7", "comment": "Malware payload (AgentTesla)", "value": "f0ae2a193d9503e989815a00cb1f80b77bf2de06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726326, "uuid": "64574a00-9336-496b-b304-a9d0537aaa3d", "comment": "Malware payload (AgentTesla)", "value": "b520400948444710be1bf22c04be25afbd1a93c817667aeeed7d9252ef93b81dc8467fb7164a4581659fd72b1b97891c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726326, "uuid": "1e9b17a8-6df2-4493-b2c1-769cbf9e9f38", "value": "T128958C0223E89B1DF2BF5F36A87110148AB3F5166F61EB5D351CD17E2B61B009AA2773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726326, "uuid": "e55bbd03-4d41-45d0-a7b7-de908dc59a23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726326, "uuid": "6959af33-0788-48e4-9dae-7000a5f92e8c", "value": "24576:Ug3t8lrlNvUISP5xRrxIMNRxV2fNrcJ5Q2cGq4Oi1sNya43vJqySnWz1sC2:ULrlWdPjXjT2DV4OD43vJqySndC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726326, "uuid": "6bc6d1e9-4be3-4786-8b09-4d432b5aa583", "value": 2024256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726326, "uuid": "071fe21a-0bf4-453e-b81d-c9238adfc88f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726326, "uuid": "fffb1ef7-5880-43ca-bfc5-8dea8cbb330e", "value": "SecuriteInfo.com.Variant.Tedy.123517.31792.3618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a03917-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1655745405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745405, "uuid": "2360d32d-ed18-4873-a3b2-ea534cde8fda", "comment": "Malware payload (QuasarRAT)", "value": "97532a90b14c6d0084fa2193982358bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745405, "uuid": "3a490d84-e506-4229-b965-53d1578ae25c", "comment": "Malware payload (QuasarRAT)", "value": "4a3a8abd7f6d5fd9adfb51703085e839781cffc341705123be40b0c146dcf0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745405, "uuid": "f829e358-783b-42aa-a18f-ab0c93584920", "comment": "Malware payload (QuasarRAT)", "value": "dd4a9ddf2b84b3f500cc4a54f08aac1c00fc54cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745405, "uuid": "8ef12143-5571-40d9-ab95-666cbf9c2b98", "comment": "Malware payload (QuasarRAT)", "value": "adde3512476e9005a5a0a7a06f5a0840c151ecdf2171b40608e9d1ca6d2ffd3d1c40c30d84df90cd715c1b82be74c3d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745405, "uuid": "d922cb58-065b-4395-8727-508895d813fa", "value": "T195B46D4067F88527E1AE577AE87104319BF5F807B26BEF4F4A40A2F92C6670A9D40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745405, "uuid": "7588747e-546d-49c9-9211-9344f4fe742f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745405, "uuid": "af62d331-96be-4bdc-a8df-7215ddfadea7", "value": "6144:JTEgdc0YtX7IxUpGREWCvnfneqgZXrO1uvkAlcEY3fb8FgEjOjlhTcZ96cTR3J:JTEgdfY2xUZmXDE8HjM7Ta96cdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745405, "uuid": "5f047d7f-ae35-4fd3-9e13-3481a6dbe588", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745405, "uuid": "7415ffee-de08-467c-91fc-14776e52bcf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745405, "uuid": "920107c0-11ae-41a8-88f5-3f3e4dd6e9d4", "value": "shitgame.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0985ed1a-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655716318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716318, "uuid": "577a8ae9-d462-4c52-a80f-47ac3caec448", "comment": "Malware payload (RemcosRAT)", "value": "4f30d169ae00fd1227d3df3173078dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716318, "uuid": "f83e3208-93e2-43fe-9729-d04cf9ae8a32", "comment": "Malware payload (RemcosRAT)", "value": "4ae4c2b6f32dd67cca997477b3bfb8caac0f9657960beb758834191e36ae0033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716318, "uuid": "68697c70-cf6a-44fd-ad68-370fe2daae50", "comment": "Malware payload (RemcosRAT)", "value": "3692b295853e980517ac3101e866f2010e0d3ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716318, "uuid": "6bd98c3a-5714-4ad7-905c-2e44c15203a8", "comment": "Malware payload (RemcosRAT)", "value": "e67c119e5ed2a34bbebe6674cfda8c7f2fe40e32492c2e13b94963575419386d488d71160d336af730056cc1a1904961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716318, "uuid": "025adb8f-f6d0-4172-82e2-6d9d798bc021", "value": "T15174124469F99B63D07797F40CBA11908374A6325993FE488EC530C904FAF589AF6B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716318, "uuid": "64876764-6c36-4407-98a9-b1912bbc6f9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716318, "uuid": "b2abb960-ed17-4adc-b294-0ed4f237a339", "value": "6144:DxtkVwc4n4VEhL5miTTWhvApNNRCW/hqdrXnqaRMPDQFUK0TTbALvx:Lci4OzmiT0v4Z/hq9XnqaRMPDQFGTMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716318, "uuid": "8dcefd23-01ce-42ff-a06a-4f6f42e6514a", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716318, "uuid": "8f51c242-07ce-4130-9844-67593e444a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716318, "uuid": "ff64f808-b04d-4d32-a799-90336774c1a5", "value": "ENQUIRY # 12201408_06202022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce43f348-f0d6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655756591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655756591, "uuid": "21ce6490-0460-490c-b250-7b82c4d59f84", "comment": "Malware payload", "value": "f7eb6fa0a6b0586dd613d010385c2a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655756591, "uuid": "84dea683-7314-4966-89d2-79cb96c38fbf", "comment": "Malware payload", "value": "4b24c15221047665beed68b9fdb94a826d6debfc3f8843a99c3ac296028f7176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655756591, "uuid": "288ba8e7-c31f-4233-869e-516de447809f", "comment": "Malware payload", "value": "2fab399f35f8ad49a35a46fc8eaf1fc7c207db61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655756591, "uuid": "5deb107c-43b4-419a-8f68-dd8630055abf", "comment": "Malware payload", "value": "1b904c864460e006e898f064b96892c76e4f035f0d042b5a998840b754a5a73089d6693ec8afb8f8c6fe74b0dbf04dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655756591, "uuid": "1a0a6f21-f339-4646-8c60-7c5a38984cba", "value": "T1FAA46B9CB22C74DEC89BC27299B45C64AB50746FA32B510791630D9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655756591, "uuid": "6e9606f0-cbbf-4f29-94e4-e479c4c3bce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655756591, "uuid": "6adf147b-02e5-41cc-b3cc-c94f97772300", "value": "12288:NmrSdNmMQLfj910beN6/3JK1Xp0O/23ASxmHFgkg:fNmMIj9KJ3Jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655756591, "uuid": "3634f75b-514a-4c75-8043-c357176eec23", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655756591, "uuid": "dc9b5302-45fb-4e0f-b97e-81b4872e57ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655756591, "uuid": "9eeec03b-8122-4d02-a005-e851f162a5a8", "value": "MT TUCHKOV BRIDGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f606cd13-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655747638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747638, "uuid": "2768ab17-a0f0-4cc5-bc74-1491911b5e18", "comment": "Malware payload", "value": "23eabf874151ed5d663e84bc12631f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747638, "uuid": "e2a7c70a-4ae1-431e-8940-d4191e59f8cc", "comment": "Malware payload", "value": "4c26dbee513067e6d327e4b336b29992fd5270a0a8ecd1e9571378a3fb0bdc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747638, "uuid": "71028425-8298-4fb6-bdc5-e2e71555c7c3", "comment": "Malware payload", "value": "fe8658bf4207335dbd53edcb3c5ea9b15414fbac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747638, "uuid": "a5b6944c-0d73-42b0-a03a-1bbf46ab76b6", "comment": "Malware payload", "value": "7ff1ecc80f97e6ee9ff59f9b7c898d55845b5aeb733bc7aa28bc523e417e697612eef5dcbc318420071fbb8d0188b1f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747638, "uuid": "c08ab9a0-2b58-4791-9cd1-87d14b589808", "value": "T17C743B44EB918CBAC921633B89C7D277623CBAF44763DB476E651934EA132E15FC9302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747638, "uuid": "8bee52bf-a9f3-44c8-b658-7d7c591e272b", "value": "ddb8da8ce9f6d7c99471e82a46c98901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747638, "uuid": "c811540c-afb8-4509-852b-21429c0f9ae8", "value": "6144:whf/YQTFZtNMYORbhB9l1ds1yVQhAyPlO/s:whBXbMtd161yVQhAyPlO/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747638, "uuid": "cd2f136b-0b54-4773-937a-34a7a7b65991", "value": 356199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747638, "uuid": "e856c3ff-14d7-4d74-86ad-6983e0e38f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747638, "uuid": "f2d7477f-860d-4969-b563-1be0a416be4d", "value": "4c26dbee513067e6d327e4b336b29992fd5270a0a8ecd1e9571378a3fb0bdc60.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae070c6-f043-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655693235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655693235, "uuid": "bf953d56-9a87-42ae-8240-d20e30141b1e", "comment": "Malware payload (AveMariaRAT)", "value": "f7ad1a2e8f73eeed6cbab48a129b3c6e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655693235, "uuid": "31d19070-c2e5-4bcd-a8e4-c767a7e84a07", "comment": "Malware payload (AveMariaRAT)", "value": "4c51ac11bd6f142f894d1c42fb07b3f5eff5c125e0342f4ea322ca131cecaa21", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655693235, "uuid": "fdb2926c-608e-4f75-abfc-3e38c633f8ea", "comment": "Malware payload (AveMariaRAT)", "value": "f198282b667cebd73ac44086438ec3af6382daa5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655693235, "uuid": "bf803f98-dc16-41e5-af04-23df282d9af1", "comment": "Malware payload (AveMariaRAT)", "value": "81b43048456e76c747ef9d881658601ccef693215da050b27ecbdc66af26022040e2dcdf00e155555ebb9654b9b4de7d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655693235, "uuid": "524f01ab-9b5e-46ac-8011-d16312b883bd", "value": "T1D4C50610A3A11107F9F767BA66A5475488FE3C814B6991CF09850EFAF62D6F27C342B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655693235, "uuid": "551077db-f623-4fd6-9a6b-30604177ca60", "value": "f0de9267aaab548b7fa32bb478277d98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655693235, "uuid": "83f23033-0ca5-457b-8fbe-76396ca07304", "value": "12288:5dlWu6lY4g1xii6uuit3GAJ6hhIk5mXFfJP/P7Bu7dR+YeD4pa7+ougoC:5vx1LtWvhhIYm1fJP/DlHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655693235, "uuid": "7e1cf337-5d50-4823-8573-a33286d2dd64", "value": 2700800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655693235, "uuid": "d1db8cb6-0770-439c-9efe-aa7a2527556a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655693235, "uuid": "075d6c17-568f-41cd-8bb0-fd4705bbdb9b", "value": "Order Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d80e4c1-f08c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655724565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724565, "uuid": "5de70fa6-d11c-4926-a311-d332306b6800", "comment": "Malware payload", "value": "48f036784fa14badcf634dd8f01f81c1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724565, "uuid": "2e7d212c-a05f-454a-812f-50008f38fb73", "comment": "Malware payload", "value": "4c96a751c1ba60c3d28a9413d71166401c796d1acb3d5f93d4fee20db7984344", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724565, "uuid": "5506f96e-e863-494d-a797-9cfc60ffb1a0", "comment": "Malware payload", "value": "c140f7969e39a2618e87f61047ce525f8d5263dc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724565, "uuid": "99383366-3c69-4c21-907a-d08756633f4d", "comment": "Malware payload", "value": "ff322bb6259cfea0c947a15fc2082b83a0ec047fea7059ce8ec4bbae1aabb428f1ddc14b2a2890ff5f2580b592b655d7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724565, "uuid": "ccef2a60-1465-49d4-9bfd-01af0a1e274f", "value": "T141B5F143E756A81ED4F3C33889B64B6541478C268747E3538AA5733C6DBBAC01F96EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724565, "uuid": "50b0a9c6-69e4-4d5f-a05c-82e05a0310d0", "value": "49152:9k0QIH3hkb9JehYTUJOPc+fQbOnAAn2izZBZuagOvjNqMhyM4px74uLj4s:9k0QG3wjK0tU+fwOUSjDgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655724565, "uuid": "0246737d-ef69-4096-8c1d-5979431bfcd5", "value": 2309322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655724565, "uuid": "2fe0c4e0-a349-4c16-be07-4ffbadce8bae", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724565, "uuid": "bb2ebf02-db32-4a1c-8fae-96e256464396", "value": "hpss87ilafsmcjig5f0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2853bd30-f072-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655713363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713363, "uuid": "c010e991-1ff1-4e69-8797-9d17809a0e33", "comment": "Malware payload (AgentTesla)", "value": "aaea46cf5da43be09ccc93d7ce2f8e1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713363, "uuid": "1a05037e-531a-4822-84e7-3b9c02dc4d44", "comment": "Malware payload (AgentTesla)", "value": "4dab4fd68a17bb98d112c730919a5f4bb2fd780e6bfbdae7bd4cf957a617a382", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713363, "uuid": "c70209d6-53bf-4e87-8033-34f2f3ec4099", "comment": "Malware payload (AgentTesla)", "value": "11f0e98386ef4fa2793c5e824c9c9d226160db33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713363, "uuid": "0fb3a2e2-3295-45b0-bf97-f2bfe6e6d77e", "comment": "Malware payload (AgentTesla)", "value": "4574fd3bbb8085fb5637baa9c4a3304bbeac24db98d204b6b200ba88672899f3921b7c351063e94de3922c121fac3294", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713363, "uuid": "3631b627-ff64-4b3b-919e-52a8a0990113", "value": "T1A215480227C46F64E47AF33A6174840813FABDC7D754EE6F7D5968C82033E819AA6B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713363, "uuid": "587a8dd3-8c24-4f45-b75a-3f04e0d700f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713363, "uuid": "aaf426e7-e771-44a7-a43d-3071963a0ba4", "value": "12288:bO1xfZzluOsd0wj3fM1r46rd5RgKNNTK2xy8If//Fpydqpg:S1x1Gjurjg8DytH/78L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655713363, "uuid": "390fdb2c-f62f-42ca-b663-a36140e1001e", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655713363, "uuid": "8818ab9a-5505-4958-ba36-8c987511ad70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713363, "uuid": "89920e62-894a-43aa-8d49-2657b99f41d9", "value": "Claim Reference No MAR048780314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62116304-f082-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655720332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720332, "uuid": "b6689044-89d3-4fec-99f2-09e3a4c216ff", "comment": "Malware payload (AgentTesla)", "value": "293a9b73d10004b0a6c00e3d820893c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720332, "uuid": "4d601da2-bd14-4615-b471-0ce938cc4c37", "comment": "Malware payload (AgentTesla)", "value": "4e66e70ef947e8c220665cd4a18464d76aa7f80082cf202632749d5217cba611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720332, "uuid": "df1d9c64-30f3-4985-b8cb-fa33d5154393", "comment": "Malware payload (AgentTesla)", "value": "5f83206f0d38df6fcf03f491e523dba4ccf8e68d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720332, "uuid": "3b456450-252b-484f-b97c-348bfae9fd20", "comment": "Malware payload (AgentTesla)", "value": "9e6943f59e9cab3b08bfd52f19f72623ed67365c91a82fa580304aafac7c7e09906a4476aa44e1a93dd70c20df441f99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720332, "uuid": "4b296f31-f6be-4160-81ea-d112ddc0ea06", "value": "T1FFC40200A9785262E83A83FD89E2B25053FC7423D266F7A84FC570DF9877B168B51727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720332, "uuid": "d8d60211-3365-4722-af4d-daec008bf637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720332, "uuid": "69a5748b-8f76-4e1b-abe2-b44d1495410b", "value": "12288:T2iN3tUtZpBtY4nmwQ5kSaf2wudFZarAA+LuCgHqX8qsr98QV:T1dtU3pvqQ2wSCkA+LuCStr98QV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655720332, "uuid": "ea79453d-b244-4b2f-a21c-e1adec69a8aa", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655720332, "uuid": "c485c366-5f52-4760-853c-9203d1d509ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720332, "uuid": "c436199c-378a-42a4-a0be-bf105b4f343f", "value": "PO288000174652900_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975e74c6-f050-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655698946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698946, "uuid": "4aee506e-f19e-4561-bc53-643f6a9d0998", "comment": "Malware payload (AveMariaRAT)", "value": "e0039f8ab05ebf6f80275d4d9d43eb11", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698946, "uuid": "856b4734-d5fc-48e2-bdbe-b2353fb2e863", "comment": "Malware payload (AveMariaRAT)", "value": "4e78c695a94e178e1810245062f96cca054f3246736f430756f330c88e151b7f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698946, "uuid": "ab9e033f-d066-49ba-8cef-9f54392a1604", "comment": "Malware payload (AveMariaRAT)", "value": "caa22dfb1ab74d6d4fd1969b2f6772ade1f93b39", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698946, "uuid": "a45173cd-c34d-45c3-ad42-5d3719715213", "comment": "Malware payload (AveMariaRAT)", "value": "6b31b6b6e0f5cf81486faf0ef0c47f60ea9f6963acb4f05559512d586cf393e86643147082e613ef4d471342ddde5d39", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698946, "uuid": "b0c955da-8e95-4665-85f4-5ec12d7149e3", "value": "T12825B061B2918437F0B319389C5B6368192BBED32E39A54A6BED2D4D1F372913C35393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698946, "uuid": "b716b8e4-7ac3-4c23-a45c-4721e958848e", "value": "6bc49b119ffc99d9e27364e06b706e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698946, "uuid": "90dfaa2c-69dc-4fac-96cc-92610462f2b4", "value": "24576:mArq7iX2O7Zo+r5E1kBiKvyJsPFtZd52EUAEc:m17+7rTPdtZ9Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655698946, "uuid": "655442b3-d059-4e91-8d49-f36c7699d273", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655698946, "uuid": "c645b5df-97e7-4a81-881f-5c23a1ec67a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698946, "uuid": "a93d48a7-31b3-48fd-8263-21be9d4699c9", "value": "Paccar Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa9f316-f0ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655751512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751512, "uuid": "611533f2-3eb6-42bb-93d6-8a208c6ac8f6", "comment": "Malware payload (RedLineStealer)", "value": "13b8474742e1ed615d2447de7db5fe58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751512, "uuid": "4c726709-2a9d-4fc1-b475-eb5b1a0d4f12", "comment": "Malware payload (RedLineStealer)", "value": "4ea7658ff4fd0e46e3939bcc3b4461f92205cbdf338719027377e039f8e78071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751512, "uuid": "bfe8f2c1-55c0-4a68-96d3-06c73c4fe266", "comment": "Malware payload (RedLineStealer)", "value": "5478710726f8fa6e8b552519aebfd535d864191b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751512, "uuid": "42780afb-02e1-4ea1-bfad-057c072078ae", "comment": "Malware payload (RedLineStealer)", "value": "b0e784ae9897933913748b012f8461a3f53797175de455ffde7f599cd7ad3857c9fa0ac07d7400f0b39d7f63228fb3e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751512, "uuid": "78c044ef-a4b0-4803-95e7-bb76b5e7f53a", "value": "T166749E06BBA18F11FAD51670D0BB00246BF2E9567573F30B2B5991EA2D433B5CE863C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751512, "uuid": "b917eb75-0b37-4e51-999a-7e50b3179042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751512, "uuid": "9bd78b6c-40a7-4c68-8c0f-b62f98be1d53", "value": "6144:jFqzI0/9L/tnE1DALOUow6uPkKwdShglqz3aj8Kz:hg/x/avUowgNdShg8Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655751512, "uuid": "4fa2329a-84a4-43a3-8597-8b3974550aae", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655751512, "uuid": "0c0e0a03-1e7d-487a-b358-d7d576a9c234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751512, "uuid": "b7853159-f1cb-4963-a0c6-de377a627e57", "value": "4EA7658FF4FD0E46E3939BCC3B4461F92205CBDF33871.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea14e44-f0c0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655747035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747035, "uuid": "61eb8b1c-fc1f-4af5-9ab9-184923189550", "comment": "Malware payload (Loki)", "value": "a88b943b6829aaac2ad54fab6cd221ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747035, "uuid": "b665b198-a90c-4cac-ac23-60149afeee12", "comment": "Malware payload (Loki)", "value": "4ee295836e389ce1f17af643c086d1912a6261c1fe55d69e669640a66aaae25a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747035, "uuid": "de01cd71-815b-429d-8786-33610b929e51", "comment": "Malware payload (Loki)", "value": "60b69b4ce53e52aa4b7e41c0212bea7acb61ca34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747035, "uuid": "50c76479-a233-4e07-8ec1-f7b0e3af20c1", "comment": "Malware payload (Loki)", "value": "c9e58132b594558d602f82aee036c036c243d03022b8fc9a9277e604f9c6bc21a91892b223aaa060f13a3cd40422d539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747035, "uuid": "cb54e822-481c-4dc7-968b-78cc16719492", "value": "T16484E042BAB95B16C9BFA7F656A6105407B534BF6371F10C4DCA60EE2876F008B90F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747035, "uuid": "af30a53a-523b-4964-904f-1549889a9c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747035, "uuid": "c2f69229-fe18-4216-b931-fc448cacb883", "value": "6144:s4bFAW0w3OgpjYezpLgAIwUituWSNDJQVZVa6c2C7t9VFB0BVIAPnVBcZv/5b:3bFAWr3OCjBRIwUikTqhc2OtHhycF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747035, "uuid": "bff23e4e-ac2a-49b5-8a2f-db6b075b12e0", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747035, "uuid": "3fc7efee-9084-476a-8007-f74b1604b015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747035, "uuid": "f470c129-86ca-42ce-a9b9-9087e7b092f5", "value": "copiadepago45546785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd353970-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655747650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747650, "uuid": "5f581c9d-15ce-4066-9111-5799f7c5d237", "comment": "Malware payload", "value": "19f8e6a0242f95219a6f8c4c45061440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747650, "uuid": "7e2d6630-2bcd-46d5-b4a3-bcb5369c1de4", "comment": "Malware payload", "value": "4fe56d88c1170a3d0e025b9d8f7939139a7618b3868eb993037c6e3b52d9d501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747650, "uuid": "84b119c8-b0bd-4a4e-beb9-92706245d4c3", "comment": "Malware payload", "value": "61a664a064c55cd5c8341fa7a69e94c35d7efd57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747650, "uuid": "e3d22b28-57f7-42c0-880e-045dc817b4f9", "comment": "Malware payload", "value": "1ddfc74cf2b07ac83672a39f95aae60350098a5a894f36522acdf7008c66df8d6c712f9d803baa692c25dcc663a1e606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747650, "uuid": "3c7ca18d-7ad9-4d37-a5b8-2fb86c258c94", "value": "T197744A45EB918CBAC921633B89C7D277623CBAF44763DB476E251934EA132E15FC9302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747650, "uuid": "f524b9e0-a958-4dfa-8a6b-50f047eb494c", "value": "ddb8da8ce9f6d7c99471e82a46c98901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747650, "uuid": "a8dcfb3f-0295-47e3-bd7b-401470012edc", "value": "6144:ehf/YQgkZgtMYORbAB9lIhHY1yVQhAyPll/s:ehBT4MtAIu1yVQhAyPll/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747650, "uuid": "a54f1295-5060-489e-9b68-1fbfaad26f38", "value": 356148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747650, "uuid": "8ce96eb5-f5ca-406d-9801-9443d5fbedb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747650, "uuid": "d88e8e1b-493b-4636-bf66-44bb9e3695f5", "value": "4fe56d88c1170a3d0e025b9d8f7939139a7618b3868eb993037c6e3b52d9d501.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fcf466-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655730450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730450, "uuid": "4a4abeeb-21f4-4bdb-8c21-6b6600c15165", "comment": "Malware payload (Heodo)", "value": "cbb745bc771ce59e4e7a0f4e14cc407f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730450, "uuid": "96d73ff6-3ec9-4234-a530-daa427dcc945", "comment": "Malware payload (Heodo)", "value": "5115e4f50f11b0b609c897d34831859ad3208218dac994b6e4be1cf99351df56", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730450, "uuid": "acf7d156-8ebe-442d-bcff-ad2d220cd20e", "comment": "Malware payload (Heodo)", "value": "bf6905a4060d233dc234a012ca79207ee7fa5bbf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730450, "uuid": "6c0d7895-1b47-411c-b77e-f618d1c7da40", "comment": "Malware payload (Heodo)", "value": "4d57fdd1b6ada774f424c9e7e406543e5a836de18f3bc75ee4ba6accb88c5fe857e948c457e1ba5ea0b0c89229ffc8dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730450, "uuid": "58ffac3f-eaa8-4e32-87ab-499ab8f9e48b", "value": "T1AD733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730450, "uuid": "fec3fbac-ec7a-43e1-9a7f-53dfb822a35f", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBo:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730450, "uuid": "633577b2-c09c-4164-84d5-864c9a8e2d87", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730450, "uuid": "11d804c3-d99e-44ae-aab2-f4f4a7ac46b7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730450, "uuid": "43ea256b-6279-4822-ad31-e3ec53504bf3", "value": "4108614832074759.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62752c47-f049-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655695851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695851, "uuid": "e6c0b14b-622f-4d92-af6e-6090f09e9008", "comment": "Malware payload (Loki)", "value": "cff727132eabedebdbf75ea1e1831c97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695851, "uuid": "5c1b227d-051f-4024-abfc-6186fc993006", "comment": "Malware payload (Loki)", "value": "517f8f9c2ae85a1f8851a524d47e145df69ba0cbbedee2146f2547895f57fca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695851, "uuid": "2a025a5c-a7f5-4c95-a3ac-bd1ecd2589e6", "comment": "Malware payload (Loki)", "value": "c9cf70336e954d49442724b9caa5cb44a5f88160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695851, "uuid": "f2d27ece-edd0-4ac5-b5e5-58da47511c8e", "comment": "Malware payload (Loki)", "value": "836647adccb3105fb8d4e0e612bcefab9ca93bdd7d5be6b8d8625f683c5c70fbf9c41476dd0c23d94ced94f1dbbf4d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695851, "uuid": "89b662e5-51a3-4b52-8482-ed51b2e545c1", "value": "T11B8412092F3D9753D9BBB7F446278290C7F1262A9AA2FB08DEC460EE04B9F30455171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695851, "uuid": "790b7d8f-55dc-41f5-8abb-c6ca149aedb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695851, "uuid": "249f0106-be8f-40b7-b9f5-c94e3809250c", "value": "6144:R8eOwVnj6tHS5tC9UNCvHopIjl8jMiRq2QmLuw2kWX9Y1IHQe5tKvt+u8:7gUtCKCfJyjMwQuNuXxQe/K+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655695851, "uuid": "36a422a9-db64-41cd-b543-7b27a42309b1", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655695851, "uuid": "6a68050f-3606-4ec4-8c78-f2e1d57a830f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695851, "uuid": "12d44c18-5302-48eb-800d-fd4353533244", "value": "Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e83cb39-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1655716326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716326, "uuid": "2de623b5-4bbe-44ac-b188-ad458b73b4f1", "comment": "Malware payload (ModiLoader)", "value": "e7b14edfdac1f3a0c080c5ad66652872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716326, "uuid": "96e14631-3d57-4247-8932-1247c663d287", "comment": "Malware payload (ModiLoader)", "value": "51d43ce469b459d324c8766633ffc415fc7e3fce3db9434918baf1c5c6d602dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716326, "uuid": "e8ccb487-404b-481f-85cf-362839cf48f1", "comment": "Malware payload (ModiLoader)", "value": "5d166eec4e940ddae963f3e1f5fc88745584eda5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716326, "uuid": "1325fdaf-8f1c-476e-9e42-df38d4bcfbd9", "comment": "Malware payload (ModiLoader)", "value": "bce939d6c490636a74cc271246e33275ef97186347499817156c51bf2067d8d784827055be6d5739255b138ced403fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716326, "uuid": "80a5a8bf-5f3e-497d-9111-cfd5aa749277", "value": "T16FF48C22A2914B32C03E45357FCBD6AF5CE67EC12818A48B67E57E085E39E403FE6157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716326, "uuid": "54341a13-7d63-4abc-a10d-d4754e6a807b", "value": "af0c0876a9f8593431bb7b319053d44d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716326, "uuid": "ebe5508a-2461-4bf4-b16b-e7dd6f40a83a", "value": "12288:M8q60+2OVKAqSdGeXX8cViJ+g+CRxZtVSX3x7FRSJWeOkDyHg:th0kVKAV0eX7VPgRxZtVSn52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716326, "uuid": "942adfe4-101b-4466-971b-570e20c5ada1", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716326, "uuid": "ab70e434-3214-4bf1-944a-35402f9ba20c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716326, "uuid": "9c93b52f-009b-4079-a68d-7a6ebe8348d3", "value": "ORDER NO-08374345345.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143afcd4-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744683, "uuid": "d5205ffc-1e37-47ea-9c44-5e67f1345da5", "comment": "Malware payload (Mirai)", "value": "577d69ead1a96a79a995a6bfdd0a0efc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744683, "uuid": "81ae6e56-b21e-4004-ae49-51b3b414d37f", "comment": "Malware payload (Mirai)", "value": "5269abd0c88898c256e3aa7fad9a131bac707dd5b5fb35e5def0c18a14a534e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744683, "uuid": "9294c04c-ddc9-46c2-bd0f-583fa366cd84", "comment": "Malware payload (Mirai)", "value": "5056d32c4c72b1db479eb575a1f4c0c603c803ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744683, "uuid": "33428954-0602-4810-938f-b7aa2247204e", "comment": "Malware payload (Mirai)", "value": "b84022a9e68513193df8ddd00098f0ebc884d1c7d719aa367252bafefdd7a936c3a183f4d511e79df08bc94386717390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744683, "uuid": "81386cef-b6cb-4253-b8d7-321e2b5ceecb", "value": "T11C338C268E612D98C18A82B0B4349F342773D2A583476FFB5C99C678D493EACF5253F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744683, "uuid": "6eb93943-2a8c-4903-9d96-2eaeb1d5f597", "value": "1536:ch7cai47zhpdBvW7BymcJ4KDp6PdjmFRCt6L:ch7cqzhp3W7BymcJ/DUmFRJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744683, "uuid": "6cc9ef29-43e8-4b40-9ff1-477cdba4615d", "value": 52340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744683, "uuid": "fdd90aba-5bdc-45cf-baa4-ce0186885599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744683, "uuid": "edb23b83-3172-452d-a19c-6d15e96357b4", "value": "Hilix.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa13a3d-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722064, "uuid": "5df84a30-49a6-460b-b3dd-7c8e846af49e", "comment": "Malware payload (GuLoader)", "value": "8b7eaf79ae752abfc8a0ca479ba5341e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722064, "uuid": "414a0f79-12ce-4cf6-85c6-a4df1e9824a0", "comment": "Malware payload (GuLoader)", "value": "52c7b939f645d728ef9f9b34ca5925c29b63d86269617793fc279934924f69be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722064, "uuid": "c934839a-69ec-4d32-956a-8754ff54154c", "comment": "Malware payload (GuLoader)", "value": "d4f74da66bea63b00ecc57e8f66118a6f1e4418a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722064, "uuid": "10fcc1d9-4eb1-44e4-8f8e-ada3f5760a89", "comment": "Malware payload (GuLoader)", "value": "0663cf8487640561a671fbaaef712a0b3808b2b4df4f3b65ee2ede5ee88b9f353f73bc4068cada48f7276270e481724f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722064, "uuid": "931c12c4-ec27-40d7-8e82-9c69021841ef", "value": "T1B1E4D0A2F6A15842C52A1B7049BF4F043161FD989EF2275A29DC73293FF31CB015B99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722064, "uuid": "a4dfe955-8899-493f-b93a-3cd1803f7551", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722064, "uuid": "0f477bf6-ee2b-4aff-8b59-9d11fb57fcf2", "value": "12288:uYqpoZBQTyslxAjzzZ1JN9S8V0cq4MMVE/ix2nZVMEBcr:uYCxTyyszlHN0otVE/ix2ZVMEBcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722064, "uuid": "db199945-90d4-48eb-9da2-be0fef9cdf8f", "value": 664574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722064, "uuid": "333d1717-07c8-4588-9423-42167ce05413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722064, "uuid": "470f37a7-5fd8-4852-a6c2-507dea48f4c8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20054a24-f0c5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655748997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748997, "uuid": "444a2344-b822-4090-b015-bae12fd35e20", "comment": "Malware payload (AsyncRAT)", "value": "788b67b7e944d107d287fb2bb1b73c79", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748997, "uuid": "841d5351-c1a9-475d-95ef-d3ace79784c7", "comment": "Malware payload (AsyncRAT)", "value": "52f4d9a82aa80952594d1efceba6ef326395f97005bb06d240d378a8c4a6da70", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748997, "uuid": "b8a6db97-948a-4616-9473-2112dcb0f5cd", "comment": "Malware payload (AsyncRAT)", "value": "05108324ff34f638443d79ffe35664433ef63baf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748997, "uuid": "d0cbc29b-7d82-4457-a30f-9a637d2b91db", "comment": "Malware payload (AsyncRAT)", "value": "f1ce3f88ddf3a3052af9416858f1f8a71d56897377a7699734999160294d25cf5bd93d7069af90b6d5808f1d85ad4596", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748997, "uuid": "f080e34c-d010-4e78-8ec3-dcb88ed16ca5", "value": "T175231A0037E98127F2BE4F7898F26245867AF6632603D5491CC451DB5713FC69A43AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748997, "uuid": "eadfbbe3-9f4d-479f-bcae-34c30f30ed8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748997, "uuid": "2d473bbd-1bb2-4268-bcaa-c5648d7fa7e2", "value": "768:1uAHPTgoRzbWUnd9rmo2qr50ewN1ARTbWAzjbygj3iRbAgpysXI34cDZPf+:1uAHPTgG/2Ow3EiA3b1jSagpysXIfdPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655748997, "uuid": "878fa91d-127d-411e-8e20-3ad4e57a9ae1", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655748997, "uuid": "63e6dba5-6cbf-45da-9d78-8a08ac9f12fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748997, "uuid": "c50fea66-f3fe-4315-8213-ea9e08f7cb97", "value": "Meth.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565d290e-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655715158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715158, "uuid": "ea225ca3-0d5a-4628-908b-ced6b3ff1c81", "comment": "Malware payload (SnakeKeylogger)", "value": "ebfffae0e2c0521671e34ac85e28a0f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715158, "uuid": "7e401a32-f47a-4bb8-9fe4-80f468451041", "comment": "Malware payload (SnakeKeylogger)", "value": "5329cec64048b4e75701d3d9141cf3d207af09f97aa59172267a02553398db10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715158, "uuid": "91dcdf4f-d07d-4f78-a98c-87665a11f8ad", "comment": "Malware payload (SnakeKeylogger)", "value": "94129bfc634fad07ff57b4e7c9836b0ccf0296b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715158, "uuid": "5dcfb25d-6142-4413-9a1c-e688de576fbb", "comment": "Malware payload (SnakeKeylogger)", "value": "ffca8fe3a8bfa354653b083af5256599484959f12e538ab368d0f8e4dd3d96bca091f92523dd06403e6fce41797beb7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715158, "uuid": "6262ba74-fc58-4b40-8351-35601a354547", "value": "T17B04FD35F440E70FDA7887FA1D74E79859D75C69080886C923493BAEE1F2A33AD1D43A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715158, "uuid": "b71d497c-750f-43ec-ba8f-bf91f0812a2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715158, "uuid": "aca8e4ed-638e-4eaa-9b8f-ec90464fe552", "value": "384:uIJmbxIP0uEIyOD9mnWz5dF1Oo2XD/HnEjVgnVlzul0T/QSMzMrV/zBZ8tz0666g:l2xIP0SEhXjHkVoTgENZaw66666aqvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715158, "uuid": "9ad4dc69-2cee-4a60-a235-121675c58d90", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715158, "uuid": "3d0badc1-a117-49d3-b192-a44ae46100da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715158, "uuid": "555a9507-4e5a-4ce1-add6-fda56248ca27", "value": "VESSEL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a4ff91-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655733786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733786, "uuid": "aeec6663-f4a8-4ad9-bd7e-84bda28775c1", "comment": "Malware payload (Vjw0rm)", "value": "6b40bc20c20e427d9f3eff75a199e5c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733786, "uuid": "91358551-5964-4a00-a930-f1fe18e74f22", "comment": "Malware payload (Vjw0rm)", "value": "5382fee9aa7bef18d245bd37a9f93feb2671e6dd4b76fdaf90623c2438d22d71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733786, "uuid": "7ba35ecc-3e8e-432d-a8e1-ae077548e299", "comment": "Malware payload (Vjw0rm)", "value": "eeeba7f94c0c71545dc1a412181bbf59ab3816a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733786, "uuid": "cc980027-8909-4cb9-a01a-5e87a2cf9a74", "comment": "Malware payload (Vjw0rm)", "value": "b3b0259857f050ae595d601e30621e68a7df6d30855d4881da07ca7cfacff832e52d6894257bb6401159eaa7c352a1af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733786, "uuid": "a5512eb4-8636-464d-bd81-a85281ac29ce", "value": "T1F3B39DA4F99070FE8A5190B328BB3B0E53B45103FA055189F65AF6205BF5B88D71BF36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733786, "uuid": "10e4d461-8539-4381-b098-ec4a0b21f971", "value": "1536:zDVQKCPd7kXdFC8cC9pOjaOWn9YEcOOqgWmOf3nUnHt41jrU+3f3vmi3fFOEQ8fu:wU3CofX96n8fO4OZAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733786, "uuid": "5adf9dd0-41d5-424c-82f5-4070b0389132", "value": 108741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733786, "uuid": "37456d26-4381-446e-b0f5-6d109aa9352a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733786, "uuid": "b55b6913-bc48-4ebd-9912-da89658894cc", "value": "PO 062022.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c415a008-f0a3-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655734670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734670, "uuid": "2177b127-e45a-4fb0-b563-4d863fbe70e6", "comment": "Malware payload (AgentTesla)", "value": "715502ff0bf69f570b4efe2f6648d508", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734670, "uuid": "6bdd6cb5-b253-4f8d-825e-12ff24c84583", "comment": "Malware payload (AgentTesla)", "value": "538f174211e023b4d11c776378ee4a6d62f601695c9a54818c3d705da03c18a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734670, "uuid": "72a27f28-ae3a-4eb4-aceb-60140807625e", "comment": "Malware payload (AgentTesla)", "value": "1e422e41809d0627c2c51bd9ecc7b5d5a3fc10ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734670, "uuid": "45c3ca75-a86a-4e20-8d14-b9194c4b02eb", "comment": "Malware payload (AgentTesla)", "value": "f09af5a0a2bbb30110c4e359bb6325285798a3865cfe334865dc9650806ad5afb83cc078b07c120a5ed83a3bd021f97a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734670, "uuid": "6f8e5a83-5db4-4b46-a270-15c0e289d8ab", "value": "T116B4F12ABB93CD02D1A95B77D4E245040378AA47A112EB4F3ADE23594D133E74EC9BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734670, "uuid": "3db828f0-a364-46d5-90da-e9dffc5b8c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734670, "uuid": "11afcbd0-a13a-4c84-b450-3a9d33e582dd", "value": "12288:ntcV16BuRRbE/WrxljTd14pVK/RLI19Hy:nO16ibEaljTd1bRI1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734670, "uuid": "42f72a14-5179-48f2-a8c5-6b65a483d2d9", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734670, "uuid": "859dbd7c-987e-45a2-a39f-09bac4d66794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734670, "uuid": "21831ae9-d337-4bb6-abfb-f3fbd94f3e36", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff450c7-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655722019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722019, "uuid": "e4cdbaf5-024a-472c-b11d-6ef16de593aa", "comment": "Malware payload (Formbook)", "value": "3d7958ca651c77eb1f3493bbdac0a04f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722019, "uuid": "0a4d55a1-7e9a-41b0-bb5b-6f5c2b895168", "comment": "Malware payload (Formbook)", "value": "53dca6d660eda64510764652628582c7179680459bf336c5d85ceffe7ecf6964", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722019, "uuid": "1c2c6f39-2ea4-4c91-871e-c577faa53523", "comment": "Malware payload (Formbook)", "value": "66b3ed87f04d57bd62ab844a0217ec03fe51409d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722019, "uuid": "e47d2d71-c6a9-45eb-ac51-e8c934738aa1", "comment": "Malware payload (Formbook)", "value": "85b8c3dc84eaacbdf79dd9c9cf73eff413d5687b50d507f0dc047f235af666ac9532c7a8e1802edcdbe42c25f9b478b4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722019, "uuid": "4c411887-0ed5-4791-8253-1a79c9e51081", "value": "T1B963DF9057317424F1DD89317EF460ABBE63AEEC698A837EEF98770D617274035C1262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722019, "uuid": "24db60fc-afc7-40ae-9bb8-7a992ebc4a17", "value": "1536:Wud4BL8BkrL5eCw3kmpWEXoaLl2vBSMvrYGj:WuK8Bk/5eCkloEXocO5rYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722019, "uuid": "0f31e6fd-4bce-4692-9186-f4ea96b601a3", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722019, "uuid": "24e1257d-4708-44a0-a7ca-49f78e5e48a5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722019, "uuid": "5ae85ac1-856a-4e76-9d7c-c4c3ba531fe9", "value": "Etalon Zala Kft.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2461b634-f03f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655691452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691452, "uuid": "d6f164bb-8547-4ce9-980d-abd6cac3a156", "comment": "Malware payload (Loki)", "value": "c66de1e2d00d39b7c41136c7586e3f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691452, "uuid": "3b52478a-c249-4914-972d-c8a69f3f0024", "comment": "Malware payload (Loki)", "value": "56a9829d3a588c2a1f2a8e82f358214387d36cdf1a28afef973bfbae53ff888b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691452, "uuid": "1e962163-ddb1-4079-a738-8314d19f2e85", "comment": "Malware payload (Loki)", "value": "1b2932567e142d77b7df0d42ed253db1e1601c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691452, "uuid": "5396c086-c9ef-4a9b-9b9e-90058b59ff79", "comment": "Malware payload (Loki)", "value": "ccb03c96b929ca465588100e59c5ba68a37501b53a404b070619edb78e6b9e66465ebcd54715530b3c08a99bb8610994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691452, "uuid": "d529bbf8-ce96-462b-8abe-36c2cccb4af6", "value": "T1EB8412183A7AA7A2C9B797F5D0C31594C7B2583AE402F3185FC470CED8B2F884562B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691452, "uuid": "b8b79ee1-e4f9-4d92-88b5-1ebd79cf9d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691452, "uuid": "7bffc7d5-5195-4ce1-a000-6d5ccaedcd6f", "value": "6144:uNghwHW2T/BxlSVnXIc1RiQlFZl5FDbPUF5EsngHIDc3BtoZx4OmvB6:AHxTl0t1TlFrvDbI5bgCUGvWvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655691452, "uuid": "88b429a4-2d70-49e8-832e-af1d9188aac4", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655691452, "uuid": "b6692994-64c0-4f0e-adb5-ec3353f1cfc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691452, "uuid": "884daa91-ca2e-4c12-a041-9a1567557d65", "value": "Request for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825abf83-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744867, "uuid": "96b9ced6-1aaf-4980-8c47-bc8b54089fb0", "comment": "Malware payload (Mirai)", "value": "1c5073ae4eb9ab290cf5b53b0f4232fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744867, "uuid": "241f3a7f-0b62-42a6-99b0-cf15dce5d71d", "comment": "Malware payload (Mirai)", "value": "57a51f9d58f75ab7ce4b9da9e69d602ceab9f4238b78b00219f6bf456b0db346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744867, "uuid": "a02abb31-482a-4825-a739-d60b6419d9cb", "comment": "Malware payload (Mirai)", "value": "77dbfbbafef02897fb4b8efffec965bdddb68b63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744867, "uuid": "000a1628-e89f-4a76-ac42-631f1ef9b3ae", "comment": "Malware payload (Mirai)", "value": "f02835f2f2da7bf786d765d24c2c08e461dac5a8724a4abe5a55f7026dce03bea64bbb165a782f9f52cad1530632b72d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744867, "uuid": "238a9030-aa9a-4405-9de0-29753927cfab", "value": "T1A7332AC596C3EAF1EC22007C346BAB719F73E57AA436D9DAD78A5832CC05506D2073AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744867, "uuid": "d8d5af2e-5c79-4291-b45e-9ca2b5ada6b8", "value": "768:VdGORKL2ZzIJjbbCledj9yueoE9oexAzsweaNmSgBDmwHOg+iKmmw9:V/kYIRR99eoE/xAzswDNmSqmwugf9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744867, "uuid": "ae9d22c9-996b-47b4-8bf1-d263c8acdffc", "value": 54404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744867, "uuid": "cf2ee9aa-4754-485d-89f2-e69e9f7ccc6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744867, "uuid": "f5f712e3-d632-4365-a62c-ba4453cec2ff", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed0a33e-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733587, "uuid": "f62f74d5-3037-43a5-8d36-e0be52dbbcc6", "comment": "Malware payload (Formbook)", "value": "3782ef13c0c53f716f21426f82e21b64", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733587, "uuid": "0172a39b-886a-4e08-9e90-63406e51fbe3", "comment": "Malware payload (Formbook)", "value": "596cf8d5e8e23b93382b45070b9e95e401f547a442c3db3202047bdb9ed9c737", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733587, "uuid": "b831c7f9-584e-43c9-886d-d214667576e1", "comment": "Malware payload (Formbook)", "value": "846f8019a3827196b8b826ababb04eb9dd8279c9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733587, "uuid": "a28577f1-a72d-4eaa-89b7-c8a8de022e15", "comment": "Malware payload (Formbook)", "value": "995fa3112886802336d13244b0178cbe76145793c63f0ababccd38a606a7a3b0756c0ffe46f2061f1344990e5ecdc6d9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733587, "uuid": "41ec8d8f-c7bb-424c-8584-363c9e2038f4", "value": "T11473DF3E0EF58491FF75093CDA2CC69430302F6A4A11A3177E1D3ABE8CBB91918F8865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733587, "uuid": "3cfdbd3e-91d7-4ba4-bf42-d1be1cdcbbb5", "value": "1536:kVlLj9SCPdb5WXPULuos0OBsfW2vKLXWSMnEQbrS57jP:kXLj7B5M94upzNMEQiFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733587, "uuid": "7844ab7a-0671-4616-9aec-75b11fd0616f", "value": 73384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733587, "uuid": "7bbc07d5-cf1a-42b3-bc7f-ff724fbb7063", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733587, "uuid": "883c45af-2ecd-4586-9e4d-cde28f2763c1", "value": "DHL_AWB_NO#907853880911.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7224858-f082-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655720448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720448, "uuid": "3e3e126c-2517-4d71-b46d-517811f3cb28", "comment": "Malware payload", "value": "798608ec017f4c3d17f662c9f6ceb056", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720448, "uuid": "98ee39a6-71a4-4a83-92fc-97f739b51647", "comment": "Malware payload", "value": "59e124084e9e269b3c1d8789c27b60323cfaff0b3118152caf7cdc042bd1b945", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720448, "uuid": "2a4cc36a-9ae8-42e2-a900-c29b4d5bbb07", "comment": "Malware payload", "value": "355a08c6f8037ebffd8354eff58cffd9f6a16752", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720448, "uuid": "d406ba0d-d088-43ed-b077-d1073482f1ad", "comment": "Malware payload", "value": "5c91270ebb982d0421ad132ae71ace0a5509057f972524b53c53752d47f6610921bd66ded9e491473b51a0eb3f4de447", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720448, "uuid": "3f2c85a9-1067-4633-b00d-a80945773b16", "value": "T19E04122CC3D96CB2FC581432137F42D6DFE8518BF3245F52AA34A1984EABB95D928C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720448, "uuid": "7b3e352f-0b43-4b0e-9850-1dc1d58326eb", "value": "3072:glUwCIHV9BW5FcwVf2My26yEbviQX7+qkiRCa30/+Sr8oDFCn/Y3I0Ss:glUwCIHk5iwV7y2QX+8RYFgoDFCg3IO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655720448, "uuid": "dde1c232-8acd-487c-809f-776100c947fa", "value": 184790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655720448, "uuid": "47f5a7a5-373d-483c-80f1-5149dc3ab621", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720448, "uuid": "cf35cbd4-e689-4ed7-8eca-bff2f4e8b6d7", "value": "sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf954d92-f069-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655709751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709751, "uuid": "4582d40b-40ee-4f6a-a043-9ce3a27671a3", "comment": "Malware payload (RemcosRAT)", "value": "0400816733f036b3633ca618a8937739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709751, "uuid": "0e1b795e-5118-4e90-8a87-d55a1d6e088a", "comment": "Malware payload (RemcosRAT)", "value": "5a80d33725dc44720c5bf641ba8adc05c49194bed8f073b4efccaeec17e8d871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709751, "uuid": "6ff52847-923d-4533-9bde-4c77ae9bf34b", "comment": "Malware payload (RemcosRAT)", "value": "4bdca252e33e0f006a341f999ce82f50df2fe903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709751, "uuid": "4dd44640-e4ae-4c73-aad8-77107935cfb7", "comment": "Malware payload (RemcosRAT)", "value": "0879c8d0df47b422b82a0c0424f10a228344ed890a38c8e2386ea70a7a59b12214483f7a4fc6b0964f90dc98397d4703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709751, "uuid": "96bdb064-2672-4788-8270-059691a82129", "value": "T1A193AF90F2DFC9A7D8A406B6CC36D9A00261BDE9F4719A1F309B3A2F9D337515112B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709751, "uuid": "e1b2daae-c38a-4061-bf77-907a561446f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709751, "uuid": "958de80c-403a-4efe-b061-a639b2dfce80", "value": "1536:6DbH3Px8e1f1PsFg/DKY2+/bDXQJWyA1YQXr1OmZSx0Ndxk:YbH/V1tPsFo+YfbDgJW1dRbSgda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709751, "uuid": "f9249787-b4f0-46d3-8f0b-8b7bd2c327d3", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709751, "uuid": "9110d852-f2d5-4fdd-a9b0-2d14523111e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709751, "uuid": "5c67a0f4-8a47-423e-9332-a139f64043a5", "value": "#NEW ORDER PROJECT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fdc968-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655761807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "3af229ab-9b71-4854-92a2-6dacbef48da4", "comment": "Malware payload", "value": "04b14f4835ff2855811b36ab2348ce8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "cb283bcf-0d25-43e9-b8b9-11f505b25a33", "comment": "Malware payload", "value": "5af610f97cb5646c42d255b1527a1928b024cbafdf5a9aa4db21e268d695449f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "6ecb277e-2adc-48b3-9012-b03493646ea8", "comment": "Malware payload", "value": "6b685ab35de7fef47e12de79e516bec36e4bbdd2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "d480d778-72f8-450e-b48d-6a3b2066ff47", "comment": "Malware payload", "value": "c35a8633e48ca75ee4b558ea11c2c2252977977c3fbe944fb23038c77b8d349efff100adc900207f1e846a92c4b86005", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761807, "uuid": "2b50615b-38ff-45bb-89f1-78d535e94db0", "value": "T16C73664CF968623EC7D1B2FBF60C12CE773E0B99B397722556340AA533C9B61653A025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761807, "uuid": "4b46463b-da87-46fc-a47a-3917339b5358", "value": "768:dlyNtkjp6R6gC6f7AwjbPyz6r7Ln7OnUEOgJVoga20AWbg2awMsd+/j1CK6YflDp:KN6MCApT71X20AWctMKzNaetv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761807, "uuid": "36721f4b-9155-4ee1-8522-bbb8e91d06eb", "value": 73408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761807, "uuid": "904d24e4-140e-4d18-8651-a23e67a48730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761807, "uuid": "6f6ac652-865b-4000-80da-51fa4830fb92", "value": "boat.arm-20220620-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ce2233-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655743081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743081, "uuid": "d3082ada-0571-4535-96bf-4fdfc13ad818", "comment": "Malware payload (Mirai)", "value": "35cc45935497a4602f7a4b7842ce1156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743081, "uuid": "85db108c-9e9b-45c7-8bec-f2bf704dddaf", "comment": "Malware payload (Mirai)", "value": "5b12d98d88362349b76296e96d2b759b93d2e2bcc6f05e9f8bc0437a1a298dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743081, "uuid": "a30d8528-0916-4d4d-98e8-ceeaa3e451b9", "comment": "Malware payload (Mirai)", "value": "be44e7d6e56e7ca7bbf78f107b1c85c77c4d2810", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743081, "uuid": "647e67f7-c207-47be-ae5e-c130ee78a973", "comment": "Malware payload (Mirai)", "value": "1bee35631154fd5828bb15df4ae8bf331e90f359e26a8aa2b062cffde44606b75fc5b4537a142e8ecbf0eba1d9a7b029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743081, "uuid": "e36cb894-be0e-49be-92f3-d16f8263353b", "value": "T143B3BF5084A0B8F8C779993069E4ED3DCF87A24452131EF2AE0F8B9501AB7A4F157F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743081, "uuid": "bcbf6046-f66f-4980-9fc9-8976bbdd5bfd", "value": "3072:zhAmpInfX/0rvr02Ja9NnbAd3ZqceERBIdkF37rO:z9pInfXII2Jaa+En5rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743081, "uuid": "457673d2-213c-494e-9069-e69f41e0eec3", "value": 107516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743081, "uuid": "3103f0c1-f2df-4c97-87a6-c8c7fec16ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743081, "uuid": "f10c8314-51d6-4355-a5c4-65aa0a672cf9", "value": "zz.sh4.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d916def-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655734041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734041, "uuid": "5f1aaa4e-c16c-43b5-8144-c672c610cae4", "comment": "Malware payload (Loki)", "value": "515eef84c4828610068a7f13582ee42b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734041, "uuid": "853c0438-34f2-4434-8c6d-4aa5837aa6e4", "comment": "Malware payload (Loki)", "value": "5b85d208033cbff8ea62d34ce696a8eed04da631ab79b09319aedb73258d3ed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734041, "uuid": "f00fd0e9-ce93-4455-ae1d-69314f92e931", "comment": "Malware payload (Loki)", "value": "74614ae6803bc0e05773cf5fa9236f9d635b657f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734041, "uuid": "23ee3847-0f7d-4a9d-96af-21a42d7232d1", "comment": "Malware payload (Loki)", "value": "b2da13546848bfcc0a5fd9a57d6c1b2e0ac0c9f26c86e73ac0e1df3640d7813d340c2c5d79dbd2db4d95430968bed5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734041, "uuid": "4f352453-1362-4075-86f2-f5c6b7ab9bad", "value": "T1B564C01237E0C032C5A7067198B5CEA25EBE38125B754A5F6BA8163E6F603D04FB935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734041, "uuid": "47d2f052-d45f-46fe-964a-580db464584a", "value": "64844bd5bbea5ab39e782122c19db725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734041, "uuid": "da981202-3073-4968-bb9c-8d5f5ab7c5ab", "value": "3072:CvBnlbbvD3ZMmOCCOfTLGko10+ygLWEOgWUTwOKd6fia2cI+lMzRv4:KbvD3ZMmOCCOrF00aZrsO6eiHf+lMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734041, "uuid": "94ccd2cc-ffe6-43e4-9cc8-73e423607de9", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734041, "uuid": "7720e21b-3c39-432e-8f78-eafc556e569a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734041, "uuid": "1160802f-0e81-4c97-b006-b91cf827c524", "value": "515eef84c4828610068a7f13582ee42b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017f68b2-f095-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655728330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728330, "uuid": "619898b0-2107-4984-b990-80efda4c711a", "comment": "Malware payload (AgentTesla)", "value": "8a85f29cc931eccae0f5e851f92008f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728330, "uuid": "ce74d299-d74a-4b1d-b9ea-5de6acaed045", "comment": "Malware payload (AgentTesla)", "value": "5bbb170a0a60a6689cf1a361b99c7d2432c93f4b80c40251d3c577644c08bdf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728330, "uuid": "dfe1c69b-c513-4a1b-b2a3-611dbf98ac3a", "comment": "Malware payload (AgentTesla)", "value": "c1ced2790eec990f8f52bc0a238bac85c3357920", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728330, "uuid": "4b374873-96a0-4eb2-9bb3-cf34d6e50c1c", "comment": "Malware payload (AgentTesla)", "value": "21e7b81af5cfa8bf991313cc9da2038f7e09e57e03667da7a58a32539c57981d347e97a75bc57042182c8b095a51179e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728330, "uuid": "39fc6103-1375-4d1f-b5b6-98a555de04cf", "value": "T189B48D9CB22C74DEC897C27299B45C64EA60746FA71B510791630E9E9D1CB83CF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728330, "uuid": "7ff5054c-3537-4c31-b208-e4bfa51784cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728330, "uuid": "08aaddab-f3d9-4334-90d5-b436f03b6922", "value": "12288:mmr5vGF3ElD+RA8JlnC01i8NhOIZk0Bc9hMZmITUmz/PjxUfN:hvg3ElD++oln0ihB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728330, "uuid": "9e5ea74e-a3bb-4871-8dfa-195296684c1b", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728330, "uuid": "33c0119e-f4ad-4271-bf47-8ee54fb80db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728330, "uuid": "12243d26-10c6-4eed-8ce3-f4a51e2bcb09", "value": "SecuriteInfo.com.Trojan.MSIL.NanoCore.AR.MTB.26176.19278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a76f74d-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655743029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743029, "uuid": "33d19ba6-3595-485c-9092-08c11e96960f", "comment": "Malware payload (Mirai)", "value": "4b5043b0b1e14a8ead60788dd36117b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743029, "uuid": "59a7d774-8b39-43dd-a8f7-581e556fa901", "comment": "Malware payload (Mirai)", "value": "5c40e79613e337851d2657f82484df3b29dcbccdeac0181ba8252811d9baa107", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743029, "uuid": "77024346-a7bf-41ad-958d-f30053ad0617", "comment": "Malware payload (Mirai)", "value": "60be700807c58e6eb689de869fa36b8c649dfbbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743029, "uuid": "845c8d1a-8250-49b4-8b9f-566da3fe212f", "comment": "Malware payload (Mirai)", "value": "d748a3c230f67ef302fc2b97d6263db89b4d48dc5cf65086bdb53a3e1460d4a23d6fdf9c4a8a51befd0a8f5171d74dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743029, "uuid": "69ea5fc0-6903-4ce4-b997-34084e147806", "value": "T1C403E1AC9E8243A4F0D6D07969F507043F9129756E63BC8E64DAE087DE8D0E97CC2EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743029, "uuid": "5f6a8711-c27b-4410-a54d-ea05b549cc45", "value": "768:o6wilqzgzFwYoGWh4mRlove0KnCENPslvaGaj8JFjnOb+yraJgGlzDpbuR1Jb:oFuplPm4efCSsNaGXJFnobiVJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743029, "uuid": "e383b0f4-c3c5-4d3d-bbab-a2b19efb4a89", "value": 40580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743029, "uuid": "154f94bf-e413-4666-a63b-7601e297e751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743029, "uuid": "e18aa069-8cbc-4223-9568-d21afbd8f422", "value": "zz.mips.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65d70c0-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742780, "uuid": "17a62815-0f4a-4be8-875b-9c1e639c833c", "comment": "Malware payload (Mirai)", "value": "aa61c664d27b3673033e3996d90fc6ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742780, "uuid": "4b018f10-1ec4-40d6-b850-aa66de1e0560", "comment": "Malware payload (Mirai)", "value": "5cec8958ad3eb27010cda1b3e6ebeeeda09afb6e82335a9c312e4ee6d50d89ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742780, "uuid": "632ae1b6-e3ec-480f-b283-cefe06bc380d", "comment": "Malware payload (Mirai)", "value": "1d6467331bb62b3f8d33a7baf67d2659bd4827da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742780, "uuid": "7049b5e5-d645-453b-ad49-f785da4f49c6", "comment": "Malware payload (Mirai)", "value": "bc7f39df7af58d3e6aecb4a166c2a27cb1aa3068dc1cc2c5f6ce5996689c7a961957dbfbe5d0e200f354c27049a535df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742780, "uuid": "234a9385-7159-4dbb-a7ba-bfff7914330d", "value": "T1AD23F134819034D3D063AD7A82B817C16EAD0AB7DC15EC6FF4A29F8A54D65F43DA2EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742780, "uuid": "dc3c8e49-3b47-4583-8913-add4edd78878", "value": "1536:lLDrzw96kqPHzG62ufakvl7VJuCoNSKg5:lLfLkSpdawl7VQ3JG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742780, "uuid": "d325418a-3940-4313-b4fe-815dbe8ebadf", "value": 49272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742780, "uuid": "bcb7cdd0-e896-42be-8ce6-31c31f85d99c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742780, "uuid": "276ce3bd-1b18-4627-8988-284c94f51464", "value": "KFS.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53ff79a-f0a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655733356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733356, "uuid": "3c219994-d617-40a9-9617-5b202c1e85c6", "comment": "Malware payload (SnakeKeylogger)", "value": "12774bc9b1e40d0974d0aa2458792e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733356, "uuid": "0e3fcbc6-79df-4753-9c4e-71d4df5fe0ca", "comment": "Malware payload (SnakeKeylogger)", "value": "5d0092a2e51287b0a2d7f3b464f0dd008168f6b5ca6a213de83310acf6b8d693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733356, "uuid": "280df915-a37d-4371-96f3-b632eeda3798", "comment": "Malware payload (SnakeKeylogger)", "value": "a02fdd779a6170cacf09988e57b4e6ef5c579b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733356, "uuid": "71e33f5a-e0f2-424d-9870-284229b7cacf", "comment": "Malware payload (SnakeKeylogger)", "value": "f32e563fc4618bb30f0106dd2f86e7dcd0e80fe3f9cb7ad6519288fea57aaa255ab557df56c2eec7b7ba1b992539e311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733356, "uuid": "b9f3e277-d006-4cef-8062-5a975b583404", "value": "T109A4F10566BC1762E97D8BFD84E2610093F87437919AF7A84FDA30DE9C27B06CA50637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733356, "uuid": "b29383d0-c379-4af3-b57d-9dd98ad6087f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733356, "uuid": "f60f5a29-3798-40aa-a793-7854d13a917d", "value": "12288:92iN3snIFKMzaNQsvtiJo/gQUjphTKGuU3Ij:91F1zaNRiJo/gQsphTKW4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733356, "uuid": "cb684549-c74a-434f-b723-24225c1fc29e", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733356, "uuid": "7161ade0-9875-4f30-bdfa-11b18f7bac52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733356, "uuid": "46f35c27-eb50-47e5-8c09-9ab7d99690f1", "value": "AWB 5331810761.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3c5c7d-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730442, "uuid": "b18b66a9-1497-46a1-9033-47facca65837", "comment": "Malware payload (SilentBuilder)", "value": "d4c19c7d284e6a748d20489520bcef44", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730442, "uuid": "e5858229-7cea-4a80-a731-d3d8bff40477", "comment": "Malware payload (SilentBuilder)", "value": "5e616a463eca7387f8e7dad22fcd2bf16f6f23360be361f1d441ee18252c1813", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730442, "uuid": "097c5deb-9407-4ceb-8e2d-8d471bc56f6b", "comment": "Malware payload (SilentBuilder)", "value": "ce7b16726c8f498abc17974f78ec673ded3778b7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730442, "uuid": "5006f1e5-82ee-4de4-84d4-1c5593a59ebd", "comment": "Malware payload (SilentBuilder)", "value": "7363f8559e95174668defce422599930b9a920a9168957951531bb5f4edd05aa3887a8a5f93fe8d4e67bf7195e3ccf95", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730442, "uuid": "725180cc-8e63-4952-b2e7-cca60efbf105", "value": "T125733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730442, "uuid": "f05b4a0d-8b85-450b-aaae-4d1e6debed9d", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJB4:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730442, "uuid": "d7886e03-216a-4837-a2c6-e2f429d52aa0", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730442, "uuid": "7452418a-9999-4cff-b52e-28d4ffe7090e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730442, "uuid": "29f6994d-b1d9-462f-9f4b-76288b9417b6", "value": "100136635705719636.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045b4ba0-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655709867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709867, "uuid": "75968b93-4d17-4b09-aae0-a81082908f1b", "comment": "Malware payload (SilentBuilder)", "value": "5fa3defa13a1170589e4e85fade2f63e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709867, "uuid": "27854e1c-4595-4c6a-a6d2-c7fb105b1062", "comment": "Malware payload (SilentBuilder)", "value": "5e7d3a7465868515da290894f5fd63b877320a67320faf0829df628d26ca4862", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709867, "uuid": "66c19bf7-ae6b-4587-aea1-e7345732e43f", "comment": "Malware payload (SilentBuilder)", "value": "b411d2d3be560160b1d726f8957b41545ca3ca1f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709867, "uuid": "abe9d88b-be57-4e19-bb8f-64b3be4195f7", "comment": "Malware payload (SilentBuilder)", "value": "335e9e0816565bad43029a1e85f55ad0970f76146393d317f9c7eee137583eadfb1f82ee710f1568ff38b27633a3a1d1", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709867, "uuid": "47610981-7146-4425-a1ea-bf08e40a34ca", "value": "T18E833A96B659CA9DF926873048D747AA6323FC304F6B07472264F3257FBC9A05B0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709867, "uuid": "dbe6f6c2-4c25-4350-a6ce-4c64a369f4bb", "value": "1536:ROOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgG7HuS4VcTO9/r7UYdEJeZ:RBKpb8rGYrMPe3q7Q0XV5xtezEsi8/d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709867, "uuid": "47866d38-1f28-4115-96cb-42239d2d42f4", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709867, "uuid": "a388158b-5e67-49dd-bc62-47153d0add08", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709867, "uuid": "4550902a-3476-4f58-9fdb-d4628f6370c1", "value": "Gmail.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ec75b5-f084-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655721197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721197, "uuid": "063abc20-34f6-48de-86f5-3e427ba0d21e", "comment": "Malware payload (AgentTesla)", "value": "1fca286fd503efea8bf67bb26439990d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721197, "uuid": "408496dd-2613-4319-b273-76f953ba5633", "comment": "Malware payload (AgentTesla)", "value": "5e8cc96994df3b0bcb528fc17b3c2155ce82022a7dc36440f4f4a95bc4c186ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721197, "uuid": "51167744-743e-424f-bcf7-199ecf3982f8", "comment": "Malware payload (AgentTesla)", "value": "109001fb31f0c2ea5ab791371c0ca672ecdb22a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721197, "uuid": "218df1d0-7378-45fc-a404-22c53fc00f88", "comment": "Malware payload (AgentTesla)", "value": "30e7ab64940f29af1141d0ff4329b839a1425727cd031254e5a3f53cf269097489fb9d44af345f452ff9646a4ffc9f89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721197, "uuid": "86d5cf5e-ccd8-428f-ab23-0c59cfbee662", "value": "T108C4CF9C366071DFC867CD768AA91C64EA6174BB430BD247A49321EDA90DADBCF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721197, "uuid": "b1dff3e7-ac0a-4d17-a307-afa7b28938c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721197, "uuid": "18477e36-1f5d-4c99-9e69-4a384ccb17f7", "value": "12288:eJiXXEWmLa1eDLp9WmzZhSn9ncLtIQiODN2CnVZixO3M4DDh1k:BEjQeDLp9L49qIQrJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655721197, "uuid": "a902b8ff-dbfc-4e5e-8ead-3d7f2d9f8e15", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655721197, "uuid": "936f1891-8b25-4d08-ab63-8901e2babbd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721197, "uuid": "ce9e7047-67f6-4b27-a03e-ae5c2e95c61c", "value": "SecuriteInfo.com.W32.AIDetectNet.01.28239.14751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0a809f-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655716158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716158, "uuid": "3a323738-f185-414c-81e3-ac5542e54c7b", "comment": "Malware payload (AveMariaRAT)", "value": "e7798ed2c8a24c056428788a3404879a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716158, "uuid": "3debc8ab-03af-430f-928b-494c26f12bf1", "comment": "Malware payload (AveMariaRAT)", "value": "5fa9c09761fb1b3dc555e9004d2999b63956735e3b92310929413d62d6ab24d4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716158, "uuid": "edcf9f6d-0d95-4146-82ad-1bd794a4b37c", "comment": "Malware payload (AveMariaRAT)", "value": "6cbea91849c78c64f3d02ecd774b484ca12f0f34", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716158, "uuid": "dc08391f-9dab-46fd-bb89-c851941b9d38", "comment": "Malware payload (AveMariaRAT)", "value": "90488d3397ad6450a899e88d03b74b4314b0c4ba6679a0ee9f9235c647ab1571f64b93eff17cfffd1aaf43f00f11a650", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716158, "uuid": "7515f6f5-0041-493e-87e4-3fb50790c3b2", "value": "T1DC25AE62B291C43BF07729788C5B52A8292F7ED32D74A64A2BEC2C4C5F775913835393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716158, "uuid": "b570940a-fcf9-4243-ae9d-28cd888ba12f", "value": "6bc49b119ffc99d9e27364e06b706e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716158, "uuid": "0219bdd8-8c75-4f6e-8e48-f6a7f46a4fb2", "value": "24576:mArq7iX2O7Zo+r5E1kBiKvyJsPFtZd52EUAEc:m17+7rTPdtZ9Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716158, "uuid": "e8e1ac0c-631e-4f94-a3f1-381fbe45089b", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716158, "uuid": "3106b44e-1aa6-420a-83cd-20d0b72ed9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716158, "uuid": "cfe7c2fd-89b4-4018-8f4f-aae327dcc267", "value": "Kawashima Export Co., Ltd Demo Samples PI_220617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f513cab-f05a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655703094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703094, "uuid": "fb7da469-e347-4f0e-985c-de8aa5456e22", "comment": "Malware payload (AgentTesla)", "value": "dc819e4d3fad145b7affbe4d26ce644f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703094, "uuid": "1afd8c00-6de1-4715-94b0-abfac456d978", "comment": "Malware payload (AgentTesla)", "value": "61526232111428e6a9859c2fcd74447213840735fbdeeffe590c1f4b0243b1b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703094, "uuid": "119b6dcd-2142-44df-804a-00a4d3c25e6b", "comment": "Malware payload (AgentTesla)", "value": "aaaee0a5a3777fedcfcacdd2a58a96b481a33052", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703094, "uuid": "a0e2f0d7-c26b-425b-ac22-72b09eb2f9ff", "comment": "Malware payload (AgentTesla)", "value": "1ad6f214b1e6185001d7cda1620a4dc2ed260a4c34eda19c5fb4e8297b9abd99ccbcf69ac489a640ade7675651c81d70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703094, "uuid": "2a1f7779-e30a-441c-b375-10ff8cd4aa8e", "value": "T1B7B423E5E0D3206C2AD324BA3885C9F865968D351F409CE8DFDB9E126301EE75278F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703094, "uuid": "261db048-5a85-4977-9593-58d09c640e28", "value": "12288:PCVpkkPyFev8St723HpO2/rt2x4hUmCLuvsSZjJjq2hlTV:ROy00c72k2zGbATu2hlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655703094, "uuid": "ea3af97d-a0fb-471b-8c47-f4cc4941441c", "value": 518998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655703094, "uuid": "a6be6d8b-ddb4-4550-8473-edf033429c9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703094, "uuid": "5d052cc5-7ff8-4a1d-9343-d2cc8484b10e", "value": "Stainless Steel Plates Sheets and Coil product inquiry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f0b154-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655715320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715320, "uuid": "5e7372f8-2f78-4c95-8f6b-979cc82f38fc", "comment": "Malware payload (SnakeKeylogger)", "value": "70c651e8fdceb60514501285e283e680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715320, "uuid": "957fc749-f7bc-47f0-b7e9-abaf233a7c89", "comment": "Malware payload (SnakeKeylogger)", "value": "61a66aec932ed8603de248a94140db83b1e167fd54b6481b781c769286a5371d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715320, "uuid": "a9476ccb-2db5-4a80-94b8-df881c8525c9", "comment": "Malware payload (SnakeKeylogger)", "value": "7c744fdb01551ca6ea1fc9a22b2b5ad355bfe681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715320, "uuid": "e104b2b9-ea35-4a3e-8873-0e2cba9e0470", "comment": "Malware payload (SnakeKeylogger)", "value": "0c8a276a70dc5be6a7094973794354193bfc482528affc2a0a1f4fd1f956ec16ca769e3fea26ff0bedb00ae8eaf9424c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715320, "uuid": "c45a5600-f519-4aea-897f-6ed05b151f5b", "value": "T179041FD7F848985DF93750F90CB793599DDA29B18F004EDEAF863A8902B2DDD640C90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715320, "uuid": "d7c75b49-e909-43f3-8f81-48a056e05e9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715320, "uuid": "a856520a-423c-48b8-9730-c408fc86fc31", "value": "768:73I8QvkWveSIedLpZsf/vt5UsLbgg58Jgfp:73zQve+Lpqvt5vl586fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715320, "uuid": "e1a95a51-aa67-4c2f-adc9-b656856b4f9f", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715320, "uuid": "5547ed0e-4d9c-48c1-8645-0430c2e58e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715320, "uuid": "c68cf545-a70e-4eb8-9386-87d1d562b11e", "value": "VSL'S PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83756dd6-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655722106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722106, "uuid": "87b2644d-f095-4f22-9da6-06ecde22a418", "comment": "Malware payload (AgentTesla)", "value": "d04df5cc3dbf1b9bcb9e8272bb28d3ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722106, "uuid": "8eed069b-dace-4676-9fcf-7b311d8a0557", "comment": "Malware payload (AgentTesla)", "value": "61d404fca3e77c9da77c817cf0e35541e15ea11350f6068d22e33a03a28a5e35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722106, "uuid": "4c932737-9b69-4fb1-a60c-af694cab1c95", "comment": "Malware payload (AgentTesla)", "value": "35012ed49dde2234c2f83a52b42d900422b859ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722106, "uuid": "3a76f6c4-4017-4f3b-a02f-04b6462524dc", "comment": "Malware payload (AgentTesla)", "value": "9150bf74e0d8a88b324997690e4b945ee6397532a4207ecbfd96db176744a78172ef9af2855d4d5a1d0daa69d090fc0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722106, "uuid": "5491493c-1d78-45f8-ac57-68a8b14f8949", "value": "T104A4124435B99761C07B6BF560F785989BF2C836D822FA8C8CC541EE18B9F989B44F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722106, "uuid": "a95eecf8-b249-4040-90aa-d72113d904a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722106, "uuid": "db9148be-f1e3-40d7-9c09-3829ef2f1890", "value": "12288:sDlJWr5assuQzffVDaorLwhAM528YEFX8+R4JkGk:sDj2assu4HVpvw68j4Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722106, "uuid": "23157a70-f9d7-4aa0-82b8-9b19c948e896", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722106, "uuid": "a4c89b88-dc90-4be0-b857-38c7df7f0954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722106, "uuid": "e2d9114b-1d9e-4a4a-b594-ad8c43f105ff", "value": "Request for quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3415d45-f0a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655736869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736869, "uuid": "7f28f9e9-337a-4518-92d3-713eaec50866", "comment": "Malware payload (AgentTesla)", "value": "7ee5c82209d63f7a448691f304d8f0c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736869, "uuid": "9bfd83d3-8e0b-4baa-a2eb-8f513d6dbae4", "comment": "Malware payload (AgentTesla)", "value": "6238e191d91549d630dc1b2132c2d9bb184a4c01add302a6bdaa4caa5c0a040a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736869, "uuid": "a4c61762-954d-417a-827c-1fad21cb1639", "comment": "Malware payload (AgentTesla)", "value": "d3704f2dec752b2d8e816cf1a433d53e4295a5a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736869, "uuid": "df629b2c-2303-4ad2-b6e3-e8a0a4662aa5", "comment": "Malware payload (AgentTesla)", "value": "7f624b99bd891df00296743b5e9bee8f734575ca02557acb0dfc1776cad2d18f69feb0ce517bac51e904d2e1f02b5997", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736869, "uuid": "ce677e7a-4e17-44e3-87f3-de4b53dce97b", "value": "T165046D5FED04AC8CCA7509FB2B35C3406D687E42AE1F46DD238CF68B8272545663C6E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736869, "uuid": "13851f02-e4a0-44e4-bab2-e7700f2cb311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736869, "uuid": "e3a18898-ab81-4857-b197-fc30e33677cd", "value": "384:LLfyKL1goAcfskkyk0en3xyuGoNPXzeXNoqjroor64oS3Z0x:LLlgWN2GoBeXNoq/oor64o8Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655736869, "uuid": "ec6d1856-1cab-4836-9685-782c91656966", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655736869, "uuid": "18b52d37-d702-4163-b179-e5aa4f1e7f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736869, "uuid": "5ea67b56-9419-413c-8b14-2c9592c741cb", "value": "MT0678813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1071e035-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655716329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716329, "uuid": "33b0092d-f5de-4fe7-893a-d5306a23d8de", "comment": "Malware payload (GuLoader)", "value": "cdd9a0e0c89d74018148235340e2e104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716329, "uuid": "8129c948-0272-40d5-a6e6-e34ec32a4499", "comment": "Malware payload (GuLoader)", "value": "62f1d77fd86163085d828676a618ce71d44fd445ea9b927fbca506c6b43880f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716329, "uuid": "e82a8d46-8329-4ef6-a00b-2ca344f7a835", "comment": "Malware payload (GuLoader)", "value": "42fc723385407a90589abf3ba47f45cc040d9892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716329, "uuid": "a5cf62bf-7bf9-41d6-b177-1b4fa27ecaf5", "comment": "Malware payload (GuLoader)", "value": "d720798617f294ac944baecd6ac7c66e6b786a1a255e67be407f97ec6c32d747c41dd8856ca4b99623cbaba4b4744f20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716329, "uuid": "ad41a35f-bf2f-4778-a879-b34307255977", "value": "T14F24F118A290D8D2E09D02310CB5ADE59BF5BE376C704B3723922B5EBD31A405D4B7BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716329, "uuid": "60a15579-981d-4c4c-bfb6-1a8f9bc00de0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716329, "uuid": "0b6eaca6-645c-42bd-ae2b-7c33e6781e66", "value": "3072:l1NjcVVnLpPuIWD4rok6Jgbb2FdAkill4wIjJPc+x9LeY1vFPSrqSUaYg+eqJdpy:HNeZBbSQyEWwIX9XLzeqdpeLBnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716329, "uuid": "496861e7-50bb-4fc8-8a06-0f5f5c22a934", "value": 210584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716329, "uuid": "e0bd683a-cb64-42ae-a534-1f0d3bf50f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716329, "uuid": "5a25969c-7a8e-411f-bb39-74dd52f6a13a", "value": "PRE-ALERT ~ Air freight from Shanghai to Mumbai Airport - ETD HKG 22 JUN 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06760182-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655709870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709870, "uuid": "d18cdd67-0f1f-4ddb-905c-167fc64b578f", "comment": "Malware payload (GuLoader)", "value": "2cca02022854989ef82ed9b0bc86e436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709870, "uuid": "5d35f302-bbef-45c0-8a2c-34842e1b0f98", "comment": "Malware payload (GuLoader)", "value": "62fb62fd8e19d45db039738c658204a31765b962ac09371e6cf35d2bc7faae53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709870, "uuid": "8289f5c1-c74d-406a-95db-945a29e4b9c7", "comment": "Malware payload (GuLoader)", "value": "407947514cd9121df0a2cbc87d6073b1e652476f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709870, "uuid": "93fc6499-6b73-47da-a473-8579d880b1f7", "comment": "Malware payload (GuLoader)", "value": "adc57c93175ac0a2706490dda45d228dfc3d1e75459290aa2baceffab1037f7f12a9eeebf338793800ee5638b3beab53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709870, "uuid": "8fcfc3a7-2294-487e-8e9f-4158e2eccd00", "value": "T13B74CF423918D4FFE83C03B2A47785670AA67C3A95B1555F3BE3BB5921B3733064BA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709870, "uuid": "2bfeabd7-ac97-4cc8-8b4d-b494f942276e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709870, "uuid": "87d1d524-c85f-421a-84d5-5432b0a56672", "value": "6144:rbE/HUQbYqapFZI4h2UVKubIwuGoSG0krwBzB7PSvZFi:rbOapFZfh1awuG14cB7PIZFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709870, "uuid": "8102c028-d914-495b-b82e-da40576d966c", "value": 355694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709870, "uuid": "786ef8ff-9668-4b75-92c6-6ed2baa89427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709870, "uuid": "d8ec37cb-eb8e-448f-b39a-5e4bdbc21841", "value": "PROJECT DEMAND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13addd2-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742772, "uuid": "0d531bbc-bc33-47e1-a6c9-51e066c3df36", "comment": "Malware payload (Mirai)", "value": "9d1ef43ce808c63a9e5bf6af0a640300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742772, "uuid": "90d15db9-ccf3-4475-b336-90ae63316aa3", "comment": "Malware payload (Mirai)", "value": "6359be61f8b86a3b42120595f5f4f98c88a6c96d30a8ab2d1739e687a5c8ac65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742772, "uuid": "12241412-5198-4e5a-9aeb-1ef283a3f2bf", "comment": "Malware payload (Mirai)", "value": "cd7c37aa56505bfbcfb7f7577a0b08832a1e7a2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742772, "uuid": "11cb3576-be19-47d8-a77b-f5f00ec69abe", "comment": "Malware payload (Mirai)", "value": "4e785fdbf164b89d0c1cf4fe77412827484707c719f9b201605578c7b2366de3f969d33e63b0e294f5de23785770611e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742772, "uuid": "9f0d05cc-50a4-4e57-b8cb-3e76fa1f11e6", "value": "T18B23F149DBEF52A1CC12D1B9EB7F790E3510892863F581266FE4A0B93CB3FB72018950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742772, "uuid": "315f7d3f-02e0-4489-9e9a-9cb9e50774bd", "value": "768:dMUjbRMDJ4uP7AbEpCauZUiTPC6HS682PsKA7AU9UYXYfienbcuyD7UrQRjXs5c2:eWRMDJ4e7nGiiTPby68mWb9hoaenouyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742772, "uuid": "a6962633-3179-40c2-811d-eb7071f8aef1", "value": 45864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742772, "uuid": "9b1d34b6-64f2-4e23-9c01-73eb4170d020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742772, "uuid": "3094ec97-85f5-4182-8a14-502039a92e47", "value": "KFS.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6fa14e-f07a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655717098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717098, "uuid": "53d1a2bd-678f-482b-aefd-0e4e382ed8bc", "comment": "Malware payload (Formbook)", "value": "dc971c7e49e988c85c5378b82af266fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717098, "uuid": "922d1ddc-8d79-47e8-a11f-44614f20ddcb", "comment": "Malware payload (Formbook)", "value": "63a24a782f2d4f31f57886852f84eda1eea782ab040cebb37d9325c8da6f2b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717098, "uuid": "62daee8f-255e-4ff1-b6b4-84b61c186346", "comment": "Malware payload (Formbook)", "value": "fb1dadcf5db663bde803637b2565dbb44d6b0a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717098, "uuid": "4dbdaad1-dbcf-4f7e-bb7e-40963e397f9a", "comment": "Malware payload (Formbook)", "value": "201225504a946a2ed7593cbd7dda76b8b7e72bc8909d86712fd914bef6216f2ed2738b7aefa742bc83bba047529a157d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717098, "uuid": "e6c126a1-e3f0-47bf-a49f-1b98ead3c7c4", "value": "T16744E03E3794CF00C1A9A971C8DB492813F4EECF397196967F5A356D1A833A36E4858C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717098, "uuid": "4811383e-1523-4770-9141-98cdb3335ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717098, "uuid": "b562d07c-8de8-4029-8ec8-2d65d08efb1a", "value": "6144:gxGpg1XmyFFW7DMysqizjxbsyxEmaV1s5hPeTAIpVpse3kTf:gwyD9yDAjpsNXVncIpVpZ3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655717098, "uuid": "4ed4dfe1-55a6-4b22-afd2-42bd1022ac81", "value": 278040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655717098, "uuid": "ec3056dc-d5dd-42de-b466-11420e8c6c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717098, "uuid": "adb4d7a1-adb3-4576-9abf-40c490ba4542", "value": "FedEx Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da96617a-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655704643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704643, "uuid": "ceede784-0557-4069-b604-c6bf3b09ff23", "comment": "Malware payload", "value": "4a38f62efcbaf9f8daee348e014b1089", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704643, "uuid": "4f8e566d-976f-43e7-96c5-020cc7e69fa4", "comment": "Malware payload", "value": "64a460c4642c6f6c6e4a8eaed2c7958175cc81d6cf995fd1b6b96eaba726adf0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704643, "uuid": "2c5ee667-ae0b-4ac1-a137-79ac7a0fb78d", "comment": "Malware payload", "value": "d937e95ba7324d06bb24801d046c3fd8aad7f2af", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704643, "uuid": "45fa4403-05ce-4ada-afd3-acad8ac7fb48", "comment": "Malware payload", "value": "ec293d8c0a2d99a847626dc18f7c2936bb4e435c962c20a4d544ac09ab9a52701ced85b48ababc5ce0d402325d95341e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704643, "uuid": "a372a1ac-39da-4b8e-bf7a-c17dd5cd43dd", "value": "T147227C38C605F82BC11645BEE01AC1F0FBA95457EA22FA3D2018735F17D14C35BCAAA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704643, "uuid": "c9eeddb0-b724-4195-b010-bf8e08464813", "value": "192:ScIMmtPypG/bRXUq1O9o/amWBXPfxZ3nNR:SPXqMR/OOof7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704643, "uuid": "2209d4d2-3072-4acc-898a-e8ec896b4438", "value": 10338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704643, "uuid": "34d2ba3f-da8b-40d2-aeef-cdfa2b910afb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704643, "uuid": "d0ccb749-ef4d-4d39-aec2-e12b4491eade", "value": "250-copy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e288d0-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655743050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743050, "uuid": "24500f05-d25b-484d-a345-4804adc39a1c", "comment": "Malware payload (Mirai)", "value": "0cbe70a308e60c48a4d50ef2a70cefa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743050, "uuid": "bd984499-5483-4573-9358-65d1a1975cbe", "comment": "Malware payload (Mirai)", "value": "64a7e942ff4aaa7b8e81324098b521b383e2f3efcd53a66ca725d0cf81f31861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743050, "uuid": "534fc689-3ae2-45de-aee7-88687f8ccb81", "comment": "Malware payload (Mirai)", "value": "bd7a4b96ec0e4a7bbc2cee2e3ef44edd5e6b2994", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743050, "uuid": "48d21a17-1ec4-4dec-9b24-807f5890c403", "comment": "Malware payload (Mirai)", "value": "fad5e8d300c33f4a2d0ac3d8fc6b79c1782992630893258ca7c21b4638945863554915edce77929548faab8e5d33af27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743050, "uuid": "b22e92d3-c949-4eee-9c62-c2b8aa8844cd", "value": "T1FA13F1B0D5CCFF82E7B359B80EAE81F31BA2D9472328D3D946D61B126A05D0D790C5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743050, "uuid": "e058bf0a-a505-4b26-9bee-806021e2db69", "value": "768:bDLWd6klWnrM+CLzOxDZf4g66NQcWcls1qydCSKgozPRSooavQZSOS+q4uVcqgwr:Du6kljfG9q/0WclswUCSOzpQxq4u+qge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743050, "uuid": "a5a7cc94-6ed9-4cb0-8723-71534cdde4ff", "value": 44828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743050, "uuid": "d2db69bf-7ec6-4cfc-b09b-139e26ba8e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743050, "uuid": "7a6a8118-e211-4d2b-82c7-578a5207fe8f", "value": "zz.ppc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f31540f-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655733534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733534, "uuid": "34454044-8f86-4015-acd2-42fedeba748c", "comment": "Malware payload", "value": "7199ca5fd264df3a53b521be7b317e66", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733534, "uuid": "39cc20e4-a5d1-45e6-bb03-c3455e7fb271", "comment": "Malware payload", "value": "6521d5355d1b310248eaacc4004e833c80c73937bba9cfc09ccb684b315470ac", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733534, "uuid": "a65d4c37-2b25-4c05-8cf9-573169ca5d71", "comment": "Malware payload", "value": "bc71051cdfb4ef9fdfcb6ecb7ebb318577ffe644", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733534, "uuid": "1de5b3df-f5c1-48c0-b75a-5a41674516cb", "comment": "Malware payload", "value": "cc56e709e09eeb53d3548c42292ca4f15280e6160256c5b58116bbf6af7f4938c3c88ec2a4e68e5560bdf9871bb5e526", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733534, "uuid": "ae960cec-f4bc-450c-887d-79bf9e9ff8ef", "value": "T17E63D01F8F924530F55B4FFA81520298E53E0C346C44F9D920E37FA9AD79A9BC92CB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733534, "uuid": "b84f6c13-e2c2-4689-be66-d2a6da087f9d", "value": "1536:+vWP9b3vCZMaKKLV2PFiDfkkoFbYLeqVrsBqdY1FDQEKsJHR:+vWP9bquaJR2PFiD0VhqUqaUiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733534, "uuid": "ee5146cf-2077-414c-9b1e-da37f6fd606e", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733534, "uuid": "0577bb8f-a6e6-4998-9702-a1cf9708a9a7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733534, "uuid": "b9d831e7-e147-47d9-aeb2-cd7c7dd212eb", "value": "PI#00343.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d1adee-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655734047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734047, "uuid": "4974e52e-d56c-40f4-887b-3501d5db1fd4", "comment": "Malware payload (GuLoader)", "value": "3a0f6ab7e5d8adad63eaf281716c664c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734047, "uuid": "80039d07-9a3c-4958-8956-7bd5c6fdbfd4", "comment": "Malware payload (GuLoader)", "value": "6589ef6d50a4e9c5d14a9a6f4892f5ffe3c8536f22394f7185f585cc3289fe2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734047, "uuid": "a4ff440b-a6fd-44a8-88ba-276132b3ef6c", "comment": "Malware payload (GuLoader)", "value": "fd6c770e7f21a57a0049c0c8b76c25f6b835acfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734047, "uuid": "f0a95bbc-d044-487e-ba42-5783816ae08d", "comment": "Malware payload (GuLoader)", "value": "1d2887759c2f9b84b0d1348997465392bfa27bc71c576369b87997f253b671ec80c1bee96fc517a4ffc1e215d2416d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734047, "uuid": "e12c7825-c52d-489d-8b23-ca8ef6e5543c", "value": "T130E3F18573A98C63C8A30F711E7447679BEEFE2218B4960F5B107B563F72642990F782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734047, "uuid": "2d70f2e6-dd59-4e70-b2b7-7afda70fb621", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734047, "uuid": "39f14ece-1355-4681-b164-2e9e84d8bbcc", "value": "3072:I1NjcVVnLpPuBAGb7ke2F7Qt2kw4r/aq04kxKI/CPrnRCz56/lmBf0QPN/rlee/:sNeZEobF620/k7UhPs56/lml99rlee/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734047, "uuid": "f7c8441c-fbfe-4ebb-8088-a163e1f4b833", "value": 154632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734047, "uuid": "527b2728-8eaa-44f9-b4bf-eb55a29c5676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734047, "uuid": "f89ae83a-37ef-4852-936b-2df843ffffd2", "value": "5013269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423caacf-f08a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655723714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723714, "uuid": "74c7c021-105b-40be-8643-5de761eac3b1", "comment": "Malware payload (Heodo)", "value": "d384b7add9fe11859840089d8fb22a00", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723714, "uuid": "bc14496b-a604-45b8-91c7-7c7340432124", "comment": "Malware payload (Heodo)", "value": "65d35ac0698af7a3c72b6e34941392cd8fed079734bdd16e1ff99798cb40b9e5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723714, "uuid": "ca23b40f-d342-4b8f-8bdd-7b151b0a8c4b", "comment": "Malware payload (Heodo)", "value": "e2c6146a9c2d89c95c62ffafe4b3a3e7a108abd9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723714, "uuid": "0fd22355-2576-46d8-b373-469c3487e37a", "comment": "Malware payload (Heodo)", "value": "312f443b1d25aa87fca448652754a62a2ad89bb810dc6736c84410991a33fd3bfd53740dfb5d340455141a0d5b24b5d8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723714, "uuid": "8b56c7e9-88f8-419e-b8d9-2f1b8bcd9823", "value": "T132948BCD33D343A8F96FDA38C9274672F935FC094320660E03A76269EE2F355952961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723714, "uuid": "88a49c4a-22e0-478d-b0e7-613d7e646ec4", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723714, "uuid": "54c80eb6-4d18-4bc7-87eb-b915cf1f67d9", "value": "6144:9B1DTNJh/8WsVr6ql3d/xSQEN3pFG7xScw/SLFpnU0ScKiEfzl:9vpyNA3WHxFNal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655723714, "uuid": "24308de2-a522-4817-8fd4-c09f2428c3c6", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655723714, "uuid": "26e6ead1-d060-401b-b1fd-90d14057268e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723714, "uuid": "fde8ca74-dfd8-4201-9b87-02bb35660b58", "value": "yZJzcOZAvL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dedfb6-f056-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655701362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701362, "uuid": "444efa2a-9061-4d1e-9422-f16eff3e0a81", "comment": "Malware payload (SnakeKeylogger)", "value": "6e5220b328178325585cb73b98a73ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701362, "uuid": "e634af0f-b361-4a83-97f2-f8cd4589c0bc", "comment": "Malware payload (SnakeKeylogger)", "value": "660050048d88242c77c278463c5c5d727582ebdd08f702ad387507ce54b3e761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701362, "uuid": "39b237ba-a009-42be-9342-8836786b54cd", "comment": "Malware payload (SnakeKeylogger)", "value": "a9e871118a5c0346444242b3a1d7da27b1de2587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655701362, "uuid": "a39fbfb1-514a-4c2a-bcb4-db06c857c219", "comment": "Malware payload (SnakeKeylogger)", "value": "0077210651a7a903cc58185f288aec19d6b436bfa1c2212764b09a7e1904943eb3e89f6ffed24f239b3e5555a45e60c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701362, "uuid": "da897d75-a8cf-47a2-b9c2-94dd3c737b26", "value": "T10872F9666B8483FEC4FD09F2AC63E1401534F2BD9882DA493CE5598AEDA37D1066731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701362, "uuid": "c7eb27d0-2275-48d8-9b7b-65ac1543d64a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701362, "uuid": "3dc4988c-bea1-42ac-957a-573c3e4e9995", "value": "384:33hEWAjJc39IyvbguUC6tdZlFBM1E2V1XNbidvYK+4wiLWwS:yWq2BUCUSO2v4dj0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655701362, "uuid": "2cecf984-4519-413b-a02f-facd1ef5da90", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655701362, "uuid": "b709517e-b064-44c9-9d8a-0ec5d0299852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655701362, "uuid": "9552e742-e42a-4edb-aa1d-163d823a19ab", "value": "SPECT_87648.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902ca047-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655733724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733724, "uuid": "5e1e3eb1-f2f0-4cf2-944e-05c1d7299b53", "comment": "Malware payload (AgentTesla)", "value": "4e0dbbb3dac6c11e00338f86d6694750", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733724, "uuid": "4898f058-96aa-48f2-b3a5-a6dc25dcc18b", "comment": "Malware payload (AgentTesla)", "value": "66065e351520ac96c0c8cd99ce802a997438df001057da7efbfb4e3684dc1f9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733724, "uuid": "e0d96a7a-98a4-4079-9b5a-b60477e607cc", "comment": "Malware payload (AgentTesla)", "value": "2207eaa50d975e5980fdcdaca6d9cba5c71d82e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733724, "uuid": "5b6529af-d101-4c6c-bedd-23b632f69e48", "comment": "Malware payload (AgentTesla)", "value": "34ff71e58fcef0dca97fef494fe4bfb601553a0b7d3b5d72c1debb3f52436d565241b0cad0ef9e695feb1a4a9a7e0efa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733724, "uuid": "0fdf9759-0d76-4c5b-b415-67cac7372619", "value": "T154C4F1046A389762E9398BFC88E2614093FC6423915AF7AC4FD530DF5C77B178B50AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733724, "uuid": "5da975f0-64ae-421a-a220-ac32173bd4ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733724, "uuid": "e794f8c6-2f7b-4a33-8295-c704a0fed32d", "value": "12288:h2iNvh49xTIVz+4b18bLSnZX5U9k9j0yL0HnMy:h1l+DTwpqQZX5ok9jTL0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733724, "uuid": "0bfa273c-4426-48fa-880c-3cd9f9f98105", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733724, "uuid": "4b17dc2e-ae75-4316-816b-26a7db08ecb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733724, "uuid": "0c6dc329-b762-4d08-b1a1-c74d8f97d2c8", "value": "Naro\u010dilo N 000295 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045ff907-f06c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655710726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710726, "uuid": "e20a9558-0027-477e-bf8b-f9e61a7bb92e", "comment": "Malware payload (Loki)", "value": "315d8c6a8f9f7ba6aa205cf05cbd8d6c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710726, "uuid": "27bd9fcb-50ac-4d28-a6eb-56f88f42a8c6", "comment": "Malware payload (Loki)", "value": "666b183f7a42b6dc272b1ee367399d68290b8975ab93885a41bc15696ecf3651", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710726, "uuid": "068eac3b-33f4-4aec-864e-d9bd59f34b0c", "comment": "Malware payload (Loki)", "value": "ca565c81b491e097d8e98ff38c07d42df8ed90c9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710726, "uuid": "d069a93c-99b3-41fa-9a50-e19e138311ce", "comment": "Malware payload (Loki)", "value": "a026c98ef662b41a93286ccdf2a5134203f524c7910bfddb86bbf50b358253f539ef85c57ad51b0d92b11847253eae14", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710726, "uuid": "c0c56072-9312-4c8a-a916-70c7367d42af", "value": "T16273DFBCE754F448E7A7DD7C5B87608540B96C54AB48C4407E5A37DE28BCDB237A02C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710726, "uuid": "50132d91-b35e-465e-9775-e8e0dd96f620", "value": "1536:+cxbfPNvDj6lAUUKNp6LVZyNnlnsYQOYKqwQlFWil6jOfX:+cxbnNvDjKAaHKKqwsxfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655710726, "uuid": "3082f6ed-f998-4c30-9cdf-9f65de6ada9e", "value": 73544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655710726, "uuid": "5a2ae1be-5510-4bcc-8dd0-d1b4ff1ca940", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710726, "uuid": "1ab6b476-b3de-43ca-acf2-e0bbee0a47f5", "value": "outstandig payment list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1652841-f069-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655709728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709728, "uuid": "1abe6829-3276-4e64-8563-ac483ce1e69a", "comment": "Malware payload", "value": "e6a85931fb96b1e3d8323f00eefeaca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709728, "uuid": "ea822d45-a5dd-49fd-a763-3590095d42e5", "comment": "Malware payload", "value": "669c73d43ee10805a49260331dc5c2f278a84191b96c32ffe0ffc46365722b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709728, "uuid": "2d247eb3-12e1-4e93-96e9-fd6fd880d522", "comment": "Malware payload", "value": "9351faa1c8f801d2968ebbaeae05e359fcdffee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709728, "uuid": "f5f55b78-968a-408a-bd32-c1221ade82df", "comment": "Malware payload", "value": "be257509292633d7a112d947892f75b1dbac819685c9aa8010e548c3c194f31da787c43a6f297e8d549a9d1a83a14809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709728, "uuid": "6e2678f1-92a5-484b-90c7-9244422d29d8", "value": "T104B5E03FF268A53EC49A073249B39750587BBE64682A8C1F07F4350DDF765A01F3AA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709728, "uuid": "05539b66-78d8-401a-806b-b5a49db9eb60", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709728, "uuid": "1813507a-398b-49e1-8fc9-1dcabcfe3abd", "value": "24576:Y4nXubIQGyxbPV0db26TUlLJqvmuHqdnYaCXRXufwHL2ULl2dt8Syt92stT7Ykti:Yqe3f6i8g+XENaL3tT7YSi9Bl4NYwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709728, "uuid": "33fd301a-418f-4f1b-a292-3927a49e4a18", "value": 2309883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709728, "uuid": "3df0ab9c-e89f-4890-8178-ae35d685eece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709728, "uuid": "453713e2-e3b3-4176-8074-b3bae764791f", "value": "6.18\u51fa\u5165\u8d44\u91d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5053e18-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655730457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730457, "uuid": "df1c9396-4af6-4805-b7ba-d4c2a481ed9a", "comment": "Malware payload (Heodo)", "value": "eeb403fef0782353323eeface1761eb7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730457, "uuid": "a5a90c32-d0b3-41ea-9e6a-5c546332ad8f", "comment": "Malware payload (Heodo)", "value": "67b4b2c7edb8e0f0c0b7d8dd1466ce3ba24a2771be0aa1740e5548e824bc6353", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730457, "uuid": "f3427bbb-7f21-41a1-9c36-6172a9b8fd1a", "comment": "Malware payload (Heodo)", "value": "a3497242e80730519b2514be40f998d3dc3c8a00", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730457, "uuid": "d1d3f2a8-4850-42a8-9ccd-5289269fc72b", "comment": "Malware payload (Heodo)", "value": "16c047c0d216cdd05c060010e4d6fdae88bf3b5a8e67187cf703a99992d44aea4bc549a70e7bee7542b1a532e7cb073c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730457, "uuid": "843c0e5e-7a12-444a-af0e-9551fe7f6123", "value": "T1B7733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730457, "uuid": "abd7f2af-ca2c-431b-b335-74489e058b33", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJB4:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730457, "uuid": "0628dc1d-bef7-4dc5-9397-331d54f12940", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730457, "uuid": "713bcb07-e91e-452e-b034-056de9333638", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730457, "uuid": "7d216657-37bf-46da-a559-ddb3109ae680", "value": "Gmail.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae1a825-f06d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1655711274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711274, "uuid": "ad42ec6a-9d65-42c6-a0e4-7a7907784611", "comment": "Malware payload (Mekotio)", "value": "111b9f1bf78e198656c822fe9cdaa4cf", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711274, "uuid": "a9064810-e98e-4460-81ff-b5c78e1e1a1d", "comment": "Malware payload (Mekotio)", "value": "67d94aebea173f8c5bb4bed42f50897e4eb917ea3e180d0fa0aab811c932dc7a", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711274, "uuid": "4528329f-8976-40d9-bb1c-3f2ccb59b759", "comment": "Malware payload (Mekotio)", "value": "a0589b1f99ce22c25384a97cfaa6ee73a5047b30", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711274, "uuid": "fe1bb2e0-e36d-49e8-ac0b-4f80bfe9a051", "comment": "Malware payload (Mekotio)", "value": "6ac4eb1200161d453ea2dce9481f46bf6bb5a082385628e52186dd834fbb5d4f93bb53a6503adab977f3b442f0384398", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711274, "uuid": "a631bb0b-a2eb-47d5-a46a-99971cf371e2", "value": "T1A8C5AE26759AC636FA7E8270652DCB7A60B97FF00BB244EB63C4592E0D744C10272F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711274, "uuid": "2df934b6-d4b9-45f4-bc63-753403f91eda", "value": "49152:QkQNitjVqoAbAUKtulJl7VFv1lxKOC8fE/co0Oj+qHfV5xJd9zlYdxDOjSETeVf2:ttMLAptulbxKO1fTCWOjSEPYKHqJY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655711274, "uuid": "c82dc8e3-965e-4415-ae64-6b7d9d23db90", "value": 2575872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655711274, "uuid": "8898ec68-a81b-4471-805b-c19d4c58f8cf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711274, "uuid": "86eb7386-9f8c-4b6f-8ec4-e14e340776d2", "value": "67d94aebea173f8c5bb4bed42f50897e4eb917ea3e180d0fa0aab811c932dc7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee636e16-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655734311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734311, "uuid": "ca936261-e602-4aaa-b819-4efee2ed2c5f", "comment": "Malware payload (Formbook)", "value": "791098d5656278d0afed2d54d021225b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734311, "uuid": "b1d9f7fd-9749-42c4-98b1-eeae4f96a8c1", "comment": "Malware payload (Formbook)", "value": "67fd0f65b238df732b2c0ee4c77433ae70f5280f5ecce1c60af87f7d72fa939b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734311, "uuid": "eb2e28ba-9d2b-4b9e-b2ab-77c4de866d5f", "comment": "Malware payload (Formbook)", "value": "2145b89dcda0f37c6c2daadfeeef1dbaa7ad3bc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734311, "uuid": "4edec29f-d44f-448b-a33f-1076ef237dec", "comment": "Malware payload (Formbook)", "value": "8b29cfe06350c35c2c01a1b604e419112780098ad31c66d0c04691805c0333ac7f8d6f74962380dd060c87e4cfcea304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734311, "uuid": "dbee809e-ca8c-404b-aca9-87ad54237580", "value": "T1DDD4BF04BAA3CD05E3A56B77C5D6041457F8AD42B26EEB4FB7C622DC49033EB4842B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734311, "uuid": "e62598ac-6aad-477b-85ce-2566ec71117a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734311, "uuid": "8c2d8789-da8a-46b3-856e-ccc9f1526ab4", "value": "12288:kuXCkzYT5BOXPKNIgmnhwC6Ew5fowZ4q6c1lJODy6jB:QHOfCm7HkV6iJNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734311, "uuid": "d43ddf07-6f6f-4fe4-bfb5-7bf67bb9285e", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734311, "uuid": "4b152cc1-0c6f-46aa-a544-393efe7db8fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734311, "uuid": "53b8fe4f-4a42-4fc7-96a5-eabce4662f51", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08125a42-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655716315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716315, "uuid": "2b4dc40e-57f7-412f-a700-d7f9a97f297a", "comment": "Malware payload (Formbook)", "value": "debb92e762f8f7b28c394ceca23626ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716315, "uuid": "ebb8942e-af32-497c-bc32-b4d44d9479a8", "comment": "Malware payload (Formbook)", "value": "68461f9c1180025d2b1a97b218ccfd33623fadf5447cfe832f78c9cb816ca0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716315, "uuid": "ed86179f-48c8-4474-a908-5e52a1cc0dbb", "comment": "Malware payload (Formbook)", "value": "3f250c4fe5ac3128e511e184a7733df2fdd67ab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716315, "uuid": "7bdf8553-6dd8-42ad-b2d9-f7fd7e0c183b", "comment": "Malware payload (Formbook)", "value": "392ff01ce8962d916252a48129960ccd3ebd95db7b0b8d3c9153285e691decc6c8486b6013c30063334a5a78af741744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716315, "uuid": "4015a9d2-c302-4464-b9a7-8b36a0f64f16", "value": "T14BC4F15032B4C792E6AD77F2D0BA84F427B13E2AFA41D56F6D803EC93AB27D24505913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716315, "uuid": "e1ba9a2b-2675-4034-b605-5b350daa3c3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716315, "uuid": "4c228c49-212a-4f55-becc-92455b30c95f", "value": "12288:zYXjdrYVoRfj+CUn2r2D99DoPSVmsnkvoMM:OrYVoRon2r2xhySVmss2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716315, "uuid": "bebcfa37-9cc7-4c25-a98f-314f9edef346", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716315, "uuid": "3cae494f-7a45-4a47-a194-ad76b49aa280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716315, "uuid": "bc7addc9-3345-4f0b-8924-626610ef9e72", "value": "DSR24584299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a33a3dc-f07e-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655718520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718520, "uuid": "02a52e26-e795-40d3-8cf1-757873df047d", "comment": "Malware payload (GuLoader)", "value": "dabc95aae333441718313cc3c81f8517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718520, "uuid": "bae2e9f1-4760-4ecc-9f9b-48aa9cc3cc65", "comment": "Malware payload (GuLoader)", "value": "6920e4eaa3ab492628653b356b538b0a817410338e162452f4234e32bd564542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718520, "uuid": "7e9bc7b3-00cb-4cf4-90ef-cda877a2ac9d", "comment": "Malware payload (GuLoader)", "value": "a6e0bd4053c288da5c32436b484d0d927f1d4f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718520, "uuid": "a9b35366-1887-45ca-bbbc-ce7d078b5010", "comment": "Malware payload (GuLoader)", "value": "391c0f7edbbbdeaedf8eadfee9daa2b5c1384e333af21e0a2f1213d7c3af6be992e11069ccaa3add9615186946c484c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718520, "uuid": "ad927023-cc8c-4305-873b-189d5ff4d569", "value": "T1F7E4C1A2F6A19942C42A1F7049BF4F042151EDA89EF1275E39DC73293EF31CB015B99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718520, "uuid": "158eb973-7ac2-4eaa-870d-adb07a15c24b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718520, "uuid": "f627ade3-e7e7-4871-8f08-1280fc80f96e", "value": "12288:uYqpoZBQTyq+K5Q3K3+LRiTCchnF94UGZ1TLWdAfJB:uYCxTy/K+3o7hnLkTSdWJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655718520, "uuid": "f6b2d249-5ea8-43ff-86e6-84d1adf36daa", "value": 664049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655718520, "uuid": "50fc3d95-fc55-4b62-aed2-c727fc311e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718520, "uuid": "3407a81f-17b9-406a-b02f-e84e34b6614a", "value": "SecuriteInfo.com.Trojan.MSIL.Inject.9834.10738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3ae05f-f09e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655732590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732590, "uuid": "d155b92b-99d5-4696-97c0-1a93ce01d3f1", "comment": "Malware payload (Formbook)", "value": "e77a6f58a4aff2b65599f9992abbe307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732590, "uuid": "aa267790-d2c3-4051-8dab-c6077f6d75c4", "comment": "Malware payload (Formbook)", "value": "69abc132bf9e2db3f8d1feac013088c9915281b17c9ac918490e10cd64d7be2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732590, "uuid": "b5dc89d3-ca85-45c4-b57c-1e7103714935", "comment": "Malware payload (Formbook)", "value": "347f44221036cab1f03d6fe35260da363967b2f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732590, "uuid": "f2d8c7dc-1ada-4607-b3a2-cfc7b2df7f36", "comment": "Malware payload (Formbook)", "value": "4833a096e82a1228320e34a8b3cd2ba7021b28e295f5ed498e987391f44215fb96a3e46c8849fa8c26d2a7fa7bbb8be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732590, "uuid": "d05fe5f7-a853-4c07-b92f-b9b6fc7db034", "value": "T19B44E06B37D5CE00C4485A36D0DB413A23E9F6923933A7253E9D13696E033E79D4A6CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732590, "uuid": "891e7b2b-586e-435c-abe1-fa5792407817", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732590, "uuid": "f512a16f-3fe9-436e-8c7e-88fb48bd0f71", "value": "6144:8CDVQjknK2rgWro2iStH+GUFCVtjCMFmYGUyo:8COUrBroR1dGjCEmZUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655732590, "uuid": "89ac6ac6-1405-405c-911e-ff1f12dee3b6", "value": 275480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655732590, "uuid": "e615c5fc-4f2e-4e09-a993-7540d6519e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732590, "uuid": "19a602da-6aa4-46c5-8bb4-de7465b401ac", "value": "SecuriteInfo.com.W32.AIDetectNet.01.2197.29748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d221362-f0b8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655743409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743409, "uuid": "91bba6d1-f4d0-4f51-87a6-24b21fdc43b7", "comment": "Malware payload (Heodo)", "value": "736749bcedb5652055bfd2bce699366d", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743409, "uuid": "1d970849-4789-4c80-9493-3fb64cf562ed", "comment": "Malware payload (Heodo)", "value": "69e3f3c167004801cae9c4ec0e9a64cd1255ad145eb1786392aa515f263daf1c", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743409, "uuid": "115c1b00-a01c-49b4-8ec8-11d2c18690b7", "comment": "Malware payload (Heodo)", "value": "7e8e5ef910cc2a440a7637630b784c1c0c30cfd3", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743409, "uuid": "45d8577f-3efc-47ed-9fda-9823dc3160db", "comment": "Malware payload (Heodo)", "value": "e66bcf7affcbed7c7a5ba1fa1412620eac400e44993fcae53bb6133d8eaddfff2893a40d8d94539703445700195952bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743409, "uuid": "8e3381ed-8f62-4f79-8419-4b1280155365", "value": "T1B1948BCD33D343A8F96FDA38C9274672F935FC094320660E03A76269EE2F355952961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743409, "uuid": "67e539df-911c-43ee-8399-108a2b1716d0", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743409, "uuid": "bedeff7e-1dee-4ae8-819c-e245f749698f", "value": "6144:9B1DTNJh/8WsVr6ql3i/xSQEN3pFG7xScw/SLFpnU0ScKiEfzl:9vpyeA3WHxFNal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743409, "uuid": "c4109913-c30e-4311-806d-b5c8deece393", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743409, "uuid": "f9274009-8629-46ef-86ad-bf6c0ef992ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743409, "uuid": "d2830f77-8f23-443b-ba2d-e0e2f874e04c", "value": "b9C3W.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9790f0e5-f0f2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655768525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768525, "uuid": "80067c2c-3c22-4618-9fe8-56636fc4d568", "comment": "Malware payload", "value": "83e0c4026904ada7dbbbe7b5f2143802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768525, "uuid": "2f51c417-bbea-40c2-a788-01edb10e7881", "comment": "Malware payload", "value": "6ac179525c9aad27f622d3ebf99f8ccaf83ccb248dfdab0fb416a452ab95957a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768525, "uuid": "d2c4f220-d617-4cf0-b74e-c64bbba9930f", "comment": "Malware payload", "value": "2dd2def55f9991d47b32cfaaf48861afb4176a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768525, "uuid": "536ec01b-3c40-4477-ae56-b8af3bfb067a", "comment": "Malware payload", "value": "b4a74c9c8ff9c6368187ceda3f10d30f70aca717fab06af2b7db60a00af18ada436bb5be7a5d7bdedb5054593fc3b88c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768525, "uuid": "dd4396b5-e3c2-4d3f-b662-3a7c9aa4f2dd", "value": "T13A5438102B2ECF9AE1DC1374DF61A2039AFA9F0527036777546CBF56386AAC123C59E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768525, "uuid": "bfe4f631-c08b-42c3-9f03-3c967f9d8432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768525, "uuid": "329c72ce-89cc-4fdb-b19f-be87a8164bd8", "value": "6144:Z0gOxA6X/TTzPnS9H5EoTzBXaDabwvDNlS:HOxAQbT7SPz1aD6YJlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655768525, "uuid": "05b95a46-f669-4d1f-a0a1-cced86073b56", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655768525, "uuid": "ebed28cb-9d06-4377-8abd-359c049076f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768525, "uuid": "3f23493f-7756-4b6c-b2ab-9dd5dee61032", "value": "SecuriteInfo.com.W32.AIDetectNet.01.12105.20719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b8a715-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655716337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "c411e1a8-025c-45a0-a81c-9d6b09ce8a92", "comment": "Malware payload (Loki)", "value": "6c0ba047a118db4904b5955744dc3b81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "5aef86e8-e1ac-4f68-9de2-17914d9338f2", "comment": "Malware payload (Loki)", "value": "6d7218dffe2851b264766400469f46cefbec6973d0efcea96c204bbcd4d371ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "12398af7-d783-4282-8331-07eec719d64c", "comment": "Malware payload (Loki)", "value": "a94bc455fec18f661dc2562bb25d95f040f944ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716337, "uuid": "94ee5c1e-73a3-4f11-9cba-4cbdc17e9318", "comment": "Malware payload (Loki)", "value": "6d14691aa2bad56cbdab809f01308f89dc8f335dbbf943b435a32e68bc1dcefa339d52aa816fb2a73e362d5b5802df65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716337, "uuid": "806caa59-7ad1-4b5c-b689-a82606767d4e", "value": "T1AF8412181E7993D1D4B79BFA41F7428447F0A62B9447EB1CCFC0A0DA9DB6F488262B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716337, "uuid": "811d1cb8-926c-467e-8689-4f1e20416a1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716337, "uuid": "d84658fe-76e3-4dae-b578-140117c5f72a", "value": "6144:qN8ulRwglZXVFlpEOfCPJIMMgayHIo3w86Z4BFIhhHz0/XUeQ4fInDV/6YneHepC:vbglZXVFHcVt37S4BF+Hz0/kAfqD8Y+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716337, "uuid": "91cce76a-baec-4a38-89aa-922f87b2ccf5", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716337, "uuid": "863a13df-ed9c-448b-a16a-7d3333cfdbd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716337, "uuid": "4878bf2e-cfc1-454d-9135-e6a2a5c179b9", "value": "SCAN001_REMITTANCE_HMIEC_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0265259e-f0c2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655747659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747659, "uuid": "31211f34-af6a-40d1-b623-14d5a4a87d23", "comment": "Malware payload", "value": "0075306f5fda6d70684ecd0f29a61f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747659, "uuid": "c4803641-8cfb-418d-a163-32868482c003", "comment": "Malware payload", "value": "6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747659, "uuid": "503fb039-59ff-4a44-af2b-ce2216fdc899", "comment": "Malware payload", "value": "4e9d843f432c27434898864258d53787c7b207f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747659, "uuid": "af42fb3d-50e2-4806-9f45-433b1d0fb476", "comment": "Malware payload", "value": "7e222db2a6d86533adb859b62509e34ab97f9c01747de3df0e545f7f974d705c71fb25ccbf174721dab42b97e631207e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747659, "uuid": "61e6cd18-573c-4302-9da9-7f94fa7df1d7", "value": "T151744B45EB918CBAC921633B89D7D277623CBAF44363DB476E251934EA132E15FC9302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747659, "uuid": "58b3eebd-c4bd-4675-ab29-c1b42ee652f0", "value": "ddb8da8ce9f6d7c99471e82a46c98901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747659, "uuid": "d907f4df-c8c5-4b5a-bc13-3ca363f83b8f", "value": "6144:3hf/YQnRZNwMYORbNB9l2fx3RfyVQhAyPlo/2:3hBPKMt12fTfyVQhAyPlo/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747659, "uuid": "50968bbf-10b6-4a48-ae13-1aa9185f965e", "value": 356745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747659, "uuid": "84d8eaf7-b2a3-4c9d-bc9f-411f2a93959c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747659, "uuid": "067d7868-4f68-410f-891e-ade14dd431a5", "value": "6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d21cc98-f071-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655712888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655712888, "uuid": "885934aa-10a9-4ded-b648-9b3e8a1912db", "comment": "Malware payload (Vjw0rm)", "value": "278adf946df04cf2961e546bbba79a9f", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655712888, "uuid": "254eeead-7132-4924-98eb-29b8f5f981f5", "comment": "Malware payload (Vjw0rm)", "value": "6eacb035edac06e5cefb1e070b3ed350b0c33090f48ba4e34fd920454eb61729", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655712888, "uuid": "27968471-756a-4f18-967a-12311ac81bc1", "comment": "Malware payload (Vjw0rm)", "value": "553ca5de6c986313c05867b04ab755af28bf503e", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655712888, "uuid": "8f130379-264c-4313-b69f-4d80d346eaef", "comment": "Malware payload (Vjw0rm)", "value": "da493c07ac672a5e99b8b5eefcafa28be652f49215f4573aa649b072c7dbe8200f85b18466d480155f585f7952aab50d", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655712888, "uuid": "9db5f263-19b3-4784-94f4-0724c26dafef", "value": "T18A63025BEAE4BF237CBB681D1028BC1FA73565A202C1176984A6D057C209EB9F07F5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655712888, "uuid": "344b47fb-a76e-4979-bca4-ca7eca33663e", "value": "1536:NUZMOrfKH2niQsclSyzmlSHJA+S22Cn/celMwkusz3LCWWs3M0:NyMOrfi2nXRSyzmlIlnnt9kusqWWX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655712888, "uuid": "1aef226d-d9e6-477e-80fa-a7ec201465dc", "value": 70711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655712888, "uuid": "b447211c-01a1-4c3a-b383-333bb6967156", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655712888, "uuid": "348041b3-ae03-4253-be72-ef15c22b6b25", "value": "njrat-vjworm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f86efa-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655716334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716334, "uuid": "6d4a380e-b5f0-4311-97bf-9d9d48929e9b", "comment": "Malware payload (AgentTesla)", "value": "4bfcc73ca04744ff5c9b6c80a42983a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716334, "uuid": "059d0446-20d6-4580-ae31-6ab5e8ee98ac", "comment": "Malware payload (AgentTesla)", "value": "6eec3ed20cf01fe2ae28df3add8d04b987e52d1299c0ee9ff72a677f36a5a8a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716334, "uuid": "467009cb-94e4-4b19-a140-ca3eb3bfb1ba", "comment": "Malware payload (AgentTesla)", "value": "bd180908907fed2fefb0f8ff6584720010e02ea8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716334, "uuid": "883df7f8-02ef-4dce-a417-baf79dcabb33", "comment": "Malware payload (AgentTesla)", "value": "cced0c21c8b722bfd06b5f4dd40ac537629194f4ad49e6014c4fa465c79344206ca050d484c91cbe591b85d60e74d507", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716334, "uuid": "70ae9b3d-f9cb-46b4-93ec-1e8db83519af", "value": "T19FF422501BEC0636EDFE2B7960B168540731F82AB962F30F5FD9B59E1A723C181587A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716334, "uuid": "b09dab92-9ad5-495d-b389-4437300987f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716334, "uuid": "40119348-a994-48d2-97f8-a5d8158030ac", "value": "12288:9XjGdyrjjCABvjMKbxaQ+x0pD2ztHQDtCc9wVFfkTpJeMBXzgojKvqZI4dFTzFg:9KdyrjjCOAeB2ztHQDtNGVK9zIMlzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716334, "uuid": "e59ea73c-61e3-4496-92b8-3d6939ca3b4b", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716334, "uuid": "0e2c6587-dbe5-41b5-9d9c-535bc2353a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716334, "uuid": "00c2c52a-41ab-4fcc-bc61-2bfbb8727f18", "value": "REQUEST OF QUOTATION NO GITE R-22144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733bd48c-f0a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655734964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734964, "uuid": "ca5eeb91-f2e5-426e-8eda-a58fe806c8e0", "comment": "Malware payload (SilentBuilder)", "value": "b73ec5430cc80f071533863e24326f38", "object_relation": "md5", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734964, "uuid": "f53d4707-16d1-4855-ba7e-5d04e70602ac", "comment": "Malware payload (SilentBuilder)", "value": "6f57827db6a32245f5dfd96684284fd45fe75935db2f59d8f71a5d70bc3f9620", "object_relation": "sha256", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734964, "uuid": "1b6c4bf3-d85f-49d9-8124-e7f914fad724", "comment": "Malware payload (SilentBuilder)", "value": "538413c4b4748e95de28295324cd5c3ed7da215b", "object_relation": "sha1", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734964, "uuid": "820efd60-0699-421a-8cdc-541bebe90f31", "comment": "Malware payload (SilentBuilder)", "value": "bfbc105b5bbb5bb97f1061677b5686b328ceabf1c65f1c12ac7891b4ff1aee0f58c036220278463cef53a71466e6be07", "object_relation": "sha3-384", "Tag": [ { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734964, "uuid": "49d6d806-28ad-4b40-9156-c8abc1a85c1f", "value": "T10B33D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734964, "uuid": "d738ad46-d17a-4848-9874-5f9009560ab5", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKL:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734964, "uuid": "6ae18d72-0c31-409b-939f-04984ff541f1", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734964, "uuid": "c25c7bea-01ea-46d3-bbf4-1b6005c90e76", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734964, "uuid": "7de088d8-ccf9-4167-9dc0-bac0609c46a5", "value": "Dettagli-41993982.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58948014-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655726329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726329, "uuid": "9511b3fa-df8a-48ac-b6c1-2e29c8b706af", "comment": "Malware payload (Formbook)", "value": "e95fdcf0965291eae52ed597f11149b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726329, "uuid": "8338fcc5-f2eb-4de6-8b00-9c828ee7e613", "comment": "Malware payload (Formbook)", "value": "6fc02ab37d33d1c6b53b81a7df2bc2abf5bec4651c4a8f93280ed6f46dd38f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726329, "uuid": "c1bd1ffe-5b6c-4a54-b58f-9e9c6a23bdcf", "comment": "Malware payload (Formbook)", "value": "76e9006f7e7676d9f00f6519aee9276f760932f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726329, "uuid": "d6c859a4-6feb-47b5-a6ff-61e96fd94dd5", "comment": "Malware payload (Formbook)", "value": "2e5a9bd1bf4fc7f0d73f396aa44a6c36227e9dd43f1182ebf0aa1315cb96586f7f2b2a7539958e40a040baab3ba6dc59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726329, "uuid": "bd27a730-44db-4013-98b8-31c67c0dd60f", "value": "T10654F14ABBD5DF00C478797280DB052517F8B2923A31D7943EDA23A93A867D3AD486CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726329, "uuid": "71ac6ed2-43df-47f4-8fe4-213b5b2148e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726329, "uuid": "2b84342e-a70d-4648-84d8-f0fcf6ee2790", "value": "6144:Tv0PEo21kSfNXCNFZRW7MXJHu72deyMRsb7vfWvTNE:YnlSVXCNFK7M472Aib7nWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726329, "uuid": "d208df62-481b-48bd-8aaa-08def165307a", "value": 297656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726329, "uuid": "89fc5ba2-4c8e-437a-b267-d0353f76e171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726329, "uuid": "c2aafec7-b76c-4e54-9c3f-3ed4e31cf04e", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7050.931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37fa489-f0c4-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655748815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748815, "uuid": "22ad9446-91d9-40bd-9bcf-ca3848540a6d", "comment": "Malware payload (AsyncRAT)", "value": "b887675dad2df99e10030b296bed9a6f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748815, "uuid": "d971306a-00b4-484a-8dd7-b4ee56843687", "comment": "Malware payload (AsyncRAT)", "value": "70388e790654952d99e1d3a446c660753860159ac40573086edbc200c5877c4d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748815, "uuid": "3e2df90f-123d-4aba-8e1e-e337f93f99de", "comment": "Malware payload (AsyncRAT)", "value": "1f7a00a0a60712d6cb34eb41733f7e73b4f2725b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748815, "uuid": "5596982f-8608-46c6-a783-dd1fd82feaff", "comment": "Malware payload (AsyncRAT)", "value": "b9779ac27dea9e76cd191e0079048a474cb2f4c070a76e29257289062d45b58c875b994f9f6b0401f68309174d26787f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748815, "uuid": "a24c28bb-7929-43bf-811d-ee3bf9b56d42", "value": "T1D9231A003BE9C12BF2BF4B7899F26105867AF6633603D6491CC4519B1713FC69A52AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748815, "uuid": "a4348a8e-1991-49b1-bac7-930b9725d85f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748815, "uuid": "ce3d189b-8503-46f3-9ba7-bef4b31c6033", "value": "768:BuAHPTgoRzbWUnd9rmo2qrBozHyfmqW24jbxgX3i5vnthpMXzZcDZzf+:BuAHPTgG/2ZLdl2wb+XS5fthpJdzf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655748815, "uuid": "f6725143-b4c4-459f-bd9e-9f6a7980b4fd", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655748815, "uuid": "96423937-c771-40d2-926d-638d7d058eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748815, "uuid": "7b2ca7ab-9016-428e-91c6-e9c8edb8a736", "value": "Alabama.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf8c464-f0ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744613, "uuid": "5606a5bd-69cc-4cb2-b270-37596e889961", "comment": "Malware payload (Mirai)", "value": "720e0eb254ba754730e2c2e9ea488f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744613, "uuid": "8b7ecf36-451f-4ac9-9c1e-e40cb79be398", "comment": "Malware payload (Mirai)", "value": "704dd0185f414edec3e093be7678d67de1541a76f02bf03fc446a98f1ef70313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744613, "uuid": "7b300a7a-499e-4cd5-9686-3e7663d0c982", "comment": "Malware payload (Mirai)", "value": "767e30de8023cfa872c053332f646a9344acc54e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744613, "uuid": "14cb932f-2e88-4f12-b84e-2a7f7b9942bf", "comment": "Malware payload (Mirai)", "value": "04647b2046852cfe7399c8da1cbad4a20adc9cb69b3f6cdd929f30a37bed03be9d1b090bbd049490c4b460b7acd22891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744613, "uuid": "46b298bf-c1f1-4302-8a77-ed29b2787b51", "value": "T1314339E7B9409A17C5C5027BFEAE018C372517A4D2DE3207CD25AB5073D792B0EBBA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744613, "uuid": "41da33a9-6b69-4497-89f5-9eb0cb37a671", "value": "768:ro3N1olxGj/HXkKymOhnJZ6xODliP8k1iCgzr2VooY6AZMsR9mPYZJaV3lmvSxcI:83kI/HUKZOvZ+WcZYaV4UsflZIvmv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744613, "uuid": "c0c0998e-8cea-49b2-b6b3-f5e4cce579ae", "value": 59396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744613, "uuid": "731898d8-da1f-4cce-a26c-d8756d1751cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744613, "uuid": "6d7ecc3d-2f6b-4e4c-8da8-2f84907f0acc", "value": "Hilix.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26844fb-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655747525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747525, "uuid": "4d19b70f-4c9e-40fe-ae2a-6c8bce0680fd", "comment": "Malware payload (AsyncRAT)", "value": "a3c06cf4d6ab0b53b63aa838a67dc4e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747525, "uuid": "a6d28747-7e00-41df-872e-8025772b8c3e", "comment": "Malware payload (AsyncRAT)", "value": "705e8d65983d6f6ecdce444dea17e33642b7bb3336f627698ac5d32637efcb18", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747525, "uuid": "f1df7a1e-f32e-4cb3-a2fb-c801fbc88647", "comment": "Malware payload (AsyncRAT)", "value": "3896bd551daa6d4b56d695c76e63915ab3fac80b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747525, "uuid": "ad130854-155a-422e-a125-2197276479ae", "comment": "Malware payload (AsyncRAT)", "value": "1329a36d72db8f5ab7ce74a2d0a0e95ba7562168ecb393e6d5ff77a1941154a2feb1996b62d069df41e888835391ec85", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747525, "uuid": "7eff225e-87b4-498c-bb18-d9896b05c480", "value": "T1A33349026E858526E067BA34702FC76F0734AE2F4772B637176C7F8BCAA23804D59275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747525, "uuid": "bbe08353-cdc4-4cd9-b636-a8490378e6bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747525, "uuid": "3b9a2763-01fb-4f46-9fb3-adcc43252c8d", "value": "1536:Uo7brjr0gdMZ/ps0Bo2/7WB+U8lCiDVd:NbHggdMLsez/aeV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747525, "uuid": "1c31ee75-d349-462b-9b78-58e36676c29f", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747525, "uuid": "930a28a6-da9c-4461-9c1c-6c67bb62f3f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747525, "uuid": "2015a02d-5488-4e28-993f-8aef653bd277", "value": "705e8d65983d6f6ecdce444dea17e33642b7bb3336f627698ac5d32637efcb18.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee482487-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655730446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730446, "uuid": "7767cc21-e4d3-4d4a-9c72-8ac1b5e2f9e4", "comment": "Malware payload (GuLoader)", "value": "c7185ec204fd39120df9a814d7cac066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730446, "uuid": "77a7d85a-1123-493c-bf41-8356a9b6624c", "comment": "Malware payload (GuLoader)", "value": "70de083a447244f6652c3fa464b2eb2288b79619a5296593e3aaeb15321bb961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730446, "uuid": "8aed3bd8-3524-42f4-b58a-d7946f15a55b", "comment": "Malware payload (GuLoader)", "value": "38f8b2bc03a67f11bedb9e4809f4cfc3f0947ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730446, "uuid": "528031e5-d4f1-4f1b-a7e3-377003797bcf", "comment": "Malware payload (GuLoader)", "value": "95fbcb9c6bf599c5c7cab1a5c60506b40bd33072f47e97daba1a21c1c726ccbb8275431fba793f73908c3e3af46d1022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730446, "uuid": "42d9db07-2b4c-4a13-9b51-fc5e24515883", "value": "T124C48D43B154049AEC02DEB2BB26D9201D5EE5999C71C61E23FF7D2759B324E032AE37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730446, "uuid": "7544e687-1467-4222-b29f-35cdc43dd93f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730446, "uuid": "83dc279e-7de8-49a5-b5b4-a9f5a448cb17", "value": "12288:Rbzo0DUY+OjhP/cfbvc8/gnYJAAYEToYAeP0sc+GcD+Z3DH/lB:RbxDUedP/gvR/gKA2ToYAePDc+Gcqxfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730446, "uuid": "8bba1e62-96ad-4196-85f9-8448fa3c1cc6", "value": 596999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730446, "uuid": "5f700d89-605b-4bdd-a994-f6a72cdd9540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730446, "uuid": "fe8946b3-ea9f-4553-a73d-2a0ff0b7f322", "value": "PROFORMAL INV50004879 Sea_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1126b5-f069-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655709475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709475, "uuid": "a18bf658-0daa-432d-965f-1823975325c6", "comment": "Malware payload (Formbook)", "value": "74ce73492907d47c985a16437711447b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709475, "uuid": "62594739-6b24-4452-a941-4a08824b901a", "comment": "Malware payload (Formbook)", "value": "71289ee3d3e6e08fc44db915940b832c88e5a43bc99f7ac7c600c5300a054e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709475, "uuid": "52ec4a6a-7e7f-478c-b6f6-dd53b4684bdc", "comment": "Malware payload (Formbook)", "value": "ff8272e85c21f7fa571765eaa9f52d01aa4b5e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709475, "uuid": "e70bbdac-7dbb-465a-be03-f9ba3087cc3e", "comment": "Malware payload (Formbook)", "value": "e537326045378088fcbcd1c29092feb64de8749663eb9071efa2cb73cbd5ebb9bd8fcaa07180f9cd122dd8bae496bf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709475, "uuid": "a5dd76e0-7320-4d49-a0e2-3c7f72b93468", "value": "T1C4C48E9CB22C34DEC89BC2769A744C64EA50746FA72B510791630D9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709475, "uuid": "eaf1f146-24e6-4d25-b526-f16a2991a326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709475, "uuid": "bb923155-de4b-4819-9e2f-b90f2595fcf3", "value": "12288:SXzcbEXeIbQblSvb3WosCHrNt83aDmRn5Te/ZmQCT:EQbgvxHiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709475, "uuid": "f469746f-5c6b-423e-b505-8a7a9ce3d872", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709475, "uuid": "8cf73770-4609-4f8a-b07b-252f0fef51a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709475, "uuid": "dbba1621-8dd0-4ac1-9926-0ab891657e91", "value": "shipping advice#202207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4d3ad6-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (FormBook)", "timestamp": 1655734147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734147, "uuid": "654d9278-595f-4668-a0e5-f12c4eb3c368", "comment": "Malware payload (FormBook)", "value": "a5d704e7b5f67ef6ab7e189eec4360ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734147, "uuid": "3f9b11bb-09c1-4d50-9d53-d31754a434ef", "comment": "Malware payload (FormBook)", "value": "71887b61fe6c08490a0b75c00384af0aeb6fdb12de7aaa4da81195b298517755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734147, "uuid": "fb429989-a044-48ba-99fb-691931edfc1b", "comment": "Malware payload (FormBook)", "value": "764b70bff833db766ec48667ea917ca1e7f79763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734147, "uuid": "70a6c8f4-a875-418f-9385-3503f6b6c726", "comment": "Malware payload (FormBook)", "value": "cd69005948d3d1a36b3b884eae6d9362046b87349936efc0d96403c20e7e5fa3519eb8c1534b974b41b76e30ce4a2de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734147, "uuid": "fd5c8d56-c911-438c-bd40-eeb71b2ed8d0", "value": "T181259E62B391883BF17325789C1B6278592BBED32E3569466BEC2C4C1F772813835397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734147, "uuid": "4f0351df-3ca5-4bb1-ac61-79aeab603d5c", "value": "6bc49b119ffc99d9e27364e06b706e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734147, "uuid": "1c3a84e2-b9db-4dff-8f1d-c36ee423e8b8", "value": "24576:mArq7iX2O7Zo+r5E1kBiKvyJsPFtZd52EUAEc:m17+7rTPdtZ9Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734147, "uuid": "8adac7b0-9275-4856-b911-17db2a5df379", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734147, "uuid": "ba3701b5-8ac2-4cbf-8f92-f6683775d4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734147, "uuid": "e731fa44-1fd9-415d-b804-a75d2e9a95a4", "value": "a5d704e7b5f67ef6ab7e189eec4360ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4c9e21-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1655716374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716374, "uuid": "ffaa171f-4899-4ae4-a71e-f9ac2c1acc4e", "comment": "Malware payload (RecordBreaker)", "value": "0e471181646e3d7ac11efc990ed22c08", "object_relation": "md5", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716374, "uuid": "a210a891-3269-4706-bacc-9ccbd62c8b6b", "comment": "Malware payload (RecordBreaker)", "value": "71b350eea45226b852a9eb55e9189db53f4dedc00a330da768930f8ccf1d66f9", "object_relation": "sha256", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716374, "uuid": "d1bf26f6-33f9-474a-b9ae-c4233b115aef", "comment": "Malware payload (RecordBreaker)", "value": "633f59b9c7e28e45ea7144c0ad5aab9195458601", "object_relation": "sha1", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716374, "uuid": "2b5226c6-d2c5-4002-8d93-ff4f8c7b7794", "comment": "Malware payload (RecordBreaker)", "value": "1c4a0aa6e46ebb036c213a5afcfd7780e07fcad19d1896eb2aacbd1334dc49efd9c7a13c3be8e5cafe84abb5b5705554", "object_relation": "sha3-384", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716374, "uuid": "8825cac3-9a79-4c0d-bcdc-2088b9c81081", "value": "T12256627771DD4E01EB6917C0CD4399B75E78F5B74388ECE4B286D091EC6A849AC23B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716374, "uuid": "9f54371c-fa68-4914-b24c-275360ee7672", "value": "98304:h2WykJkez7THEs4WIKAjISCk1YFnNJd43rynMBH55xN7b+BQ:h2WypenTks4BKAjIS8fJda2nMTTN7b+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716374, "uuid": "f5994937-6a0d-4b96-95f2-60afed7bb183", "value": 6143651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716374, "uuid": "7d26da29-e4c3-401f-a363-856d6c9b5157", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716374, "uuid": "0497c62d-bc2f-490c-93b8-4b171432be3c", "value": "main_setup_pass_1234.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73490f6-f0ca-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655751425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751425, "uuid": "3bcf9a99-f08c-4e57-bd6e-4484a7cccd14", "comment": "Malware payload", "value": "9917a13a41397539e9f25b66907981a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751425, "uuid": "57ba0163-b8b5-463b-a12d-879567dea52f", "comment": "Malware payload", "value": "71d45ed1bfdf797cd90b9d1ad40026fffe8f0c894ce6a0eaa032d4a901d34f58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751425, "uuid": "f0c9d333-c75e-488a-bfdc-005e10e544a7", "comment": "Malware payload", "value": "8e2fcdafbb7323fb0e677a50806c75d3d55a269b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751425, "uuid": "60d31802-b19e-4b34-b428-d5abd2b56c85", "comment": "Malware payload", "value": "dd6d1b7a8e53e49020b16864e0a666540083ebf0071dae1ea86332885cff667e5391f950206469f2ccd33ac3739f5b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751425, "uuid": "3d48d4d9-85d2-4a24-8014-49e419892fd5", "value": "T16C14E16DD7C9AF62D2AD023E95B325110331EC2E5287E30BBBC4B2252D737DA9613187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751425, "uuid": "e12765c7-c2c4-4503-84ef-6269fb929d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751425, "uuid": "d29d0369-d517-48ba-8def-e4a1f4d5b8d4", "value": "3072:+4ud6wK0tgY5Hm0Ya1AwNsFx+Hj7ruh/bqJtZBu1R0k7Bbom:+4ud6+tgY5HmqAwNXuReJvBuAk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655751425, "uuid": "658d88dc-e686-4bcc-96aa-6778fd5548d7", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655751425, "uuid": "508635a2-aa75-438d-866a-38b535c28021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751425, "uuid": "af2ffd25-dfbc-4b3e-b343-8f1cd645a254", "value": "INNOVART %010352202_OR\u00c7AMENTO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b1d9ba-f094-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655728019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728019, "uuid": "418a8ea4-fea9-4f99-be55-c462aeeaa83f", "comment": "Malware payload (AgentTesla)", "value": "c7144ca03b6da7911f7e54c7a28027c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728019, "uuid": "7e285353-79c3-443e-9a23-5c8bd9a13fc2", "comment": "Malware payload (AgentTesla)", "value": "728ca4328859723d7f7fa49722483c937133036304b782b82cce69d33a726b0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728019, "uuid": "8b0ee077-476d-419f-b2ba-38d0e2c951be", "comment": "Malware payload (AgentTesla)", "value": "cd92047f85bce16f79ee7637280c157544ab0aa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728019, "uuid": "f2fac5ce-6b80-4667-87c5-2da4dd9bf636", "comment": "Malware payload (AgentTesla)", "value": "d305ce4a88a7b0731a3c4636522d1ffeeeb2d91054fc0dc0d174f29cf75a339aac20c189e1ee8a774017944a340b170b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728019, "uuid": "27c248c6-2d35-47fd-b4d5-45078230fdd0", "value": "T131B48D9CB22C74DEC89BC2729AB84C64AB50746FA71B511790530D9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728019, "uuid": "936e1576-3471-492f-9f2a-ca6e2230c787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728019, "uuid": "5521972f-51ae-4166-b64e-d7d0d24a31ca", "value": "12288:WAn7QAPUOVStYpBjIHHmq9a85oWyxZyDXkcuj4fMOhAj:hQsJ/q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728019, "uuid": "14eda668-4ab0-4aeb-b606-1a7d15cd20b1", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728019, "uuid": "efd84719-1858-4def-8dcd-9ba8c3f20b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728019, "uuid": "2f090a70-183b-48f4-b597-91a4dee32d7b", "value": "4500995888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82640854-f09d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655731982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731982, "uuid": "ed55c97f-0d13-42bd-a772-2f10f912f22d", "comment": "Malware payload (Formbook)", "value": "2106291fa4a9a8354065e0ea2bda1964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731982, "uuid": "d12d648b-cb44-43ab-bd02-94b27ac15742", "comment": "Malware payload (Formbook)", "value": "734df837521bfb39c8c047bda85b13579a12d4e69badee243220776e135b41ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731982, "uuid": "5f4a6f46-1f56-4c3a-8abd-6b79c1d7fc63", "comment": "Malware payload (Formbook)", "value": "8d9656f5395e486267ec1c8bf32710c465b7cb2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731982, "uuid": "926ddc4d-feaf-4c76-9f67-715504cee5e3", "comment": "Malware payload (Formbook)", "value": "74aba15e89a084fb4a9a0f69cf1b3288377591f153f8be0a0f1cb7458279ad6a8f7a61fa3055986f745b021d509d1aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731982, "uuid": "e2e26f17-5f68-4436-9e1b-14f12b302048", "value": "T110C4BE98765075EFC85BC972D9981C24EA60B47B170BD203A05326EC9E0EADBCF156F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731982, "uuid": "7bade012-a029-444e-9af4-430efafd8952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731982, "uuid": "1305adac-fc09-47f2-9c46-e37f9ab88a04", "value": "12288:J6lkjSXXARPer2gUodFshy2QckIuEQ9ne8KdhkqG5TEbdimqys6:JqlXXAclgQckyCne8KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655731982, "uuid": "f022ef47-29b9-490b-b3a8-625dc892a730", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655731982, "uuid": "98bb0827-cd7c-4bcc-a4e1-d9415173c08b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731982, "uuid": "0fdf8b7b-e4c4-440e-8d09-30d95019037c", "value": "Purchase Order No. 917240406AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b5d299-f06d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1655711261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711261, "uuid": "b20592bd-cdd0-4538-848b-c77113a6ca07", "comment": "Malware payload (Mekotio)", "value": "881b9fa1d9acef99650ff4e7d5cb5a7a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711261, "uuid": "a34de2cd-ac1e-40d1-b3d0-53bd439c1013", "comment": "Malware payload (Mekotio)", "value": "7396a9044c686124956620492341842b2c4a1eb722273cd07c7b5e40d0f9bc1d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711261, "uuid": "42e48bc1-2271-42dc-9693-a89f878614c9", "comment": "Malware payload (Mekotio)", "value": "571b56aabc740ce334c1b5f68909fc1fba1e6877", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711261, "uuid": "3449b86b-ce9a-47b6-80cf-c65452542b8a", "comment": "Malware payload (Mekotio)", "value": "6286af22d9c3438590abb366e24ba69eb1c64a370c683a4ecd0e2605b7f260b70f93919c47fc5aaaacd93c0c8c1c8176", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711261, "uuid": "8a226ae2-287b-413d-b647-133813d31550", "value": "T1228623B31081BEC7C2B543FA7C2698458C29F9768F02563AF02FA7A5814654DCFF5BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711261, "uuid": "07a10ddc-c290-41e5-932f-411a64f333aa", "value": "29b1a1b034fbd411fb01ab031590630c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711261, "uuid": "b553fa89-4768-41ab-9c90-363d7691d98a", "value": "196608:3M10IX94YYPSlmrRUNCGjdGuTjzLErWbQFP98:c9tqKxCkdGuj6WMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655711261, "uuid": "c1e89991-67e4-46f1-bbaf-85d9102fca27", "value": 8245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655711261, "uuid": "0d219b91-45a8-4338-9a34-4ff7c16b0734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711261, "uuid": "2cb09a4f-0694-42c8-91c9-96247f927e8a", "value": "7396a9044c686124956620492341842b2c4a1eb722273cd07c7b5e40d0f9bc1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6384f907-f084-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655721193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721193, "uuid": "dd759ff2-e336-4811-8734-269927a91eff", "comment": "Malware payload (GuLoader)", "value": "2801ca48d8bf6addc7bd6014511c5d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721193, "uuid": "0a6879b0-98ee-41c6-8018-bba5141af615", "comment": "Malware payload (GuLoader)", "value": "750711f6d8d8ea145ad7ee5a3ab3ce9f4165406f88d82d064841b2f04aeeffa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721193, "uuid": "2baa9d78-54bb-41bf-b7d3-15b2c4748eae", "comment": "Malware payload (GuLoader)", "value": "43b9167b00574bc61df43e7f938dd09453c42c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721193, "uuid": "9f728f35-ab11-4328-b31f-0e57e8a3c007", "comment": "Malware payload (GuLoader)", "value": "af745708ecfe03e3a9d0f038003ab08b1a9495aba18d784475213a2af5434cdae1c92075da8346ac3a61afb727d6afba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721193, "uuid": "2047eb0b-048e-4ad5-bfd3-7ae4fb93ecf9", "value": "T189E4C0A2F6915892C42A1B7049BF4F043161FD989EF2175E29DCB3293AF31CB015B9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721193, "uuid": "c8ef58b8-ada0-4b92-b7f0-46234e2c2a5f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721193, "uuid": "77b5e5cc-6ba8-41d6-8c24-da59d2524dcb", "value": "12288:uYqpoZBQTypBaf1jjdfNQkuHQMbNIYxGKVMKSlL:uYCxTyvamwKVcvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655721193, "uuid": "36a25efc-4fd0-4239-8d8f-00511e5b7286", "value": 664260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655721193, "uuid": "83954101-a4db-4404-80b7-2d01663e953d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721193, "uuid": "586caf36-2772-4bd3-9dd9-34aa7c9aac1f", "value": "SecuriteInfo.com.Trojan.MSIL.Inject.16.32270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c6c16e-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "425e9b11-4e18-4652-ba5d-1a80a10bb9a5", "comment": "Malware payload (Mirai)", "value": "b50216f501ce9a2456e6d1c9df9fcd08", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "024a9547-718c-45c1-851a-dde079118f97", "comment": "Malware payload (Mirai)", "value": "762d2a59dead742bbbe63412f8773dc5d930cfed9c6c64f57811ea20a1c1d3fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "05536c59-fb96-4a65-8464-2a2409e4c969", "comment": "Malware payload (Mirai)", "value": "ec4d5676b273adf7908227cdcbba2c6366fab72a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "8a592e59-2fd4-4708-b1ea-73b728d7a5fa", "comment": "Malware payload (Mirai)", "value": "111e1161fa770a7dddfd015fb4bf670563d5a59242da792c2445dc31dce13d9668a66de3a56a2c448b0a3049a41241a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "573b038d-bd5f-47b2-a28a-188d2cb8921c", "value": "T10F5302C8D41A14C1C1F43976F87E42C6B6CB3FC9ADE5A0C2A4162AB8FF60501CDAD9B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "2aa35ae9-2420-48ea-b33f-0bc32d504d1f", "value": "1536:Vt38EuDyJxzNB+nC316vS39wCCLUWbN2VJWMWOpHzbu:VlJuDy52S39Hc5mJWNge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761805, "uuid": "77e510c9-f4ed-4208-9dfa-0cc520dac4f7", "value": 66188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761805, "uuid": "46b0f436-2f07-4e02-a344-65c270fbeb1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "b96ebe9e-3f68-4d8a-8695-feabd40321cc", "value": "ZG9zarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e847a4-f0a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655735107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735107, "uuid": "2f8db967-c4a3-4108-9de3-305517f99fb0", "comment": "Malware payload (Heodo)", "value": "e4ab015716772e64dd49481c2e500b7c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735107, "uuid": "4b77dd33-6e9f-457d-bd23-0ec62ddba4c4", "comment": "Malware payload (Heodo)", "value": "76ffcc3d8db62e6c642658f4a8470ac73283f3b80904687b16f49f67893a0b1e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735107, "uuid": "d4313598-48ba-4ee9-9386-7a9f7e1c35d7", "comment": "Malware payload (Heodo)", "value": "8612a2706e342d423b62af9248282a97fab6a3d1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735107, "uuid": "ce193e66-116a-481a-817c-cefe9abcb787", "comment": "Malware payload (Heodo)", "value": "37321cb96266581ce28cacf198e93904176ee5fa1654ae17cd43d8dac20f462b41a16b8997c9c9ec75865e4aaab46451", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735107, "uuid": "66b43f9e-4bf9-42f9-a897-3d8435d24bda", "value": "T18B948BCD33D343A8F96FDA38C9274672F935FC094320660E03A76269EE2F355952961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735107, "uuid": "062990e3-6990-48b6-ba30-bd3fa01eadc8", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735107, "uuid": "e37ac9a2-87e7-4fdd-97fe-6af1bca884d4", "value": "6144:9B1DTNJh/8WsVr6ql3c/xSQEN3pFG7xScw/SLFpnU0ScKiEfzl:9vpyMA3WHxFNal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655735107, "uuid": "c1bd9a60-d8db-41f7-b31b-ab07e14e7788", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655735107, "uuid": "825d22d5-976b-4e31-8422-18a6e67df0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735107, "uuid": "738a208c-f4b6-46b9-a783-5381e08bdfb8", "value": "EvqvT.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2bef1f-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1655745152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745152, "uuid": "9b8c8a81-f0b5-49a3-aa28-ef6c1cac5c40", "comment": "Malware payload (BluStealer)", "value": "72048fbaab48b29537a9b8b6af6bd37d", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745152, "uuid": "6a987bf7-94f7-4ca9-97b0-c73377ac0fe4", "comment": "Malware payload (BluStealer)", "value": "77053cffbf81fc755f5d119b907f63456ff18706a3274bf619315baf03411087", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745152, "uuid": "705d7a7c-076e-471b-b704-0acb7eada9c9", "comment": "Malware payload (BluStealer)", "value": "fb253b22ae678164dad4de1f8f472a1338c8582a", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745152, "uuid": "2a6a693e-26c3-49d4-9512-bceb8c7880b6", "comment": "Malware payload (BluStealer)", "value": "d6e23e81ebbac0270bcf00b5464a2cab67986b2485c6da1c6124b9a4571bd0433879b2074918708039e234c56a0c9911", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745152, "uuid": "7162ae34-488d-47a3-af17-9b984e383a19", "value": "T13514035FED00AC8CCA750AFB6B75C3006D647E46AE1F46DD238CF68B8232545662C6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745152, "uuid": "68b10f24-5b7c-4e7b-a52c-fa293a0daf6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745152, "uuid": "8aa20d05-d97d-4082-952e-49f35839bb8b", "value": "768:en/gFBnsd0KSwkHhp8pQVkW7/eeXNoq/oor64o8ZJ:ECjwuv8c97/eeXNoq/oou4o8ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745152, "uuid": "41928077-3035-41d5-a757-81dffdd6ccfa", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745152, "uuid": "f81868ea-7d5b-44ce-bd63-9592f0064a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745152, "uuid": "f5998f03-85f4-4925-8f18-bc4570589dab", "value": "BPL_1057230.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1982218d-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655716345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716345, "uuid": "a40c1325-b979-4588-b9c3-9855872eb12c", "comment": "Malware payload", "value": "f1ba1f59aaf0ea4bfd85f0a6d2e86987", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716345, "uuid": "655c0dfa-dfe8-47fa-b2ea-fcddabfb7499", "comment": "Malware payload", "value": "78d222b9b2a866c286d9d2a440ddfbad02e97b6b8d4181f4365f2f89cb69c225", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716345, "uuid": "133a0f8b-b1d0-41f4-ac9d-9aaa5191dc38", "comment": "Malware payload", "value": "be2c037fd37a9eeea5547b5f1d9a9dd756e23d3f", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716345, "uuid": "a1fa812e-0dc3-44ae-9a01-41ec5f1e4ce6", "comment": "Malware payload", "value": "10bb9df6ed5f238e4054193633d8c23a11f1cf06af6e3beb7b0c8530ff3ee312736de6f4fd282fc5879b4ff04943d7a0", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716345, "uuid": "c6434d1c-8f25-4ec3-9328-e424c35fdd9f", "value": "T11B63D06293B5A84AEA5EA13BB0D3A72055D62D805903FB07F8343EBD5471EFB97C0385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716345, "uuid": "5d7dda07-cd35-4ace-9d62-ab9ef1887fd5", "value": "1536:sYn79tfqk9LpGSj8SjC7IpPovdDJDHFbUnm+1UQd:sy790etj8Sk6gvBb+1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716345, "uuid": "fd1e5263-3c7e-482f-97cf-fcb5a08e825d", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716345, "uuid": "f186236f-cd9b-4765-861a-4e6eacca25d5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716345, "uuid": "2c89a882-b0b0-4c87-a996-477932836e48", "value": "Invoice Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e6782a-f03f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655691728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691728, "uuid": "dbacb231-834f-4427-85d8-ff56653cdc74", "comment": "Malware payload (AgentTesla)", "value": "0bff1fa16fb1437794c50986716fadce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691728, "uuid": "a8799079-1690-4726-a468-ce693db49750", "comment": "Malware payload (AgentTesla)", "value": "78e1fbae10c16b140343e4b74ce4a005518c2811869aa37e38cb8c3e5d4b1d16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691728, "uuid": "ca804925-d993-4f81-a8e7-702e332ec7a0", "comment": "Malware payload (AgentTesla)", "value": "0037bd694bcc4ad7bbc1811db6ac9e835e2377c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655691728, "uuid": "546df0df-a5fe-4fca-ac41-a2534a4c4140", "comment": "Malware payload (AgentTesla)", "value": "d6fb44deb89cd705320782468520eef3ebb958efd3bc43c65abc5dde1ec0325796c91a25abf3e382a32007d74d3a21dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691728, "uuid": "7dfdbb01-6c37-4481-8a05-922c2faae286", "value": "T1BBA423026B74CF22C1BBB3F5D4B3429597F08527E852F648ADE110DA5CFAF484982B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691728, "uuid": "c6c57f5f-abc1-4a83-92a2-8f519d4fc363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691728, "uuid": "1f81526b-ec46-41a1-897e-bc29977d2db9", "value": "12288:oRBrM+xBFrgpO5qDAfEY/KsLsFrOjHEi+ZMwlBY:oRK+xBypO5qD7ixIDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655691728, "uuid": "35ea7995-ce78-4427-aef4-c79bcb5046ef", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655691728, "uuid": "9d788d4d-3ab3-4404-a487-3685f9af381d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655691728, "uuid": "36e56f89-08c1-41c1-b310-d5734b4281fe", "value": "Proforma invoice.Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20513d9-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655745430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745430, "uuid": "a822a54c-a7f2-4219-9d49-cf1e22022cb7", "comment": "Malware payload (AsyncRAT)", "value": "682512ec0cec6307154f66eb09528542", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745430, "uuid": "8e7d9034-55ad-43c6-91ca-c1da7aae3d30", "comment": "Malware payload (AsyncRAT)", "value": "7911f7426d905079f5ff1b013867d0f8b8bfa73fdb487cd0ae3a7c7d16d9ea88", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745430, "uuid": "bc41ee7e-16a3-428e-bdda-0db319a80d64", "comment": "Malware payload (AsyncRAT)", "value": "fb53642850e1fbe022b61a5b3b8be94b151a0680", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745430, "uuid": "d718fd05-461c-439e-95d9-84927d91794d", "comment": "Malware payload (AsyncRAT)", "value": "4c40de88e46d4306cc307c1f63f0dc5f6adc7115e0dc1c7f8e39cfcee5919897ee94bfef6e6f1f704623834a2b439dac", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745430, "uuid": "791d1e0a-75ff-4931-84ec-3f271f70f082", "value": "T192636B00339DC926E5DD86B8BCF2564106B4D23B2412DA4E7CC454DB9BAFBC64A133EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745430, "uuid": "4357c0f3-1ba1-4b7f-ac55-e2ed58db6a38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745430, "uuid": "c1f4f8d2-e6d0-45de-9a70-ea2929bba603", "value": "1536:bn61DsIe1hisYVxGZZark1bbs2xRJN+asYNpqKmY7:bnee1EsYSZZag1bbs25NKYWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745430, "uuid": "cbdfb44b-2927-44a9-b67f-b8e800db521b", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745430, "uuid": "eaa52770-a9bb-4c55-8a18-ab8b1974579f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745430, "uuid": "8d27d89e-e489-4b51-a104-29856526377c", "value": "VoxilitySpoofer_V1.0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe5d0a4-f060-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655705880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705880, "uuid": "c4e3fa6d-fefb-4f04-91ff-cd12f065c15b", "comment": "Malware payload", "value": "a3e8ebcea32b800ab5f2dd8319a30325", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705880, "uuid": "0dd3de3b-4318-4f08-9642-e06f4037f14f", "comment": "Malware payload", "value": "7913b157495341f990bf2a23187bf36ed9260cf49635c2efee0f6772f76bed8e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705880, "uuid": "31f63547-085f-4c58-b740-823fde6def5f", "comment": "Malware payload", "value": "2624eca46971427c71dc2c1b75f25470ce3839d6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705880, "uuid": "011575c3-01de-4e74-91f5-7030b29aac82", "comment": "Malware payload", "value": "9914b1c54c3f60dca001e53c1ad7163c9e9acdbf5a2be04ed970be868977aa9bc7ad0cc2247941fbf5378f3f834bca70", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705880, "uuid": "157fb354-1de8-4f3f-a43c-9f23422b550c", "value": "T196E185072F1AC4B5C67306F2EE36EE41DD6B101BD4161D1DB1DCC5920BB552A8BEC6B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705880, "uuid": "9fc8cc68-fe8a-4844-b73a-d7e1fd3f744b", "value": "192:JncfXJ01J9TPgOxIh99KvovVvyvIX19Y119cu:hcf5013gOuaspiILYWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655705880, "uuid": "5f2ac221-aded-4189-90c9-6b3cd518f2cb", "value": 7321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655705880, "uuid": "cbb89579-0494-4052-bc8c-93b50754a037", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705880, "uuid": "dde7090b-fd8f-4eab-980d-e681014eb42c", "value": "forbest.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc44661-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655716328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716328, "uuid": "a0f843ad-71a8-43a7-ab9a-ad0443722d12", "comment": "Malware payload (Formbook)", "value": "b76da7a8e1dffedf6af6c8e18d98030d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716328, "uuid": "df09b4dd-6b19-41c4-b980-36752e535271", "comment": "Malware payload (Formbook)", "value": "79254ae6561a612c72a4fe08efd98eda947e960a5df683be8ba37b7c663628f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716328, "uuid": "439542f5-93c2-46d9-b7fb-ee311e593096", "comment": "Malware payload (Formbook)", "value": "e9444038e20dd48377c10f8769f94fb4afc2a521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716328, "uuid": "c6b06743-96aa-486f-acd4-cd1ed54703c6", "comment": "Malware payload (Formbook)", "value": "31356cc8e89b9fdaf1f8c42730291ad29b0b39a7140a37a3a4aa30657441468884b5fa5863908f05998a0df2e4c548fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716328, "uuid": "89e46306-6936-4038-9b97-c3be64c52b58", "value": "T11E34020F7BD1A990C6242B39C0ED810C17B8EA023957C767BC87813C9FC57DA665A5EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716328, "uuid": "9138942c-f6a6-49a1-87c3-7769b59154fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716328, "uuid": "595036de-6127-46b8-9f3b-3adf72c4ce15", "value": "6144:1xRVTk6F5gxvpeTQS2d3f9/lQ4KX1t8d4Nt5dTbHA:jTRsxv6FKcFX1mO59bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716328, "uuid": "9043fefa-b868-40a8-a269-00643896c74a", "value": 251336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716328, "uuid": "ade0cb90-a34a-4bf1-8167-a600a5495643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716328, "uuid": "57be3c62-3767-48a9-8d28-4fd3db18e986", "value": "PO_06122022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0721bf0f-f09d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655731776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731776, "uuid": "81ffc886-f02c-4656-817d-e421e64cff81", "comment": "Malware payload", "value": "8cdd56b2b4e1e901f7e728a984221d10", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "TontoTeam", "colour": "#F60ABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731776, "uuid": "e41db24f-384d-422a-aa4e-78f306ed4b7a", "comment": "Malware payload", "value": "7944fa9cbfef2c7d652f032edc159abeaa1fb4fd64143a8fe3b175095c4519f5", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "TontoTeam", "colour": "#F60ABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731776, "uuid": "fdb809d4-d250-4f48-a63a-81cecabcbad1", "comment": "Malware payload", "value": "cb8eb16d94fd9242baf90abd1ef1a5510edd2996", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "TontoTeam", "colour": "#F60ABD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731776, "uuid": "276ff88d-3b39-4f7c-b269-f96a12c2e04e", "comment": "Malware payload", "value": "ff9a75ac5439cf3160fe360c78e070a67b008b727496e705bf0dc79f3a1709646b2b6f59a66f932be658576cd7de945a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "TontoTeam", "colour": "#F60ABD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731776, "uuid": "8f04bac6-5087-4bed-82c1-cde6bc2c2865", "value": "T17BC3826C52B32444E15811CE8CD47BC41FDA76E1CAFB099FE93AB7970803BE6586943B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731776, "uuid": "066412b4-4897-4398-9427-37fc97caeae6", "value": "1536:RZsHHct2Y+2srdV+LABSd1dx1snOHdNwfG5khu0uG:RZsRVRSd1CnzfA2PT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655731776, "uuid": "363507c6-4185-4425-b56a-bc1e0c21a890", "value": 124439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655731776, "uuid": "90c147f6-12ed-4ed3-b697-99a3b04dff30", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731776, "uuid": "f8744ba2-7837-4538-a87e-107b726086f4", "value": "7944fa9cbfef2c7d652f032edc159abeaa1fb4fd64143a8fe3b175095c4519f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3f2b9b-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655734232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734232, "uuid": "39ef6882-173e-4a93-8610-89e599883d02", "comment": "Malware payload (AgentTesla)", "value": "96369c23fbe297436d39650812888f0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734232, "uuid": "a5d22bdc-52b2-4786-90d8-d59be1aa24a1", "comment": "Malware payload (AgentTesla)", "value": "7a19b0d3173b0988a71ce67a7d14d461db425fbec7d8469eae46d2c047d8f95f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734232, "uuid": "32967301-8a0c-46a3-a435-7521f70e16c0", "comment": "Malware payload (AgentTesla)", "value": "c0a1c21b057824ba81da6f3ef14827f1608a6241", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734232, "uuid": "dba7c171-c920-4eaf-9063-4025bfc8b217", "comment": "Malware payload (AgentTesla)", "value": "1e621ad6480a80af14c39a3301564b3f02c9b068a7629b11d338acb5c4062dec28471e7c39c1595446b702a1fed5e4cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734232, "uuid": "33db205a-1838-4b0d-8bef-2a530cc141ce", "value": "T15AC40101A6791723E878CBFC84D2A14053FC6426C667F7A88FCA61DF8C67B578A50637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734232, "uuid": "a66a22a8-80fc-4a10-80a4-c6c7576932da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734232, "uuid": "a88b4b18-78c2-451f-9929-5fe87faabb93", "value": "12288:wX52iNwovpOH2RqmcfNg2DhR0EzYS2QTVslpC:C51TRW2ifie6sP2QTVsrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734232, "uuid": "87563d49-d8c7-4c83-9fc7-1831daa1f531", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734232, "uuid": "93a356c5-8d52-4071-a393-46200afbcbc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734232, "uuid": "3308e797-1153-4079-93b8-5bf2da9171f2", "value": "96369c23fbe297436d39650812888f0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d476c52-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1655745342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745342, "uuid": "072d4040-9438-41e7-9d5f-e30a6f59fa1a", "comment": "Malware payload (QuasarRAT)", "value": "436fa243bbfed63a99b8e9f866cd80e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745342, "uuid": "d4134a85-20c1-428c-ad1e-a950a126867c", "comment": "Malware payload (QuasarRAT)", "value": "7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745342, "uuid": "850029d1-b3a5-4b48-80b2-a882659d9eb6", "comment": "Malware payload (QuasarRAT)", "value": "94f8ab2f1abc5b1cd90cc3b66630767ef999c16a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745342, "uuid": "6428dba8-2d09-4aeb-ab77-25c0155d3804", "comment": "Malware payload (QuasarRAT)", "value": "fefb18045151f72b5c23d5d2b048893b38367decad103c2e323b4295f17ee156e3934e0b08de8b8652e5abc829fa225b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745342, "uuid": "df096b3e-1f3f-4caa-a928-817b3402f377", "value": "T16C748C2377B8D53BE6BE173AF43206144BB4D917B616E38B9A1C95B92C133868D413B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745342, "uuid": "97e28b8d-676a-4162-a822-3aa3d932b6ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745342, "uuid": "8e9af93e-4c46-4d2a-8ae3-f8fc23bf2e3e", "value": "6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745342, "uuid": "cb6bd7d5-6f6a-4503-9adf-8c7f73e274db", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745342, "uuid": "7a48a966-77f4-4d7c-bf0e-cadd4262ecd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745342, "uuid": "50a65983-1d86-46f1-926f-96836299e36a", "value": "OliwciaPrivInstaller.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0f5106-f0c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655748511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748511, "uuid": "1724dba7-fbef-4d0b-85e1-0d4e30ebcaed", "comment": "Malware payload (njrat)", "value": "29a37b6532a7acefa7580b826f23f6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748511, "uuid": "2a870bf9-dfcb-4928-aa52-117a0ae0d892", "comment": "Malware payload (njrat)", "value": "7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748511, "uuid": "0b2bfc5a-eae1-4600-a993-470a31f86988", "comment": "Malware payload (njrat)", "value": "a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748511, "uuid": "1f876641-8e94-47c5-b625-bf6d9850b9c1", "comment": "Malware payload (njrat)", "value": "fa3e68553eb612422b6f94db1640b995fe3f389342bf20f2e3c9e14e8949cfc8d1296f3309bb44ec6f99bc9e495241b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748511, "uuid": "fef20aa0-4131-4b18-9d29-e7fe655f4919", "value": "T196E23B6DFBE6446AD1BD4AB50671950013B8D043E513F77E4ECB24E62B2B2D84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748511, "uuid": "32fa96ea-d9a0-4abb-94c6-a75590435d69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748511, "uuid": "993327d5-8fdf-49ba-9acb-cd2aec3a679d", "value": "768:64+64ZRzo+zxJ+lS7gqzZ5XvzpQmIDUu0ti69j:xM3/Bh1QVkvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655748511, "uuid": "9b0ee18a-30a0-4454-a1a5-1a77c7a29ecf", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655748511, "uuid": "90a9ef7a-0c03-4e1e-bfa1-f5b09dd16236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748511, "uuid": "987548a1-efd2-4606-b7af-a39ba9982c7a", "value": "NJRat.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175bf9b8-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744688, "uuid": "4b25626a-6494-48b7-9a43-fb7c3aa0425f", "comment": "Malware payload (Mirai)", "value": "f10cc0b30a7282ccd8d19f9f52c32da3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744688, "uuid": "abae31c8-c9f4-441b-b5d2-b96be652a83c", "comment": "Malware payload (Mirai)", "value": "7b176059990686a6126e7b477c252e58ec6ce33377f2f4ee68c1b452bb72ca6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744688, "uuid": "02d444ef-0cb3-432e-a5df-54397ab39575", "comment": "Malware payload (Mirai)", "value": "aa81dfe2c86c96cb3546bc017ad99d6dd21af398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744688, "uuid": "b672f412-1179-4627-9ae5-7628a6ccbe06", "comment": "Malware payload (Mirai)", "value": "67b4a016fbce655f156658b62c3e36855e56fcb6c67617f180ac3736e450f80a78104019d3b5c3ee5f346441c7eb0f8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744688, "uuid": "029e7a70-2043-41d7-9e73-bcd3b8f0628c", "value": "T1D5534D317A751C1BC4E4647B52E34717B2B6934E20B89A2A3C710E9EBF61B8075537F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744688, "uuid": "e0881805-9016-4eb2-8e8b-adfceed90821", "value": "768:fb4oN6fIoPcYy0FOjdGZnpCpASLzsPWxK1JgxenY5O+753fVCvfy1tWkBAId:Ey6fIucuF+G9MpAixK1JdO755tWTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744688, "uuid": "035eafae-c6de-4654-a114-055348d23313", "value": 61672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744688, "uuid": "ce00f1fc-acf3-4080-ad2f-ca244a11ea8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744688, "uuid": "49d113b1-ec9a-417e-94e9-1af438f6cf05", "value": "Hilix.spc.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1accb165-f041-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655692295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692295, "uuid": "a3fd9169-0515-4d16-b21e-b59bebfd5290", "comment": "Malware payload (AgentTesla)", "value": "9d2c6454ae0477c0376c7aea448b8b9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692295, "uuid": "7a4e5ce7-00ee-4c94-bbc6-09452780deb8", "comment": "Malware payload (AgentTesla)", "value": "7b5ecf27fe105f8ae9cdc4707d1ad92348cd3fd38b49a3a93f333c93915da1ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692295, "uuid": "eda51779-f8f2-452f-a47f-64bce53c7fb7", "comment": "Malware payload (AgentTesla)", "value": "dae7bf7ea51584906827fcc70b9ff814ee079e63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692295, "uuid": "9a4bceb8-b933-426e-92d0-a48db9cdae0e", "comment": "Malware payload (AgentTesla)", "value": "be62c90966333e02d771e9c0f83bf33a93871b6f4a44e81d2251480e7339fa61fe0ddbd195930e191a6b0442f65f3556", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692295, "uuid": "4835ece1-5f44-41a2-a4f9-abc72f092980", "value": "T102E40254BAD8851FC7AF6BB750F2C01543B2679C4C63DF47EDA6A4A2B180367530E24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692295, "uuid": "8d836e19-63c1-4e1a-a648-67c51ae4a19a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692295, "uuid": "e0616665-bdb7-4cf3-9e2a-17c94853f668", "value": "12288:PUoqNBbnnBooe7trwr1pW4JXH0047Rnst0F2CdShIRwBZIxzOG0lV:MLnnBu78pGd5sWF2+/RwjIxzOfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655692295, "uuid": "89bd957e-81cb-4eaf-b829-b528d8753f70", "value": 720192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655692295, "uuid": "4b5278a1-268b-458b-bb52-221140d78525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692295, "uuid": "af706593-2855-4b6c-ab2e-5dd37284951a", "value": "SecuriteInfo.com.W32.AIDetectNet.01.27294.21079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984945eb-f0f2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655768526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768526, "uuid": "a406fac3-4ea5-45a2-b99e-81f6dc150fc1", "comment": "Malware payload", "value": "713d80a7864853839f3068be33ff38cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768526, "uuid": "24c24dfc-0626-4c27-a121-51033ed72629", "comment": "Malware payload", "value": "7bc92379bc94a0c9752be5502348e0dd0721f04b711cf4c408639c324c475168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768526, "uuid": "0470204e-6bb0-4978-bc63-b0282dba404c", "comment": "Malware payload", "value": "ba19d38ec3ae472c10193e88b92bb4b8cafae830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655768526, "uuid": "a74fb122-cc30-49a1-9ddc-4d4c6c6fb9ad", "comment": "Malware payload", "value": "e69239deda4e863f790d643cdaa888975b6e690ea2897101258a236dc9caf052d71cf15bcbd4afac76edcb3bc67ca75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768526, "uuid": "b454a0db-2be7-4124-920c-95dcf318a3ee", "value": "T11074F148B514D8F2DA727A32C97EAA2206779D14D7D14B0F32B07A3D79B3262131B74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768526, "uuid": "392e1cb2-727d-499c-a7fd-883398cc37cb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768526, "uuid": "588248c5-404e-4cbd-8f2a-cf7b3024d4b7", "value": "6144:9bE/HUGPcnzsWPVrnwf1b5zxd3q9jcQK8MGw9RXaU3fWdEL1vBydq:9b6PcFBG1b5zqhcd9R9f6kyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655768526, "uuid": "4a4202f5-2c46-45eb-a5f5-f722c0afd187", "value": 355416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655768526, "uuid": "4ad915ff-5003-4b27-91e1-2e9cea5b0bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655768526, "uuid": "e92b78a1-84d0-42c4-8490-d02b721beb1e", "value": "SecuriteInfo.com.W32.AIDetect.malware2.4610.27806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10848dd0-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744676, "uuid": "04599559-5794-44af-a62e-52692e6afda1", "comment": "Malware payload (Mirai)", "value": "4ce978fe58ec2d0c0c3252dc1717f902", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744676, "uuid": "462600ce-5f7e-4f47-8a98-1a2465348af1", "comment": "Malware payload (Mirai)", "value": "7bd3bd5feaba8a2e6ed63ae4d47ad9cf7a0bdb7ad2b1a2fb23a33be4253621f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744676, "uuid": "434fe5c9-a30c-4a42-9c17-deae28450d9a", "comment": "Malware payload (Mirai)", "value": "b34499e31206d41721f7318c57f09a903e166a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744676, "uuid": "ba3b948e-efc4-4eaf-8eac-dd58a9d2d46f", "comment": "Malware payload (Mirai)", "value": "795dc42dfec36f7c0aa8f1bfd72900a39b7783dd10a16e1f8db2968f0dcb71ef8ae4031d7abb7ecaaa6236a99f5bf9c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744676, "uuid": "6905eb9f-f51f-4dd9-a9ed-38ae82766580", "value": "T142436C00B35C2947D4971FB03A3F13D2A3BFD86522E4AAC4380F964A8175D365A9BFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744676, "uuid": "c5729352-edfa-404f-933c-3892594ab3b5", "value": "768:/b85vS1Q5gOe11pfDByd07iqN6bEDP9+wGkD/TOF9ucgWFTKtP1gax9It:/KvnJkf9207izQ+w5D6F9uhoKbgwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744676, "uuid": "c1e58499-ee61-49a0-b282-41e75149d881", "value": 58828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744676, "uuid": "149e7450-da12-4f6c-b548-5522a2dd85a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744676, "uuid": "672613de-58ab-45cd-9359-2086090ecbad", "value": "Hilix.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2563014-f060-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655705837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705837, "uuid": "19a71dd4-51fc-4442-876a-d29a41d82881", "comment": "Malware payload", "value": "db4587d6b6c7df395d73dbc5da4bf8b0", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705837, "uuid": "e86893af-7835-4b3c-8c36-5d75b2d8c288", "comment": "Malware payload", "value": "7e068268ee3b89d1f8800d6354c9f63cd57c00088ce0d850893b4ddd8e750573", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705837, "uuid": "aa5c176b-cdbe-425a-a452-76d4b7d519bb", "comment": "Malware payload", "value": "126e4b5df54cdaa5f2134b54c44a06d81800279f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705837, "uuid": "02252269-70b0-4384-8420-80766a60ec64", "comment": "Malware payload", "value": "157415beedda697663f11c8f8ac8040612442641096f7188265f8902c9a5e05f4928e8de202b733fd5ac2f9cfed3eee1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-30190", "colour": "#4F6E90", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705837, "uuid": "acd90f33-858c-4c05-8ec2-5ee6b61abad3", "value": "T195127332CA3B0B5407B1D3F561EA8F69E2D4A028F7925678C6ED432D72CEE05F602665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705837, "uuid": "608d5ab3-3aca-4d34-9f86-fc8bfb963fcc", "value": "192:VQJB7BfBpBiCRBQB2O5mDVIDuLGTlzIBlEHbTcKtZEwCzE4wBzKiSe+1+Pw6utNv:yJxBfvYCRO2DVIBIHEOvTwvG7DocPijo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655705837, "uuid": "fe3c1de7-511d-4652-aba8-c990239ec654", "value": 9823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655705837, "uuid": "82ff00c8-1e7b-4ad0-a9b3-6bb15a3650d3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705837, "uuid": "3fa4591d-fc62-4c11-bba8-00a392050479", "value": "https _upgrade.4nmn.com_microsoft.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeee855d-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655730447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730447, "uuid": "0b1cf9b4-f2c6-4fec-8d45-446510c2e60c", "comment": "Malware payload (Heodo)", "value": "d1f5231672a26cf75b78eed413e3d5a1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730447, "uuid": "2f20e3cb-38e7-4307-8b47-b55fd33b85fa", "comment": "Malware payload (Heodo)", "value": "7e56aa9594e4d5cb5c648914d5419d87215b2b0b2c9badfcdd10af758ab059f5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730447, "uuid": "05baea66-4048-48ab-8d40-aa9c18572d84", "comment": "Malware payload (Heodo)", "value": "a825af2ba8c3b059cd76ee5d8fe21a7e3f31a74a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730447, "uuid": "4a915b4a-3c3f-4124-8bfc-e51163256df3", "comment": "Malware payload (Heodo)", "value": "07685c3c4902ae50213569b3ffb423755ed79788b5753e1094c05e272556bb918bb2b405683eff295a03e99766d8c92c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730447, "uuid": "63b71157-2417-43a4-97b1-40f07eb86d0c", "value": "T18D733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730447, "uuid": "ffa198c8-400a-4049-811e-4f4ba0322edb", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJB8:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730447, "uuid": "f1824f90-d1f6-4d5a-b5ea-aa421169feb8", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730447, "uuid": "ebd229cc-adfc-49eb-9a86-2e60b0d519c8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730447, "uuid": "f6add5c7-591b-4db9-a656-7f50e586ede5", "value": "10098599522192767795.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05a18c7-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655704599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704599, "uuid": "b11efa8e-d4f4-46a6-9cee-0f17e8cf9753", "comment": "Malware payload (Formbook)", "value": "9fee4eac9bb20164ddaa8ef0e116f399", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704599, "uuid": "f2c85ea2-4bbe-4730-9d1d-81a7f232a4e6", "comment": "Malware payload (Formbook)", "value": "7ea518bebb8062fb838c87588b6ef27c52fc0c227f553a33f252ef44cc57d3ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704599, "uuid": "9c5f8c22-fcd2-4123-9080-8816f6b0fb30", "comment": "Malware payload (Formbook)", "value": "921b23562cd8945df761ce81fa43861089a87078", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704599, "uuid": "a713583f-151b-46b2-afdf-43d84d5f8b14", "comment": "Malware payload (Formbook)", "value": "87e6bd84d7e1fa0acd36757cac126c1d0c5947e3a5f0db9914aaa15dbe97bae2924b89826c5d164d3f50564642a87c0c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704599, "uuid": "d6af69b9-cbc5-4a30-9f07-999be4d87202", "value": "T13713F266B82F9A34F939103D5D537A9A76CC2725BB77B603405E635CB9AC71C42023DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704599, "uuid": "b19d6370-9a52-4504-adf9-69c5f5b3b9ed", "value": "768:6JGm/29smn9djaatz+HQj4IYbvA3WkjQnzTDQyhjFrul5cYf5mlhiIg:6JGm/yv9djakYd6FjQfDjwc7rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704599, "uuid": "60014f49-1d63-4996-82d0-5b18e567e1f8", "value": 42703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704599, "uuid": "9262b283-5d93-4506-91ef-6bf66c8e2db4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704599, "uuid": "c4749f40-87f5-4e0e-af1e-f159b59e3c6f", "value": "PO-9020226437 .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c0231f-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733520, "uuid": "83f0fc4a-0736-4739-b6d9-bc962bec4889", "comment": "Malware payload (Formbook)", "value": "5c14aa47bf6b6b12776b4f9ea72a6820", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733520, "uuid": "98b45674-28e8-4faa-af1e-73a0e1f67c4b", "comment": "Malware payload (Formbook)", "value": "7fddab1b0db16fc4e09ebe827d02c4f3ea22dca0a96a327681ded34273c2172b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733520, "uuid": "5c8fe9cf-4343-4293-8638-41df05acbfbc", "comment": "Malware payload (Formbook)", "value": "267a87571ec606ab9e001581818c4ff4935130a3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733520, "uuid": "055b3467-19be-4d00-a7e4-bcad0bf1566b", "comment": "Malware payload (Formbook)", "value": "3cc73a1a366d7d799969c0fe50bfbab774d195cea3307d57638eec0f1e9e420e9985659061687c377abdfe7b51baefc9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733520, "uuid": "a270b482-dad7-4b3a-ab84-31ce76f18d26", "value": "T1A683E03E23C9A989D765833DE1C849560AFE1D31291362CD1724763EACB2F90EF51A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733520, "uuid": "a190cd48-8fb4-4f72-a1a9-da0be97f1049", "value": "1536:aeuifPrc9k2hHOX6YRZRUuV5wHvZj9oSH8+oF5M9XB76f71:aerXr9MHOjRHj5wHzoSH8+m0XBuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733520, "uuid": "3d138080-c1ba-471c-97c9-8263733e8c31", "value": 81448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733520, "uuid": "53a2e143-0d91-4fee-b62b-245e558369d9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733520, "uuid": "f3124265-2c28-443e-b7ea-9607bf227477", "value": "AD1-2001028L IMG.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253fd0a0-f052-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655699614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699614, "uuid": "79e7dbbf-6c6e-4cb3-a408-d6739a26e9d7", "comment": "Malware payload (AgentTesla)", "value": "9f762469fb5f1d6bab596b6d4990a56b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699614, "uuid": "6d9466f0-783e-4be6-9c72-c5990070ff0f", "comment": "Malware payload (AgentTesla)", "value": "80074e963f5d53b6fdc877170596adac9e7a3b748d5532e7ff0839202cbaa0f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699614, "uuid": "0e4c00f7-4ec5-4a72-816c-472c010740b1", "comment": "Malware payload (AgentTesla)", "value": "385977cfe9c48aa1b49a6a0bc5ca4a98cea4d279", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699614, "uuid": "890040e1-ec26-4ed9-9d41-cd573b1058d0", "comment": "Malware payload (AgentTesla)", "value": "4e9e96862fa873a5bb58e6859f791bb2e7981396f9e9066a38f66de943ae308d3a0326aca6dbb4a14e1fa7b4a65cd916", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699614, "uuid": "50b7354b-b623-4f77-ab90-687a11352775", "value": "T184B4120227AA9391C87BDBF892F500809BB46637F843F2589DC191CA15EDF5893D2F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699614, "uuid": "9e55108c-8399-4247-a0aa-1dfb8ecf45bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699614, "uuid": "87b89c6b-6ace-4ae2-b058-22474f79734e", "value": "6144:ttl9wVqr3FwbIVPhuYLKMnGP4M1cx1cgbh4FlrQWbwMFDghQPRql44DYbwLxgHYl:cuwmoI7MQbmFlr/dFWQi4eHS4WB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655699614, "uuid": "8716bbf7-031d-4d1e-957c-8c41029eba16", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655699614, "uuid": "d03df089-7f6e-4a64-952a-b1f1b8cd7f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699614, "uuid": "e3a7c159-d69e-4e84-816b-d7f718c8e3ea", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3307.2931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1c6ddc-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655733581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733581, "uuid": "cb4fae89-a5f0-4f51-bfed-3c63a8b0ffeb", "comment": "Malware payload (AveMariaRAT)", "value": "66b47523929b651e5328136d5b84312b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733581, "uuid": "d2484cde-8a22-4d7f-a34e-b3d2821244ad", "comment": "Malware payload (AveMariaRAT)", "value": "806a09e7cfb0c0081ad0782df3f7dd803e46db1bef818e261aa293c2ebb87fbc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733581, "uuid": "c8e7f6ab-7f0a-40b3-9e96-94e88a26365a", "comment": "Malware payload (AveMariaRAT)", "value": "bd9eb9e5f2ccffe4a447ef7cdd344b30a92fde27", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733581, "uuid": "dc815197-b148-4cc5-89eb-d9e47e6010a4", "comment": "Malware payload (AveMariaRAT)", "value": "5178006a5c4edb25c87c3783bfdd9b79eef60f316afc80c735296251e17c583a3eb81f6e60a3211bfd2617b10b1b0db5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733581, "uuid": "91a8421d-2a05-498b-9b06-5c4a8fc34115", "value": "T1EF83F168A378C18FEB762AB31A6997CC54559C619435EBE91004733884B0FCEC5FFB46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733581, "uuid": "54078550-b7fd-4149-b86f-f1418d357de0", "value": "1536:3T3fEFIPJYWplKmOoH5U2lRFeUGJ+UWHcwdPvEr1g6:3jfEFIqkKZiSKeUGJ+9Tsrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733581, "uuid": "84a155ad-e405-4b1b-a675-f839d7ecf91b", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733581, "uuid": "be29eaf5-9dee-4ea2-9c78-fde98bafef3e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733581, "uuid": "d509be16-bb07-4387-8000-0a59c6046be8", "value": "ORIGINAL SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3388d537-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733568, "uuid": "023ec822-e8ad-454f-9873-02b1ecdcee6f", "comment": "Malware payload (Formbook)", "value": "0ec883ff807898cca05634ae9f1e6731", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733568, "uuid": "da177a48-2384-4aa7-be64-67f0392b57ce", "comment": "Malware payload (Formbook)", "value": "8199c56f52fd18126b207f2cc257989dff5e0fba1afbc5ef154da7a45f7f7412", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733568, "uuid": "d8079391-0713-421e-b7e7-e61efe052736", "comment": "Malware payload (Formbook)", "value": "5f196fda1b13e09d7553f1b5ef31797ebd911986", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733568, "uuid": "3aad68e8-96f7-4ef8-b1fb-1970d5c3b23d", "comment": "Malware payload (Formbook)", "value": "7ed957ff11f64913d0e3f094fcf75e092acb53c83668de44ab512348b1527b2976e11acf3bed635efcceedbae5a4626a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733568, "uuid": "0d003463-d8be-4d00-89f3-532d2c9fcf95", "value": "T15C63D0312F1B49DADE7102351991529A3E1FAC244F3C2AF48B52B32936B73B9527C52F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733568, "uuid": "95149d63-9160-426e-b762-c96bb76025a7", "value": "1536:XSwV//DQb1Qo4qei8s02WrPUf4iSo8P40QIbUL:XjtQZLefzUtSoYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733568, "uuid": "f50f5c8b-f5e0-41c1-83a0-67554975bdf1", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733568, "uuid": "b16d256f-6257-49fc-b04e-7c82625a0a53", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733568, "uuid": "d3d2ba97-bdee-42c5-b347-74522b924afb", "value": "Shipping Docs Order 804978892.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f207dd16-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655761805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "515a0e7a-204e-48a8-b629-069777c6a920", "comment": "Malware payload", "value": "cb33ddbba79890455405be52cc669faa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "5a6ef391-fad5-4189-b73f-58c77affb103", "comment": "Malware payload", "value": "81bdbd78cd642664532f4672be8c77b5d80311df89e33a7e54a69df9a90d9bd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "9d0484c7-0cb8-450c-b5d6-dad402dfc69a", "comment": "Malware payload", "value": "cb15188ffbaacf6a1fac526c71ae3380e4f828c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "4554f9ce-1acd-49ac-888a-eed0124d0248", "comment": "Malware payload", "value": "0368fe9c9b1d718566afdb5e2cb8c8f3d044c8778492f8e32db9810ddbe46850ef9045aae211f6bad7fdd6f994a5fad6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "85cbda5d-4a23-4456-ac64-6904478c7d3b", "value": "T1ACE3190CF664936BC2E127BBFA8A128F33374B447397732596382AB83BC5B595E31511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "45dff42f-cd9d-48b7-8b2f-04bf46de0e59", "value": "3072:OiuQRk1ZvG4Wc2UQepp1Us5mV/kmTkbM/9AeSq:OZQa1ZvTJ2UQeppusicmTIM/95Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761805, "uuid": "46f4c061-1c8e-44e9-b429-7e9c16ef4347", "value": 148590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761805, "uuid": "eb9e7899-dd69-406b-babd-cffaa1e4cd8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "f21c4c2e-de3c-45d1-8db9-636ec78a3c6e", "value": "boat.arm7-20220620-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1168436-f06b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655710667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710667, "uuid": "53d7db7b-c70d-4675-99ce-8efea250fecc", "comment": "Malware payload (Loki)", "value": "d682e8bf802b182e3183a56aab47c97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710667, "uuid": "df8404fa-bc6d-46ba-b636-bf1a7933b6cb", "comment": "Malware payload (Loki)", "value": "832a9690e4a0afc9c23d8836c249aa53c90fd78de02644a7898bcea36e9986fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710667, "uuid": "04130019-692c-417d-a6ec-2b26cb0e4f1c", "comment": "Malware payload (Loki)", "value": "a2e3022015b56273a1d1669651842298ed13b8af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710667, "uuid": "edf92718-66a3-4055-a48c-375b8e88681c", "comment": "Malware payload (Loki)", "value": "aa44b170387318f5dffd8a37d21feedc08b96adeda6ee7cc4362c7a6155fa7f2db6b77a03d2678c236aa81d1c1f648ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710667, "uuid": "6036f9c8-e7af-4c84-a6db-4965c2c85b98", "value": "T1C98412092E7DA702E4B7E7F95AE38150CBB1522AD153F6248DD250EF50BAF6884C2F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710667, "uuid": "b9c40339-ac6d-4a2f-83f1-a2a3d3de2a84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710667, "uuid": "acf7f781-8d17-47bd-ac0f-f6fb2d0025dc", "value": "6144:28l03wU1U8rKxAX1i9qgCl7wgHTBu5MYSu4perCUHMHH8k/Zqs1mm761wY6xyfwt:zJUu8OGaqgG7NHTQufpe3HotZx1d761U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655710667, "uuid": "ac2c362d-ec32-4e1e-8507-26c96b2a991e", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655710667, "uuid": "09e8f31c-f28d-4970-9f4d-305c37d71e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710667, "uuid": "4327d256-589d-4f59-b06e-68ae4acb2a8e", "value": "IM8l67900432.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be77df04-f048-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655695576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695576, "uuid": "557d1335-c703-414d-adaa-5a1fd3ca9d48", "comment": "Malware payload (RedLineStealer)", "value": "87af8a3865f441eb06b4ebbeea330099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695576, "uuid": "85b3768c-31de-46a2-a0c7-0859ad90bbf6", "comment": "Malware payload (RedLineStealer)", "value": "83a8d60614fba531f23e6206d82589e0a197eb4fcb98df32083651281e7e243d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695576, "uuid": "d40b13f2-646c-4619-8829-087b1b8cc8ea", "comment": "Malware payload (RedLineStealer)", "value": "592b904653dfa0c2a82447d283a9187c9a2145b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695576, "uuid": "f9d1b55e-f096-4e44-963e-f4308d38fd42", "comment": "Malware payload (RedLineStealer)", "value": "d111f9fdb858b43aac45b27b151ecc839cf339bb4c5f12e764205418f363d8ece60c7bcbbde0e4a928937c843c8981f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695576, "uuid": "3e83ffe3-965d-493a-8e0a-fd7db5848bf4", "value": "T1DEC4702DBB424A72ED9E913649504B48EF2E0F233645F9C653DB23C6DB6F8562D09CC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695576, "uuid": "a051b14c-3b2c-4797-948b-ef864358a316", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695576, "uuid": "be48a09d-2cd7-4784-882a-c5400e247283", "value": "12288:2LL2x6SMWxa1bx7FxfJo1mJxRHHE6mRsc9gC8NLhPtD6IA1:uSMea1bx7FxfJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655695576, "uuid": "b755375c-967c-4ae1-9c0b-4f4b1f8396a1", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655695576, "uuid": "0f9a6025-39af-4394-9227-ce0d5b0b3a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695576, "uuid": "62753148-8f90-4654-ae8b-eb3d29a92ce7", "value": "QUOTATION062022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c5d303-f089-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655723564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723564, "uuid": "61e49a1f-7ceb-4089-a024-98243bb686b4", "comment": "Malware payload (Heodo)", "value": "8607ac525a2cc8187fe3b13394bb9367", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723564, "uuid": "748d3518-51af-428a-9b8e-c261cbd95fc7", "comment": "Malware payload (Heodo)", "value": "85075fdaf04b7a5ac02436f00a371a284c7c472f7f6d864db92d12199517b3c8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723564, "uuid": "55c80daa-0c81-4ced-8d66-a9bfdcc529ed", "comment": "Malware payload (Heodo)", "value": "256537a661b92a5da9596bf5474dfd14a91eb2c7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723564, "uuid": "0fbb7570-1dd3-4597-8480-f236f2fca9c0", "comment": "Malware payload (Heodo)", "value": "ea8e7caf7cd7743ced000930a8484667b4b8ffab4f3f682da019770755cc38b054ee4d08bd52959d78a66d626e0d0d74", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723564, "uuid": "11bd2a12-a69a-435f-ac5a-1e44acf70f3c", "value": "T1E333D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723564, "uuid": "cb3703a3-079c-4cc6-9845-d8eb66023f77", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKb:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655723564, "uuid": "60b7967f-046a-458d-8b97-f7cc4bfb7d8d", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655723564, "uuid": "bad97d11-1813-49cd-9c8e-2aeda288a001", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723564, "uuid": "9155efcc-226f-4456-9df8-71e0cfd42990", "value": "Data_4104865853.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf58d697-f0f4-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655769478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769478, "uuid": "2ab6d0e7-c2c5-4cbe-ade4-063deb908944", "comment": "Malware payload (RedLineStealer)", "value": "bed8ae3c066d6902286ee65dbce63a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769478, "uuid": "f30d8343-8d1a-4286-8759-8d1c6698b6b9", "comment": "Malware payload (RedLineStealer)", "value": "856cd38a22cfd087228b61557388db7baad6d52756f34c07e1d67ba6dac70f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769478, "uuid": "d4cf4190-f7c6-4b35-9dee-ed056aee7219", "comment": "Malware payload (RedLineStealer)", "value": "ceddf95f6bb2244e3c4943dae4ced79ffe73841c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769478, "uuid": "c1a48c5c-3674-4c14-aaa0-75c6178716d2", "comment": "Malware payload (RedLineStealer)", "value": "597d8f56fe6a74e4e2bae71d15d7b3dd41a91fd2c8573375d6e5639fd8ed79b9938a39e7004ddf0f9dc2707b0e7c57ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769478, "uuid": "85cc04fb-92c8-4cd6-82fa-315528280934", "value": "T1E7457D60BBC8C010D57F5A3168B6926992B4BD125E41D78BBBC037BE1FB13D0B6316E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769478, "uuid": "c065f110-38e1-411b-bae4-5d7beb040c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769478, "uuid": "c84e5ed9-0cad-4dae-979f-cc1c4543f8b3", "value": "6144:wcvOLbbFJHcjMhr4jSss6ExrSlkZrhJ4BWrT:wcvODTwMN4jSss5cK1J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655769478, "uuid": "ac795963-8cfe-444e-9019-f8ee5e206671", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655769478, "uuid": "2facf59a-d8b2-4868-b907-214ff42493a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769478, "uuid": "eded1770-cddf-46ce-a00d-7123d343c043", "value": "bed8ae3c066d6902286ee65dbce63a71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80ae53b-f093-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655727751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727751, "uuid": "ebbaf621-52b5-4576-adc7-4ba47739408e", "comment": "Malware payload (Formbook)", "value": "99e98ed938876ac1fe42515bfeb14796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727751, "uuid": "034a7db9-a0de-417e-a42e-543c1765c16f", "comment": "Malware payload (Formbook)", "value": "8586e05ff7d2269e9495e76725cc561d433cb771d6af6581ae5fdcf7b8b571d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727751, "uuid": "2f81738c-11cb-47a0-82ef-026f4b9fcad7", "comment": "Malware payload (Formbook)", "value": "b22dc4d0252de5b9826fee528aeaa4323decd59e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655727751, "uuid": "ecd29eea-0186-4e86-873b-14673fcfad93", "comment": "Malware payload (Formbook)", "value": "b8f1bf994a897c5ee5f67808d28256ebcdcb50ff65e89869e0ca451a3b314dd9c0a351547404345381e960a5b2d35d88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727751, "uuid": "addfaaa4-e891-488e-959c-86bafaa941b7", "value": "T115C48D5CB22C34DEC85BC2769AB45C64AA50746FB72B910790A30D9E9D1CB83DF168F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727751, "uuid": "a086ebf9-4443-436c-ba6c-9ea030c1e654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727751, "uuid": "2acb339c-6844-4332-a2cb-6fe63567aff4", "value": "12288:pmrbmLwu1Rn+ik2LUtsGuWHxXQWMnq4UhIOYAtZlVgn6PSh5C9wMHMpNVhMP:lwYR/kvRuWHWU2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655727751, "uuid": "392cceb7-551d-4009-85cd-0a9f12ec2eae", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655727751, "uuid": "284f4369-3481-4ec5-b318-5759fb849f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655727751, "uuid": "71f786db-a9d0-4375-a3bd-8c559845aea7", "value": "INQUIRY 215082A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715e07c8-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733672, "uuid": "d746ec98-288a-490f-9484-c76e6c98f50f", "comment": "Malware payload (Formbook)", "value": "25c2ebbd0e8c30072c147d523f0162f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733672, "uuid": "49d22f4c-e87a-4ac9-8ec4-741bc97243bd", "comment": "Malware payload (Formbook)", "value": "859aada0cf09832daace8902102e39989f7eac7e3152006ea017a9f27e22b162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733672, "uuid": "b5a89d9f-27a1-4739-848d-ececbb0c2b3a", "comment": "Malware payload (Formbook)", "value": "d0ceb65655fc301e34c7750d1cb44908ae4a18ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733672, "uuid": "668f0813-b564-4192-883a-2a43d5fb952e", "comment": "Malware payload (Formbook)", "value": "0e396099fc06b37972bbe1a5b8798a8b5cd1a520e177d47b9972d7a8e298cf634a0b80c14b038a9a363ee97f2254df3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733672, "uuid": "d88baf00-0158-4bbe-8c50-8fb625e82b83", "value": "T184A46F2CFB025ABAFD1EC030494D0B08FFA61F036280B99357DB27CA875F1665E95D99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733672, "uuid": "bab783ae-4385-47ad-8ee4-d4d99b0de20e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733672, "uuid": "f86a87d2-e83b-46d8-8669-322ce5272f58", "value": "6144:OutsCAt9kGVF78ow/iu17hvrheL20KZwEPiom:OutsCsVFBpu1NgS0tpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733672, "uuid": "5eeb808e-906a-4300-9883-4dd898ceee6d", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733672, "uuid": "ed1d7b70-527e-4fe5-94ee-704049a9f207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733672, "uuid": "6502ab39-8757-431d-85a0-f4312152dd85", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970eaa83-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Adwind)", "timestamp": 1655733735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733735, "uuid": "861d920f-a0d3-4bb8-ad9c-301723b0f227", "comment": "Malware payload (Adwind)", "value": "daa1c32ef9e2e9a40bf681ffdd39d1b7", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733735, "uuid": "4a48b410-911a-477e-aa88-eed22e5c8c4b", "comment": "Malware payload (Adwind)", "value": "8752adfcb12af2daf3bff72ab52a4c95a0954fbdff7d6c1361c847c25f579466", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733735, "uuid": "56b9a36b-e7f8-48cd-a86a-6a3efe7b3836", "comment": "Malware payload (Adwind)", "value": "ae25896d315239053094cc5647876a90261e0d82", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733735, "uuid": "0241fafa-4660-43e3-9f09-9fbe758f4f4f", "comment": "Malware payload (Adwind)", "value": "1eb57b12f01881d4b08987fc9305f13a831de640d75244bf45b49c4cf8893c8c0e9809419b8422f605aae94bd41a1ff3", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733735, "uuid": "908a2424-7b19-450c-949f-47703893f9cb", "value": "T1FDD42305B9A1E328780E507966D4E31A3148AEBA4FED745BF7F3C270D8F2B524426D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733735, "uuid": "698eed02-b1cd-49e9-9acb-fd13c821be97", "value": "12288:ngkvYwTsBaiFrqZ+6pLq+rNVkx1xR/RHg8dAzXnYAn7+mTmdApNQmS0duwtZEE1/:nzvDISXzsXy8dA7bn7+7mNQ5u5Zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733735, "uuid": "65048edd-0e86-4356-b502-35655b45c3fa", "value": 640345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733735, "uuid": "c3e54847-c6ac-4bce-9b6e-e26d8aeef8fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733735, "uuid": "b55159a8-1654-4749-9d87-bfe4ac09fff7", "value": "IMG-8487575764-INVOICE-ORDER-PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e15e60-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "26534f94-319d-495f-9098-7f6ddaefa554", "comment": "Malware payload (Mirai)", "value": "c568d2edae01485e4ea4411b2b15e6f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "d223b900-e48d-4f68-b326-967391164e68", "comment": "Malware payload (Mirai)", "value": "87eb13d806d834701b26bdfd73a2994837125ee928f17ef01b508aa38e3fcc6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "86428a60-2865-47ed-bb30-34008c123c92", "comment": "Malware payload (Mirai)", "value": "1f6ae6e400ad5b6703dea9c53d1fa88d020f881b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "a4245afd-6403-46c3-aac6-bcd5ecc34677", "comment": "Malware payload (Mirai)", "value": "e33d11f8cbfb5bdc937b45d42ea793e8dda052972da7ae322188985c4a78b3723f117bd8bb04eadb1cb04926b8eea9dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "54e6d81e-7018-4f68-84ff-78f69ea6d1b2", "value": "T13563F2F0B6576A36C7D109F7C8E080C61D3686F8D016E4133B554CA9B6D6BEA2BB4D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "56517009-5f5c-451e-9af5-d51e583f20c5", "value": "1536:+dJjTDCz3MAL9l1Pb0IxhLTQDv3DZ2zEFtUdLTmXhGwu/GYUA3lvr:+3nCzFhr0IxhLTQD3DZEEDUdLyXhFdKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761803, "uuid": "32fcf052-b5a4-46d2-a0a1-0806676e1563", "value": 70044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761803, "uuid": "6c1e1f05-561d-4c39-8386-d95263bbc025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "4ec24e4b-d8dc-4e6c-970f-e489cae3fae0", "value": "arm7-20220620-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d850d7-f059-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655702590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702590, "uuid": "f7a81376-002b-40a5-affb-d636b55ccee7", "comment": "Malware payload (Formbook)", "value": "4fb6bb71ffcac94a3202c66f706c4b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702590, "uuid": "59ad97ec-a5ef-4833-a69f-32df30db6a1f", "comment": "Malware payload (Formbook)", "value": "880770e7288500578025040eac5bcb52ea9e27356bed4b59de68cde203d31bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702590, "uuid": "1b8ec1e3-a07d-457a-ab59-aca19483859d", "comment": "Malware payload (Formbook)", "value": "fcadc867e807e7628f1af208dc7e51f3deb68b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655702590, "uuid": "7e7549c7-74b5-45a1-b71d-b3c01b694b2b", "comment": "Malware payload (Formbook)", "value": "b4f83616a2eaeca2c5c788e51961719db14324c95dbfb8d520923150e919b1149355c5813f2d0bd1f103a4b682222b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702590, "uuid": "7ab4eb71-1131-4cd2-8858-9e3bb3be4f18", "value": "T151D3D68DB9C449C5DF2532B3F2E3E96605457CAF462C8B16E3A7774ACEF21810623917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702590, "uuid": "3997d73e-c534-47d3-adef-1aacbcf54e7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702590, "uuid": "c68081f6-7866-470d-b306-c4ea69456d4d", "value": "1536:eV8p0i64QBk1e6Ouq//VE4LA1jcdZfp9Kmd:+TiKSOu09EJByxPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655702590, "uuid": "e54c44be-9ad3-4142-9591-da6b2ea5d792", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655702590, "uuid": "835b630d-93cd-4126-97be-c57082a56955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655702590, "uuid": "a5106725-f3d1-427f-be24-2f4a13bdd522", "value": "Qaebtvd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21947228-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733538, "uuid": "2947d003-296c-422b-8067-cae3b48d47f8", "comment": "Malware payload (Formbook)", "value": "882996de436b64e5bdceaf81dd62c1ff", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733538, "uuid": "19b469bb-aba3-4d36-b61e-6a75eb4ffd33", "comment": "Malware payload (Formbook)", "value": "887b80c401b552463f018824cdd19d76cd56cf7558b572b1d0c4ccb72eaeb661", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733538, "uuid": "313a5f1e-0faf-4d7f-991b-f76fdaa856cb", "comment": "Malware payload (Formbook)", "value": "2247bc4c2b071c3e7100227a194ac1a735f6f28a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733538, "uuid": "24330b23-462e-468c-afa4-f7593b9b5e51", "comment": "Malware payload (Formbook)", "value": "d47ae4563991fe58b548455769abba2405cc1525a6e953bf95a639360de1beeeb238b11d61546044dad5fc8c8589d142", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733538, "uuid": "5c3905b0-af4c-4f89-a3b8-639cf87c7fa8", "value": "T10B63D078B9984BB8F02157FE6EF592DEB835AED438ED04C638353612E5708C828F5E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733538, "uuid": "612f6797-ac0b-4f1a-b823-29d2414be2db", "value": "1536:pXEEOMF+WC+FLd9poYXFD5Jx9qF/mK6Pl8/eqkFgMTuI+QALVb92dm94C4:p0EOMFO89Wg53qNmz98Gh2MarwdRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733538, "uuid": "2840b296-f527-4468-ae7c-433558939087", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733538, "uuid": "be22a9d4-06df-49af-bf9a-567895cb06ec", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733538, "uuid": "dd58bf5d-778e-4048-a5bd-26c98a55a12f", "value": "OFFER I Quotation - DERULA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afc4dae-f064-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655707328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707328, "uuid": "9b9a0d06-8dce-4948-9220-88f1b6b113c1", "comment": "Malware payload (RemcosRAT)", "value": "660076a4b6aaa8ece57306082dca074c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707328, "uuid": "fe21d91f-4f5b-484f-82df-17f1960d2bb0", "comment": "Malware payload (RemcosRAT)", "value": "89a956199b7400d66163543bd14a16a023efa57a4d1bc9ee9ae885f76913005e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707328, "uuid": "f1af0cb1-36aa-475e-896c-1c88b60ccbb8", "comment": "Malware payload (RemcosRAT)", "value": "d43b6db974a8f7cc5ec15e3ba884b08c5ffb029d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707328, "uuid": "20db986a-9669-4f52-bb6f-25afde5102b8", "comment": "Malware payload (RemcosRAT)", "value": "6b7c7b35bed1bed65e311a71331da0078469af7e79af75131e1ec90eaabdb4e8954857f17f898f7691b27fee0c0ac846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707328, "uuid": "0eea325a-d0c6-41d5-abb1-6ec386d6c586", "value": "T18205CF9CB21C75EEC89BC2729AB45C64AA50746FA31F510791530E9E9D1CB83CF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707328, "uuid": "789c3ed7-208f-4fcd-ba88-4fe84eb4c844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707328, "uuid": "b8ab8e3e-dfb9-4bec-a9ea-b0854ce7d7e0", "value": "12288:pmrNcnlWUdN+YIpmNWSQt7j1B2vuqLuknsnHvawzEejleN8zHTPSLt1tqBU/UnyO:/N+zanuPlkKHSLejlfzHTA6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655707328, "uuid": "0ceb5143-c178-4c5d-9e5b-dd018da6567a", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655707328, "uuid": "eda09aa0-0726-4712-a358-a8408e0acefd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707328, "uuid": "21961acf-9836-4bdb-bfd9-a8e428711a11", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3692.15370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96fd38e-f06d-11ec-93bb-42010a9c0043", "comment": "Malware payload (WSHRAT)", "timestamp": 1655711566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711566, "uuid": "e7821399-d4d3-4a26-8cc5-0754b3034fc6", "comment": "Malware payload (WSHRAT)", "value": "c46aaba5d2996d30a25d22ecd4d6b030", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711566, "uuid": "3db9fd7f-99c8-4019-a4da-c2e3f29eea62", "comment": "Malware payload (WSHRAT)", "value": "89d59ea39f7acdba2870362b32b282d34ccbe850ccb1889d95d616add09c1667", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711566, "uuid": "bab17bf7-9904-4064-8b21-440c291f8ce9", "comment": "Malware payload (WSHRAT)", "value": "73c692f130ec8ffd9f0a9a3700b81b0e5958b00f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711566, "uuid": "2e12bd98-7d23-451f-94b4-7e9f4c28575e", "comment": "Malware payload (WSHRAT)", "value": "d3d0ae291ab1852218f76d77d3ea80655cb28046449ef746bbe6026db688e07f9e235d43c0eceaca2da1e9c48d2a6542", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711566, "uuid": "21496e1f-66be-4e8f-9dd0-5d3bac324d65", "value": "T1CE64F151DD812BB8CF64650301FDAE1E63F0690E58A0A98EB377FD14A7F2948D13B66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711566, "uuid": "1fb0ed6d-78da-4ca6-875d-e5fb84a4bca0", "value": "6144:wU3COhtVDXp2GrbliEIo1IzURzwMMaUgCSWxzi4XrL7qkIAx:VH4o1IsjCSF4+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655711566, "uuid": "f3d74c29-4f8d-4986-8ddb-bf1d0db06cad", "value": 327933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655711566, "uuid": "5f71c452-c0c1-4e33-ad12-c7449d83c2cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711566, "uuid": "61e7210d-9fe3-45fd-900d-720bb004cb26", "value": "Corrected documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6321f0f5-f09b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655731071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731071, "uuid": "ed9e053e-8ddc-4635-8450-f0da7f1f0deb", "comment": "Malware payload (Formbook)", "value": "15a03c78842f8e0f47ffc35dd6362197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731071, "uuid": "c3e11947-469b-4ecb-b871-a5e9b85ea5f5", "comment": "Malware payload (Formbook)", "value": "8a3206a8bbf5056d7cb774be843c2a067aa8643e44c58c63e3e9cb65ce0f3fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731071, "uuid": "52ff1166-0fe8-4a05-bb46-4d5b6f4fe8c4", "comment": "Malware payload (Formbook)", "value": "1e4d857d05d7bd3d7ae37345dd9e38f629219596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731071, "uuid": "611fd8a0-76f1-446c-ac39-3905ed09d27c", "comment": "Malware payload (Formbook)", "value": "16e55b1a3a48947020245be4a98d1c256f0d79c35f56416dd8ca375d9172e8b384bb70c2205dcde65b235c27f2374cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731071, "uuid": "08d526a9-3558-4c86-b693-4d86b32c1411", "value": "T1A444F16997C7AF52D19D2E3EC0C72B2A03708C51A24BEB036E95B9D26D353CA151F8C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731071, "uuid": "fc7e7304-f63d-4b56-beee-60f96f2126b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731071, "uuid": "11220727-ab5a-4ee1-9791-26abfd3395e5", "value": "6144:2CJsabNUa/nm6/0QTUfwXEpw06ZN0/8tEOTEaCHyOl+Mk:2Cj/mBx4Kw06ZNjqK9kywk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655731071, "uuid": "4e04d2e4-0ef1-4999-a056-a234b764a3b2", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655731071, "uuid": "55abcd0d-aa19-4d49-99f2-9b51cd035e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731071, "uuid": "19cdeec1-4050-4ebc-a5fb-ecc680e6aa29", "value": "PO#30001174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f10a8f-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655733805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733805, "uuid": "0ef70516-7892-47d9-b702-541af0c0ec73", "comment": "Malware payload (GuLoader)", "value": "787835117e233e9ec0b597155b676dd4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733805, "uuid": "e29ddbe1-0c9e-4ebc-8ba7-6bf26fd09cd9", "comment": "Malware payload (GuLoader)", "value": "8a6946d2b906c45e79f26a42d2101c5e78c72cc91c2444ca1441e7f5d2f23d32", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733805, "uuid": "fd55a40d-4bf2-4c09-8d85-f1e2ab18a475", "comment": "Malware payload (GuLoader)", "value": "276507a321a3834e0ea0251ab7f339f84225f367", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733805, "uuid": "538cc739-94a5-4fc0-885b-99c0e9b91b75", "comment": "Malware payload (GuLoader)", "value": "b57afc6dc3f2147914adf27dc760c16f7d5036d0acf631a39785bfa52d1818cd97de48fda621ece319258ac9d3ee7252", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733805, "uuid": "e71381f6-8056-4b1c-8969-f51edface10f", "value": "T1E3D3E9D6B22A5492FB44155AB828FF821F35373B4DDC00AE27364A4D2BD76BCC51924F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733805, "uuid": "1759a166-e4eb-4f99-9bfe-a568dd9a512d", "value": "1536:9Hra16jAIVKAYGdYQhpf51AWDAMz1aiJDj/GmWfC0xq6ZBgClgrGSqTRpBV9rBvG:g8ZnT/KLBmo5UaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733805, "uuid": "eb176f3a-15e3-4a6f-a218-e14031bae9be", "value": 136222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733805, "uuid": "0986c146-82f3-4d4d-8db3-14806255b0bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733805, "uuid": "4c717e93-64f5-4d4d-b604-38d68c064cba", "value": "dvblindet.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecedbde3-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655730443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730443, "uuid": "7f13dee9-b3cc-4769-9bfa-7aeb07755bfc", "comment": "Malware payload (Heodo)", "value": "44feb8f801c923fca3bcb1ffef33c83a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730443, "uuid": "ebbb9140-e2c3-4d9d-9aa6-587d9c173afd", "comment": "Malware payload (Heodo)", "value": "8ac6428e1c404275ea1393b0bdef054ecab0fedcec7b61ce723e48ad53aedb4e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730443, "uuid": "77c1101c-3370-4e6a-8296-01b34c2cf20d", "comment": "Malware payload (Heodo)", "value": "b8ad6d28afeea84e3868cad28a137b80f479cff9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730443, "uuid": "65bd5a0d-0fde-44e8-a1cc-5726d2a09ebc", "comment": "Malware payload (Heodo)", "value": "316b9d3cffe3539125a1be0aaced195d08ba7b0a8bed4e6d50739542b1e0009a83c0ab4b9d109637a6996d2c545c74b2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730443, "uuid": "e3685f9f-cac2-45a7-9e67-ffdb283981e3", "value": "T196733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730443, "uuid": "0a819d96-c8ee-4c60-a7cb-931b29106c9f", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBI:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730443, "uuid": "f761b9a8-5654-4e1f-945f-dddf561f7ba7", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730443, "uuid": "ef25a9fe-f37d-46eb-a633-2489f55d33f9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730443, "uuid": "c5b0d340-320b-4cca-8891-341fe7afc13d", "value": "10030704147827726551.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85a1b83-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655730462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730462, "uuid": "269df4bf-905c-42ed-8418-51efef3afef8", "comment": "Malware payload (Heodo)", "value": "5316c7769ef0dc54878c1a23bb551e64", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730462, "uuid": "921d19a6-b9f4-4245-94aa-e1ce20904135", "comment": "Malware payload (Heodo)", "value": "8ad6d03203b903483b28c713a03c225af26a17accfb083ff4e378855fcec5d18", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730462, "uuid": "6e46d710-ae76-4788-ac6b-6682d43dd291", "comment": "Malware payload (Heodo)", "value": "27fc40728158c316d6a1285ad79e01ae99d76edc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730462, "uuid": "984b8b44-3ecf-4cbf-ae70-a608e34fad8d", "comment": "Malware payload (Heodo)", "value": "ee757eb292b5da6f4b37900efea9e3227a2947b3f632d697d6bd87a8c8547c5aeee173069c3b62105dfe6360ff052427", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730462, "uuid": "037d2a17-ae1d-4298-80d3-95d07578b033", "value": "T1AB733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730462, "uuid": "e78aae02-ca8e-4f9c-93a8-4fff4844ab37", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBM:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730462, "uuid": "ea00becc-dcfc-4255-8aeb-efee52aaa6fe", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730462, "uuid": "c61659cc-30ec-44f7-83a7-3ed57e4660af", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730462, "uuid": "a9b9715b-8556-41d6-853d-84df35c260cb", "value": "Scan 2022.20.06_1229.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fe33c8-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742973, "uuid": "4844415e-89f3-4a86-b2d8-35a9db18bfff", "comment": "Malware payload (Mirai)", "value": "1607752896f371da069b379e1e65e652", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742973, "uuid": "f26d5a2a-3b34-4157-ab0d-53395cddd5d7", "comment": "Malware payload (Mirai)", "value": "8b6cdd343f1555619cbbf8cd2b09bc320d9c671e4098d7ca0b4bb31997787165", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742973, "uuid": "5057c480-07e8-4f08-886a-692236d84ce2", "comment": "Malware payload (Mirai)", "value": "2b9d8d03900aa50034d59013a7580687d13c9290", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742973, "uuid": "919d4d24-b84c-4dc4-a63d-dd08b24441ce", "comment": "Malware payload (Mirai)", "value": "813782cb47b51eacd86813dab02af439a1d2923b84d21f0e08b531e95294e76f6a29f4f62e4a52a3c8e45bed3f1865c2", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742973, "uuid": "cc9ffe15-388c-48fe-916d-dab53be5750d", "value": "T17E631263562AC426C7B01E75ECEF41A206C83AB4523EA11390B45D8AFFCE9289F541CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742973, "uuid": "62eadd44-8bff-4531-8062-83f805698d8e", "value": "1536:xh2wAoSiygp6RTjLmb+gDG2xgcL+vqoAn+fgTicho:xh2wAofygp6NXv26cL+vqt+fe1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742973, "uuid": "0932b8eb-7ea2-44c7-9d11-1c1f8e018300", "value": 67812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742973, "uuid": "a663386f-97ca-420b-807a-cd4fa7b17562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742973, "uuid": "e43b0004-055f-404f-8ee7-98947cb94208", "value": "zz.arm7.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38afbb1c-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733577, "uuid": "b90232ef-7efe-4d17-ae3a-890270844c74", "comment": "Malware payload (Formbook)", "value": "e38fd1d6bd8449e499b44cc24a7bf002", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733577, "uuid": "3883e8e6-1960-47ed-a6cd-f5a9ca50560a", "comment": "Malware payload (Formbook)", "value": "8c203e84f1513344d42d0c82b737ca5a364ca264f99a314e0c4147d32dfa5bf2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733577, "uuid": "d49aac8f-c130-4e17-a880-c22c3933b4f3", "comment": "Malware payload (Formbook)", "value": "3b354f432bc9c3661fb59a0dcc4d346b6ae33e1a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733577, "uuid": "88fd36ef-c9b8-4202-899d-1d0e610c511b", "comment": "Malware payload (Formbook)", "value": "a057d0d619a5f23f48c775c352da6ab50eed592bb0b70e46fd0e66ca9e1f3fc3a14f99588acc37accaa8c295e246974b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733577, "uuid": "c28db457-9892-4ba0-bb9e-7317feb00b87", "value": "T16A63D0537F40E991E1377BF80378A73CE727ADCA19319B2638B136AA1D374C45C68A64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733577, "uuid": "309c1a06-88d4-4da6-aeac-688a04920513", "value": "1536:xeDyO4pyQjnRwI++lU7NKHjuKqvwppxDm8ac7AFFmQQSS:xo3mBjRwIlVjuKqWxDHUHlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733577, "uuid": "aa19ac5c-634d-447b-9139-fc71b6dae90e", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733577, "uuid": "0b2240c4-49c6-4d94-a414-2250414d048c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733577, "uuid": "18c2e39c-0147-479f-83d6-8a4361ce772c", "value": "Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b866602-f0c5-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655749151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749151, "uuid": "ff01d6ae-9cdb-4931-aa51-cc639704df3e", "comment": "Malware payload (RedLineStealer)", "value": "19e887bc075926bf363dde1ea3034a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749151, "uuid": "6b11893f-9107-46bd-a84f-265e09e6be97", "comment": "Malware payload (RedLineStealer)", "value": "8cfb20f35a0cd482328870cb1230063269641951fa1e1a2294676ed9a6d41df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749151, "uuid": "7cb540b8-ddc7-4fc7-846c-340908ac01d5", "comment": "Malware payload (RedLineStealer)", "value": "03637f8606a56ab103561ebff1e7a44cdbf8eb71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655749151, "uuid": "075ff562-75d2-4012-9ad8-0867b5448cdb", "comment": "Malware payload (RedLineStealer)", "value": "58fadfdff66d8c027ab9161e6ff9301dc4aa10780f4d342f29ad357c192a60ecd61dd7cf7c4481878a4d07a0553aceac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749151, "uuid": "7f382b1e-5de3-4a66-a5f6-9557bd5467b6", "value": "T1D2850109D034BA6CE7FA14B481365BDCA435BDE40760A2CF25B67B989D72BF0D87124E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749151, "uuid": "cd211d52-d9ad-4bab-8e1e-830ff6a89ee5", "value": "5f94bfd59dbec589d5ce3ff8844c7da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749151, "uuid": "464bd68a-5e48-4eed-a1a2-3ac7b8d7e991", "value": "24576:EpeihFa8YbnVGPRrubY9sVi/whJkNR8dX0dNzBlvdwj1GmMH9cGi4EOGMn45sF3i:E3gVGwdV1GcqTt5dwpC9cG5EMqaWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655749151, "uuid": "b8a75516-f763-4754-86f4-e4063b2f2dd4", "value": 1722344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655749151, "uuid": "4e96292e-034e-4880-ba64-221f03ba6f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655749151, "uuid": "9f80a358-5345-484c-8c72-43a555e16e96", "value": "19e887bc075926bf363dde1ea3034a2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155c6f6e-f064-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655707318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707318, "uuid": "108b59c5-30cb-4156-b3aa-1ee9fb022481", "comment": "Malware payload (AgentTesla)", "value": "5f1824616f1fc1a4a86ed61375e3622d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707318, "uuid": "5f0a282e-b8a0-4d2a-8105-cbaed1076d15", "comment": "Malware payload (AgentTesla)", "value": "8d4528efbca1dc8c1a7c63fecc9d5a2ba374486e514790731c28feca046188af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707318, "uuid": "24e07028-1f5f-4ae3-91f6-11d2382f6874", "comment": "Malware payload (AgentTesla)", "value": "c0ca7451dba475ef1a8f947a07cbe5bf6f1e97e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707318, "uuid": "a6ea7146-5486-485e-9398-9b791cda713c", "comment": "Malware payload (AgentTesla)", "value": "248b27ac2820b517414885578256b0636cc97d0f8bfe31d6b053e9887667be0ddb5e58fbc2918590ed713397641ad21e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707318, "uuid": "495159ef-d018-4880-b87a-b6e5096ca07f", "value": "T18263E0A393FD4D31C5671E704BE654100759CE3A49272A3F671ABE8E0A36B4046F9ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707318, "uuid": "02ac36b1-2fa5-4bbe-bc86-ad0f7ae1cd2d", "value": "1536:Wgjp/Et+wdWbo0aqnjdobxFXGeoAK4HS+7Wz2DU7P70BE:WgjNwdYo0aowxFXLoAKcXvDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655707318, "uuid": "52c692b2-3af7-4555-8e7a-79cf202280f5", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655707318, "uuid": "77b589c0-ee26-4134-b1f2-932ac775bc59", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707318, "uuid": "835424fb-9895-4b08-ac5a-802bb910ed04", "value": "Proforma (revised).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18e65b5-f0cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655751899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751899, "uuid": "0ba9a795-f79c-47af-bc6a-42eebfccdf97", "comment": "Malware payload (DarkComet)", "value": "559e77c66347f99fc2ab5e9ef757ce0d", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751899, "uuid": "7ee6cec2-da45-444c-8abd-4d62660e06bc", "comment": "Malware payload (DarkComet)", "value": "8d5f887270c6f0c2b383c57435bbf7d222ce416a09b3d74d4e1d80608543d0ce", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751899, "uuid": "f98963d8-31ab-488a-a83a-162f28e988e4", "comment": "Malware payload (DarkComet)", "value": "86bd1056e44cdf6dcd3188e16f55cef80a840949", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751899, "uuid": "faf4099e-9a43-494a-997c-5b90e37b7b8d", "comment": "Malware payload (DarkComet)", "value": "300e122f550d195b4eabafd46c4fe6beffea1522a79de048ed762449ffcbc615a1148791f4db3f8ea7fbfd555415c76c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751899, "uuid": "cef741a0-f8ed-4d91-b608-5476a8b75f1d", "value": "T16AE48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751899, "uuid": "02a076ac-fa51-4645-9186-5b1f7b889988", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751899, "uuid": "07eea5dd-5467-488e-b104-6204be26a394", "value": "12288:29HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hy:SZ1xuVVjfFoynPaVBUR8f+kN10EBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655751899, "uuid": "2db419f4-e3d2-4408-b015-512d586f726e", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655751899, "uuid": "7142cea8-c0f3-4ce9-92b7-cbc4abc387c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751899, "uuid": "64c698a8-4786-4b89-bf83-7670de1d8d18", "value": "loader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3036c9b-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "b152bb85-c53e-4c0a-b9a6-76e7ac4adb86", "comment": "Malware payload (Mirai)", "value": "64a16be34fd3896aea26ac6f427aef75", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "6648f172-59c3-4273-9054-e2997db5130f", "comment": "Malware payload (Mirai)", "value": "8da01d6351a3512b9b093b022ea73af6a9a205273788d07cd3b22c7bf7f0d1e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "8b5b4dec-2e84-4aa4-862b-fe68e4e7693e", "comment": "Malware payload (Mirai)", "value": "f0afe1a386fe771702df171cb66c8b4ccaf5dc70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761807, "uuid": "54c7a8ab-42f5-402f-9b08-0ecaf07eac93", "comment": "Malware payload (Mirai)", "value": "ce67331e8522e40b1f026ecb2efd5aaa1b88eb7f6e7debb6d2241174d4441e53963cafeb9af58013ac80cb777366559b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761807, "uuid": "59b35df2-a29a-40b3-aa5e-29de31ac8c69", "value": "T1E813012E20DB69B501F5A0794CB5E99A27A772F1C4FDCAEF7220BC15BB8074364E4741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761807, "uuid": "690e47d6-3701-46c5-9b25-c312c22a99ab", "value": "768:xxkGqKlGFftZ66CaFDrnTHBEhA+9LZ5kfLRGteM072Ktt3adocmqas3UozC:xxk5j9FDHBuAO7yFGtHu3aUqXzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761807, "uuid": "6c50220d-0c62-4315-8e6a-ea15bb0a024c", "value": 43428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761807, "uuid": "3633e222-f4c9-4817-bc96-316ac0f7fa93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761807, "uuid": "41aab3fa-2e9e-4ead-99f7-676ff974cca0", "value": "arm-20220620-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8250db-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655745183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745183, "uuid": "90dca8b2-7fec-4afd-820b-6e339a799f48", "comment": "Malware payload (Formbook)", "value": "36ea1b51442def28b8c127f7d9e386a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745183, "uuid": "e169c40c-4017-4ca3-9e28-867e3090900b", "comment": "Malware payload (Formbook)", "value": "8ecf3a66141bdd66b2ba8201bb1fedbbbde5c4e5710b99ba2e1d523ad49011a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745183, "uuid": "f8c1d20a-4524-439e-9643-143a20c62fb6", "comment": "Malware payload (Formbook)", "value": "00fac6353533794c5f4ef8ea08082974241f4841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745183, "uuid": "3c17721c-d533-4d77-82a5-e6a986a315da", "comment": "Malware payload (Formbook)", "value": "5c7b9c6bc6f93015d4d9e903bc94606290856a35e82eb1caaf72ace66b99443d3bbcae7f10f0efe581043ecc6d375ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745183, "uuid": "89847bc2-d10b-4a62-9a7d-c1f5c9381ff9", "value": "T10CB401007A7847B5ED39C7FC48A2614053FC6037A15AF3A94FD971DBA867B068B50B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745183, "uuid": "93ad1c33-3840-414c-be33-12993d0c7d3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745183, "uuid": "b4ad00a3-50de-4287-9392-6664bffe992d", "value": "12288:rc2iNjLSQuLp3IJMgdkewzeaV07rfmqS8KP1N:Y1dLSQut3I1md3V03ur1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745183, "uuid": "a0ed7c0f-51d8-4f09-b568-67566b7b907a", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745183, "uuid": "06dcea6a-770a-4154-97ea-7df1e975485a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745183, "uuid": "0f216921-0276-4c66-b833-3da4ec8996a1", "value": "btweb_installer.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588a6cb0-f0eb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655765413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765413, "uuid": "9739f04c-ee56-40c6-8721-6fae8f0b8916", "comment": "Malware payload (Mirai)", "value": "58194d8b825ce31899aa1a20ead5511f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765413, "uuid": "23f3f1ba-89b8-443a-9e32-118561de5d98", "comment": "Malware payload (Mirai)", "value": "8f60b398e75deed676b8c5bfcb887fdffa6295f0e3175d3253464e68e406a9cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765413, "uuid": "417edf64-8b7e-4072-8a00-ff194d7aaa6a", "comment": "Malware payload (Mirai)", "value": "00af57e0b29bdbe6e11d4bf94e6755359f69e019", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655765413, "uuid": "383b6990-9efc-44d0-a4fa-18fee7194cf1", "comment": "Malware payload (Mirai)", "value": "6956950fbbdedbbbb2849cb27be3e4ea5eddebef280ff5c0f1b4bf3adf1220e28e702bf3aa695865348a57e63a6893ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655765413, "uuid": "96105fd7-acd5-4343-84d8-86f52c88afbf", "value": "T11373F641BC819A6BCAD023FAEA6E118E332173F8D2DE7117CD115B24768A52F0D77B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655765413, "uuid": "fe824d84-8de8-45cf-9110-b4730ca57819", "value": "1536:fecVUb9phHTsUNNtzZ3OWPBw9cC1zkQbCneZfYffqbAvA1peUIuAFdn2+RaV3:feiUbHhHmSC1TKabeA1p56I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655765413, "uuid": "4ef320b6-1070-417f-9ba0-571e03a2348b", "value": 77448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655765413, "uuid": "51c0d350-642e-4613-95e5-7ba253779ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655765413, "uuid": "f50af475-d7b0-4c47-b19f-ba1e7f13564c", "value": "cutie.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2d3ebc-f0ac-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655738258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738258, "uuid": "18583bf3-e301-4c47-b889-1ee6f281514a", "comment": "Malware payload", "value": "447f30fcc924267039c818b26c2b5f2e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738258, "uuid": "bface752-a57f-4177-ba28-16fac9c798c4", "comment": "Malware payload", "value": "8f6ee5452ca06244fe4c592cabda5f7867adde699dfe471c5819b89f3e738ae2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738258, "uuid": "056d62da-0361-4171-a4d8-54325a695bf5", "comment": "Malware payload", "value": "65e31523fb1c88a89495784d78e9abccb143950a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738258, "uuid": "01fa46cc-a425-4a20-b0d8-72fddc3ac733", "comment": "Malware payload", "value": "b5f4e9fb4c62cce4beff52b9569a9a979d90157d8ce7a5277f5e6d8a4471eca29e3b020336089522c5c1a8bea3e3f308", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655738258, "uuid": "750840a6-92c9-47da-9f04-a02305ecb98e", "value": "T1B422BE9578649C4D0E7ECB5ED27E8284E84804178C39B2C583E3C997969FF98D24330E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655738258, "uuid": "2a6895a4-b4d0-4bee-a134-5deee3f9eff4", "value": "192:uH7zu8csoyspq6q1DBdKr4wYx3WazsM/zmi2k4dTdlSZHWIiWxaX:uHOOspqhw+GaVzD2k41sH2WxaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655738258, "uuid": "61441ae8-969f-45f5-b8c6-76afc988c966", "value": 10632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655738258, "uuid": "f5d406ee-44a3-438a-a427-7cc3ba5bd4ad", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655738258, "uuid": "c1e2dc60-b2dd-4c42-b6a2-f1a2cd985102", "value": "52220106202022.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7b27ec-f049-11ec-93bb-42010a9c0043", "comment": "Malware payload (Kutaki)", "timestamp": 1655695977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695977, "uuid": "525c83b3-1337-4f78-8d77-6bb1b1c36f32", "comment": "Malware payload (Kutaki)", "value": "c1e4a2246ff15995c559331b25cf6536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695977, "uuid": "e6de425a-39d7-4ac0-bdac-7cf7f560a21c", "comment": "Malware payload (Kutaki)", "value": "8f80042ca609cfd6ba7db84003a87d6fad6fc0418fb1392879441e4ae68aaec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695977, "uuid": "905dcc72-a5be-4d4f-9ef4-f70a93caee81", "comment": "Malware payload (Kutaki)", "value": "efa49da0e7d8c3e7a24a0dfb8953f996093b3f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695977, "uuid": "aefcea04-2549-42eb-8a4f-60c40dbe3062", "comment": "Malware payload (Kutaki)", "value": "7a106aa82ab8bec7a1f60ea7e890b8878e18caaa87e65b52629dcbbec6204d5e3bfd726bec1f3ec6074a60fb3041ba91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695977, "uuid": "eabab3ab-ce94-4ba3-9fbb-2bbe305b3784", "value": "T1A835121BFF828A62DCAD26712E9742F45223BC591B974A8F3A40A27C3865F815C7075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695977, "uuid": "05f64d22-b617-498e-b4a9-3b126db06ea1", "value": "f22edd41a8fa1aa8e687890bccb23634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695977, "uuid": "5563a5b6-49c7-4d5d-964a-d54b4e82c17f", "value": "24576:aCzue46D5tKERWpnhNjQlUPnGYI5aDM1SfmP/UDMS08Ckn35:acx46lgEshNjQmuYMao0fmP/SA8NJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655695977, "uuid": "8a089963-9f98-4161-8b06-36069f779c19", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655695977, "uuid": "9d81d2ee-71b1-4b34-82aa-22aa2e32a4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695977, "uuid": "1eff281e-ade3-460e-9090-496d3f4d9032", "value": "SecuriteInfo.com.Variant.Symmi.62789.25665.13482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1fbf39-f094-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655728326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728326, "uuid": "747a22e3-a341-4983-9249-e95a78901ac6", "comment": "Malware payload (AgentTesla)", "value": "2573cb2fa03467320ca9903161ab0bf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728326, "uuid": "69b4c75a-3b7d-4ab5-8b83-412758067a69", "comment": "Malware payload (AgentTesla)", "value": "90839a93f2916d06225104ae35029f218d115c3730b457de2a64238fe0b3023a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728326, "uuid": "974e3c13-17a7-4012-98d5-a5ec30be39b4", "comment": "Malware payload (AgentTesla)", "value": "dfe4056098a40d2cdfdb0992881ec7d6ffe9c9fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728326, "uuid": "0e581378-b099-44a3-b0b9-aabb90afff0b", "comment": "Malware payload (AgentTesla)", "value": "1fe3f201a39e7f8d5f93955d21f9160f4496d63241aa49a51e0dc35a970e0ca8059aecc1927046faba1332a9305ae801", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728326, "uuid": "bce6a63f-a4a3-418a-b01d-fdb51461fac2", "value": "T136A41224A27977A3C037E7F889AB06D0C3F556359E43F05A8ED161EE4837F988691B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728326, "uuid": "bf29cdfe-af46-476b-aef5-1571bd28d044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728326, "uuid": "a9d71416-2e1a-4971-84af-6f0ea9d21461", "value": "6144:8tPs1w3QU5VGW+6qcMWHCl5EhI5S8uP9tUWivSnIAxirXFmTAGy2NRvTMKNoWboH:CZEl5EhoSrqSIAizATU2NBosk9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728326, "uuid": "40396cc3-775e-4906-b65c-3c36565245dc", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728326, "uuid": "0de2e0ff-ab87-4041-af84-44dfbab5730d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728326, "uuid": "4f0b86f3-fe6c-44b6-a4c5-02642ff143d8", "value": "SecuriteInfo.com.Trojan.PackedNET.1389.29450.6620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64de74c-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655734244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734244, "uuid": "d288ab34-4723-46d1-9efa-02a04718331b", "comment": "Malware payload (AgentTesla)", "value": "29477f425d6c631468a2233cbbee919b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734244, "uuid": "20054709-09bf-454c-bc8d-375f2b6b3a9b", "comment": "Malware payload (AgentTesla)", "value": "9168bf8f055bbaf60630375f130577d45c9fb532204a9c373169ddf8c7dfcc2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734244, "uuid": "6724ee38-1b2c-4402-be85-2aa0cf00367f", "comment": "Malware payload (AgentTesla)", "value": "fa6d8c94952d076c3bef0d9edb704262793a0fea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734244, "uuid": "809b6f43-133d-4ec9-b8f4-21d4ff97196c", "comment": "Malware payload (AgentTesla)", "value": "8dbc888d28c12ac1f7f496fa32ae6fcbcbfbf977161b4cc324a398c5d0a1054a2d17609334df2498a86b5703eaef0159", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734244, "uuid": "50a29b17-b7fc-4187-83f3-cc12c97424cd", "value": "T15C2419166714D521CB5F417FC016820831F1DB07972AD38F5AA6D8FA2F822CEF92B9E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734244, "uuid": "ebbe3554-b68e-4a98-8ecf-3ab5d4b059ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734244, "uuid": "fef88614-5681-4621-93b8-9bd2971bef0e", "value": "3072:BbYmD45GDrnNCfxafCWUsC0c770BMQo65bfNmIzIyaVRka81nZKbILKJtis4B:b3nNCfUhUL7wBt75hUJ81AbI+vis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734244, "uuid": "fb869bf7-c42c-4f4a-8e83-da08bd5f5c55", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734244, "uuid": "86ba1a08-1688-43ee-9128-3492676bb194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734244, "uuid": "86aadd6c-a18c-49d6-a263-19d5bd12dcda", "value": "29477f425d6c631468a2233cbbee919b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4b153f-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655725934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725934, "uuid": "f3aabc9f-a98c-41cc-8f83-f710a10fb208", "comment": "Malware payload (AgentTesla)", "value": "1c45f16b3deb264b076e4067930866ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725934, "uuid": "4e253f4b-d89f-4e8f-8764-9835edd192f3", "comment": "Malware payload (AgentTesla)", "value": "916ec98c322ed25021bd604387e9471a788b6c8263d7bda7d43b5ee62c92787f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725934, "uuid": "c0056ea6-49f8-4518-a464-118921a7d81a", "comment": "Malware payload (AgentTesla)", "value": "530790b3d02558a8f9924db835497d1cbc3d6fac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725934, "uuid": "71a5c990-62a9-4962-a542-a2c8cdf31faf", "comment": "Malware payload (AgentTesla)", "value": "b4b81b5e4ed5d91ec44f47976d3644ef17bf4c5d138821491b53225535dd6b32475bb27ec7dcdf38ae96251ce2f0fd48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725934, "uuid": "e98988ac-37d4-4d4f-bda2-57a0c0fcc12a", "value": "T1C9B42378AE61C7E8514A0817D202E355CAEB7CD143125B17B345BFA68837887CBAF772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725934, "uuid": "7a5b7c1a-e741-4e39-b8d3-89f5a45df5d8", "value": "12288:TzCZNgpieCi9VTQrVtGB32NvoDddmOMw28/Nc:n0NgpPCi9VUrz8zDddmp8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655725934, "uuid": "ed3ffab3-ab50-49fa-8af7-0c9d62083d34", "value": 511347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655725934, "uuid": "4cd5f553-9fdd-46e8-92ec-9d99ef81cb84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725934, "uuid": "2ebacf80-b149-41d4-96ad-cdcba51e2db7", "value": "Remittance details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6967fe-f0df-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655760187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760187, "uuid": "2e3fd60b-3a09-4767-8bb0-ce3c31af8ca3", "comment": "Malware payload (NanoCore)", "value": "892b5291a718aadd43dc768149e39627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760187, "uuid": "c66f3126-63a1-46de-9886-484078d77462", "comment": "Malware payload (NanoCore)", "value": "919b0ee543568c289f20c4ce9690590a29b06ae53ffa5f12d24e6d260b6b8283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760187, "uuid": "13c48c28-daf6-4df2-b251-fecdd51ead81", "comment": "Malware payload (NanoCore)", "value": "e27739b07723f0f52beb10deb9883f718c87ccc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655760187, "uuid": "22df0fa7-89ba-40a5-bbfb-63035d074d89", "comment": "Malware payload (NanoCore)", "value": "0046725ef2b0a02601fcf115805527d8d70c800119922bd72ef660f3d6c20a04469723336ca0f8e5d37bacdd0659f5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655760187, "uuid": "2215f91a-405c-4561-bb0a-8e41360498ed", "value": "T16514CE2677B88A2FE2CE86BD601252078379C2E398D3F3DE28C455B78F566E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655760187, "uuid": "79444ead-5374-46a1-8d2b-4c5eedd3c048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655760187, "uuid": "722337c4-e11f-4a4b-9e5f-f3da7e9e9252", "value": "6144:QLV6Bta6dtJmakIM5Nr0/v1wyiQSFgToN:QLV6Btpmk1/9wGSwoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655760187, "uuid": "e08a181b-3f88-4b69-8be5-dd5ae3aa4e52", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655760187, "uuid": "22007462-d267-41fb-af10-e829e56f7f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655760187, "uuid": "5660f4eb-511a-416d-ac7f-5f790410dbeb", "value": "919B0EE543568C289F20C4CE9690590A29B06AE53FFA5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81782c0-f09c-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655731670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731670, "uuid": "f1e0c34b-bd29-4bae-9f27-ac41ccb2fb0d", "comment": "Malware payload (SnakeKeylogger)", "value": "5152f77a02d21e7b7a85cbc65a2b2b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731670, "uuid": "4717d1ae-a2af-473a-a49b-63b3d5825d06", "comment": "Malware payload (SnakeKeylogger)", "value": "9209fd56cdf7294d924a2c51e72727ff88f0d22ea470471467f9751f59e717ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731670, "uuid": "db34b85c-3b5d-4973-a352-ec422b3cc013", "comment": "Malware payload (SnakeKeylogger)", "value": "32a0f822b8cad58b5072cbd66707b851b3be978e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655731670, "uuid": "7504b7e9-9b37-48d7-a753-f454efa3161e", "comment": "Malware payload (SnakeKeylogger)", "value": "2344e95b149d2c0c80563e628751c8efb9cb1f2a70813433853188ce22bc398a1473cb27cbd6d193b3dc8db1039eddde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731670, "uuid": "ea62efcd-5cc7-4c6b-a7be-2346ab8958ef", "value": "T145A46C9CB22C74DEC89BC27699A44C64EB60646FB72B410751530E9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731670, "uuid": "2994efc8-cb9f-4f43-8eee-223510132729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731670, "uuid": "64ca6e4b-169a-4eea-a602-da88abf642c4", "value": "12288:jXzM07VnoUZr2z1QjqI05I2PGuHNedJwJ:37JT4O50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655731670, "uuid": "ad261f13-f04e-4333-b7c8-a0e4a7841686", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655731670, "uuid": "63487f8b-99b4-4f17-9e1a-0b010d1380d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655731670, "uuid": "ab8188b1-7d2a-41a4-ade8-a601e9aae671", "value": "DHL AWB No. 8427508235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad3271f-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742949, "uuid": "ed149be4-50d8-4cd6-bdff-6ce7f937fe09", "comment": "Malware payload (Mirai)", "value": "67f7e6f82620cfdf262aa37f941c1341", "object_relation": "md5", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742949, "uuid": "df9cd9ea-171c-4844-bfec-1783fc740691", "comment": "Malware payload (Mirai)", "value": "930119c3b54c6afb43b21cda0a37536aed4685da58396d0cf996b5d9f08e304d", "object_relation": "sha256", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742949, "uuid": "95c149b9-16a4-4ac4-9e77-8851bbdc07d1", "comment": "Malware payload (Mirai)", "value": "64e82f87f710eda03bab7003543119ce4424249b", "object_relation": "sha1", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742949, "uuid": "54fd6722-708c-41a6-acb3-b03836d56b6a", "comment": "Malware payload (Mirai)", "value": "59cf8c8f32e0423c6a6e6626f443bae6a1e1dae17e396db6fa43f3bdfb1e4ebb81fe188c755a40335f220ddd18e00b23", "object_relation": "sha3-384", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742949, "uuid": "eea1870b-9879-4071-a7b9-7dc22f24fc20", "value": "T156E2E124A17ECEC1E5315536CC9D89C21E02667C92DBA6317EB917B4D3B710099F0B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742949, "uuid": "6864014b-25e0-4aec-b8a1-1f5f999182f2", "value": "768:ZBv9WlDDFiQK+KkMVzZSg8CVphfby8j8dGu6GyAoGOAcVPs3Uozw:b125MVD8Cbhm+hLAoXUzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742949, "uuid": "3d950539-865c-49f9-852c-fa31d01f8078", "value": 32468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742949, "uuid": "cbe65ed4-5830-4a3c-a987-3bd1ce7bdb4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742949, "uuid": "e602c94e-66de-48fa-8d30-f426635a0f74", "value": "zz.arm4.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3fd56b-f0aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655737588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655737588, "uuid": "c3965a5f-2525-42bd-b0d5-2bba47c61692", "comment": "Malware payload (AveMariaRAT)", "value": "7c1a4b8e47643642780e01545c7f100b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655737588, "uuid": "4cad9ef9-731c-44c5-b186-330463aca2ef", "comment": "Malware payload (AveMariaRAT)", "value": "93a8264731f1b7b0b57f04668a205de936d9b1b3507ecd90763337b0c340beef", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655737588, "uuid": "2956eb44-f5db-4a5d-8a07-e4d6081d1905", "comment": "Malware payload (AveMariaRAT)", "value": "aa62c660e421f0b6ba644b2bdbca56d8821afe37", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655737588, "uuid": "6cf56c9e-ee49-42af-8135-ba9a971d3387", "comment": "Malware payload (AveMariaRAT)", "value": "5a0c836a90541496073192bb397c9b1a34e1369ab969948fb3e9c69a44657247b632646f74dfbedd157c34b2082f0622", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655737588, "uuid": "db0119ea-ad31-43db-99b6-9552824c6b02", "value": "T14A25AE22B2918437F07356B89C57A369592B7ED33DB4A84A2BFC2D4C0F376913925393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655737588, "uuid": "eac5b9b9-83b8-40f5-a281-b1c03282dea2", "value": "e55f5d850d824061c99d9840e225ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655737588, "uuid": "ad9065d1-2a57-4fcd-8f88-c236a55e5807", "value": "24576:QfmLEvRUTF9+mDpK88kdTAKQZLd52EUAEc:QfYrBsTL9Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655737588, "uuid": "39790adf-269c-4239-81f9-60cb560c95fa", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655737588, "uuid": "9ce201aa-96e8-44f0-8eec-5f216628c195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655737588, "uuid": "11e6ae24-1a3f-48ef-9fd9-0380e7f46335", "value": "Delivery report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420bfd4a-f09e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655732304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732304, "uuid": "a0417b28-8531-4113-846b-99e356ebb4ec", "comment": "Malware payload (AveMariaRAT)", "value": "349a4c0270160d26680eab6953ced374", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732304, "uuid": "2ad304c1-7296-46f9-bd15-9cbb9a208e4f", "comment": "Malware payload (AveMariaRAT)", "value": "93bf08782025846323cf182a492bb16e7aa2e7bbfcc23f92f75de896b2c0991e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732304, "uuid": "7f48b71f-8585-4227-b47b-23e0c39ced43", "comment": "Malware payload (AveMariaRAT)", "value": "b2e2408719988c685a9b6adb62c5de5fc7e1a7b8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732304, "uuid": "767ae633-d823-4569-903d-3d19f14147b1", "comment": "Malware payload (AveMariaRAT)", "value": "81f8654d4105ad0587b9c531d0ef29266384eaafbc5010a1101bcf2b7651eea35de99a3810a1048a96a90e2cf75b086c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732304, "uuid": "4e635657-934f-496a-9780-42254d70081c", "value": "T188C4299C366C71DFC857C572CA985C64EA6064BF671B9203A02716ADEE0DB9BDF100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732304, "uuid": "a03b0d0f-30c3-42b3-8292-046f41fadefb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732304, "uuid": "e25bac06-2cb2-45f7-9fb8-8387dd99a757", "value": "12288:hcTXMh2iNCnvVJggrrYWvBhh4Zy1qqRLlu+SqlCPMlA5Em+RmQd+coyutBg2IIfm:hc4h1HcvBhheyhMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655732304, "uuid": "be9dc2d2-8d8d-4b83-8f4f-26d5b2f0a504", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655732304, "uuid": "fccaa6ad-22c2-4ddd-86c9-1fc0dd418685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732304, "uuid": "70f85240-4fae-42d7-9b1a-3b09950e1be4", "value": "OVERDUE INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f041f4c5-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730449, "uuid": "df3436cf-66dd-4089-ac4b-3a89def3cdea", "comment": "Malware payload (SilentBuilder)", "value": "5ce70ffb674cc6110962c472b18d2d94", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730449, "uuid": "190b8f6d-aa92-4b7e-a92a-04cfa56545a8", "comment": "Malware payload (SilentBuilder)", "value": "947d98b55e1430e4511224dcb29c0b2ee13504a54814b46cd2ebeb18071aff0c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730449, "uuid": "001c5429-b571-4258-a5ad-b10b1256a628", "comment": "Malware payload (SilentBuilder)", "value": "b2c502e8a8a598bad50e173502467aa006bd9554", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730449, "uuid": "be3a05d9-53e1-4bd5-86d2-93f844768772", "comment": "Malware payload (SilentBuilder)", "value": "55b7de659ad2367ad825956c7dc1b93a144b014e7f70b42e78bedb1eab7728899ca550240a61c8fed8970181c3637995", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730449, "uuid": "594f4201-78ab-40cf-96be-60bbaaae49ae", "value": "T149733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730449, "uuid": "0f46e1ef-d889-4a08-9054-708d7e7b6f4d", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBc:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730449, "uuid": "b0fb2157-d2c2-48e1-aca2-0cda62f46b56", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730449, "uuid": "a1d9674c-ed7d-4387-b5c4-4cf2de26816c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730449, "uuid": "0d88fe93-753b-4bb2-be71-07ea41211cc5", "value": "39450672254828278.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0157917b-f05b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655703419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703419, "uuid": "1fdf06b4-37ff-4d86-949e-0738f12647ac", "comment": "Malware payload (AgentTesla)", "value": "5f93499b9ef854d5ba07a35abe87e54c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703419, "uuid": "a081f828-f0ae-4b4d-b48e-7a5437096af9", "comment": "Malware payload (AgentTesla)", "value": "95d4622cb89c3b9d783ae6c043617ba2982f05944d67eea0eb3c8ddb7367337c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703419, "uuid": "69dabb96-f44c-4cfe-83af-fbf1a111d61e", "comment": "Malware payload (AgentTesla)", "value": "d5c5716bd9391c2a0d3f29acaf12fd0542cd2977", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703419, "uuid": "299f5f4c-a44c-499e-ac9d-3b18cc0f840c", "comment": "Malware payload (AgentTesla)", "value": "29db76a38af26a1b2c270142d1d9c7978475fec0db564680bf56ba272df4b8be57b36727cbedc273703baf68465612b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703419, "uuid": "1291f83b-38bd-40a0-b7e6-e39aaeb1b9ae", "value": "T1B48423DA1A18ABEEFD124CFDA59011F951C139EE6B134F5427DF704E0FA4682F8AB204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703419, "uuid": "f726044f-a78f-4f23-9968-edaed208f41f", "value": "6144:NBj/iwwyc8VeIsoNBtZ2bRHEoYRTcoW3pXrp0fuvHWVz4CkiOD81UjSp/:NB7iz8ZtBtZs6HTX2vHo1jOD8x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655703419, "uuid": "9bd5450d-a2c2-4b94-8115-6b78a40b408a", "value": 391877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655703419, "uuid": "703def72-f3b4-434b-bb20-3356ec85d151", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703419, "uuid": "376b06a5-28d0-4103-97d6-a0e9299fc251", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a228fa40-f067-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655708843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655708843, "uuid": "5008fcca-2103-4931-9945-98c3cb5926e5", "comment": "Malware payload (AgentTesla)", "value": "18a2b921a7db4be3f96a866016bba60e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655708843, "uuid": "b643df80-ab14-493e-99fe-44a229f5a91a", "comment": "Malware payload (AgentTesla)", "value": "964777409c799bfcdc5d6b5bb96a1213387bdf613ea0921de32df37434ee7fd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655708843, "uuid": "5c2d3969-b44f-4224-a174-faf1faea5ea0", "comment": "Malware payload (AgentTesla)", "value": "b9eb20e303bdd0c9669bcd7175a98d2d1c3697f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655708843, "uuid": "6d023cee-e0d9-4a43-822d-70f5d7e83341", "comment": "Malware payload (AgentTesla)", "value": "0ef6da1a95ae5a02a745d607ea9cda610772f305ce027df6ee10fa582c80e865e1ed0c6523a5b2caca727ae1730995a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655708843, "uuid": "e565a3ed-9eac-4af5-9ee5-873a91aa7f5a", "value": "T1A214BBF36BD8C8DEDB586234F3421E1703516DEC68D6A63C1FDE7A29C630A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655708843, "uuid": "ae4c63b4-8eb5-4507-bffb-a60268c302ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655708843, "uuid": "73cc9a6c-8282-4051-a26c-e172e654c63c", "value": "768:L+8R2nQ42Chp6kELfMaCChd7ntnR+iEiiiX8n8nsMGGTdjt+++Gvx/bb2exNEzAJ:6i2Q42EuSdwlOVhhJRYXswGjVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655708843, "uuid": "5524c713-96ae-4b4d-a3b3-d0d88977a4e1", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655708843, "uuid": "1426f452-3671-480a-b2ce-89406e6be3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655708843, "uuid": "817e793d-8b38-4e39-b37c-fd87055ebcc4", "value": "MT7500663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9b1afb-f030-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655685079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685079, "uuid": "fbcf0939-72e6-4576-a0ae-ee58436e71d0", "comment": "Malware payload (GuLoader)", "value": "976399f1ee6de1af851f671f57d3a773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685079, "uuid": "3175cca1-bdfb-45dd-acce-9841baf80832", "comment": "Malware payload (GuLoader)", "value": "96850ae3b850cac5f713f37cac218c7eb6221a4021fab54df69ba416a9753ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685079, "uuid": "b313bb76-5468-4c20-bd85-ff1143199945", "comment": "Malware payload (GuLoader)", "value": "2c790b73af7b3bed717f909d06b17cc4bd9acda6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655685079, "uuid": "024bf166-ce1e-47f8-b4cd-2028bbec9d65", "comment": "Malware payload (GuLoader)", "value": "7bfbdddb7e5ff531473417f73f88fc1c640cd04c1572ae5d6ba3ba6dfd580d70df97177074a4d5b37a2800761fa6615c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685079, "uuid": "99beff95-870a-4395-81f7-b4ac8b56dc59", "value": "T11B04E110B7A0C477D4B04631092ADB779BBABC2959A05F4B23807F5D3D72A42CA1FB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685079, "uuid": "805dd8e6-9654-42b2-8161-81c8742596a8", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685079, "uuid": "c90c8d41-c57a-4c15-9ef8-18b14224f78c", "value": "3072:tbG7N2kDTHUpou/Bwl/i4O9jbTPVR57ye/ygDOupy8k+cB:tbE/HUHBjJThpySZpV2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655685079, "uuid": "6d209015-edd3-412b-a3ad-6d8ef1a4d981", "value": 173928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655685079, "uuid": "5870a443-8fe1-4530-8c9e-e13bfc7b9225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655685079, "uuid": "260fd696-c266-4f0c-bb6d-d34c8cb54be0", "value": "SecuriteInfo.com.UDS.Trojan-Downloader.Win32.GuLoader.gen.19443.13100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85565ef4-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722109, "uuid": "eee2ccf3-741e-444e-a4a3-9ca2b1f0e228", "comment": "Malware payload (GuLoader)", "value": "108f51bab5bdd6d7a9a5705cc306f2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722109, "uuid": "9e59ef01-4417-4e86-80b9-b66a004c7421", "comment": "Malware payload (GuLoader)", "value": "96d2a57a1debf5b4c49483a504e0fcfebe9202cc633198c433b9010679cd7e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722109, "uuid": "b619d029-d9c0-4f2f-9696-3a5a1da92b3d", "comment": "Malware payload (GuLoader)", "value": "ad54cbcd41dec6b0d8f4973898ec87522b8b99eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722109, "uuid": "87f03a9f-b8dd-4c2a-bca0-e0a874318b28", "comment": "Malware payload (GuLoader)", "value": "51b79b177ab16b4f406b28342cc606cbf5d185828ac3d477f5bb7997c7d46237ac15c727b13af8fdeda7bc234be69a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722109, "uuid": "2487d37c-6aee-4e81-a6d8-bebf0fa9b11b", "value": "T179241230A5F4C4FBE4EA92334EB183927AF6F90108555B1B3760274A7AB53117E2E3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722109, "uuid": "1b42c101-233a-4a79-bedc-dce8384c3574", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722109, "uuid": "7cee463a-0751-46a2-bef3-d46b52993353", "value": "6144:WYa61JUlx7THS5QvtJCGYQMecTELLlKnoOhHJoe:WYXg7Ty5YJeQaqLlYoMH6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722109, "uuid": "711f4bc2-acdc-4c86-b886-72526bbbe28b", "value": 214537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722109, "uuid": "29fa602f-c7b0-4975-8a1d-37929b70e5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722109, "uuid": "1ddeb5ef-7662-4961-a475-1bf9648b8e74", "value": "Omega 0620-220078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de02fef-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655725828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725828, "uuid": "540094f6-c78c-4945-8ca4-1c51116fad89", "comment": "Malware payload (AgentTesla)", "value": "d0779fb43eac02ed970ed4ed65e6b0f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725828, "uuid": "80692ef7-6d88-4ba7-b5d6-aec13b3da9d4", "comment": "Malware payload (AgentTesla)", "value": "97204485bd2a25ccb3b504fa17b449a5ad28c93252736087228c3eb770549d8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725828, "uuid": "f7198929-e99d-4622-b57f-5af79122a745", "comment": "Malware payload (AgentTesla)", "value": "fb66633b26332218ffc1a4b5aa7553c95a097a03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725828, "uuid": "7486b1d8-94ff-4ffa-9f9a-c7bcfb436a06", "comment": "Malware payload (AgentTesla)", "value": "c6fee64bef3af6f755e2553316ee08ad14697fcbf5907e3bfc32ca5efeaa2ddbb85115494f6772c8c02915d51d468d3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725828, "uuid": "b2aab5c1-502a-45fe-b26c-7d6012d9861e", "value": "T16BB42378AE61C7E8514A0817D202E354CAEB7CD142125B17B345BFA68837887CBAF772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725828, "uuid": "73e1a3a3-7fe9-4e4a-91b5-9cdba566864a", "value": "12288:/zCZNgpieCi9VTQrVtGB32NvoDddmOMw28/Nk:L0NgpPCi9VUrz8zDddmp8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655725828, "uuid": "0da6e78c-809a-44ba-9a97-d3e950fd2cce", "value": 511339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655725828, "uuid": "5814b37a-6e64-4084-97fc-3f0d61ea0cbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725828, "uuid": "801c3020-f0f8-425b-a41c-cbc3719b4206", "value": "PAYMENT ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45056c3-f0c9-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655750937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750937, "uuid": "d371ae24-402c-45bd-bb86-102249aa4ae3", "comment": "Malware payload (NanoCore)", "value": "1b0c365e4fc573fb3e3f868967dc1731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750937, "uuid": "b1cfba06-f326-4c4a-aa58-284dc7ac3a62", "comment": "Malware payload (NanoCore)", "value": "972acfb515dc792078bad899058cf0bc29f8e0fccc45b889a27638eed782695e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750937, "uuid": "c69213a2-b2e8-49e3-bdbb-eea67ff219cc", "comment": "Malware payload (NanoCore)", "value": "af96482c38629e7f6b770f257e306e179a4d3c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750937, "uuid": "2401b72e-8a8c-4d69-862c-2c988a3ba24a", "comment": "Malware payload (NanoCore)", "value": "a6554668425de7a3bf811520c38674eb4a343b9d9ec321e6583c6ad1713e6e9767f6e976ecbdea0eaacdd821719ab95c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750937, "uuid": "d07d23e5-8f67-45e4-8df6-451a3931fe57", "value": "T1E305C69C721831DFC86BD276DAA81C68EA90757F931F4107A02715AD9A1CAC7EF148F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750937, "uuid": "589e9426-789c-4a72-b68f-071addfb6383", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750937, "uuid": "5c12bdb1-99f5-46b8-a67f-27b1bc5526dc", "value": "12288:gCsVE0zz0VFSOQU1UnG9R+hmZERy4S2/N0rs8hGt1x5/CUtXG+USZrIU+KeFZwoQ:vsJ0GngWmZiAWGscaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655750937, "uuid": "9cdb1d2d-9b11-4e58-b105-caccde595563", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655750937, "uuid": "6e3dd24b-6fff-4f15-b29d-d3ea0f4186a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750937, "uuid": "4fc64316-5658-41c7-a45f-0db3fe78304d", "value": "972ACFB515DC792078BAD899058CF0BC29F8E0FCCC45B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0596dc-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655734176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734176, "uuid": "21fbc4b1-d01a-43c0-bb36-4c7e1a9b97ad", "comment": "Malware payload (Formbook)", "value": "db788425b989962ede936d705b6f9f41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734176, "uuid": "a06f74ae-7ef1-4903-993d-9f683568bf23", "comment": "Malware payload (Formbook)", "value": "97455ea051858a658c46bfab848532f3ead49260621d2326d82bca0a7ea6d72b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734176, "uuid": "08b0e458-43f3-4da8-9429-358beeae1b2f", "comment": "Malware payload (Formbook)", "value": "9732d04319da88014afa03111471cb28a6500753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734176, "uuid": "71347d20-a5e6-4b84-8809-f0038617d038", "comment": "Malware payload (Formbook)", "value": "d14c3f99af9026f7498d26bfc6ea1824d737dea1d4d447d7043b560adcce6616406ca08a1a81735ca44ab572a6dceb7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734176, "uuid": "9f4e1b0b-973f-4cf9-b1b4-e7f3d40cc5a4", "value": "T1DAB401007A388762E9388BFCC4D36280A3FC7432915AF3A98FD971DF5D677428A50667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734176, "uuid": "5e165f8c-5ee1-4ce6-b544-7294f6df404d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734176, "uuid": "207c0c64-4cfa-4814-9d6b-25f3ac39eff0", "value": "12288:nHpg72iNi++kEcHjOrWGF7fOlOFsjM177HaLSc69CSSS:c1j+XOqauYslR9CdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734176, "uuid": "d38a8d46-ce23-4b50-889e-434e66b2c50d", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734176, "uuid": "fe96f613-b7f8-4870-848e-8cdeaa333976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734176, "uuid": "9a8e448b-d78a-43f8-94fe-7a764d3f7a1b", "value": "db788425b989962ede936d705b6f9f41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb67770-f071-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655713080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713080, "uuid": "6d3a2500-0760-4819-b0eb-abe2d1ec6c23", "comment": "Malware payload (GuLoader)", "value": "011a4e70a5802086d3c2126fcddb036e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713080, "uuid": "48cca33a-936c-4026-b966-67230ed1797a", "comment": "Malware payload (GuLoader)", "value": "97e70b15d5321a0b02fc0317135145026f377dd1c9cd1873353b813aba984f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713080, "uuid": "5b86ed5f-05de-40d4-bc9c-0ed640911469", "comment": "Malware payload (GuLoader)", "value": "f8295b328707f408100184cc20519e942ed5852b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713080, "uuid": "5d5947f7-9b31-4fa6-8cf7-7b596d04985b", "comment": "Malware payload (GuLoader)", "value": "e8e12bf9719cc81b10467eaaacc1e272fdedcac36eb04a0aedd464ca884260966661d343b937057c0c9f60aaee4d9161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713080, "uuid": "f7632f7d-137c-4405-a749-d3567125efd9", "value": "T12A24E10DD680D8E2E4ED053109B6A99597F5BF23A4604B3713D22B6BBD316419D0E3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713080, "uuid": "e0cb61a2-473a-4bb3-8b69-2c988e4b9931", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713080, "uuid": "b21750bd-0aa3-4ad8-abdb-aff029f359da", "value": "3072:o1NjcVVnLpPuIWD4rok6Jgbz8b2FDbcECj7lZgLlb6cQdVmBVV6o/LaqJdpeLBCj:MNeZBbSQFtb2l2UVmbVZDaqdpeLBnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655713080, "uuid": "3532368f-866a-4e75-b7d1-1b11eff7a09e", "value": 211960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655713080, "uuid": "3c39e760-44a1-4814-aaaa-7e44fce00ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713080, "uuid": "837b4a77-fd1f-4e07-85da-d6d2b71a0da7", "value": "7109842.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0de527f-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "44173f0d-1049-447f-b1ad-eb1fb5e1b610", "comment": "Malware payload (Mirai)", "value": "6813f3b26152f81283778d479bfe2524", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "7275b85f-4e91-4a66-843b-d4bdf69dc537", "comment": "Malware payload (Mirai)", "value": "9877effe8cf6aa9e1df3c0636759c91df8d7ad17f18c83cc4f3b2af6c6ae5373", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "e6b46674-53f2-435a-86d3-8542e8290a16", "comment": "Malware payload (Mirai)", "value": "2340c0da76ad4323517893cce6c74e6e0d8d2b31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "f29599d1-1020-4c42-8cf9-2255da17deef", "comment": "Malware payload (Mirai)", "value": "aea7b50087608c4500d3a84ede336ad5b2878a1a193fdbe517d12824ff0b240f707ab3a5ab56e5bce52fc1f57fb05c01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "526b2413-a5c2-4142-aa1b-b9e99784cbdd", "value": "T198B3B54CFA65A72DC6E372FEFF1902CE322A1B98B3FA34119E350B5127C5F651A25121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "712f36da-096f-4e76-aad3-8629e23de4e4", "value": "1536:2ingaP952dI+GWjyRVfTf7WQiPU8u5bkYEkw8yXIm1SWxgKmlvyhGiBcoIAo8b:N52KVWjWf3WQUe9Ekw8KIESWNpcox1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761803, "uuid": "984e5280-4acc-40c6-a406-2e022c7925ee", "value": 108156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761803, "uuid": "b8ca343c-8194-4f58-9247-99434c4bb0cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "35fe7815-4ecb-4823-92c0-3dbd431fceba", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba22a0b2-f060-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655705877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705877, "uuid": "dd28ef17-76d1-4d3e-92d2-7156880594c0", "comment": "Malware payload (Formbook)", "value": "9673d8f78c479fc05c10b9b3e56caa6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705877, "uuid": "35129db3-8018-47f6-bd51-57e9587eb722", "comment": "Malware payload (Formbook)", "value": "993f460a289cf97fdf275eec6b4d1f61fda5f252637f445747cb4d5ee04527d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705877, "uuid": "178c9965-560e-4dca-ac02-c48128832348", "comment": "Malware payload (Formbook)", "value": "05da96a7f083236e7875e640f02e776e8fa818d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655705877, "uuid": "786f8170-704b-4788-8624-2f808f7d2bdf", "comment": "Malware payload (Formbook)", "value": "bfb00d02ed6d4418c67b40c6cbcf190a6dc0e798861c9b9993152767cf838efa81a7c450cc69fdad7a43e2c221c66cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705877, "uuid": "b440c383-c098-4c03-b095-c2c0146e96ce", "value": "T1719412482FF8D35AC5776BFC2293419093706E2AA407F3888ED5B0EF04B5B6949E6753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705877, "uuid": "389417fb-616a-48ca-9424-a43b21e6ef5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705877, "uuid": "f5884373-8b8f-48b6-ad9c-0d80e4235a03", "value": "12288:4WMChRI3j/05ChWmGUEZMLiCuJtB9PBktqaH:4WMaRLOG7MmCQB9P6tqaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655705877, "uuid": "3404e3e3-f245-4cd7-bd83-9d411836f3b3", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655705877, "uuid": "dbff6583-e5b3-43bc-82ae-7f9ac352f369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655705877, "uuid": "68a8ff9a-cc52-4242-a650-acd26f01acec", "value": "PI21922OLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cf600e-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655722081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722081, "uuid": "53870b13-4206-44a6-8205-7a6add51539f", "comment": "Malware payload (Formbook)", "value": "47b903a3a318033e00bf3f90f1f3d53a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722081, "uuid": "43534d72-5df3-4844-920a-3f6f10a47446", "comment": "Malware payload (Formbook)", "value": "994dd288944c3ad3229fc696132b470fa0a6eaadf9b932cdd317df9313217f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722081, "uuid": "94066a24-36af-4d4d-aec3-2d7798e804ff", "comment": "Malware payload (Formbook)", "value": "6d7e42f20b745ea81f02f161758b36917cfa29ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722081, "uuid": "e5f441f7-25b6-4ca0-aebf-39f56db4b2b4", "comment": "Malware payload (Formbook)", "value": "446e7a1a5fc7979d4e4cec4aae7b2c54c5975c49f289bc458be79e3326927e61b2b9b8ae7bd33d2aaa6b0286551b564a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722081, "uuid": "a6443dea-58c5-4de9-a4a8-94fd1f4e2518", "value": "T1CFB4F114AA7C1777E93D87FC48E2A14493FC7026922BF3A94FD621DE5867B028F50627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722081, "uuid": "1f91743f-eb51-4ee1-b770-61697faf6744", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722081, "uuid": "e95361fa-c474-4a71-9e99-afcf20db679a", "value": "12288:d2iN7pIcMtGvRQ5jCfWA056NwG0tbHuCDw:d13IcMAy5M34HRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722081, "uuid": "b21a0c18-6718-4295-8f44-ba9e4579c808", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722081, "uuid": "bf9df685-fe8f-40f4-b820-4890c254bce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722081, "uuid": "815ba1b0-0008-478f-8397-f2d03e988067", "value": "BG Shipping Co., Limited-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20674701-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655716356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716356, "uuid": "8b30a81d-e7c5-486c-b210-0f0e310524ed", "comment": "Malware payload (Formbook)", "value": "cf74cace78ccf60aaa3f4b341c5d1ed1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716356, "uuid": "8ccea453-943a-4f5b-ac6b-421b42830a66", "comment": "Malware payload (Formbook)", "value": "999d202e33f3aec6f207e15d4c641aef0824db83c4971fa8573d52b800c128e1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716356, "uuid": "f44fd0ca-44ff-4c2f-928e-3b77fc233438", "comment": "Malware payload (Formbook)", "value": "5ff22ec0d46e53e6258594c617e5af7a745a4e11", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716356, "uuid": "7a756a6c-36b6-4fcb-8c57-6072c5e27ee8", "comment": "Malware payload (Formbook)", "value": "b60ccb4f8079f05b862530af60cce7590c9bcac1552c69fd2b7e720295d28c57662eb9e91cdf622521fc92a90cf80cc2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716356, "uuid": "02221dd9-0276-4e99-bec5-bb1e1bf27bc3", "value": "T14E63DF4E92D1841CD911A2BF9E26E908CB583E67DC401BE95C5E7533C3324B20EF77A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716356, "uuid": "a806a382-0506-429a-82cc-1cf54d58002e", "value": "1536:56DflMPf4j/Ug1B95cTNK3uW7y+oIIF5fn7ARUbF4XCYgrdHBYh:5ufaPA/BoAu6SBnYUbF4X7idHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716356, "uuid": "d4a0ba78-4144-4b67-a2cf-c2e5fb861140", "value": 73240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716356, "uuid": "2d131c04-3bc6-4897-a4f9-52b687e7eddf", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716356, "uuid": "11a6169e-2328-4922-a6fd-08ef24b81ee7", "value": "Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7424e19e-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733677, "uuid": "a0b1ecb8-5ebd-42d8-a44d-cdd434407f17", "comment": "Malware payload (Formbook)", "value": "6eb8a4a501c63567e97532a62d5d6cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733677, "uuid": "126ddcb5-a722-4e42-a355-b947bd311d64", "comment": "Malware payload (Formbook)", "value": "9b3f9e2aed4eeb2b06bc8a8b968b6b1abea82d96a3f3eebf9440dc4c25047d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733677, "uuid": "0bf14f62-9540-4652-aa2b-8bc7944cc656", "comment": "Malware payload (Formbook)", "value": "7ef400665ecf9f256c880cf1115ccf8d6af8ef1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733677, "uuid": "54bd91d9-4560-47cc-acc3-d80a6f599008", "comment": "Malware payload (Formbook)", "value": "3d8f6f9695ed696c6778c0d68603edde00c9fe67e5b7db1015b900b5b26904e1eec89a478b73db49014259ced7cd8704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733677, "uuid": "bb138dc5-674f-40cf-9f9a-a3c612524aea", "value": "T1E8A45F2CBB025E66FD1EC030454D0B68FFA21F836240B99757CB2BC9874E4F65E95C9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733677, "uuid": "753cfcc7-5c14-4cc4-8f14-9fbc61a124eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733677, "uuid": "f6c3252e-6c8d-4e54-a2ef-6e543a516bdb", "value": "6144:Vhkpgygrq07bytcaVOtgviKOvT8FEBfiw6J/8i6IbASgsHwuZ:VCmN7scYBOwGNAZNVwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733677, "uuid": "0582fc24-3f62-4557-ad16-c6470bcd1725", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733677, "uuid": "78c0c484-c312-48d2-a16e-c071dfb64079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733677, "uuid": "fd75b96d-b662-4dcc-9855-7cd53762d934", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbd2d7a-f0a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655735119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735119, "uuid": "8c128ae8-1f34-4287-bfb2-022308bdc532", "comment": "Malware payload (Heodo)", "value": "0b914a7f2bed7bde0f2bb41d6a66c40f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735119, "uuid": "4036789e-fb39-4e5e-afca-c69e7fca5f76", "comment": "Malware payload (Heodo)", "value": "9cac947a780f321b6323a418eedaa939983de49cc256989e8c0e8ca9be3eba18", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735119, "uuid": "30358a42-9323-4871-b6d3-be5d0be2a21d", "comment": "Malware payload (Heodo)", "value": "ca72ff4cb440a92f3337c521b883652ad48623cb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735119, "uuid": "48e2d04e-bd0c-4eab-bbcf-8f90ea3480c9", "comment": "Malware payload (Heodo)", "value": "31855daf804746905323eeab7fd0b9b5d69e56e8f5fb90190e0b5761cdecd540bde1fd0d6f9414dfa3593ef8c578e878", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735119, "uuid": "72822c79-b65c-40f3-b866-814d90bc348f", "value": "T1F2948CCD33D343A8F96FDA38C9274672F935FC094320660E03A76269EE2F355952961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735119, "uuid": "ed4c86b1-10be-4e74-baff-a77407292f40", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735119, "uuid": "52e50c36-0952-462d-bde3-b4d1bbbb9530", "value": "6144:9B1DTNJh/8WsVr6ql3n/xSQEN3pFG7xScw/SLFpnU0ScKiEfzl:9vpyjA3WHxFNal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655735119, "uuid": "7ef9a118-ea51-4bff-af46-1bebe99f7337", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655735119, "uuid": "ab50b469-dc58-47d9-bb0c-6c00344227f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735119, "uuid": "711acdca-49b4-440d-8867-eb7ed5cfef2e", "value": "JdNPMDHOEPL71cf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23db15af-f052-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655699612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699612, "uuid": "626f1d09-c67d-44c4-9dac-909fb84ff59f", "comment": "Malware payload (AgentTesla)", "value": "4f845260edf815e8daf5b57d49d528ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699612, "uuid": "214ed70b-f590-466e-822e-894c45b05414", "comment": "Malware payload (AgentTesla)", "value": "9d05b40bccbed4a061b019b15be51cae78d800df6eaa30c04cc6234427cb14f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699612, "uuid": "a36231c2-b47b-4f15-81de-949d808a33f6", "comment": "Malware payload (AgentTesla)", "value": "abb4bd72b02f0b514dd417c3f0c58390972d7f58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699612, "uuid": "d136505c-1a04-4351-b7a6-72f251b9dd1a", "comment": "Malware payload (AgentTesla)", "value": "1ab693ea80e12e1169780c8a3cc232f9ee13d027cad8845493438436981757df2da1e67e49e8329fc9685bd177402ac6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699612, "uuid": "ca1f52d6-02a0-49d9-a71b-47678e7a1d49", "value": "T14714BCF36BD8C9DEDB586234F3421E1703516DEC68D6A23C1FDE7A29C630A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699612, "uuid": "07a60210-92e5-426e-8088-8109d8c5ac3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699612, "uuid": "c44f8e3f-dd25-488a-9caf-211d37ea194d", "value": "768:dTZR1iR/x42Ehp6kELfMaCChd7ntnR+iEiiiX8n8nsMGGTdjt+++Gvx/bb2exNES:J1u/x42WuSdwlOVhhJRYXswGjVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655699612, "uuid": "f50901b9-8f0d-4903-8917-4e8f20cc51bb", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655699612, "uuid": "6d290ca7-41e0-4aa9-aba1-023def34fd36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699612, "uuid": "fad4a8d0-9b80-440e-b59b-6cd023787702", "value": "SecuriteInfo.com.Variant.Strictor.273382.26176.21383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525bd9b9-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655716440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716440, "uuid": "0273a909-9fe2-4bed-9a4e-4c5821c5bb40", "comment": "Malware payload (Loki)", "value": "e78581fa319c649974976ff3e98199af", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716440, "uuid": "d59f2f37-80ff-4f2f-ae1c-50c3e8c1735c", "comment": "Malware payload (Loki)", "value": "9d1f5e44c67d61720095ca4b4effdeef5ccf41ecb42f2c00b4cebc604c80c53e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716440, "uuid": "43f0006e-9c19-451f-aa95-e614f551fc55", "comment": "Malware payload (Loki)", "value": "1684419b2f0835387a2b08b85f45aa0582fe1898", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716440, "uuid": "ed2b99aa-c084-47b2-af96-559bab6e37fe", "comment": "Malware payload (Loki)", "value": "d755d6463a0d153dea85e49bfc3aa502367029ee7e078e52a7a5d802fcba58b142570a4aeff595ad1e073c21b9ececf7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716440, "uuid": "14079812-e0be-4848-ac88-d6221dc91879", "value": "T18463D0886270F94DED34D23B7EBD41E10CD54FBA1A864ED6E40FBEEC58749690E0A352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716440, "uuid": "79f23a5d-a1a7-4bd6-8d7f-c2e1c1297fbc", "value": "1536:VQ01kRAGnD+UaPZJH0+pixLqD7RNMZEmpuVW6g5p4KIkl2:VQ0KyGnCUkJUrqfql5SKIG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716440, "uuid": "34d1b397-d2be-4e5f-a893-3c37685ef269", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716440, "uuid": "d38fc0cd-534e-4811-8f71-5c45d2e2053a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716440, "uuid": "2ab369c4-f2b3-4551-80c1-6f979021acdd", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf898bc-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655716324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716324, "uuid": "a8793df4-6e4e-4c6f-a34e-eff6340848da", "comment": "Malware payload (AveMariaRAT)", "value": "c05194a34faeb51eea77515249534d10", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716324, "uuid": "2cb2dd72-3e72-41f7-99f4-5637aea91528", "comment": "Malware payload (AveMariaRAT)", "value": "9d2aeb602bc3f0bc7b42932f1cd2f511f7c17a107049da2f0a8a563f60c60124", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716324, "uuid": "b1df4596-c40e-49d8-8828-7abd6c34343f", "comment": "Malware payload (AveMariaRAT)", "value": "d24a2549c3bbb23e6b8899831be4d9e9b44c496b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716324, "uuid": "12ea8567-6a63-4059-a55d-1d6e75961e05", "comment": "Malware payload (AveMariaRAT)", "value": "e5141b924a6f78d0e683e8bf7779757017c90f54cebc480db5866f248e7aab55d9dffb8d98d88dab5cfb95512c557b65", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716324, "uuid": "9f0ef94e-fc02-4de7-9a50-a40a7cc9f047", "value": "T12FC50610A3A11107F9F767BA66A5475488FE3C814B6991CF09850EFAF62D6F27C342B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716324, "uuid": "38ecc54e-b805-41e8-8c15-02568e711e2b", "value": "f0de9267aaab548b7fa32bb478277d98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716324, "uuid": "cc5f8fab-6f77-450b-8886-04e0688ffd78", "value": "12288:5dlWu6lY4g1xii6uuit3GAJ6hhIk5mXFfJP/P7Bu7dR+YFD4pa7+ougoC:5vx1LtWvhhIYm1fJP/Dlax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716324, "uuid": "598ac22a-d1ba-4870-ae96-cedcd027e0a2", "value": 2700800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716324, "uuid": "78d1540b-2a55-4c2d-910b-63160df15ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716324, "uuid": "0171b9d3-bcb8-4e3f-bf77-e7730620b741", "value": "New_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b606ceb1-f0f3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655769006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769006, "uuid": "df439aa2-f24b-4ec0-a656-d5916c7e830d", "comment": "Malware payload (Mirai)", "value": "69f5eda8b67c8df4cc3a16b336abd08b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769006, "uuid": "444ed73d-e34b-41af-96a9-6182e9be93a5", "comment": "Malware payload (Mirai)", "value": "9d46f412c8986f27501d46523433104c8010dac8581d9ed1f4412099391d2641", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769006, "uuid": "8d501339-67a9-48d1-bacc-c2d6c3567d1f", "comment": "Malware payload (Mirai)", "value": "96a3733736e81d35f6012081198fd5f40598e5e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769006, "uuid": "16552cbf-ae1f-43f0-9269-f8af57a7ccad", "comment": "Malware payload (Mirai)", "value": "1c47955b4f1aeb5cb8e6ea150a4ffbf3e1c23059b9ea1a5c211bb3b9521f081a17dbac97496c10444bf63bb49e6df7e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769006, "uuid": "54b73b83-7626-4846-b161-9e91fde727d7", "value": "T1DD03E107F7AB8850D3ABA137D86A334B5754DA09C5E880F3EDD0702A5FF889969143F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769006, "uuid": "6149665e-3654-49e5-a690-515a8984ae3b", "value": "768:ko2UTXCvrVnqXSXmRIp+ih+on4lmUkFJV9FGlHTXM1XV8o8tNVQxwBNVnbcuyD7E:ZxCvrVn81Rton4ov9Fci8RtzGwXVnoun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655769006, "uuid": "882f8b4f-ccc8-4bde-9899-22e639005a1b", "value": 38556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655769006, "uuid": "b8ffafcf-1d65-4bbd-a5ad-ef74757d8ded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769006, "uuid": "48b3206e-88fb-4c27-ba6b-6c7a5db7d787", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf808b2-f088-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655723113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723113, "uuid": "d8914c7c-f7f5-4d42-b0e6-fa62927108bf", "comment": "Malware payload (GuLoader)", "value": "f3abc2ac0864acbec0e379d549da2cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723113, "uuid": "2642ee3d-48e9-47ad-a9a8-b8dbc8fc3314", "comment": "Malware payload (GuLoader)", "value": "9e42dc7151b9c2f1cb7c64326abcf866a518262e09602b38372a7bdeb434ed88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723113, "uuid": "3ff582b3-a9b7-4596-b569-ba0c5a31b89c", "comment": "Malware payload (GuLoader)", "value": "34192e7d7bdc1881c2ce6b16861f3ffc434529a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723113, "uuid": "2d35f76d-e64b-42a9-ad01-2ffcb2d4a174", "comment": "Malware payload (GuLoader)", "value": "7580b9d6869d9b1244bb050c194a437e14b31706d0aa98ee61bf2447c233b67870f3b24b5e8525ffb5aa32cf1f6f807d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723113, "uuid": "ef012477-4f02-4711-8618-fd13c6157e13", "value": "T1C744E1A1A298C867FCA2537148379D272577BE2A7CB0871F1369B6247F332C3455AB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723113, "uuid": "e21e42bf-a404-4f14-9dbf-5add285da694", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723113, "uuid": "133dcc49-19c6-4944-bdde-f2e11ae3efd5", "value": "3072:y1NjcVVnLpPuWDXa8jxPCKbZFzH2FGZPk4/QcWo/8Ymexo3pAI:CNeZtaoPTZdW8Zs4Y68gxo6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655723113, "uuid": "90f4a7a9-ae2e-402e-916e-b369c5e1ff83", "value": 264807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655723113, "uuid": "17bae0fe-b7b4-4c4c-8f18-6330b45b6c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723113, "uuid": "cd9dbff4-1bcb-4d88-8e00-4f0d0699d46a", "value": "Price_list_0594_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f626b8-f0b9-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655744048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744048, "uuid": "8e41f966-210f-4a4c-bc8b-3964cef77828", "comment": "Malware payload (AgentTesla)", "value": "8584bfdc17e8112213d515b90b0c66c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744048, "uuid": "b4e5a652-caf6-4aef-a16a-6f93bf765960", "comment": "Malware payload (AgentTesla)", "value": "9e9c2c790cf7f0d6c1cfbfbffe85b5dbe59a1e9da68c44d872b321ffc5914784", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744048, "uuid": "3abf7f31-5f1c-4d1e-80e4-5c779baa3a7e", "comment": "Malware payload (AgentTesla)", "value": "8cdbe6d714fa851ae3b81113b247d54f6020f140", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744048, "uuid": "68248541-268c-4a5a-8f38-f5c4ac9d498f", "comment": "Malware payload (AgentTesla)", "value": "e2fe27b104fba7e3f4e133c35641a13dddb0e317227107069a1fd4e23982ea8292762eb4abcf72f193fa3dbeb614edd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744048, "uuid": "6810aeda-2f3d-48f7-b356-2d0885d575a3", "value": "T1A7B412547B7DE732C1BB43FC85E648A193B06A20A8C3E3149DC461DB9879F948AD1F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744048, "uuid": "12f6600b-bab4-4afc-b1ba-f692f1eb11bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744048, "uuid": "c01033da-0d40-47db-9a3b-5c31d594af8e", "value": "12288:37S7u676xa3XYLmbKaI8wfuK1ywPL5hqySZjiMnxji:38+0qO2ruKrL5wbjige", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744048, "uuid": "a071890a-f1e4-4bd9-b2e3-f1e8b7a20d16", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744048, "uuid": "d7ec86cc-1f57-45e1-a413-62590d8f91a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744048, "uuid": "6ee6e973-8999-4e85-98ff-2210ef098de2", "value": "Ref-PO# 03546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed92b959-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655743329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743329, "uuid": "57254ac6-1fbc-4dbf-b918-3b54b6868d5c", "comment": "Malware payload (AgentTesla)", "value": "3ab85de711cb4c772d55a5a53e8854be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743329, "uuid": "45fa0212-a2dd-4c69-a0d6-c0839b8e1c02", "comment": "Malware payload (AgentTesla)", "value": "9ea559c570260ed51599f8ed5ece24744f4c8230081f9daf3d92876218355c18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743329, "uuid": "b8697c92-32ae-42a1-9a91-79ba1d6efa53", "comment": "Malware payload (AgentTesla)", "value": "ff856c3b6b68b97745f66ea31771c170a8b9cc91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743329, "uuid": "a9a8f413-4171-469a-945e-ac3024fe162f", "comment": "Malware payload (AgentTesla)", "value": "f86f708d4d64d69b176a067badab89c153b9c28a79bc32cdd44d6f5cf2d8412f2fcd601018733729eabad9bc73925e6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743329, "uuid": "aa0e2327-b3b2-4163-8059-97d9f1b65a91", "value": "T1F2C40104B67C9272EA7D8BFC44E2610093F83536911AF7D88FD531DA497BB528781A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743329, "uuid": "e387c4cc-6f8f-4268-8457-a6681a5d8c46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743329, "uuid": "7167c5c5-f99f-4325-84b2-a3e599348cbb", "value": "12288:mi2iNFZhCXa0PzJUQWbdt6zgYHXVgo9L+RVftt:X1jZhz4z+f9Y3GHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743329, "uuid": "5d1b7430-194d-483b-b870-ee2cdfaa4b9d", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743329, "uuid": "59c8b565-4a77-4627-87f3-ec3ecbce3530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743329, "uuid": "6366b7dd-55e5-4619-8a61-04dd66bb746c", "value": "BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5128680-f08a-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655723934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723934, "uuid": "ce7f0a65-60b9-4863-aaca-71f16a8c6a9f", "comment": "Malware payload (SnakeKeylogger)", "value": "bbb2824632b58d0e283766ea8d3933c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723934, "uuid": "11f877ea-f167-4d51-a024-569d0117ef60", "comment": "Malware payload (SnakeKeylogger)", "value": "9ee9ba73a0ca08ea42a59cb79cd831fe9035c5248630535bd6c17e24cf64dc9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723934, "uuid": "ec33f638-7e8e-467e-a886-ed47fb37be2f", "comment": "Malware payload (SnakeKeylogger)", "value": "964c3d0e1d7ba9db81bee615b08a6b91fefde5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723934, "uuid": "7cd6d7ce-e407-4e3a-8096-19b9d14a3ab5", "comment": "Malware payload (SnakeKeylogger)", "value": "dfc033fe6ce4975bbcc46800e557533f35b734d1f21116941c7f6a939853ce75d6e9d52626a6a3525f8300d1b362537c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723934, "uuid": "45f2b0dd-2ce5-4786-b5af-44fe0312d17f", "value": "T1C1A4F104AA7C4762E97DCBFC49E2718053F860269257F3988FC572DA9C7B7028E61637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723934, "uuid": "9d8bb51c-bd35-4522-8271-ff53306ddd64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723934, "uuid": "f1682891-0691-44a0-9b4f-b1a8a2a32873", "value": "6144:wJypy6FEoZOW22MO26o2GhNb3Pk/8ddHRT8sWBLBcsceVDLB/IOr2D9Zs3ddTr6l:6n2iNrtHhG5c4RvTddnXcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655723934, "uuid": "e289a55f-736f-420f-85af-6fe1dd477ac8", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655723934, "uuid": "4ba985ca-25ae-4d89-8c13-db3f528e6b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723934, "uuid": "8310eb44-250d-476e-8d5e-53bac475aa5f", "value": "RALsWOPyzAyXOwM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd91a0b-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1655742602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742602, "uuid": "9c0dd39d-a3e1-45da-b46b-fef101f807e4", "comment": "Malware payload (DarkComet)", "value": "21cb738e372351de0abf0f5bc532ab2c", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742602, "uuid": "c9ed23e8-27f9-48c6-b1d0-70c547970cf8", "comment": "Malware payload (DarkComet)", "value": "9f95c22d51882e238da73706c58c9903b4f8543b8dbc549c8b01f9d3b4210165", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742602, "uuid": "0ebaa521-a707-4002-bd28-e95fb1fdff6b", "comment": "Malware payload (DarkComet)", "value": "af006c081c76f91866f377059db52576478aab82", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742602, "uuid": "902d3ae7-65ff-4999-8ed8-8b20b7fedf49", "comment": "Malware payload (DarkComet)", "value": "d567d777298f2e4964b19e2692942e9639f5c675aaee560eb52374385584808637b703e40535a413f99028005d7f0f73", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742602, "uuid": "8d614de4-79d6-4e48-8c65-de0e92f6ec62", "value": "T16EE48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742602, "uuid": "dfc58260-c83b-4dcb-8695-09cff5149648", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742602, "uuid": "5f72e40f-783d-4bc0-be1d-7ebf45f1c176", "value": "12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hy:aZ1xuVVjfFoynPaVBUR8f+kN10EBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742602, "uuid": "182651b5-ea8e-47f9-ad1a-780ae5b02e1a", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742602, "uuid": "523d06f6-7aa6-4fb9-9c5c-14141b919c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742602, "uuid": "8fa5de65-35e9-471d-b3a2-86f1422a9918", "value": "free amongus no virus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b345587d-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655715314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715314, "uuid": "34f726f8-236f-4407-9061-2eaae24f8ad4", "comment": "Malware payload", "value": "b6dc10bc2a1cbf9dfedc478e640279a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715314, "uuid": "ae3869b9-4bc4-4a8c-985d-7b998ada4317", "comment": "Malware payload", "value": "9fe02b4804309232023467188ead085e750c8fb2f0ea738012fbdc48b672cce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715314, "uuid": "53b815bb-aaa0-4273-878b-0be97ab4939d", "comment": "Malware payload", "value": "607bc876eb94cf03cad8c00bf8a00c87275a99eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715314, "uuid": "d55a15f1-c0a8-4f5d-b2ce-6e750e4a35ab", "comment": "Malware payload", "value": "045f7834615a790127854affc13e93fb030c05594fb6f21bc0a7984016f117e40cc41ddc0bc297aed2312aeea6ed89cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715314, "uuid": "e68d619d-39a3-4fec-8220-7812d09cb4c9", "value": "T1D692F9F0F3544765D96B0FBAACF2B915072AFEDD88206B0C189C749A6DB33420D2E917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715314, "uuid": "d863afb6-adf0-407e-a53c-b8e82e311c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715314, "uuid": "8326f4d2-139f-4a8f-82b1-c6cbda602b92", "value": "384:tpr1fqQuz7ncfrIFzKuMItkS4Jxl9QxiafiJKyW/zl:BiP7cNK4sxiVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715314, "uuid": "fe30aaf2-2f09-468e-b28a-3c900cdb7355", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715314, "uuid": "cac0d406-d6cf-4678-b00c-f0fef31d457f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715314, "uuid": "b465095d-87b4-4fb7-80b9-c94d5b5b528f", "value": "spec_98882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70634ea3-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655722074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722074, "uuid": "3d04dcad-fdcb-4775-8742-e0d35d117fa2", "comment": "Malware payload (Formbook)", "value": "c0d6aba1944e05446c8589d0add13e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722074, "uuid": "5ebb2932-ed83-49af-8ac8-29e7e50476ed", "comment": "Malware payload (Formbook)", "value": "a013267b2dae410a6e166f9faaceebef0324d4b9036531856f10275f30ce41b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722074, "uuid": "1f2df217-8dc6-4d7c-8c30-e168d18fdf0d", "comment": "Malware payload (Formbook)", "value": "804c051f00fecabab909b845ae9def8231572967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722074, "uuid": "c5adf9da-e664-4a6d-9435-a95bf42d84d4", "comment": "Malware payload (Formbook)", "value": "c7e52ceba01ae99ed368317ac75f6f458403455e8f4303b8355df064c458d7c52a532076214cf0dc200aaad92221d8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722074, "uuid": "05b47053-44db-441e-aed5-1dd7b53100f7", "value": "T143B4F105A9B84762E93D8BFC48E2724043FC6523A11BFBA94FD671CB9973F468650723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722074, "uuid": "bfbc1a1e-7295-4f7c-a030-d6f4806efef7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722074, "uuid": "9da00e52-b628-45bc-9753-93bfa1bfa267", "value": "6144:RwRCJqCNsgy5uUsJT1I2GhNb55qrYdWPf0qh7ijeS+KLyPz2/zy1p+HmfF2scoH5:Li2iNWqYO8ysz2vm92scQ4EAtvbYhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722074, "uuid": "0879c7eb-8def-40aa-b62e-03af3473327d", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722074, "uuid": "c154d1a8-f540-4b19-aa4d-711a2a8dddde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722074, "uuid": "4d335a88-3b2e-4f8a-bba7-91bc9fa9c8d7", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be49ac62-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742820, "uuid": "8563912f-2f4b-46ea-89f0-133dc5e71542", "comment": "Malware payload (Mirai)", "value": "816a3444f0b6679e9b77dd09c5a691a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742820, "uuid": "a8c276d7-781d-4cc2-abf5-dfd306cd3b39", "comment": "Malware payload (Mirai)", "value": "a0df7698a3e07915c31a48a573e8ef2794d605d893492e1898de257f665de549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742820, "uuid": "d74f2afc-3f6a-4cd2-b973-c60d4a82b634", "comment": "Malware payload (Mirai)", "value": "24f1007909aa0aadecda81a5ab74335013151ebd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742820, "uuid": "a5f84f81-352c-4026-b77b-38d7a5d28435", "comment": "Malware payload (Mirai)", "value": "4adfa081406546ec1d4e99399d7a826795ac3f13d778d5bbb307c3532e2227f8e1197021a7f421c2bfbaf0a3b3dd2b38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742820, "uuid": "ea6e2f30-88f5-4de9-a354-28bdf3e6a880", "value": "T19C23F166F377FE79C4366B36281E9340F9E1754A9172B27F00F5B1AC88D9E202C54E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742820, "uuid": "274b73b8-ec24-4cb6-8b52-b0b915db49dd", "value": "768:1pwtv56Q2Gvi95V6TUqAbeZLXnvCr+qoCJiQ+QrvOZJK6XPGMTZAGUuox0j1d/i0:pCC5V64qAmwoC5WNPK+1YwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742820, "uuid": "aa866919-2a13-44e2-b3b5-baa76f9911a6", "value": 49004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742820, "uuid": "87ad5499-2b53-46be-91c9-493c03ff6044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742820, "uuid": "046933bd-2078-4dd2-9765-9cdceab0eb45", "value": "KFS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b55f377-f05e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655704832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704832, "uuid": "e2ce941f-d145-4b3e-af01-63746afd6fc3", "comment": "Malware payload (RedLineStealer)", "value": "147c33b49eb4372af5aec953b2ce8223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704832, "uuid": "01f72842-62ea-4260-aae2-9f5b935b10da", "comment": "Malware payload (RedLineStealer)", "value": "a1ead1ab79e9a0e018b587542fcea7c5bad3d23dbbed9001bba431d112f4b148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704832, "uuid": "d899d2b3-b5d1-4f96-bd23-46d0aeefe0f4", "comment": "Malware payload (RedLineStealer)", "value": "47d9ebc3da73b4983019a67118bfada202b6d1df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704832, "uuid": "f906b389-91c3-4703-a00d-d953e376844c", "comment": "Malware payload (RedLineStealer)", "value": "98d87145e3d0de68caa29bb9717d35db82b2d962e0feabbcfa2bdd7b1966affce9cffa725fec0a4672df50a9dffcd049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704832, "uuid": "35249095-e93b-4eeb-a466-693569002db7", "value": "T10884C62CBB4E1A72FD1E91318D060B09BB660F0763C0BAC657DB27CA875F5B66D15C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704832, "uuid": "b3366b44-512d-4205-8ad0-d96d11ba2ddb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704832, "uuid": "58f7c267-9031-4256-8d64-2e430ba202de", "value": "6144:rPzACGeOqe3cS/3c3aGRYKvFgs6+Oli36lClDbDhoJr6F:rP8peOTMS/32aGSKv333GEGr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704832, "uuid": "5eb1dfef-99a8-4eb8-9d7d-aaa384cb752a", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704832, "uuid": "fd107b34-bbb5-4848-b043-b608c2442acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704832, "uuid": "36b4c4ea-5578-4799-b739-1fa8fb6507fa", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fef6f1-f05a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655703100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703100, "uuid": "44894105-ffa1-4229-8ff0-5eceef7c4ce7", "comment": "Malware payload (AgentTesla)", "value": "053fb2edcbed3563aff3fb1442869781", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703100, "uuid": "a71598f7-717e-4206-b5f2-f0a1223144f8", "comment": "Malware payload (AgentTesla)", "value": "a1f7f21b560c3fedcad3383bb36edcd0f61c4a239b01941c370bce9d288160ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703100, "uuid": "019a6ba0-9ca5-40bd-9882-70249e7fffe9", "comment": "Malware payload (AgentTesla)", "value": "688bc41b2a6656efae3c5b027926c5fd0eeeba3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703100, "uuid": "20a5492d-57cc-454c-8950-bbeb2cf969cb", "comment": "Malware payload (AgentTesla)", "value": "099f8be948c41b4ff8a922e4262ce6e9696d9a998430d5aa609547e37bfee9aedae663e8db8f6fff1a4519bf96521039", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703100, "uuid": "f6ca25bd-bd24-4401-b52e-0ada14ab9f8e", "value": "T102154A0327845F24F6FDE33A20B5401943F5F4D3D788DE6EBD9548CC1962AC25BAAB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703100, "uuid": "d6190845-5326-409f-b386-86c475abdbcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703100, "uuid": "3a425a30-dc0d-4fac-aa1c-b7633e675f43", "value": "12288:jRcKcCqSbmCz3xvZX2l5RgKNNTK2xykIf//FL0DQMkw9fpB:FBcCJFIJg8DyFH/DW7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655703100, "uuid": "cf812c2d-2d16-45ab-94dc-e03263521b6a", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655703100, "uuid": "4bca1e59-0a62-45f6-b5e0-fe50ae3df7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703100, "uuid": "3039da9c-c526-4f69-be68-c3d4558bf773", "value": "Stainless Steel Plates Sheets and Coil product inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4786298a-f06d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1655711268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711268, "uuid": "93b4b810-69cc-4d0d-8427-800e3462aa95", "comment": "Malware payload (Mekotio)", "value": "cb6d01a3c203ffacb7b1c3323c1a4b72", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711268, "uuid": "5887f9ac-e7da-424b-be96-ed326539c543", "comment": "Malware payload (Mekotio)", "value": "a23d677c9e5176d2e98b2dae2c72842a854f4cfab658c38b29ef883831287934", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711268, "uuid": "cf7875d7-3bbf-4038-9562-31ab789d7f36", "comment": "Malware payload (Mekotio)", "value": "cd5206f91222a0ff5c6eacfaea1443fa1f737de4", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711268, "uuid": "a465e1c2-261f-46f1-b0a5-672c8d6be00d", "comment": "Malware payload (Mekotio)", "value": "31ba11dcbb771252284fd9fac80fe805b16cd9cfbabc898a56bdd6debaa433e3de4d8a3a975893033195f73f0b52d17e", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711268, "uuid": "16c8143b-c947-445b-b04b-07528dbe6473", "value": "T1CE96338725323E9BC4D529772FD0F9586C44CBA8A061C87FC8263870C7DB59A3672F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711268, "uuid": "1b163bf2-221d-4dc5-85f2-afcfedfa0c38", "value": "196608:tWLTpVrs/z9EgY0OB31E9mo0mazlY2i0JUaSvCiEh:tqvk5abO0maxnu1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655711268, "uuid": "6d1511af-703f-49ba-b842-1a553f3ef805", "value": 8903451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655711268, "uuid": "4ff23191-2d69-43e1-8821-13aa42d40ca2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711268, "uuid": "2988ddbe-c49a-439a-b425-105e700053b4", "value": "a23d677c9e5176d2e98b2dae2c72842a854f4cfab658c38b29ef883831287934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063d141c-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655747236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747236, "uuid": "915e05a3-afb9-42d9-b991-c3c4cd2c1043", "comment": "Malware payload (Heodo)", "value": "7bdcb7759a7417868d6a0b01ccc7cfdf", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747236, "uuid": "c1c422c7-8c94-4393-b225-19a8af41c4ec", "comment": "Malware payload (Heodo)", "value": "a351b507b5e5b2c93e0e322221ffa38e17054db65f94482e0b9097dcbe5dabc5", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747236, "uuid": "7732f7fe-79ed-4327-b6d2-945ea42fae33", "comment": "Malware payload (Heodo)", "value": "3dd6b2e6c0b286fe969d2597ae1b35a013acb373", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747236, "uuid": "bf3d7674-83b5-4907-b33d-42027196b350", "comment": "Malware payload (Heodo)", "value": "75608fd5461fbf7509261dba0100fa74715ff19dedfc2e3e9c41acd9dc24669f604f1e94121bc8314dd16bc2e3fc9901", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747236, "uuid": "3fed7841-fe7e-49ea-b3ca-2f4f5193fd8c", "value": "T1E6B4BF16F6A508B9E063D13489738A45EB737C490B70A6EF279043297F33BE45A3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747236, "uuid": "a491e50a-1a7b-42e1-94ae-f98d3b08327b", "value": "d7a7fb1efd1bd874649adf2d4808fa65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747236, "uuid": "887282ad-56e1-45ba-8eb9-05529cb6954e", "value": "6144:QNVkGC3fpS6vZjKjVEVCtXCuS3GT/ogiX/soLhA/ohZTP2OIrk8k130dvqeWP:hGSBvZjKjVEVeXZ/ogiSor2BDwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747236, "uuid": "ede65b71-ca9e-4539-8cfc-5e724aba623a", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747236, "uuid": "a92617c2-96a8-4923-a52f-f4a15f62e509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747236, "uuid": "8d218b05-99ed-44e5-b6e5-70bdc3f8136f", "value": "9PTTQU1Ylxnn96hB.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c2894b-f0cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655751883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751883, "uuid": "584ac46b-6621-43df-8db1-b2c36f61346d", "comment": "Malware payload (AsyncRAT)", "value": "d708a87a0da3a91bf6204400bad565eb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751883, "uuid": "e6a84591-f613-4fae-8c66-9b1b4851db97", "comment": "Malware payload (AsyncRAT)", "value": "a4321c2b4eb8adac3c4af64bf587f8293090689d719299db85980aa1d6d30f7b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751883, "uuid": "63e3f085-4722-4910-85f9-ffaf4a3bfac3", "comment": "Malware payload (AsyncRAT)", "value": "66289d3529b7d29746646e215763647b36e3f52d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655751883, "uuid": "673d9c18-98d5-42e4-98b5-599bf3bba7f0", "comment": "Malware payload (AsyncRAT)", "value": "06585236c110128311f749247ccc41b2486abad0ce7e8192236c0c9a3deb26c89cb481bdf297be53fa04259e34231100", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751883, "uuid": "adc4b6fe-7331-4d64-8d21-475f9ffb499f", "value": "T1A9231B003BE9C22BF2BE4FB499F26145467AF2632603D54D1CC452DB5613FC68A52AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751883, "uuid": "4033ada6-1776-4bba-8a34-738a93a19092", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751883, "uuid": "f2bebf64-e51c-474c-9e0e-dced0752de6c", "value": "768:2uAHPTgoRzbWUnd9rmo2qr3KjPGagAWOzjbFgX3iH8LauUVGNQPScDZLf+:2uAHPTgG/26KTKTO3bCXSyiGqPVdLf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655751883, "uuid": "fed401fe-5e41-434d-83f8-61a04155b1fe", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655751883, "uuid": "35831402-747e-4914-bbbe-ff29310f8875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655751883, "uuid": "08a83eb9-f288-4373-a3c9-d1024d09aa4e", "value": "AsyncClient.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b77546-f0a3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655734587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734587, "uuid": "3e8c693a-cc8e-439f-9988-42c4782ea34a", "comment": "Malware payload (Formbook)", "value": "3462d2d59e6768bbe9f17f8cef6e00bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734587, "uuid": "e76bdb80-bcf4-4adf-9039-aab370765b0f", "comment": "Malware payload (Formbook)", "value": "a45dd6e68bfa4fadecf3eb1b658e494c3c335b82015256acd2a0e8447c11dc63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734587, "uuid": "d75684f6-69f0-44f2-a3a6-d4525353a3c2", "comment": "Malware payload (Formbook)", "value": "a0d94ed6b99c2e5c76d7dc515d59c7f302f727c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734587, "uuid": "066af309-f4df-4808-8dd7-b0ff7e274aeb", "comment": "Malware payload (Formbook)", "value": "d94e3e30dfefa8d388c42e280ca8299242cf8ade74ea8aaa265ed351058f3f40165f13a8ce586fddfa1bede9dbeea05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734587, "uuid": "58164064-b9b3-4eec-bd9d-5d90c94c81df", "value": "T18F0512139B6A8913D85C57B7E4E10C1C0336771AE062D79E1E902DCF6B05BD68DCABA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734587, "uuid": "0325ddd8-a4ae-4dea-a4c3-9833bf2cda43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734587, "uuid": "8510cc2d-6dc2-44cb-a34f-a48fb4a09dea", "value": "12288:otjK82yg157hrGCYkoFYVsmPfR7RoKHP5SFpzU1UcTG68DcA1p6LahrRxfEtHIyu:ocRdGdkLsmx7FcoPOwcMLCx86yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734587, "uuid": "5b9c68dd-6910-4b92-9aa2-94227d66429c", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734587, "uuid": "b20f4035-cd88-49fb-bec5-f8f43ec2949d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734587, "uuid": "8e4da81b-4821-4fe4-a7db-a2235fea9973", "value": "shipping_document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7f38f8-f077-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1655715870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715870, "uuid": "3f16a26c-8fc5-4a74-a853-7111f1e6502d", "comment": "Malware payload (NetWire)", "value": "01da8ba876eb4038213d8eb6493c9947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715870, "uuid": "3b7fe069-c49c-4774-beac-e81b62724e4b", "comment": "Malware payload (NetWire)", "value": "a4c6f718bffae66def8dc2d48d844bf90632cc708ffdc6363f2aa3021d1a6f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715870, "uuid": "8858796b-2a85-4d11-8d1e-b7b12647b72c", "comment": "Malware payload (NetWire)", "value": "c05eb1a5b5bf52bc05bece7e2bb65e8281828e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715870, "uuid": "e6065302-abd2-4647-9f6c-0bb3af03e69b", "comment": "Malware payload (NetWire)", "value": "c672b1c6cd13f3420f9aac5d4bedbf875fdca536cdae1cb2f80e0cdaf21abe1d2aebfa292f5ad2fb0331aa458bb782d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715870, "uuid": "dad0eea4-edc4-4616-bb6e-fa726af7813e", "value": "T1E6C422432AF86117D9BE42F8007D2284D7B356B6ED92F2EE9CC5D0E69CD3BE00610997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715870, "uuid": "5a46fc83-6833-4b09-b262-3d14e1a996ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715870, "uuid": "45f3c048-d69c-4112-a4a8-83ff6b94f3e1", "value": "12288:cb5BOZlBYf74qRYyoUzuawP8X71DaMcz2ojM/88Vi:cVW6pAUg4Oz2LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715870, "uuid": "f9a29841-d798-43d7-93a5-ad4ade624290", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715870, "uuid": "ad221027-6eb1-4351-8424-ce78a847ee19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715870, "uuid": "20f673cd-f5ed-4dd6-b2b1-80ba0433e0bd", "value": "01da8ba876eb4038213d8eb6493c9947.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1797107-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655715284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715284, "uuid": "fc293e65-0c4f-437b-a893-85dff12b81a0", "comment": "Malware payload", "value": "18eac1e7be627f5167c2342830b5929f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715284, "uuid": "c1459934-85fe-4963-b273-358b8e78da15", "comment": "Malware payload", "value": "a6985a9e647697edb9ee357e3acd3ee9536a36cb9bb61513278f4903cbc7582c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715284, "uuid": "7b7a132d-27e5-4c4c-a7c8-1d169e566c23", "comment": "Malware payload", "value": "fbae775d7b3033a260783645e262b33ea8136d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715284, "uuid": "1dc7252f-1dcc-4442-a427-41536aba34a7", "comment": "Malware payload", "value": "3b6ba3a562fd1fb0d847cd244216accab7956c46b75510c8b48d423047eec99a667a3fe9b1b904226a6291a3e73cfaa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715284, "uuid": "0033a595-0298-4a8f-aa21-86dda4bc9d94", "value": "T12B922A91F7C4C6B6C0A94EB668B277A5073EAE79CC11B95C38C8725F1D333820627A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715284, "uuid": "5a0159b7-a87d-467d-b276-ab8d791f750e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715284, "uuid": "0b1c3e42-597d-4451-9a30-848ac6b2bf48", "value": "384:KLp5M7+ccBIFKKuuEGSti4JFcR4xiZnWWych:f7NXEGz4KbZnLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715284, "uuid": "2a560223-9efe-413e-91ed-1fff3b7a0cc3", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715284, "uuid": "e44d128d-3024-461f-b1b2-7e31fe808301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715284, "uuid": "850867f6-077c-4ff7-b4c5-fcff6b39b016", "value": "SPEC85773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafd27a4-f050-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655698979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698979, "uuid": "4f14f58e-fc10-454b-a3b7-20492eb79a6c", "comment": "Malware payload (GuLoader)", "value": "e1f49c7f80e53dcf4d9447effd3d9532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698979, "uuid": "5b599092-7bb4-492f-981d-d2854038c43e", "comment": "Malware payload (GuLoader)", "value": "a6d664447b129bac7c089e312504422cb38b3e441bd8f226f54f29824685e0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698979, "uuid": "74a05e17-4af2-4cbe-86bf-f4b8413178f5", "comment": "Malware payload (GuLoader)", "value": "e6fbf66db4fda04ff30aaf7f6b41d7e9ac86f3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698979, "uuid": "6387fe01-5575-4a33-b48b-8076bdf1d71d", "comment": "Malware payload (GuLoader)", "value": "b78cddc4032227c8616d71d432c2b8a019dcfdddfec51ee82c8069646883891beaf2705ccd0eb299f84cabd3a7a1a24e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698979, "uuid": "e9fda145-ca40-4578-895b-c51e9d4c24ed", "value": "T1EF44D0A1A3A5C857FCA2137149378D2A25AB7D297CB0960F5359B5A87F332C3181EB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698979, "uuid": "fb16db9b-24b9-441b-a052-a192ebb0d952", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698979, "uuid": "0fd24565-d25c-4e37-b175-43139e2738c3", "value": "3072:y1NjcVVnLpPuWDXa8jxPCKbspD2FPr+/MhszWluhfOqKo3pJHTo4NGAZ:CNeZtaoPTscJr+UGSQliybZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655698979, "uuid": "a65224a3-9d29-4a12-9033-1cd51c484d98", "value": 263149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655698979, "uuid": "82bc9919-6556-4776-a1c3-c2f6973254fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698979, "uuid": "c88b99d2-777a-48ea-b2dc-7cc95db8f7bb", "value": "two_months_salary_reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646269b6-f08e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655725490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725490, "uuid": "f695085f-ee35-49b5-a043-29aa8c747930", "comment": "Malware payload (RedLineStealer)", "value": "b323d8d6dc81377e0cbf869a6dfdea9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725490, "uuid": "4258df0f-b8ff-43ca-8c69-d1171abf5b48", "comment": "Malware payload (RedLineStealer)", "value": "a6da5c90d33a9a4eb16cd7d56af7b300d4acf17ae935d84f7287ceb17fdfb4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725490, "uuid": "d03a1f0c-444f-4dc7-973a-6f2ab1d26d4e", "comment": "Malware payload (RedLineStealer)", "value": "2c6d338551dc326a94f906275a209667779c9202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725490, "uuid": "b7098c47-ad78-4333-86a8-f6a1dd17678a", "comment": "Malware payload (RedLineStealer)", "value": "318ca0adabf45784e20943ffbc7c7bbe39708902b305d167f30adcde04dafa48f501b02effbb2b0ec62b2ad2d304fbb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725490, "uuid": "6ebc184e-d6db-461d-96d1-4ec5a2e68b56", "value": "T1D4933B2873DD6A25E5FE1EB47CB2521903B0E5835C02D79F4FC1B0DA1B62BC19652AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725490, "uuid": "fc71b94f-82e4-4a28-9f01-cd89cc53cfa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725490, "uuid": "94309a98-1153-40a0-9919-794db274d248", "value": "1536:NY+QLppy1l78LaCKWYV/4XYoOTbrUWRtvYPWkKvwSx0XV:9M8l78L84XI/1tvcWkKvaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655725490, "uuid": "792171cb-d5fb-4c96-9591-766b012a48ab", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655725490, "uuid": "9a59a63a-bd81-437d-8a21-2e74e3a0ddbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725490, "uuid": "6953e1a4-d759-4eff-97a9-7ddf7a243ea5", "value": "b323d8d6dc81377e0cbf869a6dfdea9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cd5cc3-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655745276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745276, "uuid": "e5de643f-1e37-4b48-9389-222c0e95c0ef", "comment": "Malware payload (RedLineStealer)", "value": "133a4e44802fe6f8be0f8796ffb2819e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745276, "uuid": "88113482-3c7f-446f-9354-f4ee02ea8fca", "comment": "Malware payload (RedLineStealer)", "value": "a74081d8b2a8e06161f4ef254e75308b60a8a2bb83f45c63b638e3e129ae4bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745276, "uuid": "e51b0b3a-8cef-4435-804e-32ca047f7d92", "comment": "Malware payload (RedLineStealer)", "value": "49aaf0babeccf3c65f5987e3cf249aac67889677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745276, "uuid": "d8a94ab5-9df2-48d6-ab04-b7b2bc9bf67d", "comment": "Malware payload (RedLineStealer)", "value": "b35aee15567ff79102a86da701e6b3b8852053c7d140d8df0cb662890162ac8987acee15cad03952fee8df3cd2eb9e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745276, "uuid": "fbfba0f2-7864-416f-9de1-f9ecab9a33d3", "value": "T1E6C5394D3BB62551E0FD2DBA815469188724B0F71B023B9F3F8A194A5EA3FC5CDCC1A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745276, "uuid": "e6ad1463-383b-4540-9750-ea8984edb32b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745276, "uuid": "59eaff2c-9fc3-4d44-ad6a-70bebec40f0e", "value": "24576:AOHxkTvdX2vsXDq4pe4T0LvNiKwuGB6qs3Ut3zmFIgjoAZYfIYt7s:nHxkT1Gv2DJplT0Lv5wuBV3yrOXZ4z9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745276, "uuid": "f5f2ad43-62c4-4ed1-985d-81a6a65cbcc0", "value": 2625592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745276, "uuid": "8348dbba-ba0c-455a-8cd7-49a0c4b333c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745276, "uuid": "fd47828e-1b3c-4e98-b4cf-90b1ab72f0d9", "value": "1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0027451-f0c8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655750608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750608, "uuid": "3c0203b9-a5f3-4f8f-aeed-d673a4386426", "comment": "Malware payload", "value": "91461680d3dee1eb2e2f7f2bd1aeb9e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750608, "uuid": "9a6b0053-f30b-4f7a-923d-e4e2e888441c", "comment": "Malware payload", "value": "a8173312ff92759d6e013e19dc94141ce11786a3e790d6d12348360ca92c46ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750608, "uuid": "9ab3ce36-85bc-45a4-b215-3c55ee799f97", "comment": "Malware payload", "value": "33f4116ed4cfa1f9ee3a2c2ed142a2c81de555f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655750608, "uuid": "f61bdea8-1e87-4483-bf5f-83bdb0e40fd9", "comment": "Malware payload", "value": "962e1b63b6ecf7518cb6df04d5278f3f13a245dacba6c41892ea32886b782892da30019b5b47e32c1c80eb391a6db6bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750608, "uuid": "5d7c2433-5401-4a0f-9edf-746ef6b407b3", "value": "T1C164D0427ABD2B26DABFD7F5467610804BB1346E6270F5184DCA60EE2876F048E94F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750608, "uuid": "057618b7-2afc-481f-9cbb-57e047e39be5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750608, "uuid": "f1e17305-f401-459b-91fa-30a1c7a20615", "value": "6144:DNSFkenTCwallzysfiinzbLqzAIDwSpj4+obv0CkKJ1:hSFkexcptiIMAq5pM7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655750608, "uuid": "4c74cda0-6b25-452a-b63b-76e75cbab10d", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655750608, "uuid": "d274f9e1-3745-4952-81da-9d9d52519680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655750608, "uuid": "d2738725-eef3-45a6-9340-a7f196982d9a", "value": "SecuriteInfo.com.W32.AIDetectNet.01.16596.28242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb27e81-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742710, "uuid": "a05b58a8-8a60-4295-9060-74fec29743ff", "comment": "Malware payload (Mirai)", "value": "75fa30dc184ef0d4fa3a5dd50f74b10d", "object_relation": "md5", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742710, "uuid": "86b61bc7-c052-4524-887d-5007459395c5", "comment": "Malware payload (Mirai)", "value": "a825331d7939c9b067cefd924611cd1f651ab1a06d505529518cdba6e3a741f2", "object_relation": "sha256", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742710, "uuid": "97cca2ec-6ad9-497d-8a71-ffc6c3ce2d74", "comment": "Malware payload (Mirai)", "value": "4a201bff4c32d83c30ebcfe01a1c69b2e2aec6d2", "object_relation": "sha1", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742710, "uuid": "6fc4c6ba-2034-4c4c-8f7c-718df845119c", "comment": "Malware payload (Mirai)", "value": "2d5eb6ccf7c9e6e749ab7e7ada7a78e1b698decd56a5ce79169e9cce146ca9a4d51404de466de31905a1f6ddc2aa366e", "object_relation": "sha3-384", "Tag": [ { "name": "arm4", "colour": "#2C10A5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742710, "uuid": "585b28a2-ab88-4693-af3d-1b9aac6680f8", "value": "T13723F1B088CFF7528B9214339B2A8AEF715353DC95FA41B57742100C87FA4A910F9AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742710, "uuid": "1d6ee810-0a59-48d8-beb1-c4acea7efab0", "value": "768:ZtZjGL56gC5bA3YgwSY9QUe1NYnjZcPk5SC2xs3UozJ9G++WHlwBQ9Z5THQy+:ZfGL56/GhI1eHYnjOc5SCLzTGcAQ9Z5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742710, "uuid": "5418bdc8-d0a0-4ff0-b449-6abac5022db5", "value": 48828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742710, "uuid": "40e406b6-5c6b-4592-a73e-d6be1e3c6cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742710, "uuid": "5198db4d-5ab6-414a-a1f7-31ee66bf6fc8", "value": "KFS.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b50ff19-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655725770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725770, "uuid": "dc6d7bfc-36e1-430b-bf5c-4d55348295d0", "comment": "Malware payload (AgentTesla)", "value": "9f9790a81b2b22e8af1552f1d79e3f35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725770, "uuid": "3975f094-5f6d-4e58-872e-3fb6c0d7ea7e", "comment": "Malware payload (AgentTesla)", "value": "a86748c09f53015f0abf6ce8cc50bf5752e8e2bf83517523968a73ff5f26b786", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725770, "uuid": "5e7c8689-4ec1-480d-82cc-e5a687cfbd64", "comment": "Malware payload (AgentTesla)", "value": "a4de75252d9e520f916fe2489a381d0c0ec8fb23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725770, "uuid": "9cb58a27-2675-4d60-8a44-1d8c089db705", "comment": "Malware payload (AgentTesla)", "value": "ab215581946c45a02b347e26d5c0b9ea79adbef8c48a60cc6ede21bb91b564377f2662b9bbe07e2fc6bd886ceef1870d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725770, "uuid": "df21c248-8a2f-41da-a0b9-54fe536bf920", "value": "T18DA42343B37F8AE716081742EE244076993985997C7FE967D780B0BF0815AF86E603CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725770, "uuid": "246bd46f-3116-4b51-97a1-3c82c2076eb2", "value": "6144:qlrJcyIsTs3/S3Cw2Y0rKCM818XdN/13OaJZG4jko1UJ8HctOxAW92QgoKy9+2OZ:qlNcBq3CHY0/M8a/1LrbKogjy9+2WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655725770, "uuid": "cd25ecbc-b6aa-4932-bac5-d6ebbe3bb05f", "value": 463502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655725770, "uuid": "bae7a33b-460a-41f2-8e63-447a31edd1f3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725770, "uuid": "1a2e5144-d8fd-4557-9700-e45a65bfe6f6", "value": "Bank details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6082e67c-f0ae-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655739227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739227, "uuid": "c619901c-919c-4fee-98da-138a90db6cf0", "comment": "Malware payload", "value": "52771388d04addd56af7b5daa764949f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739227, "uuid": "7246277e-82d6-4745-b6fe-a79cfc2e815c", "comment": "Malware payload", "value": "a92e99269c46efa7ed8a3f3a3b88114e5b00dc071d3dc683f4dd987a8edbd057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739227, "uuid": "d0d0f188-939a-41db-8d70-ab623e4ab70d", "comment": "Malware payload", "value": "119404440638a60c4d758a36d77c70bdb8d9db28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739227, "uuid": "20d1b970-5b11-420b-a671-2a9016fd0d6a", "comment": "Malware payload", "value": "b5af1e7e6b918945df93d18fc0df0b49279d1cfb5d165b17139d4726ac0f208aae447f578b175ae7215e9e335ff08e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739227, "uuid": "dcc1432b-ee06-4e7d-927c-c7f74140b444", "value": "T190448D5F67A88AF2C426113198CF9B374BB1BC71467143A3BB61FE9A5E334149D0B31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739227, "uuid": "9e6245f9-1010-47ed-8db3-6df10cdaf486", "value": "ef2b26c857544f525aeda2ffe7cb323c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739227, "uuid": "9a2b3bbd-6dbc-40d6-b718-6f64092e753d", "value": "3072:vbh9GwujpLpheQDbfgAeqBlscKEuq6rL8DkOFUd/9iR1BhK+gQP1or:D3Gwu1njgAvsc3uvU5FUdwrhK+xP1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655739227, "uuid": "5799ff33-8f94-4b51-9c2c-b4022913bf1f", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655739227, "uuid": "e569564d-09d8-4fdc-9dfe-805b7e067011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739227, "uuid": "bfad6c49-480a-4272-b1e5-f9510be21b3b", "value": "SecuriteInfo.com.W32.AIDetect.malware2.8254.10011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02572267-f095-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655728332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728332, "uuid": "3bc0e760-fe3a-4943-9c80-7b5ba582c322", "comment": "Malware payload (AveMariaRAT)", "value": "99350ea5961ad528cc89d82a6be6f6ec", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728332, "uuid": "275a598f-dc95-479a-8d5e-fe951d60684e", "comment": "Malware payload (AveMariaRAT)", "value": "a9487ee3841ff8938bf5adcecec0c9afb1ababeea0d63c5f8705a1f05d5a1e0a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728332, "uuid": "3559ec19-4869-418d-ac2a-84c43481713d", "comment": "Malware payload (AveMariaRAT)", "value": "78991371a58779eeb836499bb40ada9416cdef3f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728332, "uuid": "e6ea9935-e6e6-4db0-bc4c-3346595ed27b", "comment": "Malware payload (AveMariaRAT)", "value": "5db48975dda51c0ca54a4f593d1349d021a34414691bda3e6f3d859c474f1913665645106aa61c9765808998684335a8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728332, "uuid": "98f04d78-cf4a-4d3a-84cf-6565bf7323b4", "value": "T1BDB23B537796D27EC8BD47B69C73D2541AB17D9ED4A24E0C7CC9B10A2E33321068A72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728332, "uuid": "ae543814-bf98-4a06-8344-2df5c8c90ae4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728332, "uuid": "81e27a82-61cb-4918-8677-320be052d2bd", "value": "384:8l+IRGc3AIwvKguGtcl2M++MsQ4iknZm5s8sElO3O:SVFHc7JdrwUs8sSOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728332, "uuid": "e9572f72-b72f-44ad-b30c-b8501d40e172", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728332, "uuid": "22db6711-e012-431d-9a46-e9c2d01512a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728332, "uuid": "f059250f-8a13-4654-abdb-3c7c4e714ab8", "value": "SecuriteInfo.com.Trojan.Siggen18.10395.7154.17046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0794e24e-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655709872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709872, "uuid": "e251d8f5-8669-4603-8eaa-4ef49b744e10", "comment": "Malware payload (RedLineStealer)", "value": "6e084e7a47c34459b1d263ce416cf78d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709872, "uuid": "f601766e-fe14-45bf-a69d-4cd2ad95e1db", "comment": "Malware payload (RedLineStealer)", "value": "a990bb85047985e317981d4889f9198173be6f941b7aebd8ff72a5935f851790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709872, "uuid": "190afa88-b61d-4ab1-8815-3a736cba9dec", "comment": "Malware payload (RedLineStealer)", "value": "3758ad17edf4f499fc5b8afdb9fa498aba19c339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709872, "uuid": "ec3623d6-f0c8-42f3-a247-7768c3643de5", "comment": "Malware payload (RedLineStealer)", "value": "a4da5b8ec02e948b1723821386d85412f8bcab16383e440152750f5e749d9ce1adf1c7d470512f044bd117d0b0f29aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709872, "uuid": "b81e7eeb-6067-4c6d-b2d9-581921771222", "value": "T13CC4812DBB4E5A72FD0D903489554B08BB6A0F1363C5B9C663DB23C6976F9B62E04CC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709872, "uuid": "39da21a0-7a01-4cde-92b6-56219c8a578c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709872, "uuid": "a74e2bca-459c-4b53-b5a6-0dc3ec13a8e5", "value": "12288:Yuq9fidOb4d7aNATuW0QkhFfJo1mJxRHHE6mRsc9gC8NLhPtD6IA1:YTbo+NVbhFfJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709872, "uuid": "3c51455f-d5f3-4ed8-910e-8672730b2d8d", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709872, "uuid": "38e93e15-1f96-4a61-9d79-c43232caf9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709872, "uuid": "b83669e3-82a9-45d3-adb0-ee9e27150720", "value": "RFQ #061622-ABU DHABI METALS LLC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7148a4c-f0a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655735077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735077, "uuid": "8892c9e9-d45f-46a2-8220-910203b9ae41", "comment": "Malware payload (Heodo)", "value": "f5e246a902b6089a6151e392f2015aee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735077, "uuid": "1deaefa2-9a28-4142-a7de-7dece7e4ee82", "comment": "Malware payload (Heodo)", "value": "a9f3894a81067feeabc63cb2139c61cba1843b1ed362887ba5febfcce2029ab2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735077, "uuid": "9069e1e2-d26d-4430-9dbf-f2236990e172", "comment": "Malware payload (Heodo)", "value": "009771f67586df6c5fa5d0238e5544f2079c5254", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735077, "uuid": "021a9741-49b7-4977-9933-e2c9f485d395", "comment": "Malware payload (Heodo)", "value": "d860952bc6ea67d29f9cc75d1ff6e22bdf425eebaf6104a74bf2fa160e2a3f3d8288758ca504f52d42b32925fa44499f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw 9079", "colour": "#99F830", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735077, "uuid": "4a19e82b-f886-4b09-9c53-92cdc5d64702", "value": "T1DD948BCD33D343A8F96FDA38C9274672F935FC094320660E03A76269EE2F355952961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735077, "uuid": "3f70a82c-6b7e-4255-aab8-a744785a371a", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735077, "uuid": "08e08b40-9243-4dff-ac9c-d7adf21b6121", "value": "6144:9B1DTNJh/8WsVr6ql3c/xSQEN3pFG7xScw/SLFpnU0ScKiEfzl:9vpycA3WHxFNal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655735077, "uuid": "a4b2a3a7-0905-41e6-b39d-295da235e037", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655735077, "uuid": "c97f95d7-3151-471d-85f2-5aaa913e3631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735077, "uuid": "76f039ff-9e36-4575-9061-85859c2f273e", "value": "ijHbzVa2EIv7f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ef8259-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655704361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704361, "uuid": "52ccf23a-849c-4355-b4a8-6018a982af53", "comment": "Malware payload (AgentTesla)", "value": "8176a72a82af87a951d57364d2153a0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704361, "uuid": "5de83b62-ad3d-460b-9583-e38b88d2737d", "comment": "Malware payload (AgentTesla)", "value": "aa14c635dffd2ac6201bfc8bbdccd084ffcacd96f2eeb237c1a42b99cd79fd7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704361, "uuid": "cff00f00-54ce-4ab7-ad9d-6802cf32a41f", "comment": "Malware payload (AgentTesla)", "value": "797f6cc26fb12603360e23ac494aae8f8ed75e0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704361, "uuid": "4d9c2cd4-2d05-4898-ba38-f738a07d6e0c", "comment": "Malware payload (AgentTesla)", "value": "9ebdea2c6d47a66a64c4db36e33f1a19ba2b3e17de5862f2988976fb4a96e0b507f161f02c362e804c5bebc5dc5ae3a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704361, "uuid": "fb69cddb-dd3b-495c-9898-6adc92352008", "value": "T17315390227C46F54E47AF33A2175940813F6B9D7D750EFAEBD1668CD2033A819BA2B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704361, "uuid": "0b6571e8-53c6-4d97-a55f-51d92329b562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704361, "uuid": "3f3b0941-f92c-4e2c-a3b2-a26122b5e5c9", "value": "12288:OvifW4s1rvsxXuOsd0wj3fM1r46YCgWbNmY+0tO9STF5SxDuZjqmzN:eifWb1jcEjur7gWZ+0U4TF5StuZjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704361, "uuid": "3ac5aab3-fe69-4a56-acac-4bf0a0b97eec", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704361, "uuid": "dd88f766-bfdf-4718-beb7-ec5c9b3b1642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704361, "uuid": "aadb7cf0-5dae-425f-b0d3-980db4cf5e40", "value": "DATA SHEET.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18072508-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655716342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716342, "uuid": "e260f7c4-620b-4826-a9e8-baf875e6e681", "comment": "Malware payload (GuLoader)", "value": "dd880a810ecdfad83988869912fd72bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716342, "uuid": "e2b0275a-32b0-4113-9c53-6dee893cdc30", "comment": "Malware payload (GuLoader)", "value": "aab216cbdace67827d9dbd5a2c9412159395d1ec8d6b42f23c9b01a93fce68f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716342, "uuid": "3f6423ca-3c4d-486a-9787-971f08c47af8", "comment": "Malware payload (GuLoader)", "value": "aed6e0d4bc286927acc4dc992b8502a82f51e000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716342, "uuid": "81b46d7a-320f-4bed-8b6f-19389f04a4b9", "comment": "Malware payload (GuLoader)", "value": "0bb92b1eba4022620bcd5e173c8c218f17e7e432ffc8fd0076478da0a15a712d2bd5550e5f21799c42e9b9354a0b12b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716342, "uuid": "26a80319-aab7-466c-9dd2-bfc89e92dd6c", "value": "T18C24D0247B94D81BC86A06728179D73526F0EE043454AA0733F07F5BBD276B1991B3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716342, "uuid": "bbf43f2f-f16b-48ce-b22d-de6eee259793", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716342, "uuid": "d7daaec5-af00-4f9e-b8b1-3013d6025df9", "value": "6144:oYa6nsvlxsB+yV9+939ETwtOHibi3FFad:oY+8BI936T6OCbi3Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716342, "uuid": "62ce6969-d464-40f1-a463-3a0618dfa7c5", "value": 229081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716342, "uuid": "2f26a1d5-268f-4c4f-9f8a-686f16f03258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716342, "uuid": "8fc2cfda-623d-4376-b503-0c2f30f3b1eb", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f45345-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655745390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745390, "uuid": "b2c54fff-878d-4f55-84bc-3c69c3bff71c", "comment": "Malware payload", "value": "e7cf029a03cdea32cd9eee3dfeab1e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745390, "uuid": "21a4e66e-f823-44e5-bed0-6939b707bb16", "comment": "Malware payload", "value": "ac3b32a95de5abf9c4e23a6f0f30691ff8e28c3e6a49b4a8c921c91da617c818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745390, "uuid": "14e6e9a0-2b2d-4e34-86ef-34cab336e5dc", "comment": "Malware payload", "value": "f281fcffe6c39fe9b549056c158f08b5739743d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745390, "uuid": "40fb6533-0c23-4222-8fcf-c5a66541006a", "comment": "Malware payload", "value": "4f72b93b0273f29d065523c8ce0f0494014b4c392c1342dd8a61c14f1397a4109a57afb55cbe2320d8d7571582606407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745390, "uuid": "192c028a-8141-4639-87e5-a2f0ad98e350", "value": "T12DE63330336CC589F9CC0431A06B913A4B95BF6AFD61C70D3A7922917DF07A9464A7EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745390, "uuid": "b66f15b5-1464-4777-90b4-9b6a879d9849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745390, "uuid": "f18cb9a1-441b-4772-9c29-30925cf227ec", "value": "393216:7LkyCp7kk/SmZd+PQBEH/jVK1MRfngl/ieTDjC:7Lr04k/SDQ+H/jWuglZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745390, "uuid": "585e1587-3f23-44e2-a2c5-26c4d4122721", "value": 14218240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745390, "uuid": "ff398fa7-3215-4c0c-8e17-9b2d4eb42127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745390, "uuid": "255a4ae1-22e3-4b60-987d-b500872ee732", "value": "SandeLLo Checker.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3b1496-f0db-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655758683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655758683, "uuid": "244ae206-eaf8-4407-a573-5870392406f9", "comment": "Malware payload (Loki)", "value": "427eea96bf87dd434b680897dd9ce2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655758683, "uuid": "7f9d330c-b7ee-4e42-88a9-18c3db09d14c", "comment": "Malware payload (Loki)", "value": "ac64348c4bd4596613d633157c3cc758283166e5ccccf6685b22a202b85bf8bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655758683, "uuid": "3ee0103b-a278-44d1-9fe9-4256467419ad", "comment": "Malware payload (Loki)", "value": "0779f4391fc2b8fcefd815f2b58636c29128ef26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655758683, "uuid": "2a1d90b4-10bf-4945-b8be-a714a020bf51", "comment": "Malware payload (Loki)", "value": "bc278b5d615ccf2796953d9c1d031e58a5819a474d17efed7e1c1fce8f215cac90b588b13ea6a80ee5b8cbeb53c8fc8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655758683, "uuid": "e43b8f53-0056-48c1-8481-629ce775872d", "value": "T17772E955BB88C231C4F94975DC2267F40231EFA8D841A75714ECBE4F7AB32834B216AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655758683, "uuid": "18ca38ca-3f81-4f8b-95e5-8c3ba23fe07a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655758683, "uuid": "b92656d9-e973-4750-ab81-87284db80a09", "value": "384:/TNI9RATqPu29E47Z0PxPj6+DOSxFv5JQzK7X9j:rETF7Z2PlTJQzKD9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655758683, "uuid": "fac4546e-56e3-4417-88f0-c59f65c84860", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655758683, "uuid": "d4bea091-4fcd-4101-8eff-57c980e7eedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655758683, "uuid": "a6b0c694-c6b2-409b-9b7a-ed866c2046e3", "value": "Ntjvbvus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb031ce-f0ae-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655739331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739331, "uuid": "4d6dba38-b76c-44d5-82d5-0f29c33ff3e7", "comment": "Malware payload (Formbook)", "value": "ac749dae9f51ec9986e8e115b5f7d078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739331, "uuid": "c940b615-d3f1-4aed-be93-3982ec8141f0", "comment": "Malware payload (Formbook)", "value": "ace902b61398f94cdecc6133a111ccf4197c08a12f37fd98e90bd29bb714c827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739331, "uuid": "fd0443c3-2755-4857-8699-8dc281a5d122", "comment": "Malware payload (Formbook)", "value": "b45477ec5fa6e160ca226c86428368d0c37315a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739331, "uuid": "1e07d733-0808-489d-9fc5-a9e0b9ada634", "comment": "Malware payload (Formbook)", "value": "a79c8be5c8806ba508142523431478bc5695d57b74528e440ed38caeea3d1f05d59cc66a5e3906f3edde09f9a76a4bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739331, "uuid": "c4ce47ec-ec87-4150-a565-d1f6225b9efc", "value": "T10013BF27639F4A31E7659F7EA863D7400B78A466CC32D60FB08032B66D13F61CA75725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739331, "uuid": "1fb747d1-8406-4ce0-b1da-8b3143162f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739331, "uuid": "5ec72314-2378-4953-8951-bf205cb942f9", "value": "768:6AYPmhtpXuhIEQ/f+I49Nf7oSFYwQjXvLWRgcL0ST8iNxy2K:6xY/+PQ/f+Pf97QWRgcL9HNxvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655739331, "uuid": "b44f814b-0e7d-4c27-a42b-f9d1c6879054", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655739331, "uuid": "e238da10-f2ad-4df4-aad3-3d2a1ecfbb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739331, "uuid": "b0124727-e999-4540-8a49-66178287a6c3", "value": "coc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d63678-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "2e86b081-466a-47dc-a367-0686d1ddce50", "comment": "Malware payload (Mirai)", "value": "b19b0f2880695abda7e87cc9740c417f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "86f94c34-ca11-469b-b717-2443a8246822", "comment": "Malware payload (Mirai)", "value": "ae5983e7701bd4dfb24a5d4cba98dd7ba78c9a42deb52246883f00b8481b9230", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "5eebdace-d431-483e-b2a2-4a99289e8144", "comment": "Malware payload (Mirai)", "value": "3e9dbb90f3374201e2e9ae5ecc2910eacf04e8bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761805, "uuid": "aea6f75a-e4bd-4c16-8638-ee4208ecfa71", "comment": "Malware payload (Mirai)", "value": "dc4dcba088242d5a287315d747671bcf82d21ee316ea537d4e59d31156c4f1dc9ca294706278b17410faf7b5183e8b2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "69a868b5-5073-4abc-97b3-4b529e83fa87", "value": "T103F2F1A6D79DE740F5AE83396DBFE22E544E052C809D8B7CC6C8250E71EAE0D67291D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "e5e10412-39c9-45db-9223-0c6272876106", "value": "768:28ElvTpUgoRSpQ7mMxT95v89bDCtplYJ0StpMPFDui6qYuXnbcuyD7UrQRjK:28El7mR0Q7mMxTrvQbDW0GqmFDN6Cnou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761805, "uuid": "bf266f0f-2080-406b-a96d-3d5b7e3c3dc5", "value": 35212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761805, "uuid": "5cfb14bf-616d-4cc7-a292-c192d04d5f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761805, "uuid": "84ccdb14-9738-49c5-a6cc-88f3b29e394a", "value": "x86-20220620-2150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c66de3a-f07e-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobianRAT)", "timestamp": 1655718524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718524, "uuid": "21a4d7a5-b6d8-42c4-b0ce-d1bc8d90f20d", "comment": "Malware payload (CobianRAT)", "value": "f5d49a63a23cf728b6844c42fe722864", "object_relation": "md5", "Tag": [ { "name": "CobianRAT", "colour": "#BF31FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718524, "uuid": "3715985e-600c-4256-9ae1-dd4ee8775a8a", "comment": "Malware payload (CobianRAT)", "value": "b00122b7e50a792aad9dac787fa5bca390f1bdc702c6df2574891d20794c5e63", "object_relation": "sha256", "Tag": [ { "name": "CobianRAT", "colour": "#BF31FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718524, "uuid": "56dc0ea8-65e1-4c92-83a3-e3d42ed0b7a2", "comment": "Malware payload (CobianRAT)", "value": "dfb47a843622afe9ae2ab15ad7f8c48296c2508b", "object_relation": "sha1", "Tag": [ { "name": "CobianRAT", "colour": "#BF31FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718524, "uuid": "4df89c32-76f4-43e5-b9d5-f6e632fbedbd", "comment": "Malware payload (CobianRAT)", "value": "be0ed24f603100e08925991a0744a9b10732853ab48e93b7981bd5f02f034433a5637e1f7d7164b7b19fc2d8c089831c", "object_relation": "sha3-384", "Tag": [ { "name": "CobianRAT", "colour": "#BF31FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718524, "uuid": "782a4887-b5ef-43f2-a751-63fd07fad772", "value": "T159A4125CBB0B0A72ED5D9071890A3B04ABE63E0367C0B9D157BA36CAD77F1B56D0D884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718524, "uuid": "ee7083d6-6e80-4e9d-a404-5d89708165a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718524, "uuid": "a7cbc231-0765-4a1c-884f-67579e596860", "value": "3072:GpfJVR1RhapAOjQ7kHaSdYPJva06EF84w8//spjsLJhuSeo8OZUiTcDzZZQ3uFYd:2hfMpqQHaD6CMJsXDSDLYAbayGdUwbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655718524, "uuid": "17cf33bc-b613-464b-8193-60ec670174ef", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655718524, "uuid": "7c4477a3-6426-4361-b734-51b9a3bc731c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718524, "uuid": "c3150503-2620-44a4-8a37-5399fee4c7fb", "value": "SecuriteInfo.com.W32.AIDetectNet.01.11584.16458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202cd9c0-f07f-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655718933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718933, "uuid": "960efc2d-5816-43d0-a8f3-1a58313a1a31", "comment": "Malware payload (NanoCore)", "value": "0c1ec0f49513819ecaac427dacdc11d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zp", "colour": "#82AA7D", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718933, "uuid": "67144ce5-0ce1-4e8d-8c5a-fc48f7f7cb05", "comment": "Malware payload (NanoCore)", "value": "b0a7fec34ce8a790e943f4db15e7fe4bef3fdd36b43064b3b01d85ad4601c5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zp", "colour": "#82AA7D", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718933, "uuid": "a51ff6de-877e-4e72-a4cc-5f56b1b7992b", "comment": "Malware payload (NanoCore)", "value": "e52099fe3f8f6122c11b09b715d3f110cf0c3e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zp", "colour": "#82AA7D", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718933, "uuid": "cb01a9a6-3c67-48c2-ad6c-91cad4c131f0", "comment": "Malware payload (NanoCore)", "value": "e573b986ce37012b50ff8b3f0610ff3a764c991baa9b9d331674c0c56269dfee10d30705bd6e45c664edcf637a963fdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zp", "colour": "#82AA7D", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718933, "uuid": "a060b77e-09c1-4985-862d-dd227e3fcf21", "value": "T12F14CF563BE9492FE2DF8A79611201529378C2E3ACC3F3EE58D850B64F663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718933, "uuid": "f902dc87-2a22-492e-80be-83f27f1e1747", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718933, "uuid": "5ac9c592-1829-432b-8f9f-89775c027cb2", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIfFm+mDiZbVGcx7tAqMmKR:wLV6Bta6dtJmakIM5SmzE9djm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655718933, "uuid": "657dcf61-28df-4b15-ba05-0393fa5497b6", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655718933, "uuid": "170d10df-9069-472b-bffc-7f6de79aa705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718933, "uuid": "70052500-cb1c-4dbb-9e22-cf556aac93da", "value": "Zula Ulti ZP Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae16eaae-f049-11ec-93bb-42010a9c0043", "comment": "Malware payload (Kutaki)", "timestamp": 1655695978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695978, "uuid": "11c5c5c8-8c08-42f7-8c05-de4442eaaa68", "comment": "Malware payload (Kutaki)", "value": "4c5fcb8c248337612968ed1ea3715516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695978, "uuid": "80969fda-7621-4402-967e-3b4983077b8f", "comment": "Malware payload (Kutaki)", "value": "b12fa782c5a1e950d3a2a2ae57bb843c56efe1994f25a02fd088f312ea8523bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695978, "uuid": "905f4f0d-ebd0-4306-aec5-29a28f6a8e36", "comment": "Malware payload (Kutaki)", "value": "472373a2d24b5bc9eacaf9f094e8ff995aef4028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695978, "uuid": "fc287dec-111f-4f38-8992-397a8912dcaf", "comment": "Malware payload (Kutaki)", "value": "e0eaed69cb6248c65afef021dbb574f06928b292a5111cf4898f6d3808189c69efe6ddaf99473a395e68278c6cb26d88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695978, "uuid": "387a821a-227d-49f3-8dcd-9e8d919b84d3", "value": "T1AF35121BFF828A62DCAD26712E9742F45223FC591B974A8F3A40A27C3865F815C7075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695978, "uuid": "4c5c4ccc-bf7a-4524-ad6b-c6be8d3be2f7", "value": "f22edd41a8fa1aa8e687890bccb23634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695978, "uuid": "8c31f815-83ca-4f9f-a684-465e14088096", "value": "24576:PCzue46D5tKERWpnhNjQlUPnGYI5aDM1TfmP/UDMS08Ckn3f:Pcx46lgEshNjQmuYMaoRfmP/SA8Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655695978, "uuid": "09c888cc-0cd5-4105-a5f9-a1ed307abcb2", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655695978, "uuid": "d7bc8457-bae7-4edc-92fc-e9a2a852096a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695978, "uuid": "dcd68ce4-a3b6-45c0-910e-95f576e14441", "value": "SecuriteInfo.com.Variant.Symmi.62789.8540.1961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e061cb-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655726133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726133, "uuid": "44f8b60e-a77b-42e5-ae47-62fd4911fa4b", "comment": "Malware payload (Formbook)", "value": "9d778dc50d81e2c0a3c284dfe72e2fd9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726133, "uuid": "fa046d44-4c46-4b50-925e-af015bab3401", "comment": "Malware payload (Formbook)", "value": "b146c3eb39648455f01435b2bf44f022d07018d4224ed891eaff56a2c2ad3d48", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726133, "uuid": "3e9dbb49-6539-4b27-9892-30fdeb4d3b1c", "comment": "Malware payload (Formbook)", "value": "18a4e50e42a4a0f78445208b0dcccd2ee70c7727", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726133, "uuid": "da7f9982-2960-4d4c-bb0b-bd270cd82d2e", "comment": "Malware payload (Formbook)", "value": "af4b938abbf03ee550862ed2aeb60728736057a64ff570fedf1d1d7b42a8396dd155e0303eea95122d8d4ea6f6573aa3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726133, "uuid": "ae9a3f4f-a2ff-4b0e-805e-9db8566f2c97", "value": "T176A423E5A377B41DAF76A4E352778730B261794ADF5F4091273230283B58874D823B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726133, "uuid": "41a89f8e-439a-405f-8e24-a670a665ca07", "value": "12288:MbXgS7/99/d0zA4Yf9H42T18OQWfPFFN77PRZb5FXPN:Mbl/9o84YJTGLSr77ptvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726133, "uuid": "6d614bbf-2b00-4d30-9d75-145f04d05d91", "value": 466041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726133, "uuid": "f8d985e9-c471-4941-a667-5486e61085db", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726133, "uuid": "c905620c-098b-46e3-a6b9-d4b0c1b41987", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eafd027-f0ae-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655739224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739224, "uuid": "1fd5a508-c3a5-4029-b48d-e95c4ca021d7", "comment": "Malware payload", "value": "bd08e74811616bb525ac67df55534db3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739224, "uuid": "ede8a327-372e-4014-ab0d-e74171cf901c", "comment": "Malware payload", "value": "b1cdf19f15f3e2e6085539fcecc7a3650ffce9fa9d60de5dfa59e94ba02b6baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739224, "uuid": "c1f542a3-6e99-4b4a-87cf-2c6b2f459249", "comment": "Malware payload", "value": "2e20c1fc1ba56ec01bfb1a98d3dc0df1d0604423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655739224, "uuid": "60a9a96b-bb94-4124-8552-b234ba9f2eb0", "comment": "Malware payload", "value": "abccdc350b0e1da31cebe91e93048dcee7779f86a12a3780d2e84a960ddd52caa7fa810c94b977c2f073854536ef1de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739224, "uuid": "058e8dd9-8d6f-4e1a-812a-966203761cd4", "value": "T171448D5F67A88AF2C426123198CF9B374771BC71967143B3BB61FE9A5E324109D0732A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739224, "uuid": "2f3b276e-0444-480c-9517-c2d1884eceae", "value": "ef2b26c857544f525aeda2ffe7cb323c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739224, "uuid": "00dc3f30-4d4f-41a1-bdd9-2b925c3313c4", "value": "3072:vbh9GwujpLpheQDbfgAeqBlscKEuq6rL8DkOFUKKtQz6uujl3or:D3Gwu1njgAvsc3uvU5FUKH/up3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655739224, "uuid": "372d3084-11f7-4a21-a5ce-f12758db20d5", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655739224, "uuid": "40bb9c11-b238-497a-90c3-9988c71f4276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655739224, "uuid": "36bcc963-cf5e-44b8-b22a-9628a573ef28", "value": "SecuriteInfo.com.W32.AIDetect.malware2.24928.28914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2868578b-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655716370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716370, "uuid": "5caf75d3-61ca-4b81-86e7-917f980d29c6", "comment": "Malware payload", "value": "f8bfaf3b9fc303af5d33fc2a45b0dd8e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716370, "uuid": "2a2dfedc-551c-4e06-867b-a67ca9ebe4ab", "comment": "Malware payload", "value": "b25e52b0395e49718096fdf0f2a0171740c8627420fb85b327df67ba5bccb508", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716370, "uuid": "ec85e534-7116-420f-a6ed-5a1128b8c704", "comment": "Malware payload", "value": "05b3db25173f7c54fed692be4978f3f4583bcd2c", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716370, "uuid": "f67dd00c-7578-4b88-8ee8-d2f0a34760ce", "comment": "Malware payload", "value": "87b5492ee9f402f82a33cc8c11c219a5c8a1e1a16eb14d04258b033ac855ff3cc266f36adb1a8ca09a8301115e4598d9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716370, "uuid": "436b465b-426e-487c-9ab6-fe4fd8e9c903", "value": "T19F63D03E2AAC4D52D9FC0E7E5D72CA20B9E5AC6C8D1780AE50F33359817ED40D23D19A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716370, "uuid": "f81bae40-c138-42e3-bfab-0338515c794e", "value": "1536:NLvJ1SnWesc89qol9xbDLJCJz43PQQBYQDa+w:NL/gZol95mU3lfal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716370, "uuid": "3655f0a2-b3cd-4cce-aa9a-90fdb1fb96d7", "value": 73320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716370, "uuid": "a4a50349-4b5d-43f3-850e-fbecb79f75cf", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716370, "uuid": "03dffec2-b6db-4185-8a98-914760d8deb5", "value": "PO-1128-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e0b5b8-f083-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655720904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720904, "uuid": "41d42163-8a51-4ae1-9394-08af157eba7d", "comment": "Malware payload (AveMariaRAT)", "value": "63cbf9db32c74d51fed8985b5ab96549", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720904, "uuid": "23d9c6b2-c819-4f51-9728-2c9ce66ca675", "comment": "Malware payload (AveMariaRAT)", "value": "b2a0d812f9f9fcf1311df615c5ff2437d73ccc7504007d761f857e79d0b5ee7e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720904, "uuid": "834eb51e-b895-4efa-b05e-a7b1fa677475", "comment": "Malware payload (AveMariaRAT)", "value": "948034ce375dbb0e0c57996da21a1e6634bcdc9a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655720904, "uuid": "e4f6fef5-14d0-49f1-80f3-0124c50737ed", "comment": "Malware payload (AveMariaRAT)", "value": "ec110bd531586e20b1525584028972499ba6c6733a3f2706aadc6194c5708f506eddafb5d0b771c3dac63532cb92a7a5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720904, "uuid": "e4265a6c-6b1c-48da-95b2-575d175c0a41", "value": "T1D8236F7D36A86B22C4BD8FF8991123DC07BDD96A6041EE4CFCD270FAD662F100951A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720904, "uuid": "a3b4d0f3-e316-4639-b963-77b0a5a1b2be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720904, "uuid": "be6cd6dd-874e-4760-b150-4e9147ab9849", "value": "384:a3SlbYMGS5fXfw38ekFytyJ7bfCHoRdWldNs1F2XRnd9duJ9YsbVu6KJ9/OBzPp6:aU6k4ANfxRoqD2XL/Oxca8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655720904, "uuid": "373fb72e-379f-4a31-81be-f346aee73d65", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655720904, "uuid": "63d54cc9-dcc7-429a-a258-50745e2e86b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655720904, "uuid": "c5caa7b1-ef19-48a0-8e39-6559a055a775", "value": "InvoicesRemittanceContractOrder- Multi-Lines .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef961136-f04f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655698665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698665, "uuid": "02333cd3-9b2c-49be-a63a-e6ca667e58cf", "comment": "Malware payload (AgentTesla)", "value": "f593766095f1c4864a0c7bef29e797a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698665, "uuid": "a2f34813-f134-412d-bff6-48e713f005e9", "comment": "Malware payload (AgentTesla)", "value": "b2b2d7c248e208ed2584c61f998e565fe54e1d0a4cd66d6af689524182fe9380", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698665, "uuid": "7521b45c-3332-4e1b-925a-2a3ba835a630", "comment": "Malware payload (AgentTesla)", "value": "bf3a66881e18f9bec64f4bab8bd131294accd106", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655698665, "uuid": "79606fde-4b2f-4c69-8a4c-905fd8da329e", "comment": "Malware payload (AgentTesla)", "value": "b2517aaa0a7b42f0b53202ebcd65235bcb5a7738be39897da59cf06464dbedce76fb17dedfa8db7452c043d0ab9dffae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698665, "uuid": "faa2ac86-093f-46fd-8d17-2ce0ba953c57", "value": "T128D4AE9CB62C74DEC85BC27299644C64EB6074AFA31B5107A1530E9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698665, "uuid": "93a6e7a6-8da7-4f86-9e41-57e53844be7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698665, "uuid": "36099984-e537-4c4b-ae81-a9ae2c0b8111", "value": "12288:DmrepUboWCi9xHQrVRUBV2FvmDdd8O+w28HDfN9haZYObpovV:hpUbnCi9xwrjOLDdd8J87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655698665, "uuid": "08cca208-b515-4124-be48-d950030a7b1a", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655698665, "uuid": "16fffd38-e611-4add-8c80-4f6cae8ef9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655698665, "uuid": "3246adbb-bb41-4a1e-899e-55136d0f47a1", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97835a3f-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655745332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745332, "uuid": "d12433eb-619c-4d29-8c09-c18469b1176c", "comment": "Malware payload (SilentBuilder)", "value": "38d8a677332d2c1175aeab4a6a1791dd", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745332, "uuid": "74e2d9b9-9fb9-471a-b49a-81a5b7de8aab", "comment": "Malware payload (SilentBuilder)", "value": "b3ace4f85d219464799bb59f8daacd1de4c64b36813d9d9defefb0850de20be5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745332, "uuid": "a876cf75-e325-410f-acf4-2264fde77ad6", "comment": "Malware payload (SilentBuilder)", "value": "f6a68f72b5fc80926ef4c3f96a62d0f640f1f53f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745332, "uuid": "4aee0f73-3622-4c97-9e62-a74b0aad765b", "comment": "Malware payload (SilentBuilder)", "value": "08df33f340247039caa1dfac2bf202f99d050a5df248bc8d940fc257e948b98e3320dcccefcb02790a2209562a96aa1d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745332, "uuid": "9c75a5cf-a1b3-4434-9f3a-e4692a9b6fff", "value": "T100833A96B659CA9DF926873048D747AA6323FC304F6B07472264F3257FBC9A05B0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745332, "uuid": "3ab3084b-2333-421b-a91c-5fe33ebaf4c0", "value": "1536:ROOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgG7HuS4VcTO9/r7UYdEJeZ:RBKpb8rGYrMPe3q7Q0XV5xtezEsi8/d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745332, "uuid": "0cbc4969-7506-49da-8b8a-47674d316354", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745332, "uuid": "61a4ae5e-8eda-4a14-9c72-9198def2b50f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745332, "uuid": "ee9c3e0d-ed69-4c0c-96b4-29cec3ab1484", "value": "Latest payment.xls.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22132781-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655725808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725808, "uuid": "def956e0-6acf-49a4-9e2a-5f84af9c6871", "comment": "Malware payload (AgentTesla)", "value": "dace13b1e854617a88a1f512f6733282", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725808, "uuid": "153464ab-fd4a-494e-81f8-38c882475720", "comment": "Malware payload (AgentTesla)", "value": "b3c79d1d6e92a8c231379fc3d9658301917a192fa7afcbd3385a3f4c634eb97a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725808, "uuid": "e2b7b8f8-fcd0-43bc-814b-b99e838b0197", "comment": "Malware payload (AgentTesla)", "value": "9fdb137e7f1a754872bcf972d59ff208459725d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725808, "uuid": "db4c35df-ce3c-4516-bb88-d3925277822d", "comment": "Malware payload (AgentTesla)", "value": "0187163b1613373ed26756d4f6641430d662d5875e4a31bfc275569ad4264677749e0eca9c4e34821a13a1c9ee6cb3e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725808, "uuid": "29ce8756-274d-49f3-b254-57a743062f11", "value": "T141B42378AE61C7E8514A0817D202E355CAEB7CD143125B17B345BFA68837887CBAF772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725808, "uuid": "ae6e73c0-2dc5-4940-b029-79a05272bfff", "value": "12288:vzCZNgpieCi9VTQrVtGB32NvoDddmOMw28/Nq:70NgpPCi9VUrz8zDddmp8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655725808, "uuid": "6cf65964-674b-4b5a-bdb7-eb024be17061", "value": 511325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655725808, "uuid": "3ef482ab-df29-4e7b-a88f-47d2f0a545be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725808, "uuid": "9748c817-ee9b-46d1-9fee-7708b70e1dca", "value": "SOA PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227ceb4b-f072-11ec-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1655713353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713353, "uuid": "39806d3c-74b2-439b-862f-d8e7fc616aba", "comment": "Malware payload (BluStealer)", "value": "f3f0f6d41762e72c52b93325d5eb2ab8", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713353, "uuid": "a6c82484-73ef-405f-ad57-34f1ce30f149", "comment": "Malware payload (BluStealer)", "value": "b3f514b9c7297f98043685c52634b663010c5a451aa7a4a22072273b4c535133", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713353, "uuid": "75996907-1a57-4f74-b9a1-e81ad5e974c0", "comment": "Malware payload (BluStealer)", "value": "a93f95ea424cff81c6ec6a7d5583b2de897be46a", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713353, "uuid": "aaaf576f-73f0-4836-b016-d024f5ce8c2e", "comment": "Malware payload (BluStealer)", "value": "60133ca0ed17115eba29574027ac0ad83814d1bbc8470d55fae2fa6816534441fac62319a5179f0c06709c8e6d1ca28a", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713353, "uuid": "00d4ea43-8348-4dd2-9511-84a9a3afe186", "value": "T16514ABF36BD8C8DEDB586234F3421E1703516DEC68D6A23D1FDE7A29C630A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713353, "uuid": "1c43ff04-1667-44d1-8c66-a790bbf29bac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713353, "uuid": "d4d7d884-00b8-4f59-be63-5f6a5544d687", "value": "768:YHRjyGIh42lhp6kELfMaCChd7ntnR+iEiiiX8n8nsMGGTdjt+++Gvx/bb2exNEzw:4jxIh42/uSdwlOVhhJRYXswGjVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655713353, "uuid": "49097e0a-f3cc-4ad7-bf13-528b83bbc245", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655713353, "uuid": "a91ff040-932c-4702-abdd-005d34f729f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713353, "uuid": "002fc05e-8577-4bdf-9bae-d106ae5e57d8", "value": "MT155026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1331ac-f0ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744619, "uuid": "18e305f8-296e-4cca-91ee-57b2a379cef8", "comment": "Malware payload (Mirai)", "value": "1754d4a09e7cbb59290b5176d0e9ab01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744619, "uuid": "2ec481bb-d2ca-44b8-a63a-c34e1df1e70b", "comment": "Malware payload (Mirai)", "value": "b5b9e2215aafe382cc38a8f686d0a42d4c8d7c207a4b2564a7954aaab2e61632", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744619, "uuid": "738a3782-e785-408d-af35-b887ccff46bf", "comment": "Malware payload (Mirai)", "value": "5d61c44e21db211164e12fd6799955553fb3558a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744619, "uuid": "0c547372-9126-4a5a-b6eb-40d3d860dc45", "comment": "Malware payload (Mirai)", "value": "73e51ca53d8c4dcff375c950aa3416ccf606e0212345e2a44ed69bea08b10dde996be6ffc603a3fd0321eed598f08aad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744619, "uuid": "fb209fd1-60f1-48a7-8da8-64af98c709c4", "value": "T132030AE7B8519E1BC5D0027BADAE019C332097E4D2CF7607CC205B9076EA92F4E67E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744619, "uuid": "3eb7b3d6-4368-4573-8cca-b2af65feb0b1", "value": "768:WHx+qg2zXNs9nStZCrfyo4GQbgOwAU6kN1CCyu4x:WHxmcXqqZCmo4+NXTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744619, "uuid": "7f156cfc-f0b5-4061-b9f6-f3b64f071efe", "value": 38068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744619, "uuid": "60d60a03-4559-4a22-a490-032d0c6c7c11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744619, "uuid": "024c48f9-d41a-4dc6-9daf-6f5f677ce8e2", "value": "Hilix.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f38d61-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655746622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746622, "uuid": "ea340733-f653-42af-b0f3-c082f3b5d528", "comment": "Malware payload", "value": "62fe64e7964779c9dee3f10e89f01885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746622, "uuid": "9b7e9483-5c11-4df1-a9cb-70aae19db0b7", "comment": "Malware payload", "value": "b68336638d6be4ac45fb3caed0d8830a0105f7d080d13b687c8fdcc02d002873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746622, "uuid": "f3c3ae89-82eb-466d-a771-2152c39cc999", "comment": "Malware payload", "value": "49b95c08bd048a1440187b49c15b79b942caeb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746622, "uuid": "69d86e93-e6eb-4b5f-a52c-4e9fefbcf61e", "comment": "Malware payload", "value": "18ad231764754c6fa2fb092c678db40a63e8b09c96704b821c3e7f7b57c451e9a97529ca5267e1878530e82364258495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746622, "uuid": "939bda25-316a-401b-b209-411a40ccefb1", "value": "T15E03E601F5895B70D39A127F78ECE1ECE2A69C2C060399C9F4503DA9167ABD09EFD52C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746622, "uuid": "853649a7-ad2c-4398-a808-51d1a9304bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746622, "uuid": "04432112-0a7f-4010-be20-ea6910364ac3", "value": "384:eJO/cFEW5tnmUboIH7V1kH5FRr2owIVQHVXuUzvNes3jG:eGcFECnLHvjEw1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746622, "uuid": "c14aea28-c5db-45e3-9362-588f48719840", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746622, "uuid": "19e36656-8e69-4177-80f3-8b04bb416e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746622, "uuid": "7dedf86d-0aad-4c89-b072-031b830acba4", "value": "SecuriteInfo.com.W32.AIDetectNet.01.32559.9346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76b1c3e-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655733870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733870, "uuid": "ef3506e7-d01c-4f9b-b1b9-1b879fe694f9", "comment": "Malware payload (Loki)", "value": "4f77dd842c1d9c7ee8a3350e79e8634a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733870, "uuid": "2438527e-5e01-4ef6-b704-abeebc905ac3", "comment": "Malware payload (Loki)", "value": "b725e73edec2f3fcaca92038ddcaffd70a8209b5e86d503e70053e336975b58c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733870, "uuid": "e110ce3c-197a-4bd2-8d2e-765d644115fb", "comment": "Malware payload (Loki)", "value": "6f1886d4a3e8a1b791e541735d8f52b70e98e3d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733870, "uuid": "ea8e1166-829d-49d5-8d36-e341102456dd", "comment": "Malware payload (Loki)", "value": "5f62a2ba254be5b07146484d8c23413f1e7a5ac30ad6067eb3e33d7597740fc00b8206a88de739530cdfcd06c6888a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733870, "uuid": "b51c6335-b20d-405a-98bf-ab006382ce89", "value": "T19C94F1046AB88763ED3DCBFC48E3604043F864229256F79C4FD971DA9877B128B90767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733870, "uuid": "42533191-ea37-4f52-839d-b799cc54b2ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733870, "uuid": "e9f0a33e-62f4-4c8a-834d-0207bae8218a", "value": "12288:r2iNiDX9qWN0lYYDIz3u7df+34Auf4hHg:r1qcDtDF7plWHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733870, "uuid": "6957559f-932f-4000-9906-32265624dc50", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733870, "uuid": "61012941-6a02-4361-871d-5494d5673516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733870, "uuid": "3ab7bbbe-47bb-4001-bbbf-1ac479a1175f", "value": "Update SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a272fda0-f0e8-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655764249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764249, "uuid": "38e0246f-4510-4bc4-ad2e-80b7f2117ad6", "comment": "Malware payload (AgentTesla)", "value": "998eebdc68e4b8a31799e6931240af30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764249, "uuid": "b912cf84-f869-46e8-8431-5d1377bbe535", "comment": "Malware payload (AgentTesla)", "value": "b8d49703ab99b1a251044099fa4a29743dfa95e4df46160829b848c5b316dcb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764249, "uuid": "cc798576-717c-4d12-93b9-de3aaacf2257", "comment": "Malware payload (AgentTesla)", "value": "b9a039ac90443810e7a1d9c140ad43b257c0fba0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655764249, "uuid": "efccd36e-dd7a-450b-b520-a3d4e52f627f", "comment": "Malware payload (AgentTesla)", "value": "aa615dc14010b2de3830fb9d88fd54c02c057a7252efec4627a48b4dbc1ed573d5f207ea75f3a04459cfb3bd1baa902e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764249, "uuid": "570dd503-d9cf-4a4a-9104-f339f3f67749", "value": "T1C055BF1177F85B1BD5EFA736A9708A1843F2F842AA66DB9F1A01D5FA1C83B408D017D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764249, "uuid": "847c3aa3-e285-4def-958e-31dd56568da9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764249, "uuid": "599dfb0c-ce8e-412b-93a3-22803dbb7960", "value": "24576:rlAvLs3A5DmFjmi0APFl8jS9fxLL7fjOz5EGhwlLjqf:Z4B+m6z+SyzKGSlLjqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655764249, "uuid": "c8a54831-7ddb-41c2-b968-29d3e54dee3b", "value": 1313600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655764249, "uuid": "824cd418-d1c7-4552-acd5-bda612c70e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655764249, "uuid": "3b070dd5-e47c-49e4-b1b5-38e364a04b4c", "value": "SecuriteInfo.com.Variant.Tedy.122334.21435.231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e4a1cf-f05c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655704261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704261, "uuid": "dff136be-8951-4c27-b106-f665bb87f5a3", "comment": "Malware payload (Loki)", "value": "f2ac3e49f64c43de22377594db0595ff", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704261, "uuid": "5fab7f1d-5011-439a-be87-8a35d5adf514", "comment": "Malware payload (Loki)", "value": "b8e2f37770f1bddd912ae701d6e05af35bda088d5deceea2431c363cbbd5b4b5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704261, "uuid": "e9dc465c-e922-47ba-b77b-40cdf8ed3ee8", "comment": "Malware payload (Loki)", "value": "b183b7647ba085ba5a9e0f83515adf3832f92c70", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704261, "uuid": "ec458a3f-3a73-477a-802b-48ecfe9573b8", "comment": "Malware payload (Loki)", "value": "545e8a7ff2edd8a338231cc5531f6749c3b68e94ee05539c060af044f9cf21ee0783aaa2e36f1591357a1cad96956598", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704261, "uuid": "a7d64c08-0ba6-4ea1-afe0-9aa9c5318418", "value": "T19663CFAE2979D79BE993853D270FC249BC599E13434BE73B6AA5323C46BCC44CCD0129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704261, "uuid": "fb35b7e0-e72a-4baf-90b4-323b24de5dc9", "value": "768:7M+gMVzja9/3pHm0QE/H4IfOgQCPiNf5PIlKDNYrlUaiSoWDS/iCXwxzRsmU5jex:72h/ZHugWF5N4KDSrmndXwEmUpOPTiFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704261, "uuid": "5f44f7c5-196b-43c7-90fb-4418b20de53f", "value": 73272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704261, "uuid": "d7f5cbeb-b698-4f72-9ac4-305fd2db8a48", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704261, "uuid": "aae8c7e0-fefa-4e8f-a0eb-1e477ea95ecf", "value": "NO435778.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afcbf01-f080-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655719488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719488, "uuid": "8303f9eb-9963-42a5-aae5-0559132f7780", "comment": "Malware payload (GuLoader)", "value": "51dfbe54084d0ca81ef57de24ffb79dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719488, "uuid": "42e0089c-239c-453e-a6d4-062d9318a33c", "comment": "Malware payload (GuLoader)", "value": "b91105bc07e23a3a1378ca6ce38488c23799a2d3d7ef5de1b0a039453a42bcae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719488, "uuid": "c9bde414-0a1e-4120-98a5-a12c1b5f4ebd", "comment": "Malware payload (GuLoader)", "value": "1654650733ec2627c31cb7ae7ac9d2e4593b8be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719488, "uuid": "b76efb79-a3e3-406f-8c19-68ad1157ea96", "comment": "Malware payload (GuLoader)", "value": "4aca9a280cba4f830f4e895ed400584df1c050be8c18d2cf396a8ff2c1f237fc488262cf69ea84467b88e3e90a58edf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719488, "uuid": "478f3922-d058-4488-8dde-15b05c8ccb6a", "value": "T14D34E0307BA4D817C86A0A7685BAD77527B0EE542450A50733E03F6BBC232F1950B7EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719488, "uuid": "2af537a9-32f7-4f97-bc1e-3823419ef6ba", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719488, "uuid": "68c0ae8c-20cc-4caa-aaea-24f7d81ecd06", "value": "3072:+fY/TU9fE9PEtujEZasvlx+LBEFxAVLSaVVglbyFBBbF+Mtrr+H2R5NdWDSUPOzp:oYa6nsvlxsB+yV9+KLFhTNdWDSWOzrOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655719488, "uuid": "d1e1e05c-3574-4a03-a335-3a455360854b", "value": 233030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655719488, "uuid": "0791eeee-349c-4f9f-a08f-950f3a21bfec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719488, "uuid": "81cdcc36-8f2f-4ff6-aafc-84c1a287c44e", "value": "Halkbank_Ekstre_20220619_082754_536974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af040db-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655746412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746412, "uuid": "88727605-6a5e-4ee4-836a-5520abbf7d9f", "comment": "Malware payload", "value": "23983f3fd2311635f8362b20a2661d75", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746412, "uuid": "3635b651-7d12-45a9-8ab9-74f127804c10", "comment": "Malware payload", "value": "b912272d7664acfa6357c7338b92ecedf0543ae230d9f78a03698458297efdc2", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746412, "uuid": "4d8b6816-6faf-4dc1-8a16-b4d4faeb78d6", "comment": "Malware payload", "value": "ffed99e8846ce23c8e9654590a0840b57f43d58d", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746412, "uuid": "6f9263fe-70b4-4c7c-b4ca-ec0cae342370", "comment": "Malware payload", "value": "0a59fc8537a617e2f5f249b295248548e829994d7970ffc53868fc14eb41332b080862ceb1af1207a72f0d23f7d7fa44", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746412, "uuid": "251e7a8a-d5b3-4364-9cbb-9d5762e327c4", "value": "T17495120575ABCAB2E6990BB7C4D24000C7B78585A1D7E32B365813F69DC37EFC982A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746412, "uuid": "cd38c508-4745-45b8-bf78-44704b9d5b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746412, "uuid": "5c9e5151-2ff8-46cd-b025-86087d5181d9", "value": "49152:8PyXKrmYMzh38PSR1MIkayyhXoj3yQSHmkONQ65HG:8PyarqRoOnkayypk3ynUW6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746412, "uuid": "9f7f5e15-c4e9-4767-ac2c-4766877e038f", "value": 1910272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746412, "uuid": "5b5eb8cd-4849-4f9a-8789-342a704032be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746412, "uuid": "d08790c2-04e4-434c-a629-aee1fb503280", "value": "vbc.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84831458-f0b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655742723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742723, "uuid": "36409436-4e42-49de-bc3b-3151ba184b13", "comment": "Malware payload (Mirai)", "value": "e7e2a9dde06e0f922aa200e2d5501398", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742723, "uuid": "77f1246c-47fc-4a1a-9846-ccb6edaee720", "comment": "Malware payload (Mirai)", "value": "b9e27f472ead032ba680aa483bcde23fa8610c579e028bc69c82d2bf56c00f60", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742723, "uuid": "a3a6da8b-b547-48cd-89ac-61313f3cf52f", "comment": "Malware payload (Mirai)", "value": "cb5094951a9334be2706d66479aa67bed5095027", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655742723, "uuid": "16efb959-7278-41ba-9b64-862aa0adc7e5", "comment": "Malware payload (Mirai)", "value": "0eb5cce872d329b7f03a79612ff579517e9256ac94ef468ac7896890f2cc312cb02927ebbd01358abe74d6c28f77aff8", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742723, "uuid": "8f9d41ac-0cd6-497b-9cdf-57de8a3d43e4", "value": "T19233020B50632DB197A0907AD93887EBBBDB59EC53FA35164E1A0ED837F0C4268641F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742723, "uuid": "51baa405-d1fd-4a91-8c8c-9496d31b6417", "value": "1536:6QhmzLXRc3XgYl+XroD9ry9Z3zrIQoV7L/qhgqg62QU:bILXRgKoDhoZj0QgLOgqg62QU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655742723, "uuid": "fe7bb14d-6d59-474a-ac6a-389e3055611a", "value": 53536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655742723, "uuid": "85ea47d7-6a49-497c-a3f2-8ff99a924431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655742723, "uuid": "f6864cc8-288b-4814-b027-36b9529285f9", "value": "KFS.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e9a572-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655704662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704662, "uuid": "7f37ca4b-3207-4164-a06a-86871cf08fb6", "comment": "Malware payload (GuLoader)", "value": "8383967a80f8f086626ce18b77e39f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704662, "uuid": "1c386e3a-12b6-452c-bb91-7b2368c9dc15", "comment": "Malware payload (GuLoader)", "value": "baa2187b1300b8a37a5bf6864f5645e9214776852fc23ca0ad9b28ce4548bf37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704662, "uuid": "2c52315f-89f1-4922-b593-b8ca1fe25226", "comment": "Malware payload (GuLoader)", "value": "f07e161ce528723ec85e3158a74af90d760ad80c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704662, "uuid": "2a6eaf9c-f234-4290-8e59-043e45492b47", "comment": "Malware payload (GuLoader)", "value": "6d6c3df17b03c11ddcf90c3d6107415f6efb4709d2a0d40314674512dde21a935cf7c4e375082e9b7d0740ec616c38a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704662, "uuid": "05fbbab0-aef0-42ff-baaa-cc57d11a09ff", "value": "T111E41287BB608E23D5B28970B463976927B0DE152928483B73703D2BFC733A19F456D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704662, "uuid": "201e478b-ec2c-4ad2-adce-5a48dc1e9722", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704662, "uuid": "b4410e06-2316-4efb-a987-9a861430228e", "value": "12288:tbC4Nh7CmRResowK09iJifdXWv6pm/ERHow338VzROaqYAA/gBmj3ZlVTO0voWx:tbCSCmRwsowK09iJifdXWv8m/8Hoy385", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704662, "uuid": "7ad7c8a8-99db-433f-a0ce-9f47d456a310", "value": 682259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704662, "uuid": "1577cdfa-89d8-436b-9702-f45b71ba2eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704662, "uuid": "a55f0b63-c20e-4dd2-b17b-b611ff23ad59", "value": "GTV3285776_06172022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4aa05c-f05a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655703067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703067, "uuid": "ef3bce8e-d61b-4416-8a30-c2253f723a5a", "comment": "Malware payload (AgentTesla)", "value": "28d31096735b8c77a653c5fe0f13749e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703067, "uuid": "f2a2f662-99e2-45f7-8fe7-5bc48f7a2cf6", "comment": "Malware payload (AgentTesla)", "value": "bacb4402a8b1adcea1d29d5148996a4faed9a92821d194f1fd252d2aeb7d015a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703067, "uuid": "a55a4323-ca7b-41cb-9dac-280a92c34315", "comment": "Malware payload (AgentTesla)", "value": "a7f92aad44ebfa3ad5063fa375974994962c9994", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703067, "uuid": "6c1eecd1-4892-4106-80bf-b03eb571dbf0", "comment": "Malware payload (AgentTesla)", "value": "545dc5f82d92f70575a65116c0c5708d01ab95528982886d205818bd6d232f35b097067eba709bf7c5c4e8fde5a401cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703067, "uuid": "73f0166a-3caf-45ac-be12-ebe60084879e", "value": "T16D652423D2B8169DD7666AFD7660C6B026236C3327B986C97D4B3C85163124C7BC0E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703067, "uuid": "f6f72616-d7ea-458b-8318-00f3cbdf81bb", "value": "24576:49sF6RvOdVD5cGIS0y4lF1J+xUuBy4Wf:Cjyd5cGIX3Qs44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655703067, "uuid": "53b9cf45-5240-49c2-9422-7a0f3c407925", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655703067, "uuid": "4d41f4c9-3184-4c6d-98ca-a8957d16b656", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703067, "uuid": "a5ac523c-8da0-4597-896f-843fc0c1447f", "value": "Purchase Order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b4f7a3-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655716310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716310, "uuid": "d86c44fc-f4ba-4ea5-8d60-de9b8fa8fbae", "comment": "Malware payload (SnakeKeylogger)", "value": "a45fdb9869bf45b8133f343425dd0f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716310, "uuid": "40456967-64f1-4db9-b3d6-a28922a5c291", "comment": "Malware payload (SnakeKeylogger)", "value": "bd03d60e184111502e6cea9bf2bfd2d6242ffcfeb2e50c5a788c137549ede738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716310, "uuid": "ce2e95bb-0e10-4bfa-bc0f-4e6a69eda17d", "comment": "Malware payload (SnakeKeylogger)", "value": "a895074a4b580104ed58d3ae026da9f52a9cce72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716310, "uuid": "fcaab6fe-c326-4f20-84f4-ccd03a8cb520", "comment": "Malware payload (SnakeKeylogger)", "value": "aefad520cf84e69b3808a857e0f77080cbfcef2ae043e2fdf6d6a2dc62d51a48fca6699e346ab056e6da1ec7b224f9d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716310, "uuid": "ec371ad1-52dc-4097-a573-ef7a4560f2e1", "value": "T1E0C2A30633880BB2D0EE0972D40AE770D722A65D8CA74E35C540AB87B4D73535E6FEE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716310, "uuid": "ac7dfb06-f909-4851-aee4-d04d6eb36df3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716310, "uuid": "ee405c8b-99c8-42c5-80c1-edb2fc59ca1f", "value": "384:41f4dg40Gcf0IFKEuugt64JUbdyd2i22i22222A222sf122WO22u02u26x2u2B+5:Tg40Vjf4d2xSHoCKbEMfnTbxBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716310, "uuid": "bfcae224-2bf2-4587-ba9e-e09ae455e221", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716310, "uuid": "9a36a27e-cffa-475b-9455-f1d55cc30958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716310, "uuid": "d8c370a3-263a-459a-87bd-4019e5bbdc7b", "value": "Ckiocrq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73beb49d-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655743125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743125, "uuid": "0ae8b224-4de5-4be7-88e9-a2023fce59b2", "comment": "Malware payload (AveMariaRAT)", "value": "6ffbcef7b5ff3775611da1fe65f81cdc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743125, "uuid": "8d52e357-8f0e-48ef-8980-3b20fe7493b1", "comment": "Malware payload (AveMariaRAT)", "value": "bd2709e7614b75b2748ddd1ec0f4d6e01ac99e9e3b321246e08a5149ce9027df", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743125, "uuid": "2c727c86-b6e5-4bb7-b2c1-e7e38c8c80dd", "comment": "Malware payload (AveMariaRAT)", "value": "42e74d2a0fc4fa6dfc515d71530e0e103419a454", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743125, "uuid": "742375ff-293e-4f7f-8a7c-da293f14417f", "comment": "Malware payload (AveMariaRAT)", "value": "a723063ef6e40494b373a90f5693031fe68f2d2d91870c19859fa71539b18d0dfa229f960d14b12d73cd10ec21465b71", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743125, "uuid": "539d94e9-efa8-41df-b693-6c58b1939125", "value": "T11CC51610A3A11107F9E367BA62A5475488FE3C814B6991CF49850EFAF62D6F67C343B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743125, "uuid": "02d4d413-f108-4b91-b1e2-d3b0ff101df0", "value": "9daafb0b78dbb87531e4bfe8a92bad28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743125, "uuid": "46e950f9-a3c5-4a3f-8c3d-517fd3469bd4", "value": "12288:uV5duit5ECY7D/iiluulX6jA6AMhIqeTbjfsPHOfOZurt512D4pa7+ouscW:EqCYTX+hI9T/fsPH+OkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743125, "uuid": "21a27202-60c3-44d5-bbe6-f2aef2f7b3db", "value": 2692096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743125, "uuid": "b8f5533b-4465-4565-9840-37683aba91f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743125, "uuid": "5870ea83-912d-43bb-b142-1bf0eeeb63b6", "value": "SecuriteInfo.com.Heur.Mint.Zard.52.1127.12631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9ecd5a-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744827, "uuid": "a0b0c0a1-56fb-4583-8dd8-3e218cf13a0c", "comment": "Malware payload (Mirai)", "value": "30b4dc36b73e21f02f055f00191be766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744827, "uuid": "8e00728d-b8d2-441b-bfbb-b257c821c17c", "comment": "Malware payload (Mirai)", "value": "bd5718eb9c14e35a0bbd3a3ef7a73b629e74e0eb236ffb3908d4ecec5cd04a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744827, "uuid": "2147fd1e-9039-42fb-84de-04f003d2a13b", "comment": "Malware payload (Mirai)", "value": "442aaf979a6213e9acca50a376d9bed536ed746c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744827, "uuid": "46c15a37-b681-4457-9e9b-f82eebc318c4", "comment": "Malware payload (Mirai)", "value": "e2d56d8d48de2c8e3ccf291ea40ea060361f734d2578bfe4d90779b59c35ca9aa50548785bd6c1b5f6ed3a591e44be53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744827, "uuid": "5a19e6cc-ff04-4e35-8593-bf23cc59c850", "value": "T155D2D1B3D0936E1EC4AB00B70CCF347F4625DA3C4550A8A5E695703E8AA7FA1361AA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744827, "uuid": "cf38270d-8f0a-4a1c-8d19-c74aeaa49f04", "value": "768:Ed78ykw0V0TyBftFGLDGLgUVGfVDsxhn7zrjnbcuyD7UryqU:67RLSDftELKVMhsxpjnouy8mqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744827, "uuid": "281712b7-6e4f-4b7e-8bc7-926af45497ab", "value": 29616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744827, "uuid": "9dec1b5f-efaa-414f-b4f5-8b2c8f71950f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744827, "uuid": "9d724054-8682-4ee5-8fde-ee09b5caa6f4", "value": "root (1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46e2b1d-f072-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655713625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713625, "uuid": "5764e97c-ec4b-4f5c-aa41-aaf9cf02dfcf", "comment": "Malware payload (AgentTesla)", "value": "c95648f2ef860b635849bc716494abe2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713625, "uuid": "597a0dec-9583-4b35-b790-5632f7914660", "comment": "Malware payload (AgentTesla)", "value": "bdbd3564ec2fb6691ef64bccb1c1ae2f8ccc9a7b109b4472210e4aa789ca5f57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713625, "uuid": "81c38340-2e05-474b-8094-ed20712134a5", "comment": "Malware payload (AgentTesla)", "value": "65f62a2f061eebb700246ac7a8813bc8cbd8ee27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655713625, "uuid": "52f164ae-085b-4805-a20c-2c1751b0c9c4", "comment": "Malware payload (AgentTesla)", "value": "9ffbb59f2470e681285526fc450d97bc320b315238cb10922987095d1c7729a1bb00923de987b95e6f0810f1e86fc9ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713625, "uuid": "89d7d222-9f22-42e5-afe0-47ffb19401cb", "value": "T169253DEDF24831ECCC17D5F568355CBAAB12683FA3661085638B321A0CAD7635637C9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713625, "uuid": "9536f195-fee5-467d-b44f-c94a41c15312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713625, "uuid": "242fd5ef-2ff3-4b33-a447-4bc03a88b29b", "value": "12288:eAnOTs+4xou9i37chHMswe4JtSoUOKlkkMj+S/2z5Z7iIkkkkkkkrkkkkkkk1kko:l+4xou9tce4Wi+ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655713625, "uuid": "415669ab-ff24-4b72-889d-78c63be74c45", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655713625, "uuid": "8c15f87a-8ff3-4e96-a686-f6e0cb1ee60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655713625, "uuid": "ef9d5fc9-4714-40cf-b725-08e0ccb9e79b", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6504f632-f0a8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655736658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736658, "uuid": "70b53a4d-3e99-47e3-b756-ac081a30a2ab", "comment": "Malware payload", "value": "29dbe97f7c547c32e0b884831736c431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736658, "uuid": "d7ecdbcc-b632-4934-bed8-f37421d431a1", "comment": "Malware payload", "value": "be0d519fddf7b363f6d9cabc6cad04061f8c77fb937ca48ed2e803b587f602ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736658, "uuid": "04e57467-087f-4ffb-9cb8-81b4286dcc3b", "comment": "Malware payload", "value": "97ccc554542c8194649d531e61a96f7c60ff6fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736658, "uuid": "935a3dbc-46b2-464b-aa0e-8991175e1c73", "comment": "Malware payload", "value": "d21b2ebce09656ba216e5d5d8fcc33530d88065f267ff4c134f422ccaf53f6546d3fd2666ed792041da0f99f5e406aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736658, "uuid": "33beab9b-c392-4133-936f-61ce69a657e9", "value": "T11E15DF9CB22C74DED89BC2769A644C64EA50746FB32B410791930E9E9D1CB83DF168F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736658, "uuid": "0f96b0f5-8cfa-4f60-8b18-9893eb36960a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736658, "uuid": "b1e7913d-09af-4615-9f98-59195857ebf5", "value": "12288:FAnS0RSoUdiDtLhCsMel3/Ty1e4zjTozXDk2uKNTkM2a9nGW3j9sWoH2Uc4IlNFk:jGMYH3FRyg4PTozg2bV0W3j9sL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655736658, "uuid": "22e1f48e-7aeb-4717-a470-5e2bd33a4b0d", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655736658, "uuid": "c92ab5b3-f2f5-4fdd-a556-6fa263e711b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736658, "uuid": "9957c260-395f-4a08-b511-7f4ae32e4009", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3179.5235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e22162a-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655734150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734150, "uuid": "9d00883d-8995-4944-9204-7d5cf8b8d3cf", "comment": "Malware payload (Formbook)", "value": "c62ed682bc9c9414b7f34e6730afa0bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734150, "uuid": "b646b6a6-90ff-4507-a178-993a111e2187", "comment": "Malware payload (Formbook)", "value": "be0eb1bf95016367e097709002bfb12c31419a9d9214f5a743d61fec0869e94b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734150, "uuid": "5895afff-370d-4e81-8499-0b273011ef0e", "comment": "Malware payload (Formbook)", "value": "dad14a28c7b941cbe854bcaaed189576e0666f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734150, "uuid": "6e2a18f6-2f5a-4871-8620-3d773b0f9e45", "comment": "Malware payload (Formbook)", "value": "d3089b6e47ed304c37d8af58d1cb936d56a7d90a15c32fbe39c6b689830be9d1437f172048fa29efa1352f7d745eba4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734150, "uuid": "68debab2-f10d-4fff-9453-29a83d2a9d95", "value": "T19EA413182A2EA743C4FF3BF445B7066583725238A4D2FA688DC420DF9676F0446E6F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734150, "uuid": "096a8cfb-29c6-4728-b543-325cc3198f64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734150, "uuid": "d3b442f6-63f0-4da0-8129-2b510eebbb8c", "value": "6144:Jp+s4twytxrgG/IOvWZtiipvZ5EQ0Vv1R5e2pNePxq3wb70z5ACLNp3:mOoaGgQWrii9HSv/PNa+s70eQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734150, "uuid": "11c0f961-42a6-45d3-8406-13c0a02d87a4", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734150, "uuid": "b62c9bec-f994-4f8f-ba0c-24a345f9c33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734150, "uuid": "b3860410-6c96-4108-90ab-5dae5504f85a", "value": "c62ed682bc9c9414b7f34e6730afa0bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194908e8-f064-11ec-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1655707325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707325, "uuid": "bc61f947-3a0d-4ff3-b560-87deb62caf0a", "comment": "Malware payload (BluStealer)", "value": "50a4e8c9048384bdcae4652529cb904c", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707325, "uuid": "05da8595-eebc-427a-a2d4-80049fcf144c", "comment": "Malware payload (BluStealer)", "value": "beae6f9716a4543dfa1a0ed79ddc4ae62215a9637082c61419a15b4a066324b8", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707325, "uuid": "5e8a4d02-521f-4497-94e8-1ad1ebe8272e", "comment": "Malware payload (BluStealer)", "value": "049de1747437476eeaf7f0900787d5b89ec497ab", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707325, "uuid": "936a1b9a-abe1-4b56-9c4d-9d2c242f5725", "comment": "Malware payload (BluStealer)", "value": "37796e1d332787632bfeffbfdff9368eee31c4e9a921113671e31a279e3f8befdd195d47a5cdefe7913a00c8448b5aff", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707325, "uuid": "ec59fba9-21ff-4b11-a980-7a9423aea00b", "value": "T12C14ABF36BD8C9DEDB586234F3421E1703516DEC68D6A23C1FDE7A29C630A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707325, "uuid": "0e90ab28-0937-4974-b3a1-191e2329b92b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707325, "uuid": "eda7d42d-eb3e-4e9e-bd6c-53221c0b9cb7", "value": "768:OekRbLW/p42Hhp6kELfMaCChd7ntnR+iEiiiX8n8nsMGGTdjt+++Gvx/bb2exNEA:J6bLI42huSdwlOVhhJRYXswGjVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655707325, "uuid": "af7675d1-1a4a-4d6f-8c4f-4cb01f277b3e", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655707325, "uuid": "e697f3a8-0266-4a46-bdeb-e810f094af72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707325, "uuid": "59ebeae6-536a-4ade-83c8-6531e9d54704", "value": "SecuriteInfo.com.Variant.Strictor.273382.14790.815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f60964-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655722078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722078, "uuid": "be2d7b48-bc53-41f8-ac4e-e713a9c9b279", "comment": "Malware payload (Formbook)", "value": "6b79bff950885e957d51a04c3328b350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722078, "uuid": "4e1772e8-4d6a-48bc-a6e2-32c25d6cef2f", "comment": "Malware payload (Formbook)", "value": "bf1bfba1cf627cb2d0670980e2cf6931ae7ed1feaf0082d086a8364f1c355c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722078, "uuid": "2a917c5f-650c-416d-9350-8c58eebefab3", "comment": "Malware payload (Formbook)", "value": "f701766b6e2583fbeb25638b267798dc248a8516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722078, "uuid": "ae104c94-8b97-42a2-82ed-b186dbadd3d3", "comment": "Malware payload (Formbook)", "value": "878eebda5dddcef7044b1d3b7676431605e9744d8c109c0a609ae8233defdfe7c73e2d2446a9068207512a635a0ec38c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722078, "uuid": "a753ef5f-26df-44c4-8ed5-196849d2ad7d", "value": "T184B401046A7C4A72EA38C7FC09E3618053FC6426D256F7A88FD671DB9C63B464A90737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722078, "uuid": "5ed1197a-c148-4ac6-ae6a-fc03d2eaacc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722078, "uuid": "28ff7d6b-96b6-45d8-8481-3754e5dc7a0f", "value": "6144:6Jypy6FEoZOW2GGb2GhNetpwD8VzHgpV2nYG+2Z03jj7qGTbNMJM9KThGdCa4gr8:S2iNeX08Vza4NPZ03/7HN2tMCa4e+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722078, "uuid": "6a1a4fec-57cc-4cdc-bb83-04d52bb3de94", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722078, "uuid": "721741d1-55b8-47f9-bbb4-4ed5d13a0a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722078, "uuid": "ad3e7be8-1249-42ec-a80a-72010e37ac01", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d00fcd-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655716260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716260, "uuid": "5a7382a2-c0b8-4ca5-945a-dde0036e6cd3", "comment": "Malware payload (Loki)", "value": "b043238b0b2b24283f789fefadc6aeb6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716260, "uuid": "00bc8973-7c5b-4f47-ac6b-20d10350c1f2", "comment": "Malware payload (Loki)", "value": "bf2a1c3a2871640bc442d1adac2aab1f494cf061121bbb4d4d79a463ffb27692", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716260, "uuid": "c7d51606-f93d-48a4-99dc-50a343749712", "comment": "Malware payload (Loki)", "value": "3b06d9110f25fe7d13c3a69accb8a0072532390c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716260, "uuid": "30abbd92-51ce-4ce5-ba7f-ea0f23c3268a", "comment": "Malware payload (Loki)", "value": "d979cceb9c32004f7e3f1750a226813c6623c8b5f15745939f68b47c809cd265d02eae0090bab3a79a2b2dce01df26a2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716260, "uuid": "9749be0f-b35b-4c9f-9664-3b5e4941074f", "value": "T16263D0392B809846EE563A3044BBB0527C94ED145F3AEAFA3C81B3BCBC7C55467E2535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716260, "uuid": "e7ff0bc9-fc2b-4bbe-9125-a290bfdf49ca", "value": "1536:v12jBHO7v5uVxsLW8m+FIGtpCPjZSsCx/Tuy/Hbc78S1N9:v12jBu7v8VPxoIG4PjEtx/TuyHS1N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716260, "uuid": "3691db5f-7d89-4a43-827b-a08ef0aaf4c0", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716260, "uuid": "e70cbde8-bfaf-40c5-b3bf-3881f59c8772", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716260, "uuid": "33c2cc04-6ddd-447d-89ca-2935970e32dd", "value": "Quotation Tender Quantity.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f158a1-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730453, "uuid": "d665da8c-6178-4013-b289-0052c9132981", "comment": "Malware payload (SilentBuilder)", "value": "2cacc253b3bfef0c1780e369d9f09fb9", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730453, "uuid": "02a7d835-6c04-410e-a2e4-5f202e33264e", "comment": "Malware payload (SilentBuilder)", "value": "c001a3b36f0fa6526530870dde79f424de097bb32517a0c2b2e9e8b635262019", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730453, "uuid": "550b4f10-a9af-4baf-9445-99cde3dd72e2", "comment": "Malware payload (SilentBuilder)", "value": "dc040d7c2ed9d09a705a2110fef9b1acfa58b0a8", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730453, "uuid": "a410db7b-a57e-4586-a32f-4e70060ab8ad", "comment": "Malware payload (SilentBuilder)", "value": "a733511ec019c49f2a73edcca2f6bf06432e0d05510a40232d1f68e5e372171b635bb4f016377821d91bc8fbc431eda9", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730453, "uuid": "949272dd-4a13-4598-96f9-dcc1ada27f7b", "value": "T1B0733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730453, "uuid": "26145b2c-b5e4-4ee1-89c1-3ee858bd6a37", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBc:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730453, "uuid": "d36133da-7497-4949-b6bb-de56b1081296", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730453, "uuid": "3c0708eb-f64f-4ffb-a422-5c2b1ab9e541", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730453, "uuid": "82a809fe-ea01-4deb-96bc-a7b6ab6901f0", "value": "9990936244990533.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fd1976-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655743270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743270, "uuid": "98510f32-c7ac-4738-b9b6-b29a5ca26242", "comment": "Malware payload (Heodo)", "value": "53e92eca3ebc6ebfefdfdc9a6477f9d5", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743270, "uuid": "b376751d-a05a-480e-9cfa-674cd9263d49", "comment": "Malware payload (Heodo)", "value": "c0542b5c806e83458bfa3e82efdb495c6a43d6864815ea0966fdd3302d0e9a9b", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743270, "uuid": "236803d0-7ce4-4933-8b97-cfdc465794ff", "comment": "Malware payload (Heodo)", "value": "930bbf0c3f55044962b3594189b218695441acbc", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743270, "uuid": "50ff34ad-0b3d-431e-9629-952607ed1670", "comment": "Malware payload (Heodo)", "value": "339a252365fd0f7a556f165c32ddc2b77c0b8e11bb062a418f8fc828a407bb087fa71dd1be56618ab6d91c4146e2b582", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743270, "uuid": "e7a5262f-f43e-447f-a962-efb021de8b2b", "value": "T119A48C17E29412B9E467833C88135D66E7BABC01C763F6EF0394465AFE2339C572AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743270, "uuid": "6d867206-b2d7-4142-9f99-99a43dc1fd53", "value": "0c55d7d801539bc945a4c9a78f4d837d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743270, "uuid": "5ad21134-1850-4f01-a746-7b18dce006ae", "value": "6144:WAKiBME7573E3RZPdvBzFohNPFSz2guNMkuZ5qWUdlD7wAPIztsys:W2ME7573+hBzFoXPSd3IEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743270, "uuid": "5aaaf864-8bbe-40cb-8768-1f6465c3be89", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743270, "uuid": "0fefd2de-4d88-4fd1-bd6a-7bd75ea53e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743270, "uuid": "83ef7bc8-ba48-4f07-9481-5ce44f5c1864", "value": "pSi03aTdqErJpy6yoY.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb574956-f0c3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655748506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748506, "uuid": "efdb4d29-c832-441d-896b-5459fd1c3df4", "comment": "Malware payload", "value": "f1a929f86640f21abef81718d8379dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748506, "uuid": "55992411-0546-4929-b92d-35d4588e53e1", "comment": "Malware payload", "value": "c17273757c3f732694ce9798a872ccd462ecc71397d880b63a428a7fad4296ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748506, "uuid": "0c30e810-714e-4e03-a043-df848925ac67", "comment": "Malware payload", "value": "fcfdc0f7c93578537d90b0ef0e3fcfe72c98e22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748506, "uuid": "4607f995-9b99-4482-a3e3-e03ca2cbeadd", "comment": "Malware payload", "value": "1c6b8f065d0f56b852070da38b49dbdc95b2186b14535c192609548c57a2a0845c577ae0e31c0957c83f75e87bc77b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748506, "uuid": "371f6198-5742-499a-951a-409306079957", "value": "T12A058E22F2D18437D1721A3C9C6BA3A5583ABF512E38794E3BE81E4D5F3E68138152D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748506, "uuid": "f9733891-3445-42c7-a1ae-623b572a5d68", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748506, "uuid": "229555d6-538f-49dc-9c56-46a82fadcf1e", "value": "12288:pMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9B/bAjnOj:pnsJ39LyjbJkQFMhmC+6GD9Vsnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655748506, "uuid": "ebbbfb4f-2060-4654-b7ba-b82f19cb01ad", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655748506, "uuid": "9c7709a4-266a-4e4e-9092-d153983d0054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748506, "uuid": "9d41925c-3499-439d-81fe-ab10b9a56e72", "value": "Client.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1db26ab-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655733807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733807, "uuid": "95490a7b-a6d2-49c3-95bc-b55030712db8", "comment": "Malware payload (RemcosRAT)", "value": "8f422ddec86f6e29b21701b8818398cc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733807, "uuid": "dc1253f0-9e96-4020-9bbc-13d43047e729", "comment": "Malware payload (RemcosRAT)", "value": "c2171f7aed9432c8b671fabbf2c33e64cde8e707bcbfe4468c66d4c90083ad79", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733807, "uuid": "e196b888-c642-4a3b-ac70-17b2ec9f827d", "comment": "Malware payload (RemcosRAT)", "value": "72c13081cd94d524c173d0fb65e0aff3a9d2f2c9", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733807, "uuid": "ca3ac723-2213-465d-b092-6e1d51d5cf6b", "comment": "Malware payload (RemcosRAT)", "value": "e055e1c05e559caea117da6d9e87de7422a03c61cd872b5d6ab62ade750b137017f60ec3df2a5a734b8fb760ac2cd91e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733807, "uuid": "f46035cd-db9d-4ff7-b413-8ed4d1cf063a", "value": "T188D3F6C0F4D5A481F902AE997B61FA450E333D2BAEFC1A121B7EE94937730D581914AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733807, "uuid": "98b9d600-7f47-489b-9e91-cd350e361056", "value": "1536:FDIBs4IQuPCLee0rbnjU2E0SzkmKBQxZ8iFhamGIUUjDRV/e7kzO+ubYC5Rm6Asf:XhsZVGHm6fxDqQADk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733807, "uuid": "d62f0e99-b0de-4331-9f23-b234c0e7657f", "value": 137355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733807, "uuid": "3e78e93f-7660-478e-8a91-922fead45165", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733807, "uuid": "46c5f2e2-7961-4b2d-a79c-b3b2f6c48659", "value": "Shipping documents and revised BL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19edebd3-f064-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655707326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707326, "uuid": "0e556b32-f843-4d64-9e53-44d34a6e6096", "comment": "Malware payload (NanoCore)", "value": "c2ce32e5813f6fdbe7b5ba9c488dc697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707326, "uuid": "438ec75f-0cae-4569-b57b-1abed646f27a", "comment": "Malware payload (NanoCore)", "value": "c312fdb9a3dd594d0da189024dcc598c220a93d7d8f2e5029c36fd4fefb5598a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707326, "uuid": "3037b4ef-39c9-4105-a3bc-d2689da35d25", "comment": "Malware payload (NanoCore)", "value": "da8842714d7e0941821ba442cc91f7ed7ec954f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707326, "uuid": "0e959d0c-44f1-42f9-bf8c-14a6ac6858c4", "comment": "Malware payload (NanoCore)", "value": "792fdbb6bbee595a88653a814bfe642b0186602b21d812b49ea49443ba48a573cf7c84637ea1e529efe8c22248b4acd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707326, "uuid": "4a73a047-538e-4ff7-a5c9-6e697989d551", "value": "T10BA4702CBB021AB6FD1ED1308D0D0B09FFA61F036280B99757DB1BCA874F5665E95C98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707326, "uuid": "1ee37171-c4c0-45d4-9402-affed498e068", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707326, "uuid": "03f55488-5e45-4cdb-8ff2-0ce5caf13c45", "value": "6144:/t2nB7zsqrqDl0zm8fJ5K1cl1P0E95ziAlEpNTciOgu68FKTmwuZ:F26S8lmm8R81/EnziAlEpNROgu6+wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655707326, "uuid": "e13b3c36-3c8f-4339-88ca-1d744c1e5432", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655707326, "uuid": "d6e3f6e7-e3c3-44c8-aac7-1016981205b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707326, "uuid": "4ceca83c-ce6f-4470-995c-7b77a745facb", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17169.16536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59f4d01-f09d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655732122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732122, "uuid": "daf6d053-0282-47f0-877e-20a534620967", "comment": "Malware payload (AgentTesla)", "value": "d97c8fae596fe6d063612c476dfa9f25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732122, "uuid": "f2abf0ac-0e78-44bc-8f9a-c187e97631e8", "comment": "Malware payload (AgentTesla)", "value": "c38e40b915728aba6eae01aae534d82b513cee09fe68c503fded00fc521c1a54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732122, "uuid": "9ed1ee84-5d34-44d7-bd3a-a491e69ee898", "comment": "Malware payload (AgentTesla)", "value": "c2920c175bed97c1741ba147aee072ab4432f460", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732122, "uuid": "5904b5af-6e80-4fb5-bea6-286a943cfa7e", "comment": "Malware payload (AgentTesla)", "value": "523066c2d4e79cc0c4678a2af88e5567154cbdedef5ba90d23314ca51acd195fbc8f0861887c0fd090c43903c1f7e643", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732122, "uuid": "15155539-1b29-4c8e-8180-0e58109c0859", "value": "T19794D0143BAC7D01CA9FCBBA5091C1519238808F3D63F35A6BE30DDEAD9975193B0A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732122, "uuid": "82246d8f-9168-4c22-b1d1-7b43664b04a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732122, "uuid": "c69eb534-15db-4df5-9767-19e55b2ab991", "value": "12288:P0Mh2iN3gT/w/ODOiVlOSxEZmgHVdL28RW4:8618/wvwgHVdLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655732122, "uuid": "9183194d-5652-46e6-9db8-db4a8d7103a4", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655732122, "uuid": "f6c97663-33c1-4df0-85b1-c21591d07345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732122, "uuid": "f1c8a7ef-170b-41f5-b16c-ce3058c5d6f9", "value": "PRE-ALERT ~ MV#MAERSK QINZHOU V.221W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc5918c-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655704671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704671, "uuid": "3ce02c8c-b0ab-4faf-a930-0caf2dc3704d", "comment": "Malware payload (Formbook)", "value": "16069ea2de3675d1780a69c258d26264", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704671, "uuid": "0b55c590-5125-424c-ab9f-a26fe134d686", "comment": "Malware payload (Formbook)", "value": "c3e187cf3c0b82b1fedb6340c005a03f7a51909227d3ec4924e760dd0d1b10d2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704671, "uuid": "59216053-2129-4675-a3c2-aa8fc47b3cc9", "comment": "Malware payload (Formbook)", "value": "f46bee1213bb9c182ad11cd46777eaad41c7e5b2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704671, "uuid": "e8890db9-5c23-40e4-92e0-aa5986563c58", "comment": "Malware payload (Formbook)", "value": "b8f276e76176bf9422e4f944896406ae322a6007f7dd70d2420e12f6157200e3f955435e929d293ac4b44b2965f0ecf0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704671, "uuid": "254efc85-ae69-44a6-870e-3882b01401b7", "value": "T103A423C9CBB54A4BDD3CA6F30D90AE1287857F11EFCE49ECD16BB504A0A2109776B346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704671, "uuid": "dcddf61d-26c0-44d3-9b52-6b8ef4f399ca", "value": "12288:ca31B571s9WLbHq0X6Cb1ZeMmDrQkrGQbT4gIj:PT6ALqG6Ch4N/QoGQfhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704671, "uuid": "bd9e7a45-ae8f-4908-b935-ea476e07f4f0", "value": 450634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704671, "uuid": "fe7886c3-72ab-4f32-847e-b3a43030682e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704671, "uuid": "cb8c0b8f-053b-454f-a7db-1bcbbf420464", "value": "Copy!!!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a7df89-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744665, "uuid": "3c1d101d-9e71-42e7-97c9-f4dcc6286143", "comment": "Malware payload (Mirai)", "value": "ad4cdcb8972515a8e9a1aa27fb719235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744665, "uuid": "3bb7e2f7-f302-4951-9bb2-40ed29b9df47", "comment": "Malware payload (Mirai)", "value": "c3ff01bfd338611f808ef270907cde16832aac494b007f1211e0415340f057cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744665, "uuid": "2801cd14-07f2-4447-99cc-5e490cf6e600", "comment": "Malware payload (Mirai)", "value": "9b89e18915a08981c0f6d6401b891a10db49ee80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744665, "uuid": "3b2be953-e161-41ba-b1a5-8b5e5549e481", "comment": "Malware payload (Mirai)", "value": "748135f67b6f6c4b30ce01b43731944c82d98ba45db47cc34552c0da3ff9b54767fd54546cdf69be76bcfb859b488499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744665, "uuid": "0778508b-e78d-4a9a-984b-bd441b89297f", "value": "T1B063E95A6F229FECF7A9833587B38722675433C627E1D5C9D25CD5001E6034E242FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744665, "uuid": "068aea1d-f39b-4e8c-82ad-5d6088fd0947", "value": "768:3PiowO90pH8WB7cs2Q+4+Jl9tr+N16FUygXNwaM+/kASSo8Kuj+0DvPe3inf+JVZ:/9w7cblOw8k58C0DgkEQeev2bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744665, "uuid": "97ce7c84-909f-4678-90d6-cd9cb8ec82d8", "value": 72276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744665, "uuid": "92f699a5-7f83-490d-829f-9e5537a75a12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744665, "uuid": "e1e68364-033a-4729-80a4-82352d7fc71c", "value": "Hilix.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223ab550-f07d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655718077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718077, "uuid": "68a17835-b51c-44e7-8a38-e71cd211cb74", "comment": "Malware payload (Vjw0rm)", "value": "7c2e7e5a48421b27561a23936f1d9fee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718077, "uuid": "d83cc3e6-fc96-4ce1-a4df-0e9c9aab01e9", "comment": "Malware payload (Vjw0rm)", "value": "c409b163881ea5ee746756d65f515f7a5dca8b622e6d1e557ef963acb6849000", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718077, "uuid": "ab63ae48-b086-4a84-aaed-54798110e12f", "comment": "Malware payload (Vjw0rm)", "value": "739fde5b0ad4d2f651a16e2458bf3e64bfa748b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655718077, "uuid": "d053a1e0-4cd3-4de0-8609-de80ef2a9e2d", "comment": "Malware payload (Vjw0rm)", "value": "dc6d6415eb1da550eb4c12f004517a4fe3151f52dcae1ef189a50aad5fbbf264ec74ca85ceee7c8799a07160b76f12e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718077, "uuid": "ddfe0a5e-0544-4b83-abe9-d28953b225da", "value": "T173D20880B3D234BDE66B3AF719AF000EA2BD54129549C481F929D5B53BB1F44CE27F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718077, "uuid": "3baf6c21-9279-4713-8069-bd23d5cba7f9", "value": "768:zDVQKCPd0pmkXdVwM1Nlbb1bqIgN81rtlHz8fd1L5gNAulD+N7ZQAmU:zDVQKCPd7kXdFC81RF8fdKcXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655718077, "uuid": "15330aea-f66f-4a00-a9d9-6e916471cf51", "value": 30983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655718077, "uuid": "a831ae1c-ed98-463b-81ce-f7280e5f533c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655718077, "uuid": "fbf90a5a-22a2-40ef-ae91-528f4c84f897", "value": "zpgygxtRex.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015a5443-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655716304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716304, "uuid": "ebfb22aa-a6ee-481b-a8b6-5e5efb21c63a", "comment": "Malware payload (GuLoader)", "value": "906bded58ae50cf90e8a876a7be479b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716304, "uuid": "fa4d4e07-d2b9-44b7-9a63-5afc6c4de573", "comment": "Malware payload (GuLoader)", "value": "c4c15305fa263775a2882c527a05c40852e0c33eb69cab9c3015e5b76ef516a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716304, "uuid": "25d6717d-0ead-49e3-86fc-d3b160048671", "comment": "Malware payload (GuLoader)", "value": "4a3acda8b85bcb4c196b7461c531f5365452ea83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716304, "uuid": "2b373aa1-511c-471e-86c5-a377747982df", "comment": "Malware payload (GuLoader)", "value": "17c5b1e58f291e3f0c656e38dc59ded9de5e917e213c10edafdbcf46d4b294592825dc96a1400f71e900cb152c6f0d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716304, "uuid": "46e0ba82-9969-4cdf-9b49-c4bc0f37f58b", "value": "T1C9F413303555E909C2507BB16F66FAB687647C446EE0DB432370BFAE29354F3AD0A398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716304, "uuid": "e20aca32-0678-4dc6-99bb-e0245c5e000e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716304, "uuid": "8aae6f5a-70e4-4280-8e25-a7f7c285f86f", "value": "12288:CbiYPIZYmqiBigHO8sAi6QLM0Xn7nEgYvgRU95xWo+5ycZReGNkZK:CbiYwZY+1O877UM8nSc5LXkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716304, "uuid": "83befbf2-65f4-44c0-9048-a1095916e61d", "value": 729983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716304, "uuid": "ae431e77-9b87-47f6-8252-0868109cfdec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716304, "uuid": "b16d9841-fde5-4438-9623-e7d553d77418", "value": "000224_G991DF982E4A4914AA972EC0657DE68F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3460ca7d-f075-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655714672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714672, "uuid": "9d028597-1d33-4cca-b71f-79417afb79a8", "comment": "Malware payload (AgentTesla)", "value": "10b78711895c32a82b4e7424a07f3a42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714672, "uuid": "5727d444-42eb-43da-9fe4-db257c206990", "comment": "Malware payload (AgentTesla)", "value": "c5a1a7f96960fda6d5d0a8ead5a9f3a9918bbaef02a6fada8aaacaf0d233513f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714672, "uuid": "1c8f8a81-5f19-4798-bd86-6b6b84506155", "comment": "Malware payload (AgentTesla)", "value": "f3c7befe97fc1a52de2bd6082e11fa8a4bf100db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714672, "uuid": "52aedc79-720c-41fc-92d9-dbf879d0bb15", "comment": "Malware payload (AgentTesla)", "value": "616876dc26285bb2fd809ea1ac37471ce5fb17b30929328f38348f177f62030d583aa404788c8cbcb687eec2b2290105", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714672, "uuid": "a05f7a7b-5f39-4140-a1df-346bdabddf07", "value": "T1C2C4CF897660B1DFC827CC72DAA81C60EA6164BB930BD247D45315EDAA0DADBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714672, "uuid": "0f0fa718-7979-47b7-857c-d0da4acfac58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714672, "uuid": "2f4e7e29-5a72-4bc4-8198-c69782af2ccf", "value": "12288:ZR/YUjdkPo63lJvjovksyE3aDPaY1GnChybzf/POFeloaOTbyeVJiJp:H/pjdGlJvjoME3a+wwz3GFel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655714672, "uuid": "c631a8be-ad87-4a30-b56b-51d4be05ed14", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655714672, "uuid": "3ea35304-c85b-4eec-918f-d3ea4d8a7366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714672, "uuid": "78ca4358-b869-4396-83af-3157c3f13973", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3741.8060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01b0944-f0ad-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655738985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738985, "uuid": "14185009-1057-4420-8933-302607cefa98", "comment": "Malware payload (SnakeKeylogger)", "value": "1cf397dbf455508478bbcd88885e6250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738985, "uuid": "4fd17bf2-15d2-4822-bd40-65e7e91a71df", "comment": "Malware payload (SnakeKeylogger)", "value": "c5ace959d6807804f1b6afa6aa8f041afe41fc9c8c281ca865cb8c0551d123ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738985, "uuid": "213955f6-2032-4efe-896e-03ec6e371c81", "comment": "Malware payload (SnakeKeylogger)", "value": "726f86b3e1236a0bd544876a11c5487635f849e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655738985, "uuid": "e32a5741-9503-4a0d-a2e6-54db25d864ec", "comment": "Malware payload (SnakeKeylogger)", "value": "52552e201bcf06b89482060d8be019c52b2766e60ea0f1a35a84cb810efcf9dd62d8779f3adfb1ff6f950661fa80204d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655738985, "uuid": "b9b5721f-fb7b-4f6c-ae5f-0ba7e073273f", "value": "T167D4AF883650B6DFC42BCE76C9941C50EAA0A4B7131BF207995721DE994EB9BCF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655738985, "uuid": "5f2ea4d8-9472-49c8-b7b4-87cc6cc7bcf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655738985, "uuid": "bb3fe817-1291-4739-a7d9-06fdf106d7f3", "value": "12288:xYpdqs8Qy2iNWT69/rt9k3h3TsH9ElPsvPYo0w/ng9RQcOdYco:x71QWxCBg+lEvPYbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655738985, "uuid": "9ab0da6b-8ce6-49fc-bc7c-961dd126853a", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655738985, "uuid": "fe8c7d3c-45ce-459b-8e73-23f7ac7a03c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655738985, "uuid": "ca750c81-54b1-4893-9929-bfd1c66db4d3", "value": "arinzezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c95e2a-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655716285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716285, "uuid": "9b0841ae-710c-4717-b3c6-b5ebd1a23e7e", "comment": "Malware payload", "value": "7e4a5ec3d2a65aa5dc8d5662b8b92a0c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716285, "uuid": "a593c75f-691b-4a4a-8bcc-59d63a16cb47", "comment": "Malware payload", "value": "c5d81c645df6b068eec6a8d003f550e76d6d2662f23e5c0a5faae86a9edde0e1", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716285, "uuid": "e7672256-f0a6-4d7f-a59a-9f6d45a3d8c2", "comment": "Malware payload", "value": "42dcc1e9a131ffcac20e05a87db06d8400fd9010", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716285, "uuid": "1a5ad961-1f47-4e96-8f3d-474876909732", "comment": "Malware payload", "value": "c366cf53f5ffbe349caa2033a7618be4fde20b16d39c2a256df87105af5d7f9cf4a7ebe5808e38d7cf9a3c4629437fcb", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716285, "uuid": "d8faf29a-8432-48d4-b12a-2c7b16d1884d", "value": "T18773D006363EEC3ED866EE710559E7F174543C26E8E2A52CE1337E272C35DA30AA45B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716285, "uuid": "4d685c5d-fa7e-4a99-bc60-d8c411f3c040", "value": "1536:bb4yeghm4y47uI+A31CqNluasMJa8aRFxLLEtFv/mTI2KImYPjq0:bbzh7l+OCKsMt+v8VuTILSPe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716285, "uuid": "1d25e768-e447-4df2-9297-0de0533e2249", "value": 73496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716285, "uuid": "94c50342-49f2-496a-9a0c-8730de3715d4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716285, "uuid": "786f091c-d101-46f6-bcc9-58f3274474dc", "value": "PO 009_011.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4407d524-f0f0-11ec-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1655767526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655767526, "uuid": "5b656191-e78e-4c27-a0e0-a559b7253f7b", "comment": "Malware payload (SVCReady)", "value": "5bd1110589e70c5f9203a3a1d8839b1e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655767526, "uuid": "9b7fd4d5-453a-4e55-a85e-9f55bc14e032", "comment": "Malware payload (SVCReady)", "value": "c71fa657d1264aeab2d3f657edc70a4455893d1cf7f3502adb7c7d4ca8e9335e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655767526, "uuid": "a4974619-f69e-4cc3-9819-658d0e4d9717", "comment": "Malware payload (SVCReady)", "value": "a496221115d08aabcbf5e09245544195cc8d543c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655767526, "uuid": "d9ce7e89-e0d8-420c-a9cd-413a424c2c12", "comment": "Malware payload (SVCReady)", "value": "5f8b5191105c84e5d7f52e4193fe85d1ccafa0799a4305f84a4794e944d5fa343ff8ff904d9b13dbbe9e03d81bc906ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655767526, "uuid": "d08ab4c1-7c92-4790-b802-874ad443d035", "value": "T1D0D533E54E5218FACB1107BC31C69D70BC5C326996C968CF913EF285B69E41F2EDA80D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655767526, "uuid": "ad54d399-9550-4467-aabe-59684986b986", "value": "49152:WzjCDsCsXxiATwQT+Bp1vMFdPd5WCq5arFbdGPf4ifcYpwmOLg35HI:Wz+DsxM+dPdwCb2f7fcYamkGFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655767526, "uuid": "d3a69aee-c217-4d7a-80f5-97ac5dcccde4", "value": 2748159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655767526, "uuid": "c79f74ff-02eb-4e23-bdcf-9ece9adb58d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655767526, "uuid": "e3f264d1-6b3d-417b-80bc-4e511814ca94", "value": "akibelma_document_16.06.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062c04f9-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744659, "uuid": "eb886083-ef54-42e0-b46c-f865bf35a038", "comment": "Malware payload (Mirai)", "value": "3e950d362ead164f8dda6dfd26deb91c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744659, "uuid": "cf84f15a-8490-40ac-8351-6f0b278da14f", "comment": "Malware payload (Mirai)", "value": "c7d6a45177a8cfb7a36f2d454726c0b71335a88eef885e758a29bb424aacf565", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744659, "uuid": "baa3a807-69ed-4717-b0e0-288584dbb051", "comment": "Malware payload (Mirai)", "value": "0a150b6a3b947929bd8f0e5ca5b2c61c97806325", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744659, "uuid": "692d1f5d-2112-4fb9-9b1f-267e33350d12", "comment": "Malware payload (Mirai)", "value": "fbf430c650a47a4869ce635493cb25d4794c1874bb119e00407d324b021c65b14fa81ee83e3b775f6b1a31773a896e8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744659, "uuid": "21bbaaca-414b-4c57-a96e-d88c961cf0ab", "value": "T1FB434BC6B800DC6DF41FD67A8423050EB970B32541834B367B6BF867BCB62A25D23E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744659, "uuid": "550dc969-0a77-4a41-86b0-d51e16bbb7b0", "value": "1536:RlgKbuke7sh2xk748FDbxMNL/EeFrPPl6HM+:XpoPxk7xm4eOM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744659, "uuid": "4677e9cb-7c9c-4221-9bf5-c747b0829311", "value": 59968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744659, "uuid": "f3d1e58c-0caa-4650-9809-1db2b5a57e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744659, "uuid": "735cd4c5-977e-427c-8396-89f84ddd9f8d", "value": "Hilix.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a8d799-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (a310Logger)", "timestamp": 1655716335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716335, "uuid": "9ca3f3e5-29b0-4456-b454-4f11b8c9f77c", "comment": "Malware payload (a310Logger)", "value": "dde4114e3ff1b8d74bb976348c2d6fc1", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716335, "uuid": "360e3915-1305-463f-a711-55602e95211f", "comment": "Malware payload (a310Logger)", "value": "c907fd27adf7420fd289342126b10b96d399c76559ed4450625178a7e5f04b12", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716335, "uuid": "50d28c28-bdf0-44c4-9ef7-961ab07d2c47", "comment": "Malware payload (a310Logger)", "value": "acadedca2dba2629b019ec6165dc568738bd7a7e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716335, "uuid": "735e43de-dfe6-4e62-931f-21046478976f", "comment": "Malware payload (a310Logger)", "value": "83f95cd5cee9636660964d3a82ee24f3fae48c73c4a0c4e94dc47790501f7176d6908fca7110ea5d1b6f17426de78f2a", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716335, "uuid": "7a4ddc26-06c1-451f-a31d-905963a31c4c", "value": "T15FF4221032EC6785D1FE5BF825B4565213B4E9142962E32F4EE9F0CE29B3BD1C28578B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716335, "uuid": "78f0d2e9-3255-4e6c-afe3-5e2272916ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716335, "uuid": "5bf70426-40c7-47ed-b583-528568905c86", "value": "12288:zm/242PLfh1LiiODDSGwZKlpAWaXSSEOizMCnc9XXdvbfrIkP/0w2uhYV3sFS3Ja:zIvzMEc9RHI+32uhYVp0X1S8pRHbUZmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716335, "uuid": "2146f4d0-f705-456e-a0bb-9a90b7ad5cf0", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716335, "uuid": "5aea5c62-12bc-4970-ae75-a43b9b0b62d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716335, "uuid": "adb8d2e4-0af4-429a-b610-b02f37897a59", "value": "RFQ_23233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82c6816-f033-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655686653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686653, "uuid": "f7c3f8e3-ed04-4ea1-b213-c8646b992ef9", "comment": "Malware payload (Vjw0rm)", "value": "7cddd1ada20deef4be9176c2ab1d87d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686653, "uuid": "7d52400e-1466-4cf1-8757-113279cce49f", "comment": "Malware payload (Vjw0rm)", "value": "c93f922e9a0be35410e250a03c5c557281a73dd5c648246e1de3340d27222422", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686653, "uuid": "c52f2ec2-e177-408c-b885-821359793d78", "comment": "Malware payload (Vjw0rm)", "value": "ea4f9c24abaecb0662b912c86a06b4fc019d5aa8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655686653, "uuid": "5f3ee502-d43e-4b6d-bc33-623dceba2e50", "comment": "Malware payload (Vjw0rm)", "value": "083376b566ca4040d1f55f153d30a965569d5ff0c8c57b7b3bf485e82fa6cd7303d14efa5251228a7a8a44b232233276", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686653, "uuid": "37301c9d-27a7-48a9-a7ec-83735ca994a7", "value": "T1F0D3A0DCA914F4DED921E2B97A7A3CD997E8221BD44143CDB85D72014BB2780C3EDA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686653, "uuid": "11bfe3da-b954-4c4e-a404-11960cf1be1b", "value": "1536:t7Jv17tcDGfZ0ttMhV0Hug54TGavjXq4UCpjnGsyE+N:tFN7tiGRq6hqHutSP4UEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655686653, "uuid": "8907e30b-a440-408a-9551-eecec63f641a", "value": 142232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655686653, "uuid": "210a8025-6f69-47e8-a0e5-3787921cbddf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655686653, "uuid": "191cef2a-7c7e-4340-81cc-b70df9e6cc91", "value": "SEIjqoLyloVjnew.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122f0715-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655716332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716332, "uuid": "5979ef9c-df42-4b2c-bcd3-23a21bd93e8c", "comment": "Malware payload (AgentTesla)", "value": "65c254639ae85b308ed147e27b81980f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716332, "uuid": "500e25bd-0935-46c0-97c0-d84ed03a06b4", "comment": "Malware payload (AgentTesla)", "value": "c974e399df1c43bccd6ed3b2fc7f4c0cb18099a485a7f57407f53ab74f6bb763", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716332, "uuid": "13a1b531-e79a-401e-b0ea-b4f6be73d7ee", "comment": "Malware payload (AgentTesla)", "value": "f104489d06fe038a220a0162d6a9bc3136ea4dc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716332, "uuid": "9d9b0310-6460-40ff-8cf9-ffa00def2f68", "comment": "Malware payload (AgentTesla)", "value": "7556ea4cba00db88bbf41a3eb603a27169993a09bbbf11f66d80e461fc1895db05949c27887aaf297f5be7a60cf15e62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716332, "uuid": "95f2bc7b-5d85-4d09-94ff-99cecedc5bd6", "value": "T11763DF187D21752AFBE00FFD58789EB3D6AE2E310D66E79898F633C4B4386224035C16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716332, "uuid": "baf2a45e-8ee3-4a3b-8abd-a9b1274468c9", "value": "1536:v+Df/0DMbrDoKqF8jxI/uYYWXl4bKP5LHat0nMWo:vCQMbAKqCjxazlLkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716332, "uuid": "5dde5681-cfe8-4038-82a7-0698bcc16e56", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716332, "uuid": "42b5ad27-c58d-49d9-a9a3-84b73b277d90", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716332, "uuid": "4acbc800-55ff-484b-8e85-b88d50b9b54a", "value": "shipment_bill_of_load_20062002000000000000000000000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780efb98-f045-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1655694169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655694169, "uuid": "1d480103-a338-411b-8baf-e7e9cba15230", "comment": "Malware payload (NetWire)", "value": "5c538dfac919ac38159c53d83ada7c45", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655694169, "uuid": "de6af0a7-3732-41b0-b31f-52df303f6bfc", "comment": "Malware payload (NetWire)", "value": "c98536e21791966e0aceb3414c7c163ac1d14d1953aae370b0fdded212bd8b1b", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655694169, "uuid": "e2c7281a-0162-4477-8129-89e241bb77ae", "comment": "Malware payload (NetWire)", "value": "18d23b6e5b01a976d30c431cf02619f2283f09a0", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655694169, "uuid": "0f143ae3-77f4-4493-92b4-031870f515d2", "comment": "Malware payload (NetWire)", "value": "5ef6e78134a110ace12095934a1641ad8d425c8e7cee50507ea1ca488bf680e315ef01650e2e62043c65879d0e5d73a0", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655694169, "uuid": "91ea99d4-eb94-4f20-9e45-a036d0b1ce3d", "value": "T161D3A2E4B32A4D8CFE1E6D827418F6C12EFAB53B4EDC50241B793837ABD2955839405E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655694169, "uuid": "672ed44b-7fc2-4d88-b3c3-1313a4fd589e", "value": "1536:hWmCt0fnW/fMypMxVTBPmFO/aRypPqtlrYKVYiMI2O60/VXlnzOd84mkzCIl1j/q:0m1kMyMjZpyMiS19eS++56/xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655694169, "uuid": "cbf5a95a-64ef-41a6-a281-05fec34ba952", "value": 138169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655694169, "uuid": "ad4bf544-3b3a-4b80-a902-4ed2fa87d4c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655694169, "uuid": "36b555a2-7cdd-4166-bfc7-68dfcfd7b757", "value": "Doc0094734332745.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388ee6d3-f07a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655716826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716826, "uuid": "5b615b0b-3386-4d62-aa2d-ee142260d1f5", "comment": "Malware payload (Vjw0rm)", "value": "05d29ef471cbead69dd8c6f56a900004", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716826, "uuid": "e7dec713-6221-4fb0-a13b-9994363f4d6e", "comment": "Malware payload (Vjw0rm)", "value": "ca905686651e423399d864687173d5472e4ecdbc76ea201b46d23012c799b617", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716826, "uuid": "155ac35f-af57-4491-97db-f623191374d8", "comment": "Malware payload (Vjw0rm)", "value": "fa017cb4a1ad381d6b0569f7ec50791822350ba4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716826, "uuid": "affeea60-9578-4b5b-9482-567aa61f4b2d", "comment": "Malware payload (Vjw0rm)", "value": "bf655ce5726aee691f9c6fd2ef6623dc43adc69a626d7aef1a1335363f9a6cc46b00ba00b14f0b9f42477ea80c999c3e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716826, "uuid": "0d1684e2-bb50-4dc8-bcc5-c63d389adc43", "value": "T1A9B38C94F8A062FE8B5641B33DBF2A0D57F46507EA455486B009F2322FF6B80D717A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716826, "uuid": "70d38a9f-bf48-43ed-b24a-77118ef7717c", "value": "1536:zDVQKCPd7kXdFC8SQiG4Dd4HnJ0f8OoUxsOrUSeO6Pd+bObtKXI609Iu8wQPZq6Z:wU3C8nTJg2/BQXK6u8wqIrAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716826, "uuid": "1ea39cb6-8710-4a9e-88f3-e5e229538e40", "value": 110447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716826, "uuid": "7661902f-e407-446b-883f-65b506de9e0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716826, "uuid": "d5d91e17-c3b1-4281-a8a4-29af7c6eaa65", "value": "52220106202022.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9cd2cc-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730444, "uuid": "d8e47b3a-99cc-40d3-9160-f672432eb3ed", "comment": "Malware payload (SilentBuilder)", "value": "fa847fb4cc68546a4a09a9bfa4b27133", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730444, "uuid": "7b83304d-3e87-4a5d-8ee1-72d8b60270e7", "comment": "Malware payload (SilentBuilder)", "value": "cb3ac0d336bf4fd9a850aeaac2292ce3a31532fe856253ae1ce30ab967ecb0d1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730444, "uuid": "5bf03cb7-235d-4da5-8c41-2faabc48408d", "comment": "Malware payload (SilentBuilder)", "value": "a1bfa7e797c968a187f1e0965d7752a8bcfded5e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730444, "uuid": "e4a0b927-0147-418e-9759-3fb0249dac1b", "comment": "Malware payload (SilentBuilder)", "value": "d6a7c7a1e7006f731f44ca1d7db47f8eca216e465b83c924218399d0cd2754a15095135f8ec187792def79f909da0fe0", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730444, "uuid": "ed4f7809-3529-4cd9-9020-0d8440239669", "value": "T175733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730444, "uuid": "ae6c17cb-47b9-42d2-b952-10bf123c5bf6", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBc:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730444, "uuid": "4ecfdf44-a42c-4738-a2fc-a73dd9e4a392", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730444, "uuid": "bf437733-f29c-4773-b8ad-3b3cc19b57b3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730444, "uuid": "1de54671-23fd-4c20-bdc5-e0b2b0ec2e87", "value": "100617275128197521977.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b6be3f-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655725888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725888, "uuid": "a160e651-1314-4da9-9c7f-35b15b02d784", "comment": "Malware payload (AgentTesla)", "value": "e795c9cef0927c40fb491ab19da182b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725888, "uuid": "e20c31a7-102e-49d3-9239-1880b4c49c90", "comment": "Malware payload (AgentTesla)", "value": "cb8986a8081a7ea0f09860b598129483a5a2d64c052d33d6a1b77476ab7abf9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725888, "uuid": "2b2fc9c3-7702-418d-b003-858643a63fce", "comment": "Malware payload (AgentTesla)", "value": "6960863547b780cb86f907479899615a6c0a285c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725888, "uuid": "f004bb44-8cef-45bc-ac1d-44aa449f5fbb", "comment": "Malware payload (AgentTesla)", "value": "103c5fe0f9d744055f8e7dbd8eff35c09ca8a12eb4f9bc4234e118e8a6f05c57f5e5c8e00c4356c73d6fc692f6feaadc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725888, "uuid": "d3566e96-206c-4ca3-845c-1425f55b2f6d", "value": "T112A423944A34BC35A3667FA95B4CF3CD8DF88EDB1A9084813D5B417BBB900987C25BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725888, "uuid": "ac323bfb-eda3-4e42-8c0a-5f4b9bd958ca", "value": "12288:MO5nPhe5RjG44fKxdeN43g+DjM7/c69fmAlPKFXDFr+D:MSxuIag+nYPfoFaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655725888, "uuid": "cd6e671c-7173-4fdc-9161-0049b3ed9923", "value": 465535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655725888, "uuid": "c1f9fa14-bc92-4a9d-b582-d13e3e66d298", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725888, "uuid": "14c97ddc-e58c-4d9d-90cf-d714cf1b4496", "value": "Swift Paper 20062022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b870e0-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655709869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709869, "uuid": "40534356-5ce2-4934-802a-05d6a32161a5", "comment": "Malware payload (Vjw0rm)", "value": "ead2e4417e0ba32a086cbd96ffde7ce5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709869, "uuid": "d0aab2f9-670d-4aad-a96f-10b9bbf64ec8", "comment": "Malware payload (Vjw0rm)", "value": "cbc74da583fc123ca5783a7c977f382af7a71a227888d95a9b8203bd0a2adf62", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709869, "uuid": "f0f7e008-3969-4ee2-bbf6-713677d51d51", "comment": "Malware payload (Vjw0rm)", "value": "0f47a3ec2a02054f1d54815544feaac77fb32793", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709869, "uuid": "7c885ec7-6c44-45c3-b0b5-9b67506b2a6d", "comment": "Malware payload (Vjw0rm)", "value": "4e93fe409bd5b50ec70669fc6f8ff853769f182f62b86e7d9c7d8e204107b1c5d9c282e3ed4842e30483e7dc1ec060b7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709869, "uuid": "46cffc42-8999-4a68-b02b-58b9a89620c4", "value": "T17784C021EF805BEA97585D57D07E162E52F3A336E023E1CCBA913607267EE489B17D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709869, "uuid": "180ff17d-c29f-4b82-bb9e-60187fb2ae5c", "value": "6144:wU3CsTz7Y3F/akpFIWPNON3eMJhh4KE6KcVfppCQIA+rtZ+nZsiMw2o96FbHcAv:C/FIW1ONOMbh4KE6lVhlOtAsmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709869, "uuid": "a5fb9dfe-d925-48ed-a513-106136ff9092", "value": 406198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709869, "uuid": "68d327d7-f207-44e6-ab77-f1db0dff0a63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709869, "uuid": "2b9dd802-747a-4871-95fb-67f2e4d0c67f", "value": "PROCUREMENT_001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41dd941-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655730455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730455, "uuid": "4ea1aec3-8d4a-4d68-a527-11f7ea288d9a", "comment": "Malware payload (SilentBuilder)", "value": "7ef3e5cfb307fbc6628d341d6e264799", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730455, "uuid": "04ebd50c-1709-414d-a11f-d9b592c184c5", "comment": "Malware payload (SilentBuilder)", "value": "cd18d903a0ff98d7487d8fe62218c514bd7a2037f5f4e32f2b81a5242cd01ead", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730455, "uuid": "77c0c390-0a2b-4405-ab76-a48c86c80563", "comment": "Malware payload (SilentBuilder)", "value": "9a24c6da85ecdaad9390d0afc5cbc13cb8026a9a", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730455, "uuid": "511bcc92-7b58-4453-a55c-3960b52f931a", "comment": "Malware payload (SilentBuilder)", "value": "95dff50ae13a1fb856aaa59c254ab54204fb61cfa4106cdda64b9a60e1da7bb9613832350c0516fbb96cb964cbae4bcf", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730455, "uuid": "c582219c-78b6-471d-b729-86303588bfb6", "value": "T182733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730455, "uuid": "2e598125-f3db-48d9-b061-10a47781fba0", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJB4:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730455, "uuid": "afc7f6ef-8cea-4082-93fd-c36217133b25", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730455, "uuid": "aaed8cf7-9743-4e87-a6d1-6d004e3f06ac", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730455, "uuid": "b2132337-2cdd-4a42-8795-73c1668e550a", "value": "C1821763647820C.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a49e735-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733526, "uuid": "e239c7b6-d026-4d2a-bf47-c0a079d56cd7", "comment": "Malware payload (Formbook)", "value": "e8e6db5a344b2a76274672464cd74633", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733526, "uuid": "47d0005a-bc7d-4c70-8810-c8a826db6a6a", "comment": "Malware payload (Formbook)", "value": "cd71adf7e4f77092fc252b2f26e77e95617fd71de9077182f07b54c2ddaef39b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733526, "uuid": "50ec35a4-476a-4e32-8c25-7cbdc5d59ba4", "comment": "Malware payload (Formbook)", "value": "b3cc85b851ef064f85ec1b650e6a58ed38b395b4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733526, "uuid": "6c633235-e1d9-4f0a-b849-9bc641ad2322", "comment": "Malware payload (Formbook)", "value": "b49315fbd89b27680671733264c17ab6231823c89f62aee07a98bb1747d08df1325b16f3d435dc23730198251ba692c9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733526, "uuid": "0f505ec4-8baf-4ec8-a58b-3eb8ea1fd4fe", "value": "T1C563DF867FAC8DC3EC2F78F60D16A245A12E1C371B745CB66879729C97B081BC16B1B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733526, "uuid": "73f7c52e-8277-4e70-8310-3d407e852b8f", "value": "1536:vRuKJghU0SO5XAkLzFC4i99uITS2EdQIqGRObLBvR5Pp2g:v8KG3T5VLhC4ibg27pLn5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733526, "uuid": "d971c09d-ebcf-43d5-bf08-667c48c5e1d4", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733526, "uuid": "583d0c2c-6048-4270-a426-77824e455060", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733526, "uuid": "f4d99be2-f58b-469d-8cc1-816ab9370c03", "value": "ORDER PO 101003389.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884bce78-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655745307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745307, "uuid": "83863b82-16e0-4c58-a3a1-206950993a87", "comment": "Malware payload", "value": "3229e7be2129344177e557e4acd6b0ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745307, "uuid": "32f596df-3d63-4b43-a9b9-6cdbe3319066", "comment": "Malware payload", "value": "cd842daec1b1d9dcc4474fd070c9cdf0b1cbb194649a2d22e79ded54a0a5f598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745307, "uuid": "efe68e8a-fe7b-4a21-9e92-3daf3b35cdf3", "comment": "Malware payload", "value": "cdbab03397cfdb02fab7bf9a0d382ad870d98cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745307, "uuid": "9ee884b3-1c67-47f4-8dd2-1beab1ec5dd8", "comment": "Malware payload", "value": "c2bd0ca0886043703e64db0b9068ac8df02b47fb0aefa506873e63e8077beb8cb5a07ddb45eae28b4687fe062eb31b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745307, "uuid": "099efa0e-862c-4a17-826e-5419eb171da3", "value": "T1FDB50B135A8B0E75DDD23BB461CB633A9734EE30CA2A9B7FF609C43599532C4681B742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745307, "uuid": "8325bb84-890e-4d14-9c1e-ac519485057e", "value": "3b2c194cfa3987a614a425ab2ade4588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745307, "uuid": "dd8a239c-3621-4c7e-8e5f-004646a217f1", "value": "24576:9SDrPpoIGf0GxzNqlTNpzqJ/UHCMrfiPAxu4cquQ5p3h35B:9l1fJxS4UHCMDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745307, "uuid": "f42f6f4a-5b1b-48af-b942-ad5ad5490083", "value": 2477034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745307, "uuid": "c747a7a8-747a-49f9-9008-776e36a823cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745307, "uuid": "9896b798-b318-4d87-99fb-5d5f35796a9a", "value": "HackLoader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dc17a3-f041-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655692292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692292, "uuid": "98fece4a-941d-43ef-9b64-39e43a642073", "comment": "Malware payload (Loki)", "value": "b7bc95346a7e3716d3a0020df3b5c786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692292, "uuid": "298f14ea-e319-43dd-af58-04a5b79c05ea", "comment": "Malware payload (Loki)", "value": "ce21bc34fac3800be7b220feb16ab6aa9aecdec89e82e207c2b8201a9d3b3b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692292, "uuid": "acc1eb9f-4b31-4ba6-a0ab-cfe0e57a71ea", "comment": "Malware payload (Loki)", "value": "8502089e59311ceca51a04315f7402afbc45b244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692292, "uuid": "e3b4e151-e3bd-4ac7-8515-0f935ac8c95f", "comment": "Malware payload (Loki)", "value": "7c743c25020fbe70f0f41dd1c100c69dc3ffdef82d006ec6685b865f7b9b2acbc5162b08ae90a1c5a2ce3a6c85adf862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692292, "uuid": "7c386a60-8dcf-461b-9237-cbd431325328", "value": "T1E58412152EFAD302C5735BF884E34560C7764A3E9963F31A9EC170EBB4B2B14868572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692292, "uuid": "5afad9a9-c1f5-4f78-9e82-a100cf776244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692292, "uuid": "89990b28-40bf-442b-b2bd-fb56994859f6", "value": "6144:BVc50wb1VYXjSxoP7M+MP6HuM+pDgYr5FZWjlUQKi+6AVQW9RN:sp5xk7ry6HuMIgYLEjSQPDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655692292, "uuid": "bab0462e-3177-44c5-9027-c696c5b47150", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655692292, "uuid": "293f8e70-774d-452c-b1fa-68e05070d9fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692292, "uuid": "60506e16-cc62-40a4-bdc6-9f87d11ecb70", "value": "SecuriteInfo.com.W32.AIDetectNet.01.12749.9448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325ae414-f075-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655714668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714668, "uuid": "2e591f0e-ab8e-4ea3-a5da-85aca44b5f50", "comment": "Malware payload (SnakeKeylogger)", "value": "f71aeed737f8291ccee28f8120dc936a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714668, "uuid": "c23d4896-41e3-41ea-9b95-0c5f103b0eee", "comment": "Malware payload (SnakeKeylogger)", "value": "ce504f5c7bd3aa7e42c933a733bbbd958db397fffd81b69aaee7069c4c5125a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714668, "uuid": "18c5544f-0797-445b-b0ae-1becb6931ffe", "comment": "Malware payload (SnakeKeylogger)", "value": "c01cca0fb6fe602011798436739c7a947e056a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655714668, "uuid": "03ecc046-7c38-4fa5-8e02-d85efe5f15c9", "comment": "Malware payload (SnakeKeylogger)", "value": "55c9db3f105d58166cec82ba8b62ba076d9eb52d1d5580db7128810b4974bd569bb7977889201563b9e0cce421edb166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714668, "uuid": "b462cc26-5a99-4448-bcef-f14225efdafd", "value": "T114040E35F411E70FDA7887FA1DB4E79819C76C2A080886D923493BADE5F26336D1D43A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714668, "uuid": "4e9b7760-6473-4c33-a460-27d2dbc83116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714668, "uuid": "792fcef3-2980-4d30-b156-c8b5ba67b6e7", "value": "768:9dU7FySndm5ljGHeXCdDv+dTgENZaw66666aqvp:9dSaeACdv+dUENZaZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655714668, "uuid": "4675d80a-95d5-4343-8ccf-781b90efab94", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655714668, "uuid": "146c8a71-9f49-4f74-9063-7053833a8a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655714668, "uuid": "82a35a15-ffc9-4d36-88b8-94d9791c5d74", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22001.4415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982bc323-f0a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655733308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733308, "uuid": "f426a322-a8ec-4265-85e3-7dc66ba1fd09", "comment": "Malware payload (NanoCore)", "value": "a767af4cb0739db3627d5ec035284a7d", "object_relation": "md5", "Tag": [ { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false }, { "name": "maybe", "colour": "#5296B4", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pornhub", "colour": "#7BEEEA", "exportable": true, "hide_tag": false }, { "name": "premium", "colour": "#CF110C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733308, "uuid": "768cb8a6-3bdc-4ed0-8470-9b8637c93b62", "comment": "Malware payload (NanoCore)", "value": "ce6c198f957781e58d4d0982a581ecd6c36f552fdfbf7874115c0a9be70ca98f", "object_relation": "sha256", "Tag": [ { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false }, { "name": "maybe", "colour": "#5296B4", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pornhub", "colour": "#7BEEEA", "exportable": true, "hide_tag": false }, { "name": "premium", "colour": "#CF110C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733308, "uuid": "d9d4dd6e-57cd-411b-9f78-951e9149aca1", "comment": "Malware payload (NanoCore)", "value": "44f1f8935d96545e6667ba5baba33b2ea424e1b8", "object_relation": "sha1", "Tag": [ { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false }, { "name": "maybe", "colour": "#5296B4", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pornhub", "colour": "#7BEEEA", "exportable": true, "hide_tag": false }, { "name": "premium", "colour": "#CF110C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733308, "uuid": "39744886-37c8-4f3e-ba28-ea264a7b783c", "comment": "Malware payload (NanoCore)", "value": "3b2a0bfd64e10016bfba0453e225e1996e4d082d9c8dca5539c0fd8dddb3bcde5586a1c6ecc4a1cca69871368eef02ef", "object_relation": "sha3-384", "Tag": [ { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "free", "colour": "#C8D11C", "exportable": true, "hide_tag": false }, { "name": "maybe", "colour": "#5296B4", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pornhub", "colour": "#7BEEEA", "exportable": true, "hide_tag": false }, { "name": "premium", "colour": "#CF110C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733308, "uuid": "d5ee705d-e1fb-4e9f-b25d-2a730731ccdd", "value": "T18814CF1677B84A2FE2DE86B9702212139378C2E3D8C3F3EE58D854B69B167E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733308, "uuid": "3b554664-ad89-4dbc-ba3f-34e7ed40bbcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733308, "uuid": "d5b42010-aad1-4947-98fd-7956fd3bd7bc", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI4WcZVg9FMMywQakxalJRs:QLV6Bta6dtJmakIM5hVgLMMywQVols", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733308, "uuid": "7165dd4c-4603-49f6-9cbf-44d5633baee8", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733308, "uuid": "fc620a55-f6d2-4f19-a517-a27918f72b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733308, "uuid": "937c12a2-05d1-408a-8ccb-2565f4f136d4", "value": "gasxeqf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01083b9-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655747548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747548, "uuid": "87729a85-3049-43ce-aa70-097bfb305f5a", "comment": "Malware payload", "value": "a67c3b8322682a83e015cc452bc78d1a", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747548, "uuid": "ecd3c59c-18c3-4a9d-974c-708700e4bf92", "comment": "Malware payload", "value": "ce830f802b7fdb4d42c18bd692690cfac0e2d03947c6b13f583af215a7039b54", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747548, "uuid": "a7698746-1e03-4ca3-bb48-e3308e1e6cff", "comment": "Malware payload", "value": "d479377e08e3dcf226eaf4415f7568183ccd20e8", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747548, "uuid": "b4d2d7c9-f84f-4184-93e7-ad9a71436fc7", "comment": "Malware payload", "value": "0a9b14fa156004ad5010b661b035e749da8826096b50a146c1c434a99f33ab6d69eb77a1d457e717f91ea6f9deefa37d", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747548, "uuid": "5454cfd3-187e-41ec-991d-75ad7d8d72ac", "value": "T143839E007B98BAD5E818CBB48C66A7CA0365DF9855A283A835F4FE7F7BC1954C804FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747548, "uuid": "825d8ba6-0237-4ee6-9653-3f1d51485945", "value": "1536:noIbQ4GZjzQwK5WW7VCn6Ky3FAmu3wtBUniymYq07sZzSTskOzBqMh:DbOe5BV0uUniyED8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747548, "uuid": "d8878706-f8b9-4566-b3bb-1bbe943bd46b", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747548, "uuid": "9d6fcb92-96c2-439e-bc09-48e7e811758a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747548, "uuid": "66598281-c03e-4817-bbf8-55eefe0f4880", "value": "ce830f802b7fdb4d42c18bd692690cfac0e2d03947c6b13f583af215a7039b54.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7ae0d9-f0c0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655746983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746983, "uuid": "0f027ea5-59e6-4a7a-a623-00446b48dd1c", "comment": "Malware payload (Heodo)", "value": "4eca46c687e1b4f00dfd27ea5cab5823", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746983, "uuid": "4f60be6b-723e-4a87-94fd-f53baccedd27", "comment": "Malware payload (Heodo)", "value": "cea83acf13b4ab572f1b5e12464b6a2cb210ecb16cae3d6b945504c4289c3aa6", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746983, "uuid": "d0fb204c-8579-4284-a192-89d8b32d42e6", "comment": "Malware payload (Heodo)", "value": "b31f3e36d00c00106b49d7bf38aaf149df956506", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746983, "uuid": "2977914a-0353-4d94-93ee-359fc1c20867", "comment": "Malware payload (Heodo)", "value": "706f9bd1eee9c3148695e4a325e122e8b5023a2ff50496cedc41b0321bf7dd06d845d957bb8bd6babcb31abf15045c60", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746983, "uuid": "ccb1975e-ff44-4f1f-a2ea-23d8cd62f717", "value": "T1BF948DCD33D343A8F96FC934C9234A72F971FC454370960E029B26A9DE2F354962966B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746983, "uuid": "d0cc0254-f82c-4294-b9ef-fa929f80a38f", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746983, "uuid": "5ac4da43-ee3e-4864-bd16-9cfd8db14d62", "value": "6144:HRNTd2x9WN4bAFWRFNA8x6SQEDM3AD2lUpDi6uGGYiyUH7zZHTzy:xGbvdVLpryFXdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746983, "uuid": "5c9fe412-c8c0-4c7b-866e-6ccd67c68ba1", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746983, "uuid": "8c9b1b62-abf9-48bb-86e0-f9aaeca519fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746983, "uuid": "d9822f7c-b984-494b-94b5-31f528d9ac30", "value": "7oPo38SijyG2J4r.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b565cd23-f0f3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655769005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769005, "uuid": "627332ff-c9b9-40c8-b41f-43b5509ceb1c", "comment": "Malware payload (Mirai)", "value": "7ca9a2dec8fec0fc10f8971fb55c4ac6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769005, "uuid": "254b5ed2-760e-40c1-b4fb-e5030ed65bae", "comment": "Malware payload (Mirai)", "value": "cfa118bbaae576f179351b7f87497c6ae358dcb00f86a9a8244c4199fa8a72d4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769005, "uuid": "f984de88-31c3-4f6f-a44f-905229101f85", "comment": "Malware payload (Mirai)", "value": "eaf9f06f92db639775817df037bb80848fcb593c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769005, "uuid": "12b20bbf-7567-4dcd-b522-c1459aaeaa16", "comment": "Malware payload (Mirai)", "value": "1290bf0d50b16ceb92e9e4d4e8466a0ccbe8eabbd58376c4a00617aa40cd99d72cdd0fd8e4cb34c8961e4d6014afce63", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769005, "uuid": "71a7e533-d978-470c-8072-f10045dcf02e", "value": "T1D853020A7A22257B4E748DBB8086CE81CEC1136C6F6FA7B255B4017C1B4639B67F2246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769005, "uuid": "6781ea8b-4938-4c07-ba17-cee49778cb1f", "value": "1536:NW11RwXS83z/tIgnyxqkbq7n+UEZLld19DhGFDh:8bRwXS8j1cck+7nNuLl9hGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655769005, "uuid": "f221bd96-1adc-430c-b901-224efcf528bc", "value": 63856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655769005, "uuid": "3421b12f-c49d-4700-a8d0-4efbd664d470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769005, "uuid": "06cc3d9d-8000-480f-bd63-2702e40bdedf", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d03ffe-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655715229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715229, "uuid": "e2faf1f3-4254-4ff1-8315-2a856d2bc9a9", "comment": "Malware payload (SnakeKeylogger)", "value": "3507b96b11ec1512f500132915b9c91b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715229, "uuid": "504906ad-79ce-49eb-893d-cecd277c748d", "comment": "Malware payload (SnakeKeylogger)", "value": "cfe187b4289d43017be0bc24969d705372bc381fbe11189be93207422b118905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715229, "uuid": "e4242183-839c-49aa-8019-266a7681c487", "comment": "Malware payload (SnakeKeylogger)", "value": "9659e08f4a2ac2e3139f329701a62e48399d2a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715229, "uuid": "7c48abca-7b6d-4399-a310-e574f82aac37", "comment": "Malware payload (SnakeKeylogger)", "value": "f5bf13c80c07a72fc7267e8173c1c2dfd0acdfd89274eab15d90e08aaa14b51d050b562c5ce9b2ce10f0f8521e91bc3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715229, "uuid": "d34c14d3-c625-442a-9a29-4e9ec42d6dd1", "value": "T13FC4E16023B88318D56FABFEF07050340BF9B927752AE7AE9B4174DD15D27828433A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715229, "uuid": "d8f0f308-f912-4977-9868-235db894bc33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715229, "uuid": "a805dfc8-7517-40c7-b443-a1de32a8e6d6", "value": "6144:zWr1S/Qz6OnV4JbCuzG/fBR/ocKKgpuP7rnWHM/8bN9ym+1NmuYiHRPqnwXmprvu:yQ/UTXHBOuPfWHIC+rm9ScaogX4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715229, "uuid": "dd57f1fe-234a-40cb-93ec-fb65ea53ae26", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715229, "uuid": "8fa59793-dcec-4170-985b-d6743e7a147a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715229, "uuid": "aeb67ec1-12c9-42b1-86a8-68cd2b7b14ce", "value": "3507b96b11ec1512f500132915b9c91b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d722b8-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "3b47efd3-78dc-4dd3-b489-81d9ca3720d6", "comment": "Malware payload (Mirai)", "value": "5476108cd7b1ae7f814743fa1a563517", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "34cedee1-2761-4895-ac2d-424c82e94d8e", "comment": "Malware payload (Mirai)", "value": "d0c60c78ee77c802c4b442eff5cd53c81cf5b17ac88ab7979351eeae765c2e1e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "207532d6-6b6f-48bd-8bd2-f2f256c75297", "comment": "Malware payload (Mirai)", "value": "e89639ac692db7a0e7a590a25838a934862af8af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "1c7b83b5-c2e7-4da5-b57b-85e3c03a9617", "comment": "Malware payload (Mirai)", "value": "166c423c9403c8b19b173d8ef180e382bf7c01558f92c67b7214fd2cf805399f752869d28998f1a71d86aae73c469c4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "5e84b3ad-e8b8-4ee8-88f8-d876b7594e51", "value": "T14CB2C075D4CDBB70D3305431D26A8C4B53951BF7E8E736460B0202B47ADEAA0B6786CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "50e6e657-7804-4c38-9e5a-7f30c689c425", "value": "384:XtbZciv+WjgXQf2GWu75YZV6K5dFllRRi50ZUbsn/F0yvehymdGUop5h3:dbZcjWjgXQf2108Vnlle6Z7/F0yWs3UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761806, "uuid": "79b1dcef-1438-47f2-a279-8f0bcc88fbbd", "value": 24072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761806, "uuid": "32b330ab-b890-4c50-a845-bd9c7fec318f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "fbbae5fc-9a0f-4619-a999-169f0ed75e4f", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbd6256-f094-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655728327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728327, "uuid": "42425b62-be78-49f6-b263-686cd73340de", "comment": "Malware payload (Formbook)", "value": "6ca8a60f5c34cd4007edb912c1afde9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728327, "uuid": "088a28fd-5c6d-4928-a678-571a4eeb18a9", "comment": "Malware payload (Formbook)", "value": "d141b9e994a78ea1081fd3ea0768e3c7f01d3f570910923a5ace448b98e63e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728327, "uuid": "8a4257f3-3ee5-4366-8331-0a4d089b6a3b", "comment": "Malware payload (Formbook)", "value": "8cc9c9bbc0668c4a7f191e56541a94d36fbc1134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728327, "uuid": "bda6a56e-72c7-4706-a5ae-87fb125eb956", "comment": "Malware payload (Formbook)", "value": "ad6b6324212978c1448d71a1724a6e90902d5e350a72613641afe30c2f3b5b5eb7d674d3560bdf3b18e203d86ecc0e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728327, "uuid": "7cadd02c-86a0-4775-a4a4-6b18654a4426", "value": "T16225AF22F2908437F1B319788C5B52A8592FBED32D38A58A2BEC6D4C5F772913435397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728327, "uuid": "d9b60ff9-5c14-4ae3-8079-b84313316f92", "value": "6bc49b119ffc99d9e27364e06b706e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728327, "uuid": "80038fe9-257e-407d-ab74-8ad175e1840c", "value": "24576:mArq7iX2O7Zo+r5E1kBiKvyJsPFtZd52EUAEc:m17+7rTPdtZ9Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728327, "uuid": "e7bd9fdd-5ed3-4417-b943-edf3639bc46f", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728327, "uuid": "a584263b-f639-4daf-9a96-0d3471063378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728327, "uuid": "c8e79464-ccf9-461b-8597-53561818ad3c", "value": "SecuriteInfo.com.UDS.Trojan-Spy.Win32.Noon.gen.9267.6445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1052d15-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655722209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722209, "uuid": "b660e0ec-b4af-4a31-a3c1-feafb843f0ff", "comment": "Malware payload", "value": "3c0cccf2790ba49a122d0235225dbceb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722209, "uuid": "c3f92805-a0f6-4d03-bdcb-b6070696a390", "comment": "Malware payload", "value": "d19bb4b16b00b6c088c624dd7a7f130e688c6502143c1763a572cf0b77ac7dfc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722209, "uuid": "d9892b3f-d151-4e69-b595-3180bf84db8d", "comment": "Malware payload", "value": "025c2e69c519f7bf3a9682e045ba49b9a349cae7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722209, "uuid": "b70578b5-188f-4bb0-92e3-b80db31960cf", "comment": "Malware payload", "value": "90640c3f6513e7f1fe5bdb80a303b9d187462ed8d0f0df9fc62597ea8caecf050acd1577a98c1be9a37d75e4cac0e877", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722209, "uuid": "5ad9984c-b58d-4c35-b767-157e6ba46f91", "value": "T14FC52342F665B52BC836D0326A56137A54065D0CCA8BFB4B3A0A37BD39B7CEC4F816C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722209, "uuid": "4ca346e7-30fc-4871-a194-7c7b1dc2705e", "value": "49152:wIgYN2eWcmEUR6c2ahba+DCnvl7YBE1TwToJQ3rGV8WDJtL74Dlph6ja:TghXYUR6FapCnvl7GE1TwkJQ3rGVXL7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722209, "uuid": "bd178fb8-5de3-4156-ab11-08a49d574197", "value": 2675942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722209, "uuid": "241205eb-59ba-494e-baba-b6dbbfdf261a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722209, "uuid": "f2e729db-c6fe-4b11-b71a-97d9da43933f", "value": "go.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757a90a3-f05c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655704044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704044, "uuid": "96e84adb-d4af-489f-bc26-ac5f5b9a1b18", "comment": "Malware payload (Formbook)", "value": "50572e4728c7f43cba542f7778d4ea0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704044, "uuid": "34a26d7e-29e4-4cf5-82d0-9d2bf1a06f9c", "comment": "Malware payload (Formbook)", "value": "d19ee254c80f055cc9105c37afca0e2cfb2ac45ae933547004eebc4011aca538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704044, "uuid": "14a0502d-7e69-49e7-a071-524b12e5d063", "comment": "Malware payload (Formbook)", "value": "cd7e5d1c314b3d8171bdf7592d2192efd0378277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704044, "uuid": "b9a22291-15ff-44d6-ae81-27d128d91246", "comment": "Malware payload (Formbook)", "value": "da9381e8fbd3330c7c0159030b17c775094ecd00905f55a06c09567803bdf995127dcfb8aabd413082081da7e631df35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704044, "uuid": "ee5c201f-8b02-4212-96fc-e3819e398949", "value": "T10AA422152F7893A2C4FACBF595EB458197B18A35E993F74C8EC630C924BBB148094F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704044, "uuid": "784e6390-809a-4e2e-b1bf-50a0bcfef244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704044, "uuid": "f9b6c0cb-fb99-47b8-9767-950e2f64b899", "value": "6144:sZ9OwD/RunII15DbhQ+mjf8e32VAB/QzBcfn3n/EdJWXwDOr80baZE5fVTr0e:+7RS15ffOUecABozBcf3nkJK7baZExV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704044, "uuid": "57fd4994-47b2-497d-9d79-d5112abff705", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704044, "uuid": "21d750c1-f0e7-4a42-9003-f5cfc4fcf6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704044, "uuid": "ffac48d2-04ac-4095-832e-053862dd38a0", "value": "fwCHryPZ3tK0bvs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ce0609-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655734134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734134, "uuid": "66fb507c-1a95-48c5-a92d-5d4e54461a80", "comment": "Malware payload (RedLineStealer)", "value": "243f4442416942dc2ddd1b6da7b3fd30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734134, "uuid": "d33fe107-2f65-4e6a-a12c-cdee5614d96d", "comment": "Malware payload (RedLineStealer)", "value": "d34f1d23b7dab0b50f29b8647720aaac21c3c43cd3deb478e55b2b46a9872334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734134, "uuid": "816fb653-e640-48fe-a94d-c5af2eb89dc1", "comment": "Malware payload (RedLineStealer)", "value": "02209d4d4327227d6ee9625e5659b12a1db8ea50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734134, "uuid": "cf1f8103-1e75-40b2-acad-e60ee4cbd097", "comment": "Malware payload (RedLineStealer)", "value": "2cd1eb402d0bf382a72e7949bf2c256380a450d719953ede18927f5cd768e5dea7269ba0438042c96b87701a17d96e2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734134, "uuid": "0ced9af7-9bbb-4366-9c18-f99e9d4bfaa0", "value": "T18094F2357B91CC36C592167049B9C3F12FBD38121679994BF7680BBE2F302912AB935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734134, "uuid": "11211188-06b1-4219-b45e-94982c87fdb8", "value": "32138f5b4c47f39b193f3de45cb1e6c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734134, "uuid": "d8aff859-4f63-4a3d-8458-35a4a7e05fc8", "value": "6144:vnWptuEL0GJj69rkysszxYeM2PiQ3p22tNE6TVz:vn2tDL9W9IysszxYeOQ57/TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734134, "uuid": "7bf31910-6372-4db7-b834-fc4b0a3ccef5", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734134, "uuid": "e3d256b9-9566-4dea-862f-ea71b2c8e29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734134, "uuid": "30fd6495-a35e-44fe-bdf7-ac1b15510e28", "value": "243f4442416942dc2ddd1b6da7b3fd30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bffeee-f06d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1655711283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711283, "uuid": "28849313-c921-4895-baf7-e4f0a072c694", "comment": "Malware payload (Mekotio)", "value": "0ce3ed7cb95cbc49621cd388170ff91b", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711283, "uuid": "64c52317-d06b-4bcf-91cb-f8c0ae039376", "comment": "Malware payload (Mekotio)", "value": "d3ac2ee262568527bb496eb66f3646d8f165430041e2cc11a922d3968ad6e9b3", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711283, "uuid": "a7bb2a84-ff14-4b9d-849a-7cb17428381b", "comment": "Malware payload (Mekotio)", "value": "3eb363ec1a1d6b882eeb9aa4a31919a031ad2257", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655711283, "uuid": "8a8564ca-3033-466f-85b5-badd6b614800", "comment": "Malware payload (Mekotio)", "value": "4ebce052bd29a6abd4e14a7a96b661de39a8de55627f58d6149caa1d481d7c7c2c0a46ad3cd5fbe6003cb1cb1b9223c1", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711283, "uuid": "3c64a547-9b58-4357-bca5-270df4780f03", "value": "T135C5AE2675DAC636EA7E8270652DCB7A60B97FF00BB244EB63C4592E0D744C10272F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711283, "uuid": "b18c08ed-5ed6-4d83-a794-f216ddd5be34", "value": "49152:uMQNitjVqoAbAUKtulJl7VFv1lxKOC8fE/co0Oj+qHfV5xJd9zlYdxDOjSETeVfY:XtMLAptulbxKO1fTCWOjSEPYHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655711283, "uuid": "f24adf5a-6c43-4e78-8409-728cc24de155", "value": 2575872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655711283, "uuid": "a5dbb956-7691-42de-9259-8bed734ab888", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655711283, "uuid": "4d757cea-7acc-4997-85a3-8b0fa4ff20b6", "value": "d3ac2ee262568527bb496eb66f3646d8f165430041e2cc11a922d3968ad6e9b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb38949d-f09e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655732588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732588, "uuid": "13345c6d-69de-486b-b580-43f58cec7d54", "comment": "Malware payload (Formbook)", "value": "3a50c049cb7c89e9a6829f1725d31555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732588, "uuid": "3b7a0b1e-7d0c-47d7-8bee-6800beb5a6b5", "comment": "Malware payload (Formbook)", "value": "d4aba71c5e7292eeea13722a41fc53166e50a6d7cdf6a1a28b94ca8c1cfc2245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732588, "uuid": "a3644f76-f1e8-498b-ad1e-111f24e7af74", "comment": "Malware payload (Formbook)", "value": "2de2ff251c9fc219643733316138af6d210bb725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655732588, "uuid": "d8d51283-cad5-4d81-91b6-820572239812", "comment": "Malware payload (Formbook)", "value": "a9a7697dfe7767b9b2ea46f8a3ea037157a3b11bb2fbd4bdd575be7d2c78dafa73a0d7ff33d04c92ef97522a6bb59da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732588, "uuid": "55205430-34b6-470f-8099-6029bea5ab2c", "value": "T11A44F11BB3988F01C5686A3AD8DF0A2427E49EC23533E7167F59725C49833E35E1A6CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732588, "uuid": "0970058b-016b-474e-ad2f-0149fff86f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732588, "uuid": "6453851c-7c76-4048-97bb-7da885c6e9ff", "value": "6144:Q89PfqA8dGP9bFbwps2/Jn4LpzFLwvPi7Pox5KXGIj7rsT:QymE9btz2xWHLwvGPFX7rsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655732588, "uuid": "295ec389-78f4-4b82-929d-033e2429c4a1", "value": 278040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655732588, "uuid": "5ddafdbf-a71d-42b6-8d36-be7a92bf3179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655732588, "uuid": "451c4531-b036-4141-8fea-8f0180a58466", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17983.29545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c38984a-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655722094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722094, "uuid": "37f977d1-fce6-4d47-8fde-6dce0199e1fb", "comment": "Malware payload (SnakeKeylogger)", "value": "0229ca3a38357b0af5778ab45982f3b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722094, "uuid": "d2fd6d87-2bd5-4ecf-b0e5-b6f4a76fb0ca", "comment": "Malware payload (SnakeKeylogger)", "value": "d5089097d89c6c35169c7abd2a96a5e7b676543f8cc932032642a75416f66ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722094, "uuid": "cb99d259-b5bf-4c5a-90be-6e38cffc9621", "comment": "Malware payload (SnakeKeylogger)", "value": "aa3efb63bd92d2019d410c0e03296f58fbaed9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722094, "uuid": "e74195ba-5020-45c4-aebb-43196f8b0adc", "comment": "Malware payload (SnakeKeylogger)", "value": "574248ab702a5919ca6861d46cfb959cc91ce5914e8e931f8f1eb164c07d50fa98c21ff671743c8addd79e562a125aa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722094, "uuid": "5624749a-213c-4ed3-b99a-d5524b70dd75", "value": "T16DE48D5CB21C78DEC85BC63589B49D2CAA10686F771B810790531A9EDD2CB93DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722094, "uuid": "d5c954f5-d340-4324-a8cc-6bc643155cbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722094, "uuid": "16971cd7-957b-43b7-b22e-58b744f98b6f", "value": "12288:OAnsCLPm7FtUsHfhX+JgHv4yAGTleLDny20USsXIat+zs4PWNC0g3RgwyOg:6CC7FnhOJ+gyAJghgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722094, "uuid": "56302d2d-c90a-4e47-9e1b-bd6c5e94c821", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722094, "uuid": "7dc53843-1b77-4d40-a27c-8ad140fcc626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722094, "uuid": "94d62958-da73-441e-924a-025ed246a321", "value": "Z10, S10 offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa78438-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655746608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746608, "uuid": "decb9ec3-a486-4612-ac44-b6c634abb3c2", "comment": "Malware payload", "value": "be1d7a02e92963b76806685415debd81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746608, "uuid": "683bba8a-c8f6-40f0-9544-bfd6e3091fbc", "comment": "Malware payload", "value": "d56fc5e1bc194507c34dc97a117ccfb40e83f9bffc4afe6ae1a0fcf5a3129711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746608, "uuid": "d8c9d003-8501-44c7-93f4-991ffb6337c2", "comment": "Malware payload", "value": "c9875b683f0544b977a016370dfeb16245cf4894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746608, "uuid": "57f13ec4-84f8-4026-80b8-fc450c393e90", "comment": "Malware payload", "value": "fa4f59447f6d95a59f4d0043d44c8c92b1640ebd9811e5c24b2c949bec139bdbfd41e67937a1f0189ee0d6027c67231a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746608, "uuid": "c7da8892-3406-41cb-8ef1-a620a63a1a5e", "value": "T17342B508D3E88263EA9F177D68F2870207B4FB56D522FB6D25CC50E71E93B4A1E09356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746608, "uuid": "3b6f3dc2-f485-410d-93b5-d5263c96eecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746608, "uuid": "15577820-1a08-4c62-974b-2f32f2e57523", "value": "384:Pcu8BggxSBwInM6VL1EtGdEPEU7b9Fb3Y:Pp8BggoBwIndFedbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746608, "uuid": "376982bd-04d0-429e-9506-8a2d219177b3", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746608, "uuid": "852b853a-9fc6-402f-9e88-64535519276d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746608, "uuid": "6ea18419-6849-4146-a9a9-ec6956c4cac8", "value": "SecuriteInfo.com.Trojan.Malware.300983.susgen.16826.9726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dd2725-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "e049095b-8774-4f63-97b6-01b4435a5fb1", "comment": "Malware payload (Mirai)", "value": "bc275bc3f68d8137d7381fbcdfba2b18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "86861c65-6d75-4896-9764-f274847d750b", "comment": "Malware payload (Mirai)", "value": "d62c7dbf054573fa91d0b0f49c9936b7b361dcbfcb7261cebf7965c9e5666a6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "5c3a6363-1899-4c3a-ba1e-00b5c2726f06", "comment": "Malware payload (Mirai)", "value": "ccdb9193b647441bc327f8bbb2342e4308db8f7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761806, "uuid": "02dbbb28-5801-4c27-b776-c4422ab815c1", "comment": "Malware payload (Mirai)", "value": "0c66988036f06fc8ccf6f51a049d2e5d138efacddb44608320c2691adbe34648a3c0c71b5b4f01870cb8051db20af2c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "ce50d59f-3186-4eb9-8f0f-c16437d684e4", "value": "T10E330885BC91EA25CBC15677FB1F018D3B1953D8E1EE33039D296FA0728BC1E0E5664A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "250526af-0f75-4e23-a191-99f3a8d9010c", "value": "768:6SYxdrkS+kFaa8llqtpLowcxdrp68ABYI2k41+yZXNdGqGrGdxhLblTcxDEAIQpp:XUdrkS+maXUpoxMduSPBkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761806, "uuid": "4c9058cb-9f24-4d18-bb27-8e46366cdc99", "value": 54304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761806, "uuid": "0e67919b-6b8c-4182-ade8-f30f4501ea18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761806, "uuid": "50b53964-4d28-42f8-827d-d0bf1d2beb3b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f32a7a-f0a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655736664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736664, "uuid": "54effd4f-2fc0-4fff-9447-78b53a7dbe57", "comment": "Malware payload (Formbook)", "value": "19861d87fe26d68455c99bf2f9bbcbd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736664, "uuid": "79b9ba5f-dad8-4ffd-be58-95777705b98f", "comment": "Malware payload (Formbook)", "value": "d633761b804b67c96b1b53eef2bc4be89542c95406882f35d2dc12ef24f35885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736664, "uuid": "09a01514-ed6b-4105-a31c-d6383a5ecf36", "comment": "Malware payload (Formbook)", "value": "a6564b4d40554302eaf5b268c1b68ee782106e7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736664, "uuid": "10de13ef-4a55-4158-9c76-39884c77d6aa", "comment": "Malware payload (Formbook)", "value": "1c77343eadf4e6b4f7a610a8ce2ebdbecf13eadaa272ea12107b616bb0c067dbdd6c81efe1a8d3c4baaf8394ad660a82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736664, "uuid": "bad57ccc-e242-4665-902d-87ea474d7aec", "value": "T18C44E05A33D59F10C42DB971C5CF022403E8EEC33677A3527E4A3AAC5993BA3AC5568D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736664, "uuid": "45793acc-4ef9-432e-b793-56a409398e7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736664, "uuid": "2ab319ef-fafd-42fc-a15b-79b6d7806077", "value": "6144:VnM8WLfm91b6tVBE1HfdGR/SI2Os6PWFaJYr:VaOiVslGb6ABJYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655736664, "uuid": "5c762647-bfbc-4915-95f2-f3c56c236464", "value": 275480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655736664, "uuid": "1dea6949-459a-4f75-9ef6-9f355558ae2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736664, "uuid": "dcb552cb-20f1-4fd1-b23f-4d4a74afae29", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17604.15051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dceca9eb-f06b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655710660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710660, "uuid": "fa9a6849-877e-4c7d-a4e1-b619287cc042", "comment": "Malware payload (Vjw0rm)", "value": "8c577d950786e8262f22dd3c23ca8c07", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710660, "uuid": "43e27afb-3458-446a-be14-18103fa5879b", "comment": "Malware payload (Vjw0rm)", "value": "d6d4d55f2df43c5d2a35a96b53ac0f949673a901ce8aeb41ed1144ecb7b3ba09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710660, "uuid": "eaa58ade-d600-4c70-9b49-c5d83cefac69", "comment": "Malware payload (Vjw0rm)", "value": "a933a3f7da664089ab715ee06ca9fdf17d9ef318", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710660, "uuid": "9344ee45-b605-4cd0-b042-71aea4ec243c", "comment": "Malware payload (Vjw0rm)", "value": "121d240bc9307a24201469f7bdc1dd863602ca06b291f87de6ac96043a843cced111bbc5538331f59c3233af10581f28", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710660, "uuid": "e70c56f2-51ad-469f-8ab0-61e8dc5c4f02", "value": "T169839ED0FA9031BED69650F719BF2A0E53B49103AA049445F265F6302FF5F88D627F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710660, "uuid": "17702e09-f6f2-482e-81ad-3a49c283f9e6", "value": "1536:zDVQKCPd7kXdFC8aC4iOjtOfn9YDWOOq/WLOFr8Tm34lfrHP3f3vr8fdKCXN:wU3CS3J9NTrfTA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655710660, "uuid": "4e8ffbc8-39a3-4424-9816-9826b638dd30", "value": 83472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655710660, "uuid": "2e2da935-4f63-4dc1-a4c3-c5ba734662db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710660, "uuid": "e7a6a74b-f68e-47b2-8bd8-be4b37a0bc8c", "value": "ORDER SPECIFICATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a42a87-f099-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655730438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730438, "uuid": "d1574b8c-88b4-4ae1-badc-431bc4bc324d", "comment": "Malware payload (GuLoader)", "value": "d063a69e87068b9b74a40a350d7550e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730438, "uuid": "4f0e9b06-0bc9-4dcd-a5cd-791f41c622f1", "comment": "Malware payload (GuLoader)", "value": "d79f464c8fae16edb3299d47e9ba6a4bf1fae30c590dae2670de26f9a12c3f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730438, "uuid": "4cedae54-f715-4411-94f1-e3632109db63", "comment": "Malware payload (GuLoader)", "value": "10e6291c1d1e4f33778e81d6919f99d6ac08dffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730438, "uuid": "3dc8b073-2281-4726-b86c-85dd7c82cac0", "comment": "Malware payload (GuLoader)", "value": "c00c1fe9d1875cb9af26e7f725f504d030a1161361b7e4d527857a209b232c382482a78a6288236ef05a1565adf103ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730438, "uuid": "7324ebec-ce99-43b2-a3ba-d51a6c755467", "value": "T1B1D4CEC7A5AC40DBC9674CF0D89A9E36219F389B4AB25A5317936F0FE073252405B63F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730438, "uuid": "c54a996a-6578-42c8-8426-4f4f4e4b465b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730438, "uuid": "f384a519-56af-452e-9ba3-e866f93652c3", "value": "12288:pb6mwFqosjGtEON7UW1tt7t5XaGCRZRb/SBrzzWDFl6x:pb6z4osittUcT7tMzRLCrHWFUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730438, "uuid": "fe8eb46b-be0d-4296-9799-6a61d85d36ee", "value": 606500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730438, "uuid": "ed6f8ff2-fb9f-42b2-9c2d-f00b6ebe5ad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730438, "uuid": "a45918d1-a49f-4f37-a154-9474f46fb4e7", "value": "SWIFT_INV50004879_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0194807a-f06a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655709862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709862, "uuid": "f591f2c6-54d1-4e15-bb6e-ff08bd3f27f2", "comment": "Malware payload (Heodo)", "value": "0506e6bcaea3b54584ee414b08fd48c3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709862, "uuid": "d4b19df7-c7e8-445d-adb1-d1d73a1746b3", "comment": "Malware payload (Heodo)", "value": "d7ec5139b06067100252e304a3f5f0a4330916509b61865f72400c8e1d12eaac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709862, "uuid": "eda0ffb8-0b4b-4d93-ac87-b00ae0acabb0", "comment": "Malware payload (Heodo)", "value": "7bded0d7c52116ff3dfde8d2f79fe76e82ffd995", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655709862, "uuid": "ed8b2845-d992-43b1-b921-329e9ade67da", "comment": "Malware payload (Heodo)", "value": "c3b5a563d987639db349f3b44fd4528744144acb703abc67f63a7470d834c688984111d6d06230d6ab44e73e1f37e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709862, "uuid": "b6c90ab0-a7c1-4a4b-9efd-cf7c5cb74c8c", "value": "T160833A96B659CA9DF926873048D747AA6323FC304F6B07472264F3257FBC9A05B0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709862, "uuid": "507c267d-4c2c-4149-854f-c1ddc7910694", "value": "1536:ROOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgG7HuS4VcTO9/r7UYdEJeZ:RBKpb8rGYrMPe3q7Q0XV5xtezEsi8/dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655709862, "uuid": "202cc534-da7f-4fec-81cd-21f7bfb105ad", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655709862, "uuid": "771b6c98-5e32-48a4-9102-66bebc911cc3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655709862, "uuid": "90519d3e-d583-4e97-af56-8db30bc51ef8", "value": "5965722715234250247.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0aa43db-f0a0-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655733322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733322, "uuid": "2b9ee562-82e2-40e4-8604-73ac22a12baf", "comment": "Malware payload (SnakeKeylogger)", "value": "546ecd6a53fc96679db4d0a60105372e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733322, "uuid": "a3e9d9ab-8f26-4a0d-8b81-10f2483dd755", "comment": "Malware payload (SnakeKeylogger)", "value": "d933982f919e359685ee9f161ea10b50c44dbaf0c58c6e89abb93ad7294ebe66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733322, "uuid": "bdd4969e-1521-4dcc-adda-d05c910ff9fc", "comment": "Malware payload (SnakeKeylogger)", "value": "89c0eeb135a2c5ef2bb341779b1958194f78d660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733322, "uuid": "33c2fefe-666c-4f15-aa0a-21036cf087c5", "comment": "Malware payload (SnakeKeylogger)", "value": "36114d38f421983033ed22136ec6828030db014ffd03ed2ef88881bf5e56a88e99c3cd36a5f915e34ea53d25e5983785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733322, "uuid": "e1e7c521-ed4f-4d9f-9fdc-3c601bfdabb8", "value": "T13DA46B9CB22C34DED85BC27699B45C64AA10746FA32F510791930E9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733322, "uuid": "94b05529-ea46-4531-a05b-278ab5e18d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733322, "uuid": "913b23b0-d69d-4a9b-9658-ccb98e8bb38a", "value": "12288:GkX9fQIyrpfPSyLhJgVcN3DfgY/uBMzaPxk5OuleD1bO4QS7yTU/5:7QIChao9zfv1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733322, "uuid": "805abdd8-3456-4709-84d5-8330d788c0bd", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733322, "uuid": "cf291c6e-21a0-4fa0-a7e9-e0d2ec688687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733322, "uuid": "d0025fef-6ff1-4cd6-a6c4-f8ff813ed7cb", "value": "PU Request Form Hardware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cf2518-f0bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655746620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746620, "uuid": "cdaac9d3-a42f-444f-b93e-1d3331cd24ed", "comment": "Malware payload", "value": "e88b4af34c71b5f1bfdc3e4ba1d9a02d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746620, "uuid": "0bbb78df-68f1-45d9-9d10-8a84806a8767", "comment": "Malware payload", "value": "d9a00915df5440745c87c39c8c0bf5d0f9d67c9d4252f032ba0dff6fea1d0752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746620, "uuid": "5d68c7c0-5c2a-4868-a364-b39f37f34dd7", "comment": "Malware payload", "value": "a7a3f5b5fa75b917621f1a74f5d71f28e1b6c1e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655746620, "uuid": "4c68edb5-ecb2-420e-a3e5-9204f94305b1", "comment": "Malware payload", "value": "d285439ba6695daa3567290c44fa6ee5f05db6c454eaa2c8583c1b5b2f67b460c808f8560897e4c55d9b68428c5df2a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746620, "uuid": "553cf640-38ae-4aad-9d97-968d4bd4a0ce", "value": "T1E913B027B29F4A37D76607BE9D23E240077894628C1FA65E648075B36D23FB1CB61335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746620, "uuid": "7169f07e-db25-4518-ac24-2786531a3463", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746620, "uuid": "771ac4e8-e6a9-414b-87d7-b3c553515126", "value": "768:vAfKKrpgLihPuO9z0dz9Nf7oSFYwQjXvLWRgcL0ST8iNxy2c:vEKMzv10dzf97QWRgcL9HNxvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655746620, "uuid": "0b725b6b-e1d4-4ede-b00d-b648733e6ea5", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655746620, "uuid": "1f4963bf-18eb-4cb0-a2ec-33a816588f07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655746620, "uuid": "ec5cd53f-918f-46fe-8f5b-a05365ec94ed", "value": "SecuriteInfo.com.W32.AIDetectNet.01.32232.21835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4397639-f095-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1655728711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728711, "uuid": "194a5780-92ff-4d3b-a485-7a65db969e5f", "comment": "Malware payload (CobaltStrike)", "value": "725e9dbd056b9a851ca78b25dd1c57f6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728711, "uuid": "132cd5eb-17db-4f43-b4b0-cfc9c0185760", "comment": "Malware payload (CobaltStrike)", "value": "d9e2d68add72f123e59f0834d8d27c65c21b096722332240e3cbbde1eaac2dee", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728711, "uuid": "4bd7bd10-deff-4a31-b814-bcbfc1d7f9c0", "comment": "Malware payload (CobaltStrike)", "value": "0d8b47751b94ebbeb87a62d0800d8297d51c484a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728711, "uuid": "c61dd423-6b08-41a4-a57c-4625a917dda4", "comment": "Malware payload (CobaltStrike)", "value": "a07b0ffd7dfa83c88e1504d371fd7f60473fbae6eabdfd2abaa78fead8d7f8dd5dc7ebcc65008364e62c9fd6f0e49ed6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728711, "uuid": "5aa17f68-d86e-4d84-948d-61d7d5fc9bd4", "value": "T14BB4E6E3CD48FB8EF92D1458540DF0D34899B9B00AE4D661A6FDBC996E88C412F275CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728711, "uuid": "a3c1ff24-8115-4e05-abcb-04962f34d3ef", "value": "6144:TOx0+nN8SGsqg02KiH/2Uaxd9xR/wW01O393kAF3693lsoB7Yr0ca8IRwMQh7Dpn:SN8SifAq3rVywMQjTri2YPhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728711, "uuid": "89a0a8f6-2b91-46b5-aab6-0698c872b663", "value": 518166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728711, "uuid": "b0d01917-9b9f-4410-9820-944b5444ebe8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728711, "uuid": "acc64639-59fd-4583-8e9e-09878dc00fc0", "value": "gootloader-payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa86ed2-f07a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655716803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716803, "uuid": "beac1987-ceb1-40fb-b796-22468112fd28", "comment": "Malware payload (Vjw0rm)", "value": "522a31506ef88ce5bff4b179b11a9a4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716803, "uuid": "054da076-2152-4004-aee8-2c982c03ae6d", "comment": "Malware payload (Vjw0rm)", "value": "db0307c145bf8f940b790830d5ade8fd7bb6bac5dfc482a0d2eda2097ba24246", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716803, "uuid": "e7087e7d-3f26-4645-8f2a-b7112980b299", "comment": "Malware payload (Vjw0rm)", "value": "24c6896ce449bd32acc6827247b14f5c51ae9f71", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716803, "uuid": "24c0a1bd-bbbb-4538-befa-72a5d59c9ae8", "comment": "Malware payload (Vjw0rm)", "value": "0ca7b4d5a759eb46921704815a42dab501c74d4c36b960349cae8e4842c929df154abde387f63ed70ba1787ecf59a7ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716803, "uuid": "59861f9d-14fe-48c0-86de-500f1104a022", "value": "T1B984E040E7C42BB9DAA8150BD0BE160E83F01346D91664CDBB36BE076FFFE889217655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716803, "uuid": "0a2bfba4-f9d7-4fbf-8dc4-2447a9bfb9d3", "value": "6144:wU3CA/8y0AW4Yn+BwWUN/6/5ywLkJSHbEJU5blbLEDnpJo9Kp+DZLnlJVxjLA4:Qvn8HyS7Dmn3U9zJVxj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716803, "uuid": "44da7349-579c-447a-b5a6-26557970d966", "value": 384095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716803, "uuid": "103966f8-31fa-4272-8572-2042e36b135b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716803, "uuid": "06af8a5b-3e70-4a35-bedf-270cf953a251", "value": "RFQ- Ref. No. MS-DGP-220137.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bb167f-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655704475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704475, "uuid": "9088c205-25d5-49de-bf09-735126ab0997", "comment": "Malware payload (Formbook)", "value": "486492e6532d2753671463eb39ad16a6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704475, "uuid": "fe2b8e09-cbd4-4506-85c1-ba8876a446d9", "comment": "Malware payload (Formbook)", "value": "dc4e34dd9e56ea4fe9f7bb32f94c9bca81bb37ea06acdf536cb391c3dae303a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704475, "uuid": "dfed3d5c-7567-4339-ac53-f5ea31f1c2d6", "comment": "Malware payload (Formbook)", "value": "d8b534e472f48d4f9c7dd57b6ef9d5f7ebb92110", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704475, "uuid": "bd7d9467-6b2a-4e98-bba2-2d2a4f43a0c6", "comment": "Malware payload (Formbook)", "value": "42f39c890ab7f2d9b62d7bc66d751d42b2715039333aa1c7d2ebfdc778acce9de356a332c954bc0af31116494801d09f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704475, "uuid": "121caf7b-8ce2-4092-aa60-7b86dd67c8e9", "value": "T19963CF3D17BD47C4DEBB2E38D667B4C1276BCDE958429100242779CFA6F818CEA6611C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704475, "uuid": "5d2422b1-678b-4514-9470-325efe41258d", "value": "1536:x9I+2v+yb/i0ckDCSbFKovIlAYdClT90kAI5on7AhZ:x9IJ7/YYFHvIb8lfAEYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704475, "uuid": "7a595c7b-6550-490d-b190-97d6da437293", "value": 73272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704475, "uuid": "ed1e8ba2-cf72-4e71-9609-b57fc7705753", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704475, "uuid": "dd77989b-4c1d-46c2-a956-cae44ad39775", "value": "Revised Order BB22-0007032.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe26b48-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655734153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734153, "uuid": "c64c5701-fae3-4b3b-9bf0-ffd6e2234641", "comment": "Malware payload (NanoCore)", "value": "a88b1378237da8dc5ce1b174b08ba618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "\u015faka", "colour": "#B1EFD1", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "t\u00fcrk", "colour": "#8ABD41", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734153, "uuid": "139f0a22-dd65-4cb3-be92-6d29bb007e5f", "comment": "Malware payload (NanoCore)", "value": "dcb5330316f2cd274e28927e3ebb604e55fe6604593c45a3c2a24799190bb363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "\u015faka", "colour": "#B1EFD1", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "t\u00fcrk", "colour": "#8ABD41", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734153, "uuid": "8670b1ce-62ef-475d-a839-993d389a8409", "comment": "Malware payload (NanoCore)", "value": "35063e0fadc39dcd690b3f20793223f096a614d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "\u015faka", "colour": "#B1EFD1", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "t\u00fcrk", "colour": "#8ABD41", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734153, "uuid": "8e0a45a8-f140-446e-93cc-0f2e0b30ef3e", "comment": "Malware payload (NanoCore)", "value": "49b618492e6b946853a617ff32788571d07fca28da5c5e89946da9a7e128df8a8d168ad1891b0a978197e622f593bbf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "\u015faka", "colour": "#B1EFD1", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "t\u00fcrk", "colour": "#8ABD41", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734153, "uuid": "64b3b207-6b90-4ab0-903a-7ff21290900a", "value": "T1B314CF1677B84A2FE2DE86B9702212139378C2E3D8C3F3EE58D854B69B167E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734153, "uuid": "bd146fc7-7a22-498e-9c22-4b65475882f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734153, "uuid": "9328793b-14df-42ab-9595-7c634ba36c75", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIZzcZVg9FMMywQakxalJRi:QLV6Bta6dtJmakIM5pVgLMMywQVoli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734153, "uuid": "71ea4b05-c9a3-4d08-bfe9-88dd2d9a9e67", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734153, "uuid": "ae8232ad-baed-443d-9852-f99288fdbfbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734153, "uuid": "1ad112df-f17e-4ab9-873a-ce9834e117bf", "value": "ccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c9b1ff-f05a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655703042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703042, "uuid": "9816f0b8-1927-42a2-aebd-5052b51ace65", "comment": "Malware payload (AgentTesla)", "value": "09fcbeecade1886ca49a01adc9781c4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703042, "uuid": "7cc5cfa8-6a6e-46a1-a897-b4a6e82bc804", "comment": "Malware payload (AgentTesla)", "value": "dcd94b983a76bc6eebdca854b1b478ead4bf1b34de1a653fc2150d12bb48cd7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703042, "uuid": "6828d2c1-6c2b-445f-a559-07b105b22787", "comment": "Malware payload (AgentTesla)", "value": "ab64ed50bc614d6863ea456ae319a46c8483ee4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655703042, "uuid": "82b0b35b-57de-43ed-8cc5-bdfc145605e8", "comment": "Malware payload (AgentTesla)", "value": "7bb79c3332c63208eb1e7118b30ca4bb3b5a0a51461fe14e2cae8f92181c6dc07ce1c77850bcb0c3defc5748f6aa4641", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703042, "uuid": "bf1a2b03-67ce-4ad4-98ea-f5a5c7657ee9", "value": "T150D42B5CBB0B0A62ED5D9171890A3B04ABE63E0367C0B9D217BB36C6D77F1B56D0D884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703042, "uuid": "9bd15f9a-d7de-47c9-a58d-2f4eafd41f91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703042, "uuid": "e8fb6139-d7a3-442d-8263-ba53c24cde8b", "value": "12288:QMRLeYqWdHaBJrEqNAZDnFZC/mGt06CoVdYT:vJL2VcFZQmGKbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655703042, "uuid": "7ed2fd23-6888-4849-84da-fac886984eaa", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655703042, "uuid": "3dc464b6-bbb6-4073-b7d9-5757210778d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655703042, "uuid": "25ef71b1-03bf-45c0-a2b9-d9b433d3afb7", "value": "SecuriteInfo.com.Trojan.Mardom.MN.10.30334.25828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bf6ea8-f080-11ec-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1655719367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719367, "uuid": "2ace011e-db26-4c99-978c-143deebd1174", "comment": "Malware payload (STRRAT)", "value": "5bf6b04530c02a313ba5d92147b06321", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719367, "uuid": "1b43ac54-5a19-4b0c-ae35-3f1ce4461527", "comment": "Malware payload (STRRAT)", "value": "dd442e73388a9539511939b51033c00472d45969f84c4e205beb0c30a12ea9bc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719367, "uuid": "c3c4450b-c8a5-43b3-9d9a-8239892e2874", "comment": "Malware payload (STRRAT)", "value": "ee0191d52f835bcf0c7120586d9f08c4db0369ef", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655719367, "uuid": "2aa023bc-56cb-44b8-acd5-59b5ece4b9b9", "comment": "Malware payload (STRRAT)", "value": "4e93c6d32174e06473a771a1130973e942460c2b6146ae25040d33e623b3d10337ff1436728218a242bfcbb527ce5108", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719367, "uuid": "8d64e8d4-bae0-49fa-8883-94c7a0908e25", "value": "T174F3F15B7DBAC2F6D443903361919227EE9D1294D202E09F32EC459A5C36CAE4393EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719367, "uuid": "205ca458-e9be-4a35-925d-8c153f0db52b", "value": "3072:tuu3SXWMoDX+8SlmO/NkHfgLCfacgY/d9y2rl5OR2d5jtjdRihOQlWTjm:tuuiXWMUGNk/guftgY1VrrOk3jxx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655719367, "uuid": "d59fe652-8651-4309-8f03-62f5243eb067", "value": 168739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655719367, "uuid": "cf63ec63-2213-4311-b5bc-4faff523ae63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655719367, "uuid": "5c48036b-f7bc-4c6c-b68f-b13694966bb8", "value": "PAYMENT- CONFIRMATION.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f79964-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655733549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "b0c07634-6b14-4d78-9a56-b4c05540b8eb", "comment": "Malware payload (AgentTesla)", "value": "554dd180a01dc3543fbe51a3cb41844c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "b29bc219-a120-476a-89e4-70978adedab1", "comment": "Malware payload (AgentTesla)", "value": "ddc86960abb79618117ff216debd2664065bdc2099297528f2cda2649d86b7d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "cff028fe-27f2-4819-a8c8-be37b5b7f337", "comment": "Malware payload (AgentTesla)", "value": "98811e6ea290cce4d4fc6986a3c479f8783d94b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "9acc80e7-f9f1-4d11-9d5f-2d2edea620f6", "comment": "Malware payload (AgentTesla)", "value": "79f51f8d9b580ecbef139c36631009a0ecceb39953d5b55cf38cccbc5a30694d5adca0209e1a5720d4d6019beef9f269", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733549, "uuid": "526fa108-3212-4175-b1cb-0b0bdcfe0b7b", "value": "T1F0057B8BB3553E97DCAA473B82F70F5051719F70464F83B60660B93B832B6D9AE70849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733549, "uuid": "98aecc11-1816-48f7-8e91-2ad6119a5f55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733549, "uuid": "116085c0-2cfc-4408-b7a4-ac2548961bcb", "value": "12288:nqjLVM9o31dQOhodVCdphH22qla5w/yXbxfPkWtMRgzAYRN+lN2TlMw7Ju:qjLm9ilhWUHH0MW/Ibx2+7Mhw7Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733549, "uuid": "135243f3-97f9-4343-ad2c-6f8f1077712f", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733549, "uuid": "dca8d65d-cbcc-47c9-8724-4d31c2f697e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733549, "uuid": "cd7a5844-497f-4cd2-aef0-337e1445ae00", "value": "New Order10278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb941e2-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Neshta)", "timestamp": 1655734124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734124, "uuid": "77f1f30c-8baf-4df9-93aa-f9d00044a764", "comment": "Malware payload (Neshta)", "value": "3d339653a024ebb3969829307400a392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734124, "uuid": "9e556bea-ea0c-4627-8bcc-4b8a8d882e08", "comment": "Malware payload (Neshta)", "value": "ddda60d1e3fa833ce9bc480cbd5cbabb28d2902f7ab20c842a6bc73dab1ec293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734124, "uuid": "c054d7c4-dd50-45a2-9129-78ba5444e630", "comment": "Malware payload (Neshta)", "value": "7e2cee7f0a5d607583389b16887c46829abc36e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734124, "uuid": "68b16674-528c-47cb-8356-7c1dd436883b", "comment": "Malware payload (Neshta)", "value": "d79145bf57509666c0f259da6c2823b006001c3676f9291533de4fd8707b689ef23d75c61a1e0d2f3d8876180453ba1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734124, "uuid": "4989a212-9fc0-4b3e-afdb-a8808d8d16a8", "value": "T1C1659D13B29611F9C02EC1B88B565161E971BC850B35BADF17A0B7262E32FD06F3DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734124, "uuid": "2d387dcb-70fd-402b-b215-2fbdb0bc03fc", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734124, "uuid": "54aa3f8c-b983-46bd-a50c-1c603acb9619", "value": "24576:B4/s8CUCfJdjgqsLqf3ZfMmVcX3hmyaadfkzrS4LcNcts2g2cKjTeqbGDGOr0VMj:Bc0rJdjgqsLqf3ZfM0Pa5kLLcatsXkju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734124, "uuid": "416b0732-57ca-42d3-af4e-58c38888c15a", "value": 1490728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734124, "uuid": "bc915eac-e3ea-4700-9cb9-04f47349ab6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734124, "uuid": "ee0a76f5-ff7a-44d2-8dbd-1fc44f097f33", "value": "3d339653a024ebb3969829307400a392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6aaf342-f0f3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655769007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769007, "uuid": "31cea149-d2c8-480d-ab5b-793f0da72431", "comment": "Malware payload (Mirai)", "value": "318bec7796c679269b8f7ba84f8ad740", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769007, "uuid": "bc1f2d44-5f48-40f7-a3e9-576cbd3cb3a7", "comment": "Malware payload (Mirai)", "value": "df9c772424991f0c55d27561b733019abed5e14fe9e0b7b3fff90920e3c688e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769007, "uuid": "2159c79c-b42e-44ea-9c09-7d9c409b63e5", "comment": "Malware payload (Mirai)", "value": "a04019230026910d42a134f1d597a7363292e39b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655769007, "uuid": "b96f166e-51f6-438d-9613-8059b0437784", "comment": "Malware payload (Mirai)", "value": "e7be32c3c361c9a3a5d65270bbe723ce19d31484cb239c71d2da9944532edd702e979c758fac2a76bdea98be695f7b2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769007, "uuid": "99b83ab7-5036-4aa7-b8c3-9d1f0bf3c1ce", "value": "T19D03E1A1621D7D6AC2349D3357FCD9D6B7686E7A81E4303A3E280333A69F5C208741ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769007, "uuid": "f22ead5d-17e1-49ab-ae09-457a58003e43", "value": "768:nOb08nZV8ndKm5XFam/z2tL3MtByYTwUYx1jc27u9x9s3Uozq:OnZVwD10mTt/TwUszq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655769007, "uuid": "b3ac2abb-58cb-4dcf-a2a5-c55cc50b575d", "value": 38516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655769007, "uuid": "cf92f327-f325-4624-95d4-6d181374d7c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655769007, "uuid": "eaf9c8e5-e8f0-411f-b43b-41ca6087a891", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041c9ba9-f095-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655728335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728335, "uuid": "e3a9780b-0069-4acf-9cfe-fca08c1fb2db", "comment": "Malware payload (AgentTesla)", "value": "e9216d1aa92eac02fa30e3a6b82ca0b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728335, "uuid": "87869932-5355-41a8-a700-dc9cda37237c", "comment": "Malware payload (AgentTesla)", "value": "dfa5acb86806632fa7a681304551761050faea1debe25bc383e7d16fc47ba0b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728335, "uuid": "25546d78-1163-494c-8764-ad883c5bc109", "comment": "Malware payload (AgentTesla)", "value": "0e8ffef3790c19dd33ef621bc4c1999eaeff2ac9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728335, "uuid": "f12d6556-2bc7-4cfe-bdbd-b0a1e4b95f79", "comment": "Malware payload (AgentTesla)", "value": "16c01ec8fb699dfabf2c1cf0ecd18c2adfcafc7d566c5a5099226a329a1d98faf50004957aa30bfeb0a305d36152d173", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728335, "uuid": "7b3d237c-eb45-4758-adc8-22005822b829", "value": "T1BBC48D9CB62C74DEC85BC27699B84C24AA60746FB71B900751530E9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728335, "uuid": "1f1bd4fd-909b-4f25-8144-096baaa00ce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728335, "uuid": "922e734b-a80c-4fc9-93d7-ac3bb5efdc63", "value": "12288:lkXutyD+wVWuF3HxRJI6TDa46KlZx5dmb4gJ+J7o59exV:pyqwkuFBHIuX7lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728335, "uuid": "ac27fd56-10f3-465d-9e5a-64e24e1c6986", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728335, "uuid": "6a68c1b3-4c04-463f-bc82-e4b1553273cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728335, "uuid": "63fb9a91-ab2b-4160-8cf5-c227cba7d854", "value": "SecuriteInfo.com.W32.AIDetectNet.01.2479.32684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0defdd3-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "ab55335c-1c3f-4b94-aba5-8232d21549da", "comment": "Malware payload (Mirai)", "value": "cb0f4b49c40365df2cc0ca066ba4790a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "9f76808f-53ed-4936-9f67-9f0ba87e412a", "comment": "Malware payload (Mirai)", "value": "dfbed93b20940ef708bc7a604d4dbcb76f3330427b2315fb3a1f5508cb8f8362", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "6d2c3134-1b64-4557-b14c-2ca419b79152", "comment": "Malware payload (Mirai)", "value": "ee79c307400bc047ec6f3fab3e6bf271f1320353", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "c80cca4e-fb9d-4bf6-bddf-d824e8a66f0d", "comment": "Malware payload (Mirai)", "value": "6ca9ee8ab663df086e9e7aea8d1d8a0e9e5e6ec892467c6eecc4eca30be9cc405ef9feba28f1b1f9a1fba39ededcdfd2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "feca6e7e-b692-4518-ab0b-ca036661b9b8", "value": "T18C2302B1673E4B97EA710DB4CF3854C371CAAEB88C0B709272944E0C5F926552AF1C8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "50b22240-62a2-4d6e-9deb-ad4d78c1aa39", "value": "768:ZhlEeauld3fldEjYhpsPW751+B4TfnOkmOTDwZRcf9q3UELnQpDLkJcQMfU3zFKm:ZbEeDpkjYhmW75WUzTsjDLnYLci83ZpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761803, "uuid": "0afe3b08-dbf4-4ed8-a548-759cc8ddb0ef", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761803, "uuid": "175af24c-d45b-4265-9717-40066cf68e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "89c24076-edb5-431d-90c5-b5dfc4915f11", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671ee11b-f084-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655721199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721199, "uuid": "0983abd4-04f8-4f40-9b8f-32fec70f8445", "comment": "Malware payload (AgentTesla)", "value": "2b2c55ccb722c767707be53648f7c40d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721199, "uuid": "5fb28fbc-7478-4c7b-82fa-c5f453ba1d91", "comment": "Malware payload (AgentTesla)", "value": "dfd9e5d49d3656905dec9934d54569a71ad20e83d056aa2d4b672c9eaf4ea0b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721199, "uuid": "cfbdb282-63f1-40c0-9c25-a0e9ae69546c", "comment": "Malware payload (AgentTesla)", "value": "fcbb1180216c3e077861b737f422e809f7a388ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655721199, "uuid": "5af8ed5e-c8a5-4fd3-be04-5a08f1a9f45d", "comment": "Malware payload (AgentTesla)", "value": "e001ad74cf5d4f5397f4a09fedd56330a5e7809c1c2e644b5b3292f7ebf4d1dcb584e6fe3086a80b84f92c21a12a29b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721199, "uuid": "3237b023-9b9a-434a-afd5-69a41be79a1c", "value": "T19E34E02B73D4DF40C59C6932E4CF103A2BF8EAC23973C7563E99635916427A39D486CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721199, "uuid": "9ce7f372-8cd3-421f-b089-3f3784c3d018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721199, "uuid": "c0c959e7-abe5-4935-a020-a11190771cf9", "value": "3072:5rlKT+V+yP+ZLxFBMnhVUk+oh+H+Jg7FdWXGXE/xL8p2nPly/JSD4B25u3UTt1ML:5r7cy+d+hXy7iXG0/xQ8n9yQ6GJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655721199, "uuid": "f8343879-1263-4c0a-98b7-5f85d5f25e50", "value": 248344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655721199, "uuid": "07351cb6-60dc-4481-8fc4-d27843e950d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655721199, "uuid": "354c5d8b-9e78-4f33-abf7-ae9c9fca89be", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17601.11936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bdc1da-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655734240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734240, "uuid": "c10a88a6-3203-4670-a45d-83099fc2a15b", "comment": "Malware payload (AgentTesla)", "value": "a6eb3bdd4f3e6676a13e4c4b0fd91e0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734240, "uuid": "08099d34-6ad6-44cf-baa8-c1ce8d725633", "comment": "Malware payload (AgentTesla)", "value": "e01716ed7f62fa9536c5e78c9313cc5c78bb9872c4ecb096fcdba4e5da796f62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734240, "uuid": "08a70344-d392-42d7-9a5a-41bd6c6c41a4", "comment": "Malware payload (AgentTesla)", "value": "7154e125287fd43d2fa9a4b34d0e8634991aee6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734240, "uuid": "09734881-4263-4b76-bb4a-a15473e0c319", "comment": "Malware payload (AgentTesla)", "value": "648f09aef36e4f02094b0e25429887aeb9d5e59b7a63a79533417e68c8502a305c34957141c33ada0daca6aac3a27e2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734240, "uuid": "daff4e1a-7e6b-458f-a962-00e7114a77d2", "value": "T1F8A42381273AEB72E13787F655E7009483B1A52A9C73F26C4ED5A0CE48FAF501D96353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734240, "uuid": "3f29a3ec-2bbd-4a3d-999d-8619f89256b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734240, "uuid": "2dd285d5-1ce0-43da-a69a-86f7d8e00cbf", "value": "12288:EHMF1dA+pn4a3AFFJjeHd7cXVSqEGWgldN9:EHMF1q+pnJsVeHd74V1Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734240, "uuid": "9240499d-e6d3-4c85-aed8-897162613ec3", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734240, "uuid": "55d77dd9-2e38-4d7d-bfab-79ee4baa2db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734240, "uuid": "9e5093f4-7e80-4e4d-83ec-ab612c00d941", "value": "a6eb3bdd4f3e6676a13e4c4b0fd91e0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e5ba8a-f0e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655761803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "0aa8a192-22bf-4cb6-ab75-3888a7246ce6", "comment": "Malware payload (Mirai)", "value": "93d4a4fa6691bfb891380ddd0bb4047f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "288ef939-148c-4b80-aa44-ccb9d191b16e", "comment": "Malware payload (Mirai)", "value": "e0b94225daa58f828f74cc602d9c227fd847dccaa38ab531f25955d53ae2f4a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "e0653a15-ab92-4a7e-9d4c-6ae7b9a75512", "comment": "Malware payload (Mirai)", "value": "0544f23926e7c1340b4618d909be272473271768", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655761803, "uuid": "770ff058-130a-488a-8ce6-f33415cabfcf", "comment": "Malware payload (Mirai)", "value": "6398e8ea714cbcead597a576ddc2591a748ac733522031f6d1ee8df9a166cefc73d50d50758907c2b65751c5caa0cce9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "33b6c85e-2318-447b-ad5a-196b46c2ff4e", "value": "T18503F196D5F842BACADE01760C0FFE66A60C550EE8880BE1EFDD38775442B7F9C28085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "eab4dc8f-f090-4d52-a777-56b020da336d", "value": "768:ZxNyg+zaEr9LYOz6stw+YcMOJ3PLMGAE5S/pkcEN/nbcuyD7U4/2g:Z7T+zaoY0btwSM6fOEQRw/nouy8Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655761803, "uuid": "3ef6c95a-7c5b-43f1-8f2a-068d744ea16e", "value": 39708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655761803, "uuid": "2929c076-33ac-4904-8d9a-c0fe9ce394cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655761803, "uuid": "2470ddbf-a3df-4a3c-a892-65566ecee86f", "value": "ZG9zx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5d49f8-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655704597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704597, "uuid": "c27b54e0-cec5-450f-9d05-688309ddaf8a", "comment": "Malware payload (Formbook)", "value": "9ba7c6d861477b8c79d803ceb1e5c8db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704597, "uuid": "ce62dccb-b5b9-4983-a689-7aebf8f57b5a", "comment": "Malware payload (Formbook)", "value": "e1391a6c61ca35308ed8d433404f0c76904c12576186f4fc8bbdfe66a7025b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704597, "uuid": "b06d32c2-9df1-49b6-b451-3016dd112e0f", "comment": "Malware payload (Formbook)", "value": "490cc23d22e9468878d492651dbabc1bb4ebe5b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704597, "uuid": "8d1d20a2-f335-4df8-9b5a-e76f024f7b19", "comment": "Malware payload (Formbook)", "value": "6aa3b6ea635c06eec8ff0cd97cd5217565017020d30ce347ebafdb111ca62cf088ef0796fc65dc2b08aa0677b93d6f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704597, "uuid": "261336bc-680e-4adf-af11-5083531952bb", "value": "T1C415D0AC3260F5DEC44B9AB2C8681CF0A9207C27D706C11764573E5DBA7E7DB8E056A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704597, "uuid": "930b0531-2b22-4679-9613-aa8f075475b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704597, "uuid": "c9f145db-56f1-46ac-b37f-c38af1df43b0", "value": "12288:qWjdrGUsfkfREMp9uQ3LisVqo7gEF7wal1oV9bmpQmAAcgZcEGsYH37TkX+rtMtp:ZrJQkfREq9u87/Z4aKmAtgZYsYrQXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704597, "uuid": "fb35f788-6b52-403d-aee6-f1e31ee4db94", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704597, "uuid": "1c70d0cb-0249-4a52-8e87-e546db91bbb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704597, "uuid": "9ff71a18-0344-4968-906a-ab8c8272c4fe", "value": "18062022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ca477e-f094-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655728129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728129, "uuid": "27728eb1-7b54-458b-ae69-9961cd0a8491", "comment": "Malware payload (RedLineStealer)", "value": "ade94578186982aae328c4f4440c5fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728129, "uuid": "17b682a9-585c-40eb-9ff4-eea989488ce9", "comment": "Malware payload (RedLineStealer)", "value": "e1634af02f0f7d06f36fede5b3976b15e8489ac0f15920f71317457e9aa82e5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728129, "uuid": "0593424f-945b-41d6-ad6b-18c89e0f527f", "comment": "Malware payload (RedLineStealer)", "value": "60b64c18f64b0a5799fcb5b8a0bb5b5889d8539f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728129, "uuid": "bfb73a55-258d-4d32-be8f-3f710829f396", "comment": "Malware payload (RedLineStealer)", "value": "acad0846cb4decb4446943716a7bf3bc40eb45d01f5b764e31162298616a0776095e3fd30a032115e1987237efd5996c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728129, "uuid": "6bf7b201-3bad-408f-9622-16b06567e3d4", "value": "T17E36233723650185C5EAC93A823BBEB872F9077B8AC1BC7865DE69C13E1A5F49503D13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728129, "uuid": "0dfe385e-e694-44b9-941a-481eeecdb8e1", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728129, "uuid": "763133a6-57a2-4211-ac5e-3f042d9a2086", "value": "98304:TP6iOMOf8aB3QXkiegEZTQSw8OR1IVeqXtd//Ny0Ul5Os8ipsB+7IPaxp:TP6iOkalQX9efTM8IU9fdypl5OzipsBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728129, "uuid": "5e97f441-e1b4-4ea4-8a73-3d81afa3c928", "value": 5090816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728129, "uuid": "2c3744e3-a474-4f28-a358-8777d3670ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728129, "uuid": "ab48bcd0-eb6b-4a91-87b1-51f0ac88161a", "value": "ade94578186982aae328c4f4440c5fbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd725b8-f049-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655695976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695976, "uuid": "5f188311-f2c5-4b1c-beaa-47432a0fc39e", "comment": "Malware payload (AgentTesla)", "value": "c4bb75c02c578fd9e97ddc0c4123d929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695976, "uuid": "5a99ae38-8eb4-4aab-b609-0cdf65c15a5b", "comment": "Malware payload (AgentTesla)", "value": "e17ee22d39b9faaad5a190aa0ae80909c1862e278417b2933997076980c214e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695976, "uuid": "46d62983-3bcc-490c-9616-fd87d2e1a661", "comment": "Malware payload (AgentTesla)", "value": "0d89f6fe8311345c1e6af4edc7eb529c08e97011", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655695976, "uuid": "829eae41-1a4a-4edd-8acb-d172f594b149", "comment": "Malware payload (AgentTesla)", "value": "6ec4ebcfa2a60b46137c963a36558c72993ac2539a6a26f0584ee9f07058ea73d58928d7ebacd7e72c7d11ca193f26ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695976, "uuid": "26a152c5-2ed4-422a-81b6-db67643eb31a", "value": "T193B41216E9B8A623C9BF42FE0072E285D3714237A6A6F3C65CC1E0D265E7FC4E156643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695976, "uuid": "170dc43a-49ab-48a6-adab-56b73e7657db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695976, "uuid": "cdc4966a-4703-4605-a2d7-5376279d57e0", "value": "12288:/lBwSOVSZxA0tTJ6ua9B/7ORKuhJOKlfhAoYYiO:/b3R3hMd9B/7mKB2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655695976, "uuid": "6a4100db-440d-404d-a8d6-ef2d80e71e9a", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655695976, "uuid": "480ae105-13ee-4a4d-af09-966b2a613cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655695976, "uuid": "b2ad08d1-7d1d-44e8-b1fa-f0818a1e9a27", "value": "SecuriteInfo.com.Variant.Bulz.754063.32666.27009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9d1566-f042-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655692942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692942, "uuid": "84a376db-c837-43a3-993b-5a5f31e6236f", "comment": "Malware payload (AveMariaRAT)", "value": "4f903936030582fea8ca1e01453fcff6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692942, "uuid": "d119e90e-2de5-4f1f-994a-3197bcc0c822", "comment": "Malware payload (AveMariaRAT)", "value": "e1f652cc24531e85e52b8a04cdaf9d925206c0d8d306426897868bd045729cc5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692942, "uuid": "4c480741-0908-44d1-9966-570dcc2bde32", "comment": "Malware payload (AveMariaRAT)", "value": "4e3043978fbc1f7d5278929ec9f58ec2cd411eea", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692942, "uuid": "90c0ebea-c85e-42d8-a73b-cdf1076bc95a", "comment": "Malware payload (AveMariaRAT)", "value": "72e16ffc200607f69bd4558270ff43a3d035aafac6f43b7b968840195dd8ef7d69c6a9cb9b9f5e7df094522ab5b80a44", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692942, "uuid": "d95475f4-d53f-432a-9b0c-eaf80e528841", "value": "T1DD8412055A7A8F22C57F97F891860090C3739F081C46F7E8CEC56CED74ADB488A5AB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692942, "uuid": "35ca71f2-8ccf-4da6-b479-5b1aab6ffab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692942, "uuid": "52bf7526-7b66-4ae9-95a6-e84aa40f646c", "value": "6144:u6e6w1yuYPMB+vI6TJOwPnoWgc3oZWlAOydAZ5mX/V3ZgRQl5ONwt8qDWyUrq84h:S1u0mnOw/Gc3NA7W5It3AcONwXKyUrqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655692942, "uuid": "2a78aef2-0f50-40d8-9e0d-e4bb24d50810", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655692942, "uuid": "e8d12cd0-16e3-4a69-8380-91137fe57a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692942, "uuid": "8bad0607-ca5e-4c35-85e9-f700e9aa0159", "value": "Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ae4572-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655745415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745415, "uuid": "4e237e79-f298-4857-af18-5729a6886429", "comment": "Malware payload (Heodo)", "value": "ee1ee0a5a6d58e06630e16671428db25", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745415, "uuid": "6d3bdc79-ccc9-49e4-a5ab-51ce2d29d432", "comment": "Malware payload (Heodo)", "value": "e26cea16093ba340eb8a12cd6488b94af613a46b988621ff7edc8bde965baeba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745415, "uuid": "f11ac529-a4e9-441b-a61b-bf2e8c1666ef", "comment": "Malware payload (Heodo)", "value": "879737d11b7e092228c7ed94f8a343d87d1aa5db", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745415, "uuid": "0ca3ef19-3454-4bb3-87fc-071eade6b55e", "comment": "Malware payload (Heodo)", "value": "a625efa3205e7c0ea12fa48505eb7d42a4cf1a175f387f79d970179b3f233be9de82d2e6ad63ae98ed82479426640470", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745415, "uuid": "0fd2b849-7c31-4a2d-93b5-0214e54a8d0d", "value": "T1F1533A56BA5AD81DF915C73548D74BAAA323FC314F9B0B832269B3106FFC8A0561714F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745415, "uuid": "6d9dd8d3-0abf-4f09-b4d3-10c396a84aa7", "value": "1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAR5N:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745415, "uuid": "4ea17024-9559-4c43-9e71-69855964a911", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745415, "uuid": "967d96d1-414a-44ba-9ce6-f84f31012d78", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745415, "uuid": "1ac8d774-7f1a-41c8-805f-73d6c96f2e85", "value": "sin t_tulo-1406.xls.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c53b612-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655747273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747273, "uuid": "a148df80-7a79-49e2-81b9-2cd5b6e61bdd", "comment": "Malware payload (AsyncRAT)", "value": "99a9eae0a693d4ed7802569c5691d33e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747273, "uuid": "e477c92a-899f-4ad0-b694-d0e545248e91", "comment": "Malware payload (AsyncRAT)", "value": "e3873c987d4427d2baf025e497e623a29838f4243f2e2bfc682caaa336bac406", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747273, "uuid": "ea5bd318-0496-41aa-b66f-cd2af1a49a6e", "comment": "Malware payload (AsyncRAT)", "value": "b0f823f541a1a7d7630c4bbb35240bd9b9cc6845", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747273, "uuid": "90dc334a-9f58-40ec-b3eb-c454a02cf61a", "comment": "Malware payload (AsyncRAT)", "value": "ac60061b2f2dc1bf286cb2f1266cf877bfff2fb8f59a1eb2059a031f3d805598f5205ce9cf4489b9ab3d3b43eb1fefe8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747273, "uuid": "273b1983-9057-4b0a-978d-cc360106547b", "value": "T1CA232A003BE9812BF2BE4F78A8F261054A7AF6673603D9491CC451DB5713BC69A436FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747273, "uuid": "8a1dd62a-6e92-4dbe-955a-ff9f6a6759d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747273, "uuid": "f2fdc3f5-cd17-4ccf-aae8-25287f845663", "value": "768:SuAHPTgoRzbWUnd9rmo2qriMoQVK80WXzjbfgXaip/UiP0hEUscDZnf+:SuAHPTgG/2TMjbvX3boXjp/18dnf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747273, "uuid": "a532c2eb-b7d1-46be-9d2f-b1989b04f413", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747273, "uuid": "b3569ddf-5d0b-4897-8cac-a8be692997b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747273, "uuid": "51cda58c-ddd1-4d75-b72f-cd9ba1dc7cdf", "value": "Fuckjavon.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ab3009-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655704561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704561, "uuid": "e350c620-f7db-4999-906e-1f94600f24b3", "comment": "Malware payload (AveMariaRAT)", "value": "e4e731fc4e2bc0d0655fa348eadc29f6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704561, "uuid": "d4c09d13-4c11-4269-b7c4-8699fe033fe3", "comment": "Malware payload (AveMariaRAT)", "value": "e4868ce242a501454b88704e1fdf8d2e39ba4e1f5a7a82d432d74998b834b05a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704561, "uuid": "7f8681a7-859a-4904-918e-afdcafa7290d", "comment": "Malware payload (AveMariaRAT)", "value": "e5a751b5dc8610bd993e787170f2f1d9c072d680", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704561, "uuid": "c3578d24-dd11-4d74-a231-98e75d40a101", "comment": "Malware payload (AveMariaRAT)", "value": "45ff183e57b6e33987afbe52cd8af0fbfe0ac6c9327d2667bd2cfb23e7979545bad01fcc769b5f2021854a5f6ac064e2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704561, "uuid": "1d7fc386-09bd-46e3-91ca-d04ac6ed7c89", "value": "T164648C2BB25D8B4CC7489AF1B4FB46340394EFA715329B857AC4FE6C067122F6B842D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704561, "uuid": "c768811c-be84-4318-ade0-dc3260a92617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704561, "uuid": "03c509f4-03a3-4f5d-ad0a-fe74cfd0bc09", "value": "6144:pMHAwXk7tI3IHa4y/lrf/TXhhmxNKs5I3kTNE:9wXkpIsa4yNjFhmb3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704561, "uuid": "4a29c04f-ed2a-4597-b6b6-0314eed12c2a", "value": 329912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704561, "uuid": "363aaa99-009b-445f-bcb1-5d8d50f8c55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704561, "uuid": "ae93cc2f-755f-47c4-92c6-afd40422622b", "value": "QUOTATION FOR Al Wasl\u00a0 Trading L.L.C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b942f3-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655733995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733995, "uuid": "b1469a12-0af8-4cc3-bf76-1bc521cbd48c", "comment": "Malware payload (Loki)", "value": "918a24de8b8467129276bc8872c1049a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733995, "uuid": "87f290de-0ef3-4021-b915-a501105d322a", "comment": "Malware payload (Loki)", "value": "e4bbf1e1a23642852f37d41119d6c7c8a54d61a3b42581360343fc2b70d1cd50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733995, "uuid": "9275ab01-5a68-4a8e-9bdb-6ccb1af04942", "comment": "Malware payload (Loki)", "value": "151dae7fcb1dc66c1f24f843874af78624caa0b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733995, "uuid": "6f93e470-5646-41c7-a4ab-4e85097152ea", "comment": "Malware payload (Loki)", "value": "317c23e76981c8d90f571b4653c8bc2ba14a760abd3bb48395b20f14e5eeae098b1513670ca9d61c109390a873f8b102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733995, "uuid": "fb436fda-0e2a-421c-9d91-e030e60cdea5", "value": "T1E48412202ABCD752D83FF7F899A705A447B552399D52FA049CC864CF4873FD8089AB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733995, "uuid": "cd5ec1e6-6e58-4dc4-b0ba-22c5e065c48f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733995, "uuid": "3af86e65-d2b3-45f6-9483-393b603fce5a", "value": "6144:AxteuBwYVDW0aLxMQB9fq6oZDU3KQbHwF4GhpPwywEnzBQrSs1JG/GXOvQ6h1eXW:IeYhM99i/DkQF4G3PkEz2rSs1I/0myX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733995, "uuid": "28bc1790-7002-4ecd-a766-56576212c6dc", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733995, "uuid": "c98b8697-c20d-47e0-bb28-dd14374bb90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733995, "uuid": "ddad4165-935a-4c9a-8de0-dadc5245e7cd", "value": "918a24de8b8467129276bc8872c1049a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941b4018-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722134, "uuid": "51ee35c6-583b-43e7-bf23-f6193604f22d", "comment": "Malware payload (GuLoader)", "value": "b775f3307ea2141186282e6d1d4bc111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722134, "uuid": "3d66c8e3-cd86-4e19-9617-e35ba6f64eba", "comment": "Malware payload (GuLoader)", "value": "e5cd1521ada582d105f9d3840f84359ecb9f33d09205fe51d5b048c386cfd364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722134, "uuid": "16fc9274-99b1-49f9-b7eb-018f83a38805", "comment": "Malware payload (GuLoader)", "value": "cf05ba9ca7da28fbdf98cd9e78043d36b2959661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722134, "uuid": "fadb5870-e079-4649-85ee-ac456fddd165", "comment": "Malware payload (GuLoader)", "value": "adb8e4c097a856bb0e91ee0924902d002d8abaf9a29a1f1ed2c214e63ee1e0b0f89efe04f2f6a6e4cb873d4152821d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722134, "uuid": "fb27ef2f-9f61-4120-a058-fdcdb3059323", "value": "T11D74DF42790495EFED3C03B3A87785670DA67C3995A1594F3BE3BB1921B3633064FA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722134, "uuid": "002b2159-de44-42ab-87dc-f83f51d2812e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722134, "uuid": "547f2549-9356-4b58-a11a-40bdd9de2835", "value": "6144:rbE/HUQbYqapFZI4h2UVKubIwuGoScceCd2fh/wP+8WS4:rbOapFZfh1awuG1Zs5k+8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722134, "uuid": "e485c53d-8add-4405-982f-acc765e6cefe", "value": 362086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722134, "uuid": "f562afaa-8496-495d-9692-e9aaa039b87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722134, "uuid": "c2ba9085-5d9d-4913-9656-17a4f8ed6626", "value": "doc.1234567098.pff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d0accf-f091-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655726625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726625, "uuid": "047cb0aa-0d17-4a59-8eac-2a4d991586e4", "comment": "Malware payload (Formbook)", "value": "417fb7df24a53a7508b51fe068a1ea39", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726625, "uuid": "44bb883a-9268-440d-bc35-8660469bcd98", "comment": "Malware payload (Formbook)", "value": "e665f49e63422d412f78bd2980c182f839f6c8263af876721623369589be796a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726625, "uuid": "a93627b6-687b-4145-a6fa-255f3e1e3731", "comment": "Malware payload (Formbook)", "value": "fbbb84e30db45aef32d7ae149a049e18e44e24a2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726625, "uuid": "b7ffc801-ab78-4f09-9d89-1324260a1a30", "comment": "Malware payload (Formbook)", "value": "018dd7f0e7026f491d817f96b576c3abe3cfd1255a970379d6b377f699d705488800f140d207844aebbd4472be851691", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726625, "uuid": "06e2098f-39ca-44c1-8bcc-daea21a3ecb8", "value": "T1A69423B4D43719885BCBDAFD3F2E5542FA98DB3D54B25AC9833D02660439486EA9F303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726625, "uuid": "e1f3dd71-2f27-4722-9763-9954e4934fcf", "value": "12288:daQqbEXUub0blSvbLWoICPrLt8REDCfz1VV2hb:x0bgvFP4d2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726625, "uuid": "3faf43b4-f97b-4bbd-b906-6063ae97576c", "value": 424642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726625, "uuid": "953f1092-7064-4e39-97ab-50254b3eec72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726625, "uuid": "3bd1dc77-5086-4afd-ae23-5e0aad8ad65b", "value": "shipping advice#202207.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c33662a-f079-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655716322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716322, "uuid": "28614f07-98e2-4183-9595-5ea4e9c57609", "comment": "Malware payload (Formbook)", "value": "057e1df589a80193190d88d889cc6529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716322, "uuid": "2d627661-8e0d-48e6-be37-f379f82d2d84", "comment": "Malware payload (Formbook)", "value": "e667a24fbbbf4349ffdb5867a4e81f7dc8091278500b79489cc0ceb19e8d6f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716322, "uuid": "18eb88a2-d05a-4c99-bab3-63e0e51a86f2", "comment": "Malware payload (Formbook)", "value": "b5b5e4b91546ef781f0496608bc0b1a8b2c0acd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716322, "uuid": "b7c50d3f-b92d-44c6-934d-e567e46caa73", "comment": "Malware payload (Formbook)", "value": "e88d1babd051a15dff63de288a6b2ed2f595e3ef28aeb4cd0583248d51479156fefbe4fa99fc28dc2cc70013ed29ae96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716322, "uuid": "05318c66-5a09-403a-8ed0-65b573f813be", "value": "T1E7D4D02026B85319D57E9BFEF030506407F9B927713AE7ADAB4174C919E37828633E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716322, "uuid": "1f90a7ef-ee06-4e46-b0bf-b526caed2f70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716322, "uuid": "135eca61-afde-4a25-946c-537cbb366101", "value": "12288:y9QUkLUu5BOxXgrtc+TtcDF/K6NEx73iXmmvnJIZ:nUuHOarsK6oyXmgnJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716322, "uuid": "fa32187b-7fb1-43d9-aa61-72cf08702136", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716322, "uuid": "09c77d28-1d77-4183-bbe1-0b5f5a2d1e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716322, "uuid": "f935edda-ccf3-4e18-9640-d43f011f7877", "value": "new enquiry list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988979e7-f0c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1655748341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748341, "uuid": "6bd8bc52-553a-4a16-8696-d87f0c939bb6", "comment": "Malware payload (DCRat)", "value": "1095ea2d678afc54d61dcd143d855ffc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748341, "uuid": "9acf2134-222b-4d73-855f-2fd32ffa47c1", "comment": "Malware payload (DCRat)", "value": "e765950b6924b37a66cc9549d2c37dd448796edee1621a847de7124776fcf750", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748341, "uuid": "4da4a238-fa50-43ee-ba9f-8e10bd66b905", "comment": "Malware payload (DCRat)", "value": "3b9f684fe0abacc0c65b9fdd6b2739f8f4a2b06f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655748341, "uuid": "61e18802-ab4e-448f-bdfc-9a87384998c9", "comment": "Malware payload (DCRat)", "value": "997e5da2d11199ac00b0a7a967aaa5cbb52ed7bb7c38058bcad44cd46800dde427926814dd946076a3f3c9b71592ada8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748341, "uuid": "e56f82c4-8a1b-4b9f-9769-b7a2b8062bbb", "value": "T14E1584342EEA5029F177AF7D8AE43596DA6EB6A33707994D00B103C60723B42DDD163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748341, "uuid": "4d40e201-339f-459f-9e80-90241077e58d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748341, "uuid": "ff460518-f287-4363-a66f-2a12cd81a91a", "value": "12288:vE2N7encWkENT8KrLc0emYdH6WeXsFSq+TML15QxtkhdHXPwVEINvm1X+5BNfcNI:vE2JmI8emuFh56WTPwVRC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655748341, "uuid": "dba616b7-72ed-41e9-9bf7-ec6cacc6ccb5", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655748341, "uuid": "c3665507-e46e-4e17-9805-3912e4cd3d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655748341, "uuid": "ae81c2fe-78de-4bd6-bb97-c8ef2e2b61a6", "value": "1095ea2d678afc54d61dcd143d855ffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34611e2a-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655743019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743019, "uuid": "d98929fd-9d69-4607-983a-730524a5576a", "comment": "Malware payload (Mirai)", "value": "b8ca9188da02004c9e1e81d4e2984528", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Motorola 680x0", "colour": "#23A929", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743019, "uuid": "962ef4a4-8116-44ed-9241-ced260da201b", "comment": "Malware payload (Mirai)", "value": "e7e2b12f2143a1bbf42923e268e4b286261a7ab67b0c26f239abbe6d4ab5d193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Motorola 680x0", "colour": "#23A929", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743019, "uuid": "b06aa602-a5cf-4e74-bef6-6dade0a24776", "comment": "Malware payload (Mirai)", "value": "79addc5848b2f682be96c96ee2f173ffba7055a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Motorola 680x0", "colour": "#23A929", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743019, "uuid": "29e577bc-07e2-45b0-be09-e7550b9bc873", "comment": "Malware payload (Mirai)", "value": "7759063f5dd62b918f0faae62b2efdb63ca20b39d577a5c433aec624f331f6642461b5d1eaae6aee84b5388fbb5221b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Motorola 680x0", "colour": "#23A929", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743019, "uuid": "2114836a-9b2a-4359-b7e0-4753521c6104", "value": "T1DA8329C06C11CCEEFFCAE57A6210090E6E951B0455E21722EB5BFF57E9B30567A8BD20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743019, "uuid": "e78bddbb-d012-4c9b-9a96-8187e7083216", "value": "1536:XTqUOX4kmit7mC83jwQG8cfoZWjCu0kD0ijkNWszGS8CmVe:pDzPINX0+lrsa2ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743019, "uuid": "52a9dd5e-0bb1-4038-847d-35bbd157c055", "value": 86024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743019, "uuid": "0c156537-dddf-4eeb-82c4-b104635908a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743019, "uuid": "7ae94b58-0cd7-4da9-a61b-7170eb81fabe", "value": "zz.m68k.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5241f8c5-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744787, "uuid": "0e7765f5-2682-4a18-80ce-c488c35ce0c7", "comment": "Malware payload (Mirai)", "value": "8a1cea44fe786f34fbcb828e4cc69d06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744787, "uuid": "608ed450-3623-43b1-b5c2-36eb21bbbf55", "comment": "Malware payload (Mirai)", "value": "e85b6a7914d4656d8a8b350de120920b7d2503f6b610cbade857d62fd2c9e930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744787, "uuid": "a57cfe52-e09e-408c-8b83-3a4951ebfcc9", "comment": "Malware payload (Mirai)", "value": "4981f967713bdc132ee0247a8d05342e63a7f3bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744787, "uuid": "a57ea055-6f36-42f6-a37c-df2cbfaa5c97", "comment": "Malware payload (Mirai)", "value": "6ae18fbc2051734188193c23f0a7df93f4c436063052171b6d61b4ab7eef9350d95c283e814513c78a2d4008e4bbd055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744787, "uuid": "90abaa95-3604-4c40-9fbd-b739956337bd", "value": "T1BC233C45E6C7F9B2E41200BC74AE5BB2DF33F57AE476D9ABD35968328906501A20732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744787, "uuid": "f6779a36-f2b0-4cdf-a95a-478519c7714f", "value": "768:iimu5fSajbbClk6Q/XnxRVoIoj0foImjPv+KmZ/YimW5XwmcwI:Z9KGvpnxRnE0foIsPvJmZQ9Qgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744787, "uuid": "be4df14e-e72f-43aa-b011-3dca470379c3", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744787, "uuid": "dce43110-c3d5-4245-938b-b0935945439f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744787, "uuid": "fd8524b5-9116-45d3-aec8-6bbd9ccfdc22", "value": "root", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3917dcc8-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655726276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726276, "uuid": "1a278205-d6c4-4d9b-a97b-dc2a27b588d5", "comment": "Malware payload (GuLoader)", "value": "c254238ec09d7c7b249ca37b491b8796", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726276, "uuid": "5bb8a368-f618-4b21-bb84-304a0d20c844", "comment": "Malware payload (GuLoader)", "value": "e865096a86fce0e1851719faea133a5afa41c981887665c0ef8cb6863a453b1b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726276, "uuid": "5a3c6551-1699-41d1-af29-9527138b0451", "comment": "Malware payload (GuLoader)", "value": "1ff98576ea7e598ea014fe3c19add734375eca0c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726276, "uuid": "84ba9da0-9850-4d9c-9d6b-99f8df655e5b", "comment": "Malware payload (GuLoader)", "value": "9b5950e359f8a95aed4b818288d666275721c8a25f46e6654c52b8de5974bb7dd8f7a3e3eef45b141c8bdfe18f800b79", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726276, "uuid": "b78ecb50-2b69-48bb-ae22-36b7e59a3bf7", "value": "T103740B82731664A60E7E5018721DA3150F882596A3DAD7340B99D3E9D762433FB3BF8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726276, "uuid": "5f068618-8ee9-4bef-b323-65774db380af", "value": "1536:pp8P+3L+o/QVWVa6upxLUfsqNQkePhqodjcMnt9hekPhYPfRNFNdWAKo148e91:p2Zl6mxzqNReJqodAiypre91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726276, "uuid": "eaeff43f-144e-4728-b690-54c398f2bdce", "value": 339967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726276, "uuid": "84913b0e-054e-4e3a-b4a1-77f0f73ffde8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726276, "uuid": "f09727f2-320d-44be-a96b-ba5ecfe89cf6", "value": "JJD20220620500100026901.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10225476-f0b1-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655740381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740381, "uuid": "1b20ba35-d377-4e0c-96ef-d12d7462f560", "comment": "Malware payload (GuLoader)", "value": "f7c63dd28b0efcaa37572cfe271b852c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740381, "uuid": "ca377a0a-cb04-4b9e-a313-53b54dff1b23", "comment": "Malware payload (GuLoader)", "value": "e90fb7259d944f038f220fbd9e73fdfa14c88394a0770d25d278e8e1ce51be5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740381, "uuid": "e8cb17f1-007f-4c6b-9fb1-627959f039db", "comment": "Malware payload (GuLoader)", "value": "e7b4d4a6d05bdbba33d409509c1509d4259aa89e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655740381, "uuid": "461185cb-978a-4ff1-a7c1-6232cd0aab67", "comment": "Malware payload (GuLoader)", "value": "2721e0b683e916321e59a4b69a232a3a758514a8ca7896d4d0e1a95d8c2948c24b10aca96854f39d1ba911f98140f4ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740381, "uuid": "9b8be739-f31e-4df8-9d96-5377564c354d", "value": "T1E8848E572534EE52F93E3DF2F8181A6A9F8F3CB2416E3905973572C816B2A634F0D192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740381, "uuid": "cebc4498-93fb-45ce-94d1-6f07139fdcdb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740381, "uuid": "ddd4b5bc-8ebc-4e5c-8358-9a657e4afaaa", "value": "3072:tbG7N2kDTHUpouNq8WJQjsAjdbh3PzLR8HCM6eAisEXRS0bWPCEjtt1ObWn:tbE/HUw8WJQjsANh3J8iMPuAS0Sq6Cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655740381, "uuid": "8d2aa305-c761-4163-8ff8-bddc803d0ca4", "value": 405796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655740381, "uuid": "ede11b6a-d7d5-422c-b9e2-1fd9083eaf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655740381, "uuid": "13f6e626-fbe4-4af5-a794-3de2d1e3343d", "value": "Scanned By Nerox Scanner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3c5676-f08b-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655724453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724453, "uuid": "124abbbc-91db-439e-8cd7-b8f3dadf02ce", "comment": "Malware payload (SilentBuilder)", "value": "85809f21d8f70c3bd3dbd57eb1a8a9ac", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724453, "uuid": "b687c056-ccda-4ec9-8d5a-5611794e6f62", "comment": "Malware payload (SilentBuilder)", "value": "e97b42d50a424125e400b2129cc787f0b49e8d2699ab9719ca4958e305f52abc", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724453, "uuid": "45b5eee3-47f6-470f-9570-4e5b26bb3bde", "comment": "Malware payload (SilentBuilder)", "value": "1ab6e9541d4f4de655605bb64fd375d1f787f715", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724453, "uuid": "fd44f54c-264b-4ad6-96c1-dfe9bf17a37f", "comment": "Malware payload (SilentBuilder)", "value": "fd9f9690dfb49db4a8845812e5f9f587c3dfe5702f97e2b0a085625be685602b3bb1e9c56559ac56b9b9b1dfe38ea15f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724453, "uuid": "26e2d46c-9eae-40ac-95bc-538f08be898c", "value": "T17B33D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724453, "uuid": "dbc69a51-79d8-4b20-a3e6-8e5b90019c93", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKv:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655724453, "uuid": "35a44825-0d6d-409b-b5a9-1e33527a3162", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655724453, "uuid": "7f3d9928-2fbe-435c-85a5-5e4c50fb8b69", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724453, "uuid": "0f8fc90f-7a2a-4fd6-8e51-704b42528501", "value": "Liste 3547.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135a85aa-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655715905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715905, "uuid": "f77e5453-1f50-4dc1-adb0-f8756332dd6e", "comment": "Malware payload", "value": "9f2c1f825ee4398fdfdbc5b09b3ef301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715905, "uuid": "e1e48b1b-997e-4c9a-964c-5ad1889e7aaf", "comment": "Malware payload", "value": "e9aad2549cd18a30a5789841bd827d3b7fa9894a774d07a50720cfd97ab4e04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715905, "uuid": "2732a632-f51a-459c-b060-ba495e1e65b0", "comment": "Malware payload", "value": "96c260125814d5c44b53dad7a5c5703641e240fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715905, "uuid": "c89695fa-6ac3-41ed-87e7-19d145d97813", "comment": "Malware payload", "value": "65c0413ee8c94fb72138e48e5adf3643e44a68ceff2668db1415a421d2f14f38f57820d73df8ab2839d331b0416f96e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715905, "uuid": "0b772755-cccd-4ce8-8fcc-4780440135d8", "value": "T16624E01076C2C431F17609325875DA689E2EF9301EA18FAB378C137A5F705C19E35AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715905, "uuid": "03452482-a0ac-4e7c-a182-2bf34b6340f9", "value": "fb9c55202bfc8248e1d5cbe6a7e377c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715905, "uuid": "b6ad0f3a-35f1-4fe1-bf73-a67aa703230e", "value": "3072:fLIRAu1Dk4oxhwRhkDWmxHXMc8+oh7R5zA5NfF+62LG4s/xC7nOriJ1aOoAZaaL3:kRkqkh87Lz4fgLG4NnIiJhZaM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715905, "uuid": "7aae85e3-fb30-4837-85a8-266f115ffca7", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715905, "uuid": "5ab73e62-0fdb-49ea-a4eb-8cbc03857d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715905, "uuid": "04dd686c-76b7-4b45-9492-4cfa71bbe3d2", "value": "9f2c1f825ee4398fdfdbc5b09b3ef301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91a0942-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655716210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716210, "uuid": "04e8043f-47a0-4475-82bc-1d65f17706d7", "comment": "Malware payload (Formbook)", "value": "055d0db85cc3bf672138c8476332e761", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716210, "uuid": "fff0d371-1dab-43fe-b688-46de3f0b72ce", "comment": "Malware payload (Formbook)", "value": "ea2cd125718434b2ab10bf45ca32ad46bf9e22f489c2338b3037da0ec7a8827b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716210, "uuid": "c8db6b89-c03b-4641-8441-ddcb953d88df", "comment": "Malware payload (Formbook)", "value": "4b9cf7d307094007609febb7c88fad7cfb3777c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716210, "uuid": "61ee4c88-12f0-45de-b30d-26f0216fc8b3", "comment": "Malware payload (Formbook)", "value": "c3290eed5d4ef45278f5ca5b53ec14fd4556bef030dd6fad5b0f48c0940bb34c1233016ac6feb6cd84fb86c8b571ecca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716210, "uuid": "75cc6c69-0613-4fcc-9c43-8b81cfbc6041", "value": "T10F63D02A7635E474C3464FF4092175BE0B3D6C3A999DAD1D2B02F9094CF0A844AB9F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716210, "uuid": "44df48d5-b699-4471-baf4-e889130bc67d", "value": "1536:wh3yaieBsRf9r+1ZtwEQZ+Lby+alav6SdA9rR0PCwZ8Cxkcv3+jv:whCr1Wtr16SdA9WU7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716210, "uuid": "2c0e36da-8c7d-4f41-948c-56dc9c457120", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716210, "uuid": "69bf1eb4-67d7-4bfb-901c-3d75abd6e27d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716210, "uuid": "fcc720d6-e9f2-490a-89b8-dd8a0dadb53e", "value": "invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f73775-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655734008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734008, "uuid": "1b6e950e-b5fb-459b-8325-47b8548512ab", "comment": "Malware payload (SilentBuilder)", "value": "262ffd0a973be87a2aa4ac12724d7f4d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734008, "uuid": "6ca7ea74-5194-43f1-b845-ec388ea80ad8", "comment": "Malware payload (SilentBuilder)", "value": "ead922aaa8dc0a56c49c6f6705e2b45a3ba6af71801e797f739f2b1b607cbd5d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734008, "uuid": "97a7124b-632b-4e1e-a9b2-40349bd31a1f", "comment": "Malware payload (SilentBuilder)", "value": "74e488a6491d71e9dfb9be5c2becb48e4524f225", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734008, "uuid": "d9715172-7ed9-4e5a-ab25-6a2b81b21231", "comment": "Malware payload (SilentBuilder)", "value": "a37c2a588a441d7650a010d88ebc0e826563b92cd805b7824778dab1f8ced4cea3aa6bc1de7c5342f92913ab68de33a8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734008, "uuid": "b4eea10a-54e6-44e6-89d0-c6e9a913ae2b", "value": "T12933D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734008, "uuid": "1b8135e7-b00b-4b42-bea5-18a316cb1c30", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKb:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734008, "uuid": "42465b6e-eb40-407d-806e-f8b852394eb1", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734008, "uuid": "043276db-4d2e-44aa-a10d-6afc39722157", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734008, "uuid": "e515ee26-d7dd-47d1-a6bf-938c2ad5a2b6", "value": "592237.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233e3d2a-f08f-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655725810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725810, "uuid": "1a99e902-8702-4f74-aff8-f00a0a5423cf", "comment": "Malware payload (RemcosRAT)", "value": "a51f5739a87cbcc07899d659f9da3d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725810, "uuid": "5e79357e-6e1a-406f-a8f9-044401c0abc0", "comment": "Malware payload (RemcosRAT)", "value": "ebcb09c56c09245ba10f231b7d4bfacdb5615ee6e3820f479f0a0d6488759668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725810, "uuid": "42474178-2744-4689-bf24-0aae2fb03a24", "comment": "Malware payload (RemcosRAT)", "value": "6d41c1a0e8115c756b56ec3fb91ffd7efe7336e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655725810, "uuid": "1346befd-fb8c-44a5-8ea6-7d4f1c8d8ec8", "comment": "Malware payload (RemcosRAT)", "value": "9816c04f5b87793c1cf2e91c6e45a2759dbdda61d79332dbf9eaee7cb50b77168c440f23e824d8159a7d06e2f3845a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725810, "uuid": "74fe086c-a676-4b6c-bdeb-d5c97d0586a2", "value": "T18605120476785A22EA3D8BFC88E2601053FCA437A206F7D88FD671CB5C677578B51A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725810, "uuid": "9dc4c694-a108-4eb1-882a-44f89edea73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725810, "uuid": "6c850153-3210-46c5-9437-462b7c9b0551", "value": "12288:h2iNmkegCLyhFGg+/RVE9EDVEFo440EV0XfkhelOYCpltaiPkHaeoFu409TKwSm0:h1QrxW59qE24cSOVpf57e409WwSmKS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655725810, "uuid": "7364b52a-13e3-453b-a6b6-670bf6ba73be", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655725810, "uuid": "fc1c76e2-3d5c-431d-8664-d3b25ecb53c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655725810, "uuid": "fbfcca69-5d1f-49f4-b7f8-446f97e5aee4", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9e42c5-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655722071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722071, "uuid": "3a76797f-4eba-4089-8244-eb79c50eca35", "comment": "Malware payload (NanoCore)", "value": "ae063cf00d0589f3feb0428fcede8f4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722071, "uuid": "11f4da73-8f65-4bc1-b8fb-fd64491a76cd", "comment": "Malware payload (NanoCore)", "value": "ebd78e0d0cf07c674914f30ec69c5a3d8a8ac395d06f05041cf55addcc4b5089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722071, "uuid": "1eb9d6ba-4b0b-4f8d-bc53-398bcb620c3d", "comment": "Malware payload (NanoCore)", "value": "41e44354841fb30de58ee402eeca0beb2c032446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722071, "uuid": "c47531f0-6a82-405a-9b08-011630b69e5f", "comment": "Malware payload (NanoCore)", "value": "7525cbdfc283e23f9db3398639bedfacfb6f60cc095f8ef94e6c9f3f8c150d60205d6c236390b052289dd8e93e0282c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722071, "uuid": "4d1a82d9-610a-45fb-a2f7-43a4544e8129", "value": "T109552302BA67E89FC466693608F3E2730F2B3F11782A16333119775A75736036E6661F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722071, "uuid": "caa4c239-0ef2-4faa-a5cc-705536cd7299", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722071, "uuid": "9ed83b81-84ca-467e-9acf-113c5dc9f81e", "value": "24576:S3ceYVEdgEEyiLbseW5AhAa3K1oz+/PALIxOX2YGyzSDuAWjJhY:8HYCOEbinsZ5YJ3K1Y4cIxOX2YgQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722071, "uuid": "c7b1e12e-df66-48ca-911e-8506de6fcf54", "value": 1311112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722071, "uuid": "04ef4c28-6687-4122-b4d6-7bf8786ef7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722071, "uuid": "00d5fd72-7ee9-4f03-b610-0a52829b467a", "value": "EN14511EN14825200622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f27d987-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655726233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726233, "uuid": "8a89c99c-5850-426d-b03a-9fbfcf043d43", "comment": "Malware payload (AgentTesla)", "value": "cbd4d1e95426eab0dcbc13ca66b2ef66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726233, "uuid": "f25a87f1-c6e7-481b-8851-99086f841ccf", "comment": "Malware payload (AgentTesla)", "value": "ec4c00e371226d49fd4eacc1e9a7b131871587995a9d283408e8179a9cc06697", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726233, "uuid": "3c49798c-e30f-4d68-99fc-ef7df77f9d0f", "comment": "Malware payload (AgentTesla)", "value": "58ff8299df7779b880a4d6235c621a9a31c2a7c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726233, "uuid": "a7692956-ae87-4d13-9375-d784cd00baa7", "comment": "Malware payload (AgentTesla)", "value": "2a8b186066a0c8a8c2ee75d2f9c5019965c8f35aaa2b5269fa485c35846d6b6d8037def82bfe608e424ef9df8943cac7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726233, "uuid": "58d349c5-df6f-4703-8e72-2fe88a41254f", "value": "T1FFA412601B69A346E5BF5BF844970090D7F3633B9566F7ACDED061C628FBB200682B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726233, "uuid": "2dfbbb5c-ae71-4263-a7d4-afe08b6759b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726233, "uuid": "55d6cda6-fb38-40ad-8164-d1197bb2ac43", "value": "12288:cZ8SNVqrc7jeTsGdr6lWXeYe+TR7bGuT:cZ8CYrQjeM8eGTRPGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726233, "uuid": "b2a04fe0-21d8-4a11-a396-50a800e542f6", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726233, "uuid": "63bb9a24-b3d8-4080-8ffd-78636e3f4b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726233, "uuid": "a826af80-7e6b-42e9-ac6a-019ad147ea65", "value": "RFQ#87658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31165083-f0b8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655743442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743442, "uuid": "a7d448b3-2131-4421-97ca-b8ffdf5f9f86", "comment": "Malware payload (Heodo)", "value": "2decb8dcb5286fddb744f09783e7aaa7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743442, "uuid": "e35b17ca-8cc6-4bc5-827c-f7d3b1563abe", "comment": "Malware payload (Heodo)", "value": "ede3debb6217c70da1f3217f237089b5d0359623e87e056c06389e53c0964437", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743442, "uuid": "351d8802-6361-4cc4-a3a1-d1ad9e8c7135", "comment": "Malware payload (Heodo)", "value": "805aa94fc90c76389bf50998ed3965ff16d60e1a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743442, "uuid": "e7cc9f6d-cde8-42fb-ab5a-6ed83e232cfc", "comment": "Malware payload (Heodo)", "value": "10695a86baa2332c4c5e7bcf5777efbdd9378b3a9fd10414071c443a7c28a7637ca1bdcf8dcd43b41d6925073dae5378", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743442, "uuid": "ad50fd6b-dcb4-429f-aa17-7e41da186ab4", "value": "T11533D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743442, "uuid": "1c6dc7a1-c540-4222-a025-142e01150915", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKL:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743442, "uuid": "c4820a20-de72-42eb-b112-fb432c79399b", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743442, "uuid": "25249086-e2df-4542-8cbc-20194c271024", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743442, "uuid": "f09740a2-f959-4a03-bcdd-1b1ae375dc35", "value": "detalles_20062022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0934ca29-f06b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655710304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710304, "uuid": "e994451a-7638-45bb-8e57-ebad2a1946ec", "comment": "Malware payload (Formbook)", "value": "f8d4219605ef4f794956afe2ae2eb67e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710304, "uuid": "865c45ce-35c6-41f3-bbc4-e824e57845c4", "comment": "Malware payload (Formbook)", "value": "ee2eb71951b61a20889d41886f210ecbd87d0c9ba5c2f909afaceed8c10cd3ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710304, "uuid": "ea4316b3-a3fb-4527-8585-81d41ac35452", "comment": "Malware payload (Formbook)", "value": "666c0048657930f2264de98cbc23450c1f1bbea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655710304, "uuid": "6de1c9d2-652d-4b03-b5df-72b6ee1b39db", "comment": "Malware payload (Formbook)", "value": "5cd801d813b90de910fb254802db2c79ed8c6a1a70d42b23403880e347aebee405735abccbf95e9bd6e3a73e805b461e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710304, "uuid": "52241a3f-3eb2-4c37-8aa0-08e1bc9ff41b", "value": "T1E1C4BE9C765072DFC82BCD76CEA91C64AA60647B431BD203A49315ECAA0DADBCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710304, "uuid": "b79c6347-8c85-4612-beda-96e2dcbd9093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710304, "uuid": "ebf38d05-a5cf-4633-b7fe-f1b2dcf4b8be", "value": "12288:qQrT5qmr2z9hStJS02BH6tGYo+HQ1YLvQ5P4MY3FVXtoGoTYC:q+wEMSTSvHkho+4v5w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655710304, "uuid": "e0c7dce5-de1d-4dec-b530-6bba65dbb123", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655710304, "uuid": "2a71eafa-0b40-4870-85a2-e8946ab74b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655710304, "uuid": "4ed84cfa-1b2b-4675-a75d-5b567d624875", "value": "SHIPMENT DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdeaaf3d-f038-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655688730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688730, "uuid": "d04f4f82-7f25-4f7f-a024-a5c7f7132de4", "comment": "Malware payload (AgentTesla)", "value": "7cd6d162ad1d33f1ebde510b431ba881", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688730, "uuid": "8cc0a47b-be7d-47bc-b500-09bb3a04ae19", "comment": "Malware payload (AgentTesla)", "value": "efb7ac512c77ac6c0ee4e3d411e2e05fd42046ba66e48d749d414d8f9a2ec696", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688730, "uuid": "6bcd9603-06da-4a9d-af5d-dd2999f4ff85", "comment": "Malware payload (AgentTesla)", "value": "3578490a594d57b38ffb13c8b18413a4312c0698", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655688730, "uuid": "abec181f-a469-4415-93eb-00bcd042f291", "comment": "Malware payload (AgentTesla)", "value": "e339e9cb45bf24ff083fc537afcc2fbd73a78b757550c9729b89ac54f1a97e5cd69290c227e853d96356a76b5eb76b7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688730, "uuid": "27af66bf-cce4-4fbc-9bf6-05d65a3d0de4", "value": "T143B48D9CB22C74EEC85BC27299745C64EA60746FA31B411794930E9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688730, "uuid": "106aa8d5-fb19-4735-b9de-f1837cf8b7d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688730, "uuid": "7899b0d2-7bb1-4aeb-ae88-ca8eb01cedf3", "value": "12288:tkXn597yGOh8SUHYT7I+Uu8YrCRDpMun7gHzgp15lrIfl+AKWerdx:K5o3o4Twu8YsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655688730, "uuid": "40b6b2a4-29f2-4031-b3b7-b030464df803", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655688730, "uuid": "79e38229-c515-4aaa-bfd9-dd9dd1410a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655688730, "uuid": "63869b76-fe7f-4555-b0d0-f0be101da3a3", "value": "SecuriteInfo.com.W32.AIDetectNet.01.13564.27680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9e5532-f040-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655692033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692033, "uuid": "3be30772-4d96-4f65-9d5b-bb27777e0dd2", "comment": "Malware payload (RedLineStealer)", "value": "b3b126c6a4f2ec5f85288af6d9525c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692033, "uuid": "e378ff73-f44d-4c65-9898-6e0bd81bbf17", "comment": "Malware payload (RedLineStealer)", "value": "f021954147e5a62434b72afe1b9b8421a8e1f246b9337035113d52e651fa3ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692033, "uuid": "4511370b-ccfa-4946-ad1c-51374cf53172", "comment": "Malware payload (RedLineStealer)", "value": "16a82996bd6efa4197d4209903be3254f1d462bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655692033, "uuid": "74d91cd2-9db8-471d-8a30-6cdfadb60e53", "comment": "Malware payload (RedLineStealer)", "value": "f43b0514d44e8553e19405bf92d2c12f5300975299780923c9a35c1b2dc4c68416e1062ac5bd1d8b70fdf52acd79c16e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692033, "uuid": "915cbd28-066f-437c-9074-511db7c8d9dd", "value": "T193F41201D7F98324DDBE76F9177DB26702297CB20F364ADF5644F5C822A1B91A0A8339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692033, "uuid": "247df03b-f98f-4715-a319-8cdd1f0e680b", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692033, "uuid": "fa795a4b-8bc7-4d86-a59c-0a5fcb5b17aa", "value": "12288:SQFLaq5F6udWKhQsT/aL/K5NOIv1DM7Jjha6zJ+4to0RZr7vl55zj58xURo2BgeE:SQxaa6ufS/K5z4J0C+4t/R1zzTqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655692033, "uuid": "2bc8c75e-e92e-4d2d-9f0c-0d3b68066656", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655692033, "uuid": "cc71f7c4-896b-48e7-918b-d4198de99485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655692033, "uuid": "3bea35bb-15dd-4d76-b3f8-9e7e159a291e", "value": "b3b126c6a4f2ec5f85288af6d9525c9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815f9632-f0bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Ransomare.Stop)", "timestamp": 1655745295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745295, "uuid": "8f22c37f-e9f2-40d1-8537-2f1a7ada8690", "comment": "Malware payload (Ransomare.Stop)", "value": "c38b1f5087b560432a9e4d401c9c7c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Stop", "colour": "#AC72A0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745295, "uuid": "f69f1cdb-ea72-4777-9219-6d1b3ff1c3be", "comment": "Malware payload (Ransomare.Stop)", "value": "f072f7896731668ac389aa1d7da8c1d12a858bcf58b6ef8d023ffa78ef3f4023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Stop", "colour": "#AC72A0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745295, "uuid": "14e53434-d33a-478c-8142-6e65f1d0894d", "comment": "Malware payload (Ransomare.Stop)", "value": "7bd99ddd2e3b5836317d04c506f1cc89a5f90436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Stop", "colour": "#AC72A0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655745295, "uuid": "d2b87a3c-c6b7-491b-b827-cc48ce694177", "comment": "Malware payload (Ransomare.Stop)", "value": "df3a6cfd3f703bb2ccd4007cbc2136991eb2c16696a109981ea6e1c20d2430039ae8979e8b432610959547e2d450e148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Stop", "colour": "#AC72A0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745295, "uuid": "faa72564-d747-444b-b423-2b10d0c55006", "value": "T1403612B317651185E0E7CC39C63B7ED571FB036B8B41A0B8A5D7A9C568224E4E32ADC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745295, "uuid": "be1058d1-6fbb-48ba-95f3-8d41734e2e1e", "value": "9d987c4f609ab4719a024c7fd8af6191", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745295, "uuid": "d485ac38-8043-4efe-a1d2-9027e42b01ae", "value": "98304:n9JWl4Y1GJ92KMFiKpHFNbh1d6mvmmB4tK6fqSxaaWEcQd:9gPu92XnbhXvmQF6fquWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655745295, "uuid": "8e0fdd13-5178-45a0-8b61-028343383000", "value": 5055600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655745295, "uuid": "2feebb1c-1404-4d25-b6d7-aa442bdc1350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655745295, "uuid": "8cb17902-747d-476a-b6aa-6ed0fef643b6", "value": "File.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd6ac36-f08c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655724673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724673, "uuid": "ca274e34-150b-4fbb-8368-d3d6efd73d57", "comment": "Malware payload (Heodo)", "value": "049b7176059065dbdec587056e1cef4f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724673, "uuid": "bb98f3ac-efec-4922-a178-b4ad12b08d61", "comment": "Malware payload (Heodo)", "value": "f13f0a62ca6e55cb6f5344b2c978d512f545389b65cd6b591b952ebc58607944", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724673, "uuid": "6b76a853-0e27-4e16-ae62-230b4b0e9e82", "comment": "Malware payload (Heodo)", "value": "37b92d8e34367827aa8587dd1b41f3f3837a91a9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724673, "uuid": "25f5ae5a-202e-41c7-9201-d158cc2d7c76", "comment": "Malware payload (Heodo)", "value": "ab0b538d03ac8ca3bc3ae09abb206f0a2f85baad3000dd4d552a50d43c6717f9cd4f14a2298385b677cb7dcdfcabac7f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724673, "uuid": "81ffc1c2-06d6-485d-9bab-559c1b85fec8", "value": "T11A948DCD33D343A8F96FC934C9234A72F971FC454370960E029B26A9DE2F354962966B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724673, "uuid": "92922c39-c972-4fd0-bd0b-caedf7074326", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724673, "uuid": "21f7c3b8-9d7d-4985-aaad-52e047dfcc61", "value": "6144:HRNTd2x9WN4bAFWRFNz8x6SQEDM3AD2lUpDi6uGGYiyUH7zZHTzy:xGbveVLpryFXdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655724673, "uuid": "57ede5ee-f57b-4477-85de-6affb4574e01", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655724673, "uuid": "3a3f4278-bb53-4244-8503-a54c8ccc7652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724673, "uuid": "bdec8ce2-afd2-4d23-9742-ca6b6f8d272d", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86faa60e-f086-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655722112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722112, "uuid": "5504d76a-07a1-4233-b1d3-2688eb3330eb", "comment": "Malware payload (GuLoader)", "value": "da110e58df308eccfae48376efea902b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722112, "uuid": "5e202555-a08b-4435-b439-21afd1ab319a", "comment": "Malware payload (GuLoader)", "value": "f19026025fe12161ea0e25e2a4ca7ca466e0f73d110bd84dff87afa5189a116e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722112, "uuid": "2d14e88c-eba8-4370-a3c1-c112edee3142", "comment": "Malware payload (GuLoader)", "value": "78f2c93e4811895a18954800492859e6e5403e33", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655722112, "uuid": "e7848378-cf55-4bad-8dc6-b245030cb36a", "comment": "Malware payload (GuLoader)", "value": "99461634588213a6eea5b3039a28e1d898005cb4ffed2a7f2366e3ed84e828ede0371a84a0c9c5c498cda96373dce398", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722112, "uuid": "09ddce23-b3b8-4ee5-9b47-3e5d68f592c0", "value": "T13C74F8427B2695890EBE4015B42C8B1A0F942452A7E7D7712B4283F9CB51073FBB7E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722112, "uuid": "87a07c5f-296c-48d5-a85a-41441fb03113", "value": "1536:x2Kv62yAOkdw69bnWutVhGO1qXWAaUbfFyRBV3Nhou16BBeiRkSLMSNQB7gh1:fiJsl1bHGO1qXzFaV3Nz1smgh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655722112, "uuid": "0f9bb234-4259-444d-8167-441b40b4ee33", "value": 337698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655722112, "uuid": "95576b7e-486e-4ee9-bca9-62041cc78bbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655722112, "uuid": "73796995-6480-498a-b600-6c932eca04f7", "value": "CONSTRUCCIONES ROCACE S.L. OFERTA 20062022.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be59a16-f097-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655729448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655729448, "uuid": "d5372ec7-b950-4ee1-a6dc-a70e9e745e9a", "comment": "Malware payload (Formbook)", "value": "d714b80d88018c26081bbba7b3056073", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655729448, "uuid": "f88f6c25-f2c6-461b-9237-aca806801181", "comment": "Malware payload (Formbook)", "value": "f236a0e0050d7c35735130ab0f0ea7e98c10b03b97e3aff14e9184188db8ad6c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655729448, "uuid": "6889086d-9ee3-499b-9d0e-0cb17474ef22", "comment": "Malware payload (Formbook)", "value": "1f2526046e95395e9ebfac3e62853ffad59dc3dc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655729448, "uuid": "bbb3c31e-b717-40f6-8ecf-1c32a444ec68", "comment": "Malware payload (Formbook)", "value": "cf50af856f2edb5838055a8710888586b01b9ba8b542bc945f732ab0f2529dcfeab4949f6468f772c62c64a7aed49298", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655729448, "uuid": "2a265b2d-991d-491a-84ce-cc2b83b73ed0", "value": "T1B89423B4D43719885BCBDAFD3F2E5502FA98DB3D54B25AC9833D02661439486EA9F303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655729448, "uuid": "33174669-9365-4ae7-9153-810302ef8905", "value": "12288:BaQqbEXUub0blSvbLWoICPrLt8REDCfz1VV2hJ:l0bgvFP4dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655729448, "uuid": "6edfe557-db9c-4cfd-a19b-3612107d57b6", "value": 424640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655729448, "uuid": "5c4e0014-b559-41b1-a2d3-9c1f9845ca77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655729448, "uuid": "4274a58e-c3dd-4738-9d45-cebf33b836f1", "value": "BL-SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03011290-f095-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655728333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728333, "uuid": "288f55ad-8a6a-4774-9f78-b639d41c75bf", "comment": "Malware payload (Loki)", "value": "7ff39bfad32094c7c8f12885e978b224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728333, "uuid": "5c27338d-d446-4b80-8da8-bfc1719fb7b1", "comment": "Malware payload (Loki)", "value": "f364800c07937fb2c41475a8a453df9b06c2297765ef1732f1904424021424f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728333, "uuid": "6322af2d-9d39-4c4f-ad0a-983f9f7d81c7", "comment": "Malware payload (Loki)", "value": "bdec096fc48f6a9ff62767bb6215c648052323db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655728333, "uuid": "dd939c38-352b-46dc-92bc-29e2bc2e1f7c", "comment": "Malware payload (Loki)", "value": "666e129e74fb4919519498d2954c47d9c441aeed69bc82cf38c137a1dd3ca9028ec26193c79e61d08dc59dd75c4fb55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728333, "uuid": "69528be7-60aa-4cf5-87da-3d8a31c93418", "value": "T1868402093FFCE731D4BBABF419E342A08B709A398862FB4C8ED110DD58EA7589591353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728333, "uuid": "674570ac-cb82-4f14-918a-9566efda6e51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728333, "uuid": "a7877ace-2c3c-4a65-bafb-2157ecfbe4de", "value": "6144:XVT9+weWqgNr++By1FSCa5H01+u+ohFw8vEAr8tjxGLW28lo:p4iK31HYH0d+MojcW2qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655728333, "uuid": "a23311fa-20cc-404c-858b-23058c8e1b1c", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655728333, "uuid": "cff8be79-7e2a-4e7f-8821-f7605a2171d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655728333, "uuid": "69a06fae-ed03-493e-b7d8-8e11a5376732", "value": "SecuriteInfo.com.Trojan.PackedNET.1389.5794.26930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f820d09-f076-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655715227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715227, "uuid": "443a7206-b90f-415d-83e0-287c602113d6", "comment": "Malware payload (SnakeKeylogger)", "value": "cfd7c514332597fada1b0e2663f3fc32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715227, "uuid": "23242309-89c7-4932-a3c6-596bc822e54f", "comment": "Malware payload (SnakeKeylogger)", "value": "f40496a0ab50f677d274feca59462e356b930769b66cbf1389ca6d2bdf28b308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715227, "uuid": "1768d550-592b-48f3-b9b8-7093e4ea8dc3", "comment": "Malware payload (SnakeKeylogger)", "value": "8af0dfaabd991bd60b5c0589c5aa6d9546cc3c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655715227, "uuid": "46c39182-2212-4b91-bb37-d073ca481171", "comment": "Malware payload (SnakeKeylogger)", "value": "197d0683ee72010371b2a57a7f3bcae6383f87b4e79fc66fbfc1ec66f526a48821635ae3734389b505f350aa347f1463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715227, "uuid": "9612abfc-cdc6-4163-9388-ca588ac5b948", "value": "T121142F35F410E70FEA7887FA5DB5E79819D76C2A080886C923493B9DE1F26336D1D43A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715227, "uuid": "31e7bd32-28c1-486b-b6ce-3c68dfd03feb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715227, "uuid": "5470d2d4-37c0-4785-933e-7a167bad75d9", "value": "768:HKQzOupFSpgSl0KGJaTgENZaw66666aqvD:qQ1SpNaKkaUENZaZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655715227, "uuid": "70977ff8-a9f7-4aef-8120-54f25e22dd6e", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655715227, "uuid": "1c907d1e-5a80-4d07-a110-4f2bff6a18b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655715227, "uuid": "281e1286-9287-4146-bc22-945c1ab491fb", "value": "VSL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e1c60b-f0b7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655743039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743039, "uuid": "9e7068f7-c747-4027-a19b-fb9bdcbcb036", "comment": "Malware payload (Mirai)", "value": "9f48950d3faf9cf8854afe86a29a7237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743039, "uuid": "43ee6c35-bcc5-4238-8602-8838ba097b17", "comment": "Malware payload (Mirai)", "value": "f4abc65381a5d5cd2efc9b2bf8af1d54ad8d111cc02281d6af0db4b1241e27fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743039, "uuid": "bf989722-308f-49e9-bd5e-2d9a0254a60b", "comment": "Malware payload (Mirai)", "value": "e85b7b30141fc7067318496a3a557c8d6b4bdc73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655743039, "uuid": "77c4ca44-89b4-4837-9c13-f4ff649b9f5a", "comment": "Malware payload (Mirai)", "value": "dad863b409b4750a335469905dc848a627ba220af334eb2ddbe92d4b70fcebe3aff21eda20eba2071eb52ec1400976a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mipsel", "colour": "#FA7E95", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743039, "uuid": "0155e5e6-41f6-4c97-a42d-7b7f43fdd33f", "value": "T1E003E15EAA99BF8DCDFDC436015E43D40D8175CA778A9608E7154CC9F8F583AB38A1B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743039, "uuid": "36c95f54-3496-44b1-a9b4-8c7da9e520f3", "value": "768:bSh9tArZKcJP9DTfdv2IjmgyHQcvSfQKX8VtZWA:mh9tYlPpfdv2IytHQcvCCtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655743039, "uuid": "fe6b8e6b-aa56-4bc3-b254-76162fd78d06", "value": 41364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655743039, "uuid": "125bda6c-3bbf-4b6b-9ef6-dd55f1b3f583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655743039, "uuid": "81274fdd-2547-4b7b-b20f-303a1a9d966d", "value": "zz.mpsl.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0549afe4-f05d-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655704285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704285, "uuid": "44c637d8-3c55-4e22-a3ec-b43e7e83889a", "comment": "Malware payload (SnakeKeylogger)", "value": "b99e9e02491e3e2b8e1c24417c907123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704285, "uuid": "ff45236d-91c5-414f-8eee-7349711a390e", "comment": "Malware payload (SnakeKeylogger)", "value": "f4fe1e2b3124a468e22462ec870980ac086f57da55de8233de47dbe418634774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704285, "uuid": "ccb62ec5-ae7d-4f3f-b67c-0072df60ecf1", "comment": "Malware payload (SnakeKeylogger)", "value": "17cbc243efda95f95f4ba5e4714cf7014816f8f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655704285, "uuid": "8fbca0ad-2099-4a0c-9f58-4d6a26c6263c", "comment": "Malware payload (SnakeKeylogger)", "value": "41f5880b1ad40f5d24598998eb34966cbc555a2de0efede706968cebcd1738d437bd7b8f9a5b68b3aaa6d15ec1943fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704285, "uuid": "18f097dc-32af-4a5f-944e-7dd2ef548b04", "value": "T13E8412247AB59701C1B7A3FC09E241A193F9967985A3E35C8ED060CF5CFAF5448E2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704285, "uuid": "bcb4fa2e-db07-4678-a06b-2d8ba59b1cd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704285, "uuid": "781ba48c-d7f2-4425-b50d-01086ec47978", "value": "12288:9sZ8Ekk5uxary294rf4nm5IWRv5sCk7RFP:9DEkE+r0n05il7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655704285, "uuid": "1caa9ed9-b2cc-40ce-80d9-7c6d934dde8e", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655704285, "uuid": "e9b5aa20-6863-4a2b-a346-349459fe9137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655704285, "uuid": "9f8b16cd-3334-460b-bd54-e104088cf8b3", "value": "Soa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ac899f-f09a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655730488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730488, "uuid": "133cc1e8-db7d-4714-8068-2a15248d6573", "comment": "Malware payload (AgentTesla)", "value": "ade065d1be07551b746a2f3032d38bc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730488, "uuid": "27f76802-51a4-4a6c-9150-e0e574281667", "comment": "Malware payload (AgentTesla)", "value": "f5170254958df1bc6676023ced513bd38cb5ca58ef402a260626e91347dd5408", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730488, "uuid": "a0af0fd9-cb15-4147-9855-708bed32a81f", "comment": "Malware payload (AgentTesla)", "value": "98af84eea9a815d3bd09067cec4eb454f468f924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655730488, "uuid": "6f51e56d-4c1e-42f4-8e95-c54c6aaa9778", "comment": "Malware payload (AgentTesla)", "value": "597bb50896fb37bd148fe1e0cdaf135f330b72c7349b949a83fdd28187fa044c49466ccd10097a3c49fe7c883e575b25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730488, "uuid": "255d168d-cc8d-4451-a343-07668e8220ce", "value": "T1E0C4F101A67C5762E93DCBFC48E2614493F878279217F7AD4FC530DB586BF068A50A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730488, "uuid": "31bc4618-8268-4632-a3a8-088789c8b3a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730488, "uuid": "a7979078-5861-4704-b8ac-c1078ebf1e75", "value": "12288:dV2iNfianOIsejkMVlFeVCI5WCDxBbZc:dV1tiqOIseYMVlAV5Nx1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655730488, "uuid": "37a310d6-71c6-4bc7-bcd1-4c4b104d74cf", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655730488, "uuid": "a0f50bac-ee7e-443a-b608-68a28adee907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655730488, "uuid": "b10f526d-d701-4ff9-aa92-b80d6618256e", "value": "Nuevo orden 20 0622 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66988aa-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655734190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734190, "uuid": "613d49fa-6b6e-4a83-a1bc-bfd0572f8f11", "comment": "Malware payload (AveMariaRAT)", "value": "4a489f590547ff5ad96154cfea4270a8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734190, "uuid": "d5ba346f-9305-4042-8bc9-0e10f0458447", "comment": "Malware payload (AveMariaRAT)", "value": "f53a4ccc40c91fb6a59c11fec43ddd53c409b01690666896777044e339bcb04e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734190, "uuid": "747cfcf5-69e7-44a7-92d5-88ac850a3811", "comment": "Malware payload (AveMariaRAT)", "value": "68d513bf6bf477acd45a7f5aba989cda23ea48d3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734190, "uuid": "c23bd01c-7de8-4d4d-b27d-d8d70fff10d2", "comment": "Malware payload (AveMariaRAT)", "value": "b5061111c8b31622c7726ebe197e5c246f469205d072dc08cdf7574eee9467cf7bdb076f61900c326a76acf465e72ab3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734190, "uuid": "67951f50-a221-4106-bf2d-358d5de9b552", "value": "T1BB25BF49371D0ADADCD44F36A9F30F26936AEA74291F470766806E7F332B1C9AF4054A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734190, "uuid": "611454b2-6191-48e4-a462-67aff4b4ba6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734190, "uuid": "d086c1dc-478b-4ab3-8f7a-8f5988eae16d", "value": "12288:6ZGhUBc54QDyQvH22qla5w/yXbxNfpVK/7Yx9SJlOt2/MuDZVY:iGhj5BDyQvH0MW/IbxNuDqa/MuDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734190, "uuid": "6f2e7170-5e6f-445d-a793-6b0ce39194c9", "value": 1048744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734190, "uuid": "b06e7da5-eb39-4473-a12a-257cdbdc6a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734190, "uuid": "46187b4f-5198-4f61-80d7-0421f2b527ef", "value": "4a489f590547ff5ad96154cfea4270a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf6b70e-f07a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655717072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717072, "uuid": "70bb1a77-cec8-4017-91b4-10352d42909e", "comment": "Malware payload (Formbook)", "value": "ecb4518230e6c209ee593ba45051466f", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717072, "uuid": "5fed9384-91a5-4d43-9afd-b1f8d699682a", "comment": "Malware payload (Formbook)", "value": "f5ac133b2529c2dc10e1b10629d0af82948625bf2c4efad67e7ed756db79f247", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717072, "uuid": "66499a01-e6f9-4348-8afd-4513722fdc52", "comment": "Malware payload (Formbook)", "value": "dc6a071edc6b0a217ddbaccbd354a776442ff0a5", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655717072, "uuid": "496a39e9-2120-40ad-a87b-c23190afa27e", "comment": "Malware payload (Formbook)", "value": "320ea50548026a31675ae2642d27859adaf05d6541c94e3ce917588b1e486a3a84921f0a1ef910866d89c2a87067fa23", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717072, "uuid": "ec89f925-1ad8-45e9-b3ab-d99457ffc4d8", "value": "T1E99423EF04C2C7FAC88B2D7655A85F67BE43E0D692E93E9332A1774153A8E217708147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717072, "uuid": "0d7cbf77-a584-4606-8de3-fb7d362412d4", "value": "6144:pilEgh+rPF8p2gNeVuKIFzLndAbS6lE2lCHGecqIVX6RM5uzNewo8InAacmSoYc1:GEzPeMcsuBn6CmWIVqHoVn91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655717072, "uuid": "a73f6448-874f-434e-b003-dfeb41c2057f", "value": 427246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655717072, "uuid": "f882e13e-8d4e-4fee-a659-a14ee7efd836", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655717072, "uuid": "fd13c730-5543-49c6-af05-c95ae5fb72a6", "value": "FedEx Shipment doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc11264-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655726577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726577, "uuid": "584268b4-cd65-406b-9473-81e14ef514ae", "comment": "Malware payload (SnakeKeylogger)", "value": "7811cfd2b10e5d1ea11e19265a0f6971", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726577, "uuid": "b22bef4f-bfaa-465d-a21d-580b83d45cef", "comment": "Malware payload (SnakeKeylogger)", "value": "f5c703840e56975516f462675df6a4f1fd97fc04f4e0bd2088066803110c137b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726577, "uuid": "8c6a7f2b-9185-4d41-ac0f-d17b1455bacb", "comment": "Malware payload (SnakeKeylogger)", "value": "7dd04a095c4c7758402a3ca862840d9de5919598", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726577, "uuid": "b1509f7e-dba7-4d57-8ed4-ca1befe733e6", "comment": "Malware payload (SnakeKeylogger)", "value": "4b575e85ee577b98f7df1dbfab87b01b282864f8fba6570e31b1bf660539495b6cb88b8886e152cea7cb76c349ca4720", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726577, "uuid": "69aed4b3-8bae-4c5d-8e61-c913acdec9f2", "value": "T168427EBC8DC849D8CB45A2D63B223D6C506E7FD167CBD6E234BC37C137A146C6A861A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726577, "uuid": "3dbc862a-1e1e-497a-aee6-dfbef2e293dc", "value": "192:D+QFLs3ioQHUwIt2I42nc4uvTuNm8n06HdSAToPRal+qZxPesS6WANAPsTwTRc5J:iAs3ZW662JY80iOiZPXxWHSII/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726577, "uuid": "828bbdda-907f-48dd-8861-33089b8edddd", "value": 12251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726577, "uuid": "8ac00485-fab1-4df8-a797-71f507f44267", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726577, "uuid": "86a301f8-3ec4-467d-b6d3-cc38c3186e43", "value": "Y8 3668 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3581f5d-f088-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655723072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723072, "uuid": "a9a52e6e-0697-420b-91b1-858699f6fd74", "comment": "Malware payload (Loki)", "value": "a4c2d132518d5afa661b5ca5a7e72041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723072, "uuid": "f2b5714c-bda8-421c-9f3a-eb30093c1723", "comment": "Malware payload (Loki)", "value": "f607d32b981bc80e3c4f72bc1e4d4eddb704b1cae4c4063c1536e5f2ed3bf076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723072, "uuid": "b6d3be51-710d-448b-a55d-068ab8d38428", "comment": "Malware payload (Loki)", "value": "fede4247c47180fde35dea6cc1b8579117ae14a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655723072, "uuid": "16b3d16d-978b-40ff-8f28-fe9941e128a7", "comment": "Malware payload (Loki)", "value": "dd8e5a8acfddc8575c3bb8c7f2ea5f05c5c7aa063c509974ac51cae5b050c83d90351774581a069764fc7cc66a4a1213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723072, "uuid": "f917c710-1776-4957-8bd2-c51669393a89", "value": "T16C94F000AA7C5762E938C7FC45F3624153F83827926AF7A84FC530DA4C77B5A8A50A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723072, "uuid": "b9565f27-4e4a-4631-a811-c157ccf405ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723072, "uuid": "4e45111d-dd77-4c58-9ee8-f0fe514e8719", "value": "6144:e9nhLdmbdmdCxjVX1X2GhNjQIv1MJmbRK62zJwwlfiipFEQT9B2hgt4yyiSHl6Ws:j2iNjQINEAc5ZiAE29BiakBF0pk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655723072, "uuid": "e1891234-6555-4763-97b0-c730eda7d8ae", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655723072, "uuid": "8d6bb073-58a1-4dfd-a2d2-d859eb3d1f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655723072, "uuid": "5c152f26-1ec4-4b77-94fe-d4b5e58eb5e3", "value": "audiodg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c4a3ad-f07a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655716921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716921, "uuid": "05d449ca-159a-44a5-89c8-e613593b4c61", "comment": "Malware payload (GuLoader)", "value": "8e607045c0367bb7b8a8ed6d7dbfc8fd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716921, "uuid": "16b59149-2be7-41eb-8cce-b301033c9eab", "comment": "Malware payload (GuLoader)", "value": "f6f8534c2aa81d5cdd66a505385d79ae4210cb54be53442b59d59ed0936edf34", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716921, "uuid": "63d3087e-3d65-49ef-b7ed-9b60a37e7cac", "comment": "Malware payload (GuLoader)", "value": "7cbea8846d50875705ffb7ebc5e29f6fa3f79727", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716921, "uuid": "17ed366f-ec5c-4955-948f-b8b3d1e968e3", "comment": "Malware payload (GuLoader)", "value": "60578ad7f247e8262904f00c3b4a321795e9da0637a1bcc7aa613a9021fa1af7a9655de6de0e7c04c37ef47ea61001a3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716921, "uuid": "ef940324-9d83-4a8e-aaef-04970c4039da", "value": "T101D3FAF4B0182CA7F90475B2F41AFF998EB131332FEC4861A735255E231AA4DA15D8AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716921, "uuid": "43b6c53a-6341-43f0-94f5-40c5389328cc", "value": "1536:B74bym6bCVMJUjKjilikAO8zA9f2heL3454vN033s9FqFcRmxre1IwRew4txvz99:BsbkYmSISwxe1KxiMvM5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716921, "uuid": "bc0a51e3-a855-4a00-86eb-379f48f25ecf", "value": 133621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716921, "uuid": "bb29dfa4-c858-46a7-a73a-0d78821e08d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716921, "uuid": "a2c0e675-f343-41e0-84f6-9b6538dad2ad", "value": "Remittance_Advice_No_27399.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282d848a-f0a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655733549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "b8975c3f-adef-4ed7-98e5-91ce1d36667e", "comment": "Malware payload (Formbook)", "value": "859b68d7efad7e93fbbe0ef17a28d186", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "795360de-a6a3-4aa6-ab63-fc40129a2ce2", "comment": "Malware payload (Formbook)", "value": "f72eeddbc462b5461b4f912772092b6609208dac393545e46a3b01ed19d506da", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "489b9b7b-8dd5-4059-85ef-b67cf0437cef", "comment": "Malware payload (Formbook)", "value": "5fdd185dc67d5a5c9cd61277a146603e9c82c4cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655733549, "uuid": "574aff1b-8c3b-4173-bcc1-116cfe33eec0", "comment": "Malware payload (Formbook)", "value": "be685d4f2ed3e408ca2e23a949ca7fbae6267ad02ccf04052c95154659875c61ef487f2f5ea8fab24fe4bc506d3a8141", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733549, "uuid": "c42fb63d-7da6-4bff-8466-94b6e6edba7e", "value": "T173F3DF4EA43A810EC586F3375E1EA5BA1799EC2B77DC03C35500380805FEB5A696F69E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733549, "uuid": "26daf123-814f-4baf-8f12-63260b88f619", "value": "3072:oeSMRezWSSSSF+o0lSaJS2SSSSSSSbrFlx7KigC4OByVBcj/Ixq/I9EJJLoFsTgU:zRSSSShcS/2SSSSSSS97KPCsBTqgvWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655733549, "uuid": "6e152d2d-55ce-4380-87d1-9eebb4a85a21", "value": 172136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655733549, "uuid": "9955f030-58d8-42ce-a213-8d80919e4fe9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655733549, "uuid": "88176fec-4830-41f5-9ba9-877706bf0259", "value": "RFQ POTENTIAL PURCHASE ORDER .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d787c6-f0a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655734131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734131, "uuid": "4c169bb6-c079-44b2-8d38-60ad2f0f6385", "comment": "Malware payload (Loki)", "value": "efe77ada0f5bd89b5b0f6a26fc74ec82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734131, "uuid": "5eb8e030-d3b6-4b0e-a76b-99997871d833", "comment": "Malware payload (Loki)", "value": "f7875d600d9f4c6b2064871fb2d0f0738197675eb80f13ac09bd49bd769037c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734131, "uuid": "eac519d9-84e3-4166-b584-373c8e404b0f", "comment": "Malware payload (Loki)", "value": "8838a34f74c1da876b909ca5777f8268ab02911a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734131, "uuid": "f92dff29-df8c-4ba0-80c3-651824060b0c", "comment": "Malware payload (Loki)", "value": "d82deae95aac4e6ce75d3026cdc9294fa0f3fa11f35353ca306616e13202d6175f6d3ff3acfa87ddaabe3378a448d0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734131, "uuid": "8d14e010-0a7a-4fda-b83a-0220a57df14e", "value": "T157C4AF983660B69FC42BCE7689581C60E5A1A477430BF347C88721DE994EB9BCF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734131, "uuid": "446b4cae-c6bc-40ec-9e37-72e959bad728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734131, "uuid": "3aedb963-9028-412d-b270-ab12b9242bb6", "value": "12288:MGKPiUrE6Xaja6z2NN2iNfE0Q2wWOHgJ7SZLRdI2PHjHxQLoY3+HyeQb8CulFJZ:pUvg/iX1e0DwM7SZLRfVQLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734131, "uuid": "37230344-6662-4017-8594-e3460b932d94", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734131, "uuid": "e947b173-7695-4d4c-9a60-8c50eeb7c65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734131, "uuid": "233dfe28-30ee-4d91-a407-ef15d4fc2ecf", "value": "quotation june.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba0112d-f064-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655707329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707329, "uuid": "945c02ea-5323-4aae-84d0-9735c8779f33", "comment": "Malware payload (AgentTesla)", "value": "d996647cbe5541693e0a8d23ff20482e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707329, "uuid": "3f974929-a505-44c5-86b4-4586f051c68c", "comment": "Malware payload (AgentTesla)", "value": "f9f783f1bb2d8edf017982527cdbca9d09470fc7e7da46303e71e1538f3a1ae5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707329, "uuid": "e54f0068-d576-4ef4-ab52-2f2080bc4024", "comment": "Malware payload (AgentTesla)", "value": "1107c685e2eb3eb827039b009d59692ace7221fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655707329, "uuid": "f26ce772-65b0-4bf9-a3fa-ec605986a74f", "comment": "Malware payload (AgentTesla)", "value": "d292a8ffeee88dd1b61d0fccd3e2cb9755534360f741564d976cd56defb5e0b61856a352ba7825a536fb59e81ff311b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707329, "uuid": "74055aff-a4ce-457a-9217-f9b46b5de8e7", "value": "T18DA42209876B9B42C8B76BF8A1D38186D3B213289466F75CCFC5E1D916BBF500C51B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707329, "uuid": "7f93a6e5-919c-43f0-87a3-81a06c18519f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707329, "uuid": "23ff47a4-d08b-41cd-8bb6-df70f229b7bd", "value": "6144:/N3hlwuBEiRgLhNS7d/C0g4O8aRJbVmAY9mcvPpK8cF6NjbckCxuBnPt3nPAFo6N:iuBECgH0rcmAY9mcJTNjhrF3PA7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655707329, "uuid": "de45e403-e08c-40b7-a052-37eb61877316", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655707329, "uuid": "b2778b0e-1372-4a08-82ff-bbde71b05744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655707329, "uuid": "060f87c6-d37c-42de-a364-16ecc2a8c929", "value": "SecuriteInfo.com.W32.AIDetectNet.01.16806.28167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc914a44-f0a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655736858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736858, "uuid": "63ee23a0-ef65-4ba4-b232-46b5bfcee183", "comment": "Malware payload (Loki)", "value": "37b7c0922daabe86cfa4cef4da3acf25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736858, "uuid": "8dd6b5b4-02a4-41ee-9fa5-55079282e461", "comment": "Malware payload (Loki)", "value": "fa3beafcde3e38bef1694685be70378f324af5dcc6757abaf3fe03a933141088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736858, "uuid": "f2f17c63-0d9f-48cd-904f-1889e5441a64", "comment": "Malware payload (Loki)", "value": "bb4876d9f529a57a69daa6e0b91e01c73c32d4b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655736858, "uuid": "36ce8fd6-9a1d-480f-8930-f3fa17e9f8a1", "comment": "Malware payload (Loki)", "value": "b7ccfba304ca3dfa5670b49614dc5cbfc1a8decbbde6fb7f6bedb035d10d173ee3127254a95a57df16bdd1fd4f8da46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736858, "uuid": "e723f782-d023-4d1d-8052-473a1b9e4b48", "value": "T1B5E4399C3650B6EFC86BCD76C9A41C64E6A064B7430BE203E45712ED990EA9BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736858, "uuid": "e520bee1-b247-4f90-b624-c4ee56e58709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736858, "uuid": "b50178a3-5b94-42fd-8a98-c239f103e7fa", "value": "12288:Qec0s2Q8Kk0tf2iNqrfkcy7N9iyw8YjiiHifscmuv1HJnc352jH/FKrxPBOPRFEy:wTNf1gbkcy7NAywH7Fcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655736858, "uuid": "93f6535d-5602-414f-b306-3016c97223e0", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655736858, "uuid": "7de6937c-5555-4d1a-9c13-caa1b37808ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655736858, "uuid": "1bf8097a-41e9-4695-bdb6-43c57be00991", "value": "FD0006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49dbe15-f0c1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655747582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747582, "uuid": "63d33475-ed25-4d7b-8e62-dfd64f6b3284", "comment": "Malware payload (AgentTesla)", "value": "044d519aeb0f45864c459f197cb72e36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747582, "uuid": "a73a61c0-8064-4b3f-9608-194e6cfa584e", "comment": "Malware payload (AgentTesla)", "value": "fb0e354aa7515e58be860519a4a3c432fd777f97d91a0e8382b17db99bb77ee5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747582, "uuid": "c15bebb6-d313-48c9-aea7-32abc2e7920b", "comment": "Malware payload (AgentTesla)", "value": "aff56ec33073c898558ed1805ad97ed1104b36d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655747582, "uuid": "27eee096-df3a-421d-8604-90e9a00e9db0", "comment": "Malware payload (AgentTesla)", "value": "99c90a2673c3b3ea124c25556c0fdd59ae6e8d087fc7c54145125e49bbe32446ec3ce589134d53fe474d96d656461ab7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747582, "uuid": "e7cac16e-3773-4de3-b8d4-1b1573b21cb8", "value": "T117B4F112B6B95F5BDDFFA7F687A640441BB5387E61A1E0185CDA10EE2872F004DA0F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747582, "uuid": "0a53992d-d4bb-4a4e-82e0-09c43bee4c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747582, "uuid": "01003da2-6159-4593-90f6-6da6b0bcdba6", "value": "12288:nCt94nC93yA4/bRHMoGDehZFM+6OiLJnDBB4eN1W:PCRb4TNkehZFM+niJDcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655747582, "uuid": "e1f02552-2057-4839-904a-6d81b37eaaa8", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655747582, "uuid": "c4244644-aeb0-4a24-b767-08f85a2bdc07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655747582, "uuid": "a76f42ff-c2dd-43ca-b5a0-c7a99f6ed767", "value": "INV#18974632......Pfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec50fc75-f078-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655716269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716269, "uuid": "a0dff761-bbf4-4de7-b05e-e1d325b85cca", "comment": "Malware payload (AgentTesla)", "value": "e60230e898db717ff314fb1d186488c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716269, "uuid": "f0683ffd-29cd-46e0-b59f-cdbbd103e6f4", "comment": "Malware payload (AgentTesla)", "value": "fc01b31e1464ab8b85c3f52187f71433c1635dd907cb05be9583cd6ddec1b149", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716269, "uuid": "81fe22b4-0719-49ef-a33f-0b5a4250bfcf", "comment": "Malware payload (AgentTesla)", "value": "288079a3d0d91d26a9b0e4e1c8100c08e5dcb80f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655716269, "uuid": "c1b24adb-71c4-4ad4-9f44-c2d1df44bf9c", "comment": "Malware payload (AgentTesla)", "value": "9b8e5b9c88f7bbc8a81dbca6a829f4156cf9f8b8b6729e88e22b9db24976c5fee80d53bc16107537b2b6686e9cfb6f31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716269, "uuid": "e5f909f2-62e7-47e0-9e5a-e0a8761baf0c", "value": "T15863CF06A53D765BD8B15E793AA0FC8C2975FEE1586A73E51C19FEC21CBC2C2849231C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716269, "uuid": "4686589c-6b8a-414c-a70a-ce49ef0053d2", "value": "1536:/8QBxa/4qRNBs/1hII3DIct35Gm3f6EOAA:/cQqR/x+5x3SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655716269, "uuid": "2bdca3dd-2fa0-4845-9da1-363b1d843f43", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655716269, "uuid": "ff55ffa2-2edd-4ce8-b1a6-a9f9465e5394", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655716269, "uuid": "2298b535-5193-4fc4-b887-364b34bff319", "value": "SC3294.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba80cbb-f0a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655734817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734817, "uuid": "68ac97f8-39a7-4aec-9492-f98d5eb4eedb", "comment": "Malware payload (Formbook)", "value": "ac91accef1e9b0ca35b71d2a562752de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734817, "uuid": "43495ded-a121-4573-80bf-1b4281ed944c", "comment": "Malware payload (Formbook)", "value": "fc8d8aae87bbcd5429e5f9389f80eeee170d696382f52942eea70ca82efbaeae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734817, "uuid": "68a17c9c-f21e-4976-804b-5feebc42244b", "comment": "Malware payload (Formbook)", "value": "d4766dd6ff71a9892fb318f59b52addf8fafa291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655734817, "uuid": "b5793788-cf9c-4fe9-8a9b-13c4fc11163f", "comment": "Malware payload (Formbook)", "value": "1a47147deb7bd38ec74363d3090d67264dad146bb8d939df1429eea507a795148b8a72b595150f90544f02bdb03005c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734817, "uuid": "dc3c2689-14b1-4a9a-be87-0ddc28e684ea", "value": "T1A5C49D9CB22C74DEC897C27299A45C64AB1074AFA71F511790630D9E9E1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734817, "uuid": "cd2f618e-6dae-43ae-9beb-f9f93f60c88a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734817, "uuid": "1bf12c52-c17d-47f9-9fae-d7dc4366cba1", "value": "12288:lXzxcqoITXOonLooGV1y1PQ1oLFXDH0a7S2tKTIAFJwJGKW:vcqxz1nLGy1Y1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655734817, "uuid": "8f1cc4b5-eb28-4270-a73a-9b3d420651e2", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655734817, "uuid": "4cfac46b-5468-471c-b0d5-36f6e31f57b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655734817, "uuid": "5efba6b5-6cb3-44c7-9d5b-536803c8486c", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1072eb8-f08b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655724410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724410, "uuid": "6444010d-83d2-40bc-8459-66683010611b", "comment": "Malware payload", "value": "659e256fc0683f5f620573cc04ab5753", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724410, "uuid": "5fb91c4f-5701-4232-938c-b4b5d4712840", "comment": "Malware payload", "value": "fdd19235e6886e2b4386a91852bb8bd464bbb08097d4bf4927c0a65a84276014", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724410, "uuid": "988c092a-94cd-4cdd-8bb2-3b24765db5ae", "comment": "Malware payload", "value": "4992dcf3d83d84ed167090966c38ea11de196ab2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655724410, "uuid": "673ce585-15de-4403-92e3-dcb5591a5447", "comment": "Malware payload", "value": "402f9cfc04b7300fb9fec43f3cc8caba05d30d8ad218d7f89b4809940600f32bf755c59dbd85bfbd70a7409dafaf7c8f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724410, "uuid": "19f2dcab-54fa-43cb-aa92-30dc92ffddb5", "value": "T15033015E4AEBFD69C01E69B02DC5487AB06C07B8942A2A3A0751D8745F2DC61CFF0FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724410, "uuid": "fb7ed633-54fb-4a5a-aeeb-982b1179c7d2", "value": "1536:TtpvJqK5xBWXmH5mPjn5ehYGqnEcuXt3dDM2VnYINh:hpvJqIxBWXEmT53tnE7Xt5VYINh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655724410, "uuid": "d53f4d6b-8270-4996-807c-a9d5e8550f0f", "value": 54841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655724410, "uuid": "3fadb5c7-001b-45ee-a2fd-34b6366c4842", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655724410, "uuid": "bff37c51-e1d3-45f3-9592-cf5f35412faf", "value": "53y399qzq2j7rfg51hg.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4413f05-f090-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655726483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726483, "uuid": "d56e34de-3c6d-47cf-baf8-0a183c168916", "comment": "Malware payload (AgentTesla)", "value": "d227e859d669c3ce4e821c3c4c5132ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726483, "uuid": "0b7e580d-7dd1-4a94-9121-a77d734b28d8", "comment": "Malware payload (AgentTesla)", "value": "fe5b393f587160c52f2223bac4ce54a390bdfcc086f810c478f7518d24bfc13e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726483, "uuid": "27b91612-4a51-4672-a942-a1558eb5f4c6", "comment": "Malware payload (AgentTesla)", "value": "f83d835fc7ab3fdce39b3f6c4b6da991c9d194db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655726483, "uuid": "c17c366d-d21d-4719-8a60-37c562c04a6a", "comment": "Malware payload (AgentTesla)", "value": "42375cbe5dc2e62095e6ab31f682079eeefd755ddacbaf205b205f5cff1a591c09c27dceaaa160472bc09b73a6ae1f27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726483, "uuid": "371eeaf3-966d-4818-8762-251ec20e6a79", "value": "T1F3913A7676064DC0D20764E6DA60FC4C81D3B94261EA1CD5F59EBBCA0B73334BEA2819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726483, "uuid": "acdf141c-76d4-49f2-9bb0-db635589c227", "value": "96:rRVU9zgHnE3xaZ+1oeHvitSp5HDdmysA4y8JxDOnc87KJOVbkU:rRVs2n8aZ+GeHviCjdlsAF83Cc87NtkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655726483, "uuid": "0b082fbc-9fec-4ce5-9899-6934e16748b4", "value": 4516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655726483, "uuid": "d4cff58a-66c7-439e-95fa-134567427b06", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655726483, "uuid": "c10e79d2-34a6-487e-b362-ceb3410ada2f", "value": "Purchase.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64743cf1-f0bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655744817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744817, "uuid": "6633a4de-c832-45ce-a160-147c048bb692", "comment": "Malware payload (Mirai)", "value": "2e6d0b339c249fa81cc42f0cb7247c2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744817, "uuid": "34b95b51-2560-41b7-9aa3-233f1196681b", "comment": "Malware payload (Mirai)", "value": "fe6239629498ac1b685a555bf313f3217b4d3344496347612456b698db4f3555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744817, "uuid": "1d1d2f2a-0a6c-420e-8287-fefd104b1bc2", "comment": "Malware payload (Mirai)", "value": "d2d4cd744cea249a3ce825b299cc4e661bf5494a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655744817, "uuid": "e6286202-4d70-4252-bf77-f9a6de0d3c16", "comment": "Malware payload (Mirai)", "value": "abfca2f14e63a163f1533e9c99a09b86aa8cc5187dad07f39c9756b2f284e0715329f3c32f0301b932de513ff25b6124", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744817, "uuid": "2834056e-2222-41e2-9eec-758870d28886", "value": "T16493B54D3E219FBEF6ACC23847B75A20965933D613F1D6C4D2ACDA051E6038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744817, "uuid": "f0f84a53-07d7-4618-aedf-215d3d302d8f", "value": "1536:yJf3T5Ks8/rJNUSN1XPdMaU8Y5BoL/8JIKYeupFh7:CL8TJNB1ZU8KBoL0JIK+pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655744817, "uuid": "4d33b15d-a68e-45dc-9a3f-63aa28737d7c", "value": 97160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655744817, "uuid": "378a6c43-6930-4e0c-846c-d5dd814d43f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655744817, "uuid": "729a17de-5660-4b2e-b6cc-69f414a1ff71", "value": "rtk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a389bc-f0a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655735127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735127, "uuid": "e5537259-6f01-4a3f-b54e-5f278f02f79b", "comment": "Malware payload (AgentTesla)", "value": "57bf71e5700574b07f665885b400bef3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735127, "uuid": "bc9cbbe5-3e45-4455-b278-beae7261e9fb", "comment": "Malware payload (AgentTesla)", "value": "fe8b46c714611052f01bcdc610d5a22a19b204bf2b63b336607bcedb8ff80b0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735127, "uuid": "590b492b-6a41-4b5e-a973-2e1047e2a4b9", "comment": "Malware payload (AgentTesla)", "value": "c0f15166c8e486303dc5604e91cf37bd7b90854d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655735127, "uuid": "7fcdb4ba-690f-44be-9ee7-841a42c7919f", "comment": "Malware payload (AgentTesla)", "value": "374826d75645477e87d63ff1e491059047189b8edd4ef402ecf46be753183ac9542dc61a9671c3ec982f9db7643f1922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735127, "uuid": "2c462c6c-cb0a-464c-bb13-c190a76fe354", "value": "T151B412C426FCA727EEFE7BF99495285407B0B03A3611F2590CD222CA4A377449A9CF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735127, "uuid": "9fce5c06-4af3-4d89-8e10-001400c60e82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735127, "uuid": "55df39c1-38ee-4622-bf7b-2df5ee6144c0", "value": "12288:RR3jp1xs74ZvMRY8aFI5CQAkN+Bxp69n2XAa3fyL:Rv1xioFUExp8nUra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655735127, "uuid": "3331cf50-851c-45f8-a619-4e31c4474486", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655735127, "uuid": "c1e69298-0481-4d70-8bab-bf64bad6f08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655735127, "uuid": "e1011ffa-06b0-460a-93af-eb116303cbab", "value": "Shipment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264214f4-f052-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655699616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699616, "uuid": "e7730a96-5f20-48a1-b97c-a52ee84ce626", "comment": "Malware payload (AgentTesla)", "value": "1d012701deee0e3c0a2581312f45bee9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699616, "uuid": "31bd609c-1d00-4af2-b2f5-132abab32e81", "comment": "Malware payload (AgentTesla)", "value": "fff4716b71a858871111443b063b3b4ae60963bf983d8dfe496de04857fffb31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699616, "uuid": "71c48b1b-7214-4b1d-b23c-c563afed8355", "comment": "Malware payload (AgentTesla)", "value": "6df5bbbcce2a9057b880618c251a1f51f927dc82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655699616, "uuid": "468ebe62-d903-4721-9bdd-4af9092c03f4", "comment": "Malware payload (AgentTesla)", "value": "da83d2ad718526edfad036b9e00fd4c49e72eb4abf983bfb182cbaab462aecfdf15f185c05c91caa2cb919780bc52d5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699616, "uuid": "26d69236-c316-46cf-9a50-4c0fbe7a71a2", "value": "T1C682632FEBC56223CAE743FF54929320A51AD38A63738F46168D542807EEB84778F355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699616, "uuid": "2e583dc8-f03f-4820-b31b-83731a02193a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699616, "uuid": "1757b0d1-f721-480a-a8df-be4121cb8a09", "value": "384:ylh+xkK+RQC2t/f8ELHFDPM20rkq+KrHL2z:2YxkK+Rlk/tHCUi/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655699616, "uuid": "d25b4ac8-24d0-480c-95d3-0ec0edd02948", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655699616, "uuid": "70440074-fb8c-4f18-b459-30130daf0850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655699616, "uuid": "6536ff66-57c6-4d4c-97f6-b6bf6fff6f3f", "value": "SecuriteInfo.com.W32.AIDetectNet.01.5103.16486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }