{ "Event": { "published": true, "date": "2023-08-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-25", "timestamp": 1693008182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "11e1cd5b-dce1-4c2e-8b51-2001b1d6db22", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb232e5f-434a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692969954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692969954, "uuid": "238c0a8f-7450-49c5-8c07-fd7b9cf8c45d", "comment": "Malware payload (AgentTesla)", "value": "51b8ac83eca63b8da1608525a4fa9c6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692969954, "uuid": "02527ce2-56f6-4bb7-9c76-561a3afc80f7", "comment": "Malware payload (AgentTesla)", "value": "0008f48597e494edec9007b7458e0dcda6c98cc7a6bbc3924366335aea53421f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692969954, "uuid": "f73bc643-673b-4c73-9916-0e6214ce3bd0", "comment": "Malware payload (AgentTesla)", "value": "ee7f6e0d17073de4ece19a171dc090f077fe659d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692969954, "uuid": "3c8609cf-4559-408a-88ab-dedfe7f61ff8", "comment": "Malware payload (AgentTesla)", "value": "70e6d1f31502419d458ad90d50665cf6f1d1e5940f3dd22724cbed871a97ad8b8f6ebd5e754fdb608b6ab3629462070e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692969954, "uuid": "4a311476-957f-4614-9e9a-c0060bf2dda8", "value": "T12D947183B64B8DF1D38A1B76C18B15020BEDEA8136E7D70F794D3396350F7AAA841647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692969954, "uuid": "ab943222-5a0d-426b-8f77-5714b86ca169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692969954, "uuid": "66ed15ef-7162-47a6-be45-cf5a64a7a3b6", "value": "12288:Hf5Qo5RAtJIu1tJacOjm56gS4fuYS16x:/Go5itJIu1xVrPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692969954, "uuid": "64b85c93-8c7c-4df6-b546-41675d3dee7a", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692969954, "uuid": "0df3f17d-0320-4c58-8612-ac8a92c449d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692969954, "uuid": "71562f33-9a7d-4be7-ace1-e69c0274465b", "value": "Amend Invoice____87975557667___pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237469bd-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965324, "uuid": "5a43b856-2b8f-451f-84fc-e04cdd014dd9", "comment": "Malware payload", "value": "887ecfe083d182615252ca59c6ffb61d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965324, "uuid": "b7974de6-2ed8-4c55-a29c-cb9a48f3f40a", "comment": "Malware payload", "value": "00191a06c41efba700b65f8990080808db245f7177c1fbed33bee14d415c5ae9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965324, "uuid": "841830af-7c8a-4c3d-9fe4-89ff36fe20f8", "comment": "Malware payload", "value": "ce6e342b67c482077b13a2741c36eec37ef14fc5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965324, "uuid": "7e986f75-940b-4d0c-ab23-3f7d7ff68030", "comment": "Malware payload", "value": "b1c4be11b6bdca84a5b83b0628b69cf78a34b5ef98d443804b7f8647696e007ca67ef262b1f6f8bcf83cd4fc7f9745b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965324, "uuid": "c9d91a04-5aae-4ddd-91fa-1d7378ff6460", "value": "T15FF433DB2207DD90E014847DD430CA87172521E6C82D6D6AAF7F5BC469E3850CEEDDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965324, "uuid": "8b2cac81-41d3-4fcd-9e53-c2e3deeee3ce", "value": "12288:i22dTyc/0Katarup8g1qC90o9rskxrykVxTs6K9Vsgu34hoQUvdBNYhNXupDIjBd:i22GKaECp8G90o95vVx46KrsgoF2Xu4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965324, "uuid": "4324bb22-f61c-486b-80d9-98d4540cc8dc", "value": 745381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965324, "uuid": "0a6f8c22-a9d5-403d-8fcb-ce84b0e41916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965324, "uuid": "a1697de3-f110-4eb5-a11b-cf924f5e9509", "value": "887ecfe083d182615252ca59c6ffb61d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e12127-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692962045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692962045, "uuid": "6f1c8251-e9c7-429f-993d-c02ad3e66675", "comment": "Malware payload (Formbook)", "value": "8eaf93ff5a38924420772bb1f6c6632f", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692962045, "uuid": "93dc6d72-b1d0-424d-ae9b-826b1d31d2cd", "comment": "Malware payload (Formbook)", "value": "01b15d113f147c931149f8d1c883bbad3c3752cba08a96855774d21a3bb6e44a", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692962045, "uuid": "9cda46a5-eddf-48ee-ae40-18bc1996f603", "comment": "Malware payload (Formbook)", "value": "7c5ace123ba02c959d6975de7e98cd98bbee1af6", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692962045, "uuid": "3bde5f06-09c1-409e-a9ba-b25a4e749732", "comment": "Malware payload (Formbook)", "value": "0057f8cde0965dd66065d0bbe3d95abf19c7afcda97b3ba8a9b097bce4d610d0e40ce417a1a4aaf589c413493bb560cb", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692962045, "uuid": "7dce9906-84ba-4102-a444-3cb7c310f719", "value": "T1173423BD9C0A5912D436A6391A4F1AFF43C63784DBF0176388ACA30759749E48BF54EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692962045, "uuid": "4ef1a82d-9a14-42d8-b1c1-d1dff94c8bc4", "value": "6144:gyMcDUHLfVsd2aJnMyq2FwrvK7kkTQ1+uzi:UcD2foBnHzFwryI2Q1+uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692962045, "uuid": "ffc1b919-f92e-4b6b-a50f-db2b33f4038b", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692962045, "uuid": "c94ad5db-4c2e-4222-b08d-f64539cac9b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692962045, "uuid": "78c3014e-43ed-49dd-9278-edc871e590cf", "value": "1692962044883bbb5d51269554e7d6bcf8fa7f7f1820cf6ab699f2c0ccaab5d55041cf745a472.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a98ae9-42ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692929816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929816, "uuid": "8de18bad-a910-4f8b-b860-af598e110b0f", "comment": "Malware payload", "value": "671918b0dc1885b5b37cd776a40638b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929816, "uuid": "03d21c66-0a7b-4712-b666-4d2ce5cabce6", "comment": "Malware payload", "value": "02216d2a51d07a55660dbd40857d118281c281a974935f00b15078e5207c2d4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929816, "uuid": "24ac2d1f-ecc3-4cf1-9a10-8bee0cb1bcba", "comment": "Malware payload", "value": "4c106a9795635f7fd479aae4acdf37c93e2f422f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929816, "uuid": "39ad476f-7fd2-444b-b236-fbbcc5ae87c7", "comment": "Malware payload", "value": "28e3f1c02b4c573f9aba923df4ee2bd83279936a371f9037f1504e555a01ab18ba59e94a9b7e11560fb28a59cbbde06f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929816, "uuid": "f855e874-02ae-4e0c-8b2a-c162c63b728d", "value": "T1AB86330438445EECF156DDBFB963DB3F05ADDF689442C6A259A01FA4BC0A18E4F0BB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929816, "uuid": "3daa1d22-9fdd-48ef-8a21-2c355b09c6db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929816, "uuid": "adfc9c4b-fade-4fe2-a09a-e2557b292263", "value": "196608:Q5sT5so57UnkJbSK1sWb2dSIaZUGsJNRfCi8bBJ5/RdoHtomK/VT:v57Unk8K1w6z3/3JdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692929816, "uuid": "15d810dc-66f9-4f27-9ca9-017daf1ea8e8", "value": 8195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692929816, "uuid": "42bb60d6-b696-4efc-ba08-de1b2893411c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929816, "uuid": "a55c1b88-6f3c-498a-af6c-79eca3b267ac", "value": "671918b0dc1885b5b37cd776a40638b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126513e7-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950263, "uuid": "2b963772-8fd1-47fe-b41f-8fa545186a42", "comment": "Malware payload (AgentTesla)", "value": "857951a4685dbdd6bc5770dd1aa8900b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950263, "uuid": "cc5cbd46-2952-48ca-bd66-5054b83de07e", "comment": "Malware payload (AgentTesla)", "value": "02aa386d3dd55caaaf864292ff736ea54aba88f036ce9046c5d24545dffb58ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950263, "uuid": "264949b4-876b-4537-9e5a-a3e11c662cdf", "comment": "Malware payload (AgentTesla)", "value": "ac9c9f5921ac58a73535193922e474374c4bec17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950263, "uuid": "a8cd7896-5a69-4ff3-9e4d-998d52fda5bb", "comment": "Malware payload (AgentTesla)", "value": "c57b208f50fbde4e7192de42ad6f886ce9fcbfa4824a0f12306e8005e7bfcc230a672984fb8fb28f52efa571108b2551", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950263, "uuid": "af6e8ce1-f7fe-4c1e-a420-9dd49135b5c4", "value": "T1A3657A627AA95561C904CB74C5DF582063EBDE826AE3C10A654B33EB1E723BF8F43447", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950263, "uuid": "07d9d48c-c5fe-4bd9-a8c4-571f7d691f80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950263, "uuid": "9c02085c-af50-4d42-997f-e240020e2854", "value": "24576:dVNhHsAP0YToAs5ZSvQC/YQYUQ+fJFK8pQbXRJqo2gS6V:Hs5sQK9BJY8pQbhcES6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950263, "uuid": "6d09fa06-bfac-4c87-b98d-c9b4d44c01ad", "value": 1421824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950263, "uuid": "fdc53e52-d07b-4903-953a-bc2fb855a824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950263, "uuid": "cd3ddba1-a9f3-4a6a-80af-936daa1ab3cd", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab15cffb-436b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692984020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984020, "uuid": "6106a363-783c-460c-a3e3-99fc170f27bb", "comment": "Malware payload (DCRat)", "value": "41c48a5402817546e5a1fc041293c76b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984020, "uuid": "bb22e0b6-d26a-4511-99fd-6d2443c054ae", "comment": "Malware payload (DCRat)", "value": "031d52030afa884216a9e21b6c205afcc62b5e37fcdb8593fbce8b106e9f3cfa", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984020, "uuid": "2d9be96c-f16a-4e49-8b11-2c30f396bd41", "comment": "Malware payload (DCRat)", "value": "b615cbded42c7bd29103ca5619b959e6adeb2ced", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984020, "uuid": "6b7b8f33-fa52-447c-b799-ab9fc56a0378", "comment": "Malware payload (DCRat)", "value": "ed76555a08b2f28c58bb30d1567385d5c3ec484925c29fe3c455bad494b1fca594e86be30a8e0e85812379796ebd367d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984020, "uuid": "5c078ffc-f82e-4381-8ad9-bfc436d2a0e2", "value": "T1560508027E44CE16F0192233C2EF494887B0AD5566A7E32B7DBA376D25163A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984020, "uuid": "4d1861b2-f9e2-4745-844e-19d80b3b48c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984020, "uuid": "fcb57b2b-5287-43f9-87d2-4324ab01d82f", "value": "12288:XaV9OmFUlpIUHIXpdVfI3k93m1rCazsTsf1lvosRNL:X1mupIhXpdVfIeQZdlvoWNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692984020, "uuid": "6fb86611-59c8-4b68-a29d-c8d942357c0f", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692984020, "uuid": "c1d5d598-e3bb-45e9-822b-36a462534e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984020, "uuid": "2b556848-0c78-41f8-896f-058d27de824c", "value": "41c48a5402817546e5a1fc041293c76b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1009edc4-435f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692978606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978606, "uuid": "fdb9198b-a490-45c8-9af4-c2d7c215622a", "comment": "Malware payload (Mirai)", "value": "96dea2f25647f0d722407107fcdf873e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978606, "uuid": "44ccc5f9-055c-44f3-a01a-25dc05aff964", "comment": "Malware payload (Mirai)", "value": "039209058452c2d8b17d461f6e96f8dd2140a1942c161eaa664ddfc4644cf5a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978606, "uuid": "d857a5b9-0357-4797-989f-afe037a7fe2a", "comment": "Malware payload (Mirai)", "value": "4336dc54457e7fa91b534954a5f334bd9b091d8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978606, "uuid": "3ac78717-32eb-40f0-9864-becb5d97991e", "comment": "Malware payload (Mirai)", "value": "8c7fc5e9ae980a25700b9b845fb7f70154a25787237ea8d009773f69db8f119c0417264bc63cb70d530f01756469ba61", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978606, "uuid": "086aa224-e0ab-4f5a-8b04-94c6a35591ba", "value": "T14BA2E159BF2C868BC832293555D9E6D21353FC62F2EDCC492540C16FF1A33A96870F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978606, "uuid": "86c662a5-849e-4a87-992c-db99d50372e3", "value": "384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTy:T98o08kxofBE+ZkXaEbp2F2TWul0c5QT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978606, "uuid": "a40428df-076e-4ac0-a99d-97d85d1a6912", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978606, "uuid": "b1a3a669-10dd-4944-9292-ae24582c31b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978606, "uuid": "24c9b71d-5ab0-47cf-be74-6d533d9babfd", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5df1f1-431b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692949498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949498, "uuid": "860ba961-8f23-4ad9-9626-34ef9ff549e9", "comment": "Malware payload (SnakeKeylogger)", "value": "e42679c35e85784deae2631ab3dc4459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949498, "uuid": "7708bfe2-daeb-4972-932a-26ee13f85062", "comment": "Malware payload (SnakeKeylogger)", "value": "0758259823e80bd6a86e003977f8c3f7a2ef73f138d6ec69e22e8ae36d2d693c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949498, "uuid": "bf5b07cd-a35b-4610-bbf2-d9281ebb4ccd", "comment": "Malware payload (SnakeKeylogger)", "value": "88498990da978c511f452170ee4960c1c5ea7cd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949498, "uuid": "cad2e850-bc47-4b9f-86a1-b1f8f8dc2c82", "comment": "Malware payload (SnakeKeylogger)", "value": "87015ebb5b8f29ac52ab910acb2689f1b8877f00f2559291d07eb93762539ca1a3948fb8ac9182541cfb9e4b3539daea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949498, "uuid": "62523309-f458-44b8-b239-74037e1a7025", "value": "T11FE4123C76BD4768CADE2A7562B482848BF5712B7919EF9C8E8B30E51D72BD00504E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949498, "uuid": "72718392-ad1f-4a06-8063-da48dbfd9bd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949498, "uuid": "2d97162a-f8ce-48ef-883e-b856f93e907f", "value": "12288:V9jIkCp0SrlYBSlsLmux40gOWfWXV/mcbjbta9ehxy6Ew94HX4:UkGJYBSlE1tgOWfWXVZjPxlCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692949498, "uuid": "eb94e074-bdbe-4d20-9d41-218cb4c39cc0", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692949498, "uuid": "e7a680a1-c528-4dda-bb12-1c6ddf63b9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949498, "uuid": "ea21be50-feab-491c-b1f9-31cbb838de1b", "value": "49585_4747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ba164e-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934158, "uuid": "35ff87d8-1af2-407d-b226-06abdc54e4a2", "comment": "Malware payload", "value": "bd0b64dba6e56deec1a068912dfbc655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934158, "uuid": "e53726ff-a31e-4e5b-be02-5f142d05d2fd", "comment": "Malware payload", "value": "08365973a7fef5b23e00d7a8301d072c5d998aa01d41348c57c806effcf7fb1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934158, "uuid": "9a430bd4-9b2c-471e-b075-36f50f067bb2", "comment": "Malware payload", "value": "c057f0ef16be32deb041d1c45c376d2cda443075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934158, "uuid": "3ca1ba12-96e7-4d66-9377-4e53de67836b", "comment": "Malware payload", "value": "64d342e56b94b887fde6d92a53a9f276fa9980c2835beafb11f805afb86f62e882ffbf716b941c09162810de68dcc6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934158, "uuid": "37548936-adb9-48ad-a06f-0ec51bb5bf63", "value": "T1BEC4016A2911AA3BDAD04B3EF75C100BC9525C2FFB53B1E5B537ADE2103E011E9059EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934158, "uuid": "5841975d-4e1f-4bd2-8ecb-f0c7db078a4e", "value": "12288:wpFytX1Pm2kJhqCBaDyJnaMUnQ3kzwjsfWCS/K0KbG:cFmFwh5BaMaybjUWCxtbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934158, "uuid": "0c94d89e-595b-4c41-9e8b-150022ff2a3e", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934158, "uuid": "5a1e2aa3-7d31-4183-b502-0c8ed6cdb89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934158, "uuid": "b7c16be4-8237-4086-b7af-bcd1ffbddf65", "value": "SecuriteInfo.com.Win64.DropperX-gen.14310.9849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b41508-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1692965224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965224, "uuid": "0429be9f-b283-4e64-998c-0aa92f2f8817", "comment": "Malware payload (DarkTortilla)", "value": "a427935364a6448c961fc8956c3a853d", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965224, "uuid": "3f726bad-fce6-4400-a44a-ef4b9cd2a6e7", "comment": "Malware payload (DarkTortilla)", "value": "0b3433ae8924ce17371de3d6b58e1fd913fe77a73de514e44049f1612fa71cfd", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965224, "uuid": "9b7e5a1a-33b0-48ab-95cf-aef00e6ae8a3", "comment": "Malware payload (DarkTortilla)", "value": "75bf199189d7782556cb1bd58eba51b231009d73", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965224, "uuid": "139ced73-7af5-45b9-a816-00b12ba2dbbe", "comment": "Malware payload (DarkTortilla)", "value": "469da5ad949f353bbfa1ad52203e48e8ec38948edc0cd9b286e79e443a24f05eefcbccf2363b45ebc12a57710270aae3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965224, "uuid": "e756f415-a3c5-403d-996a-71649a6169fa", "value": "T13F65E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965224, "uuid": "15f99639-9868-4824-b4b6-643bbce3fb69", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965224, "uuid": "09c13b3a-fba8-4b76-9379-9270a384a8ad", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965224, "uuid": "e849d7e7-b1b7-4083-be77-9452eb2d3797", "value": 1448632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965224, "uuid": "527efbff-90bf-435a-a130-d5ffcc159223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965224, "uuid": "e484de5d-8502-4827-8050-ec1680d993e1", "value": "a427935364a6448c961fc8956c3a853d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98d89d7-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692950570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950570, "uuid": "dc0ebc4f-6a74-4e11-b770-d3fb18f51870", "comment": "Malware payload", "value": "551cf95aad7260921cad77ed8e1bd9a7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950570, "uuid": "5633968c-4b8a-4103-9bce-8b12b1deaedd", "comment": "Malware payload", "value": "0baaf8734ae56f4c4c20fd020875cb1e5daa6bd7e0e0d8e4bc26dc4382d6f14e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950570, "uuid": "aafdeb53-fc3b-49b1-9f7f-5fae55e63843", "comment": "Malware payload", "value": "dfe5524222cb7e85bd74393913e838abb2848817", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950570, "uuid": "6f3d16f5-14a3-46fa-9a5b-c01942e805ab", "comment": "Malware payload", "value": "94ecfe5de8bc4acc0a3e1a0bee011af53c5fe0a3f30d4260a2794059b02035f1361e6f3db3620f366803e41d835b5ffe", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950570, "uuid": "cd1f38b6-4fd0-4e3d-b8a2-7d2d3151269a", "value": "T16ED4230B3C42551A68EF9E2F434170A95FD8780D599F9C77E2B2A8BFC9B70E77924090", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950570, "uuid": "83eb6716-60d9-4e47-9073-231cdbcf7fc2", "value": "12288:p1UN6oVHl2bXwtg0yYNGxrnBKlHNQXrM54XymcIvp5Pi/:p1ToVHQnoqrnWNQXrSvA7Pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950570, "uuid": "9029d10b-3240-4d99-97bc-2e8aa2f83177", "value": 607875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950570, "uuid": "e48ed6ea-8461-4e86-830b-de2d56aee533", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950570, "uuid": "6aa1cdc0-3a97-4ed9-9bff-eb842c751ba4", "value": "Quote-230050.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93125d5-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965253, "uuid": "1203268f-a457-4b13-88b6-f6ba51f77b45", "comment": "Malware payload", "value": "40ec776d4f6ec5bb768c58538580589e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965253, "uuid": "ac163a2f-d9d6-4b13-84ac-879467d5bb3e", "comment": "Malware payload", "value": "0bcae5d66bfb9dc62807ab9eb8990f6ccfe65c4080cacf41a54bf9121bf2aeb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965253, "uuid": "bca63128-6c79-4324-88a5-09a3499731e7", "comment": "Malware payload", "value": "46061160081dfc806744a5b7276423ffd1ce4013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965253, "uuid": "3c6f2db0-3a04-4f67-aabf-26ae1ae3c651", "comment": "Malware payload", "value": "a4978456e4f60b278ead15500c7b2f33fc44c9d72de4c73003b158b38c3f8da909af45b02b4f7bb08aa8796a962c5d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965253, "uuid": "f2d2e9d8-bd6c-49e1-ab90-8d9e06ca3ff1", "value": "T198D52310B2C5C572D56509310EE197717BB97C301B258EEBA7286B6CDE701C3EA36B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965253, "uuid": "59379632-bb3e-4ac9-b51e-883493c787fd", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965253, "uuid": "21312c7a-4fee-4a07-94fb-9b5085399469", "value": "49152:8cbi6iP+2G9nlA2vLD/OGDWs6I5ozFtfGlwSqmEFXtgSNok:8cbIm2CFzD/Og2NG+tmqeS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965253, "uuid": "e08086f7-9fc0-411b-b4c1-7084aeacc9b0", "value": 2820605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965253, "uuid": "5efc8fe4-61c2-4f2f-8459-dfe345c62071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965253, "uuid": "c81d1e70-e470-45d4-9090-27a5843d1d79", "value": "40ec776d4f6ec5bb768c58538580589e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663f2166-435e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692978321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978321, "uuid": "01fc6ab5-26c0-4d9f-a100-01acf50897b6", "comment": "Malware payload", "value": "d98f25a7a575a22e7856155cedc54e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978321, "uuid": "d6aca675-d841-4b6f-8957-8298b2a0d760", "comment": "Malware payload", "value": "0c2469c368313b1c87775e00e408fe66385b6f7eab7d01ec5547c9c1fd27355f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978321, "uuid": "dfaeeb96-f987-4915-9c58-d24fa9504121", "comment": "Malware payload", "value": "c246c4074eb07a874eb6c7c1155326428206b0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978321, "uuid": "8f73cb7a-3ae7-4f4b-bfe6-382eb48f8e94", "comment": "Malware payload", "value": "3c2e2018859c95606036faa299ccd5d0612c0d7d27bde9458e20cd3763a0039168f640f325a1b4d7e3336c1f6bc76e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978321, "uuid": "dfbff057-e40e-40f5-a0cc-efb981b96bfb", "value": "T148A6335EBA479075E030073436BA637EC13DDF5514F0B28B8711493A6DA9631F28BAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978321, "uuid": "62668ed7-46f5-44f5-816e-11d3b488df44", "value": "bc5ce990cf54f8d435a68eb97512f73e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978321, "uuid": "ecdbd119-ce58-48bb-ad19-181490eb7ad5", "value": "196608:hsZDEF8wtcS6V6uYp4xSpHWHOny827dhQVCncl5Blhjw+LwPq0nTDs:OZIF8KcyuYp4xSpHHyx/QVtBP0+EPXT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978321, "uuid": "cee708ed-e50b-469d-8476-0e5db052d2ce", "value": 9937707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978321, "uuid": "ac19e2d9-9f53-453e-9c6d-bd65da1b5e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978321, "uuid": "de1cd619-72b3-41f2-afff-0301a5c80ebc", "value": "UP-BM-GM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed8882e-435f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692978604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978604, "uuid": "49b4c15d-3d41-4052-8cef-c3158a4500c3", "comment": "Malware payload (Mirai)", "value": "5bb7db0da57026ada4b81be983b7ba38", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978604, "uuid": "3793d494-7270-4045-bbec-59bd4ecbbe98", "comment": "Malware payload (Mirai)", "value": "0e9d0a4b47cb579ac5d52411e9bf3541ad8ceda9195693b800c90b23fd1b7a95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978604, "uuid": "69e8e208-cd57-4230-ae68-31be2cb71a86", "comment": "Malware payload (Mirai)", "value": "0ed910f88f90038f495330a84c1e51169ad8a2dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978604, "uuid": "42dce6d3-e911-4013-a7c4-718bb2a47eff", "comment": "Malware payload (Mirai)", "value": "8a63d56440c347ec83ff69e4febb6d70571bfe070b9cdc5081d565f364b9fa3e827c8eb932552c051c3b25d310bfd561", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978604, "uuid": "38dad262-d9a2-4b9c-80a9-0af5ed274181", "value": "T1A823F271890E9EF524303C76EAD5D3837AA11AB1C667302396290F382F75B631E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978604, "uuid": "0cba00c9-a1fb-4135-91ce-98b2c186e1ea", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3F9q3UELbUXfi6nVMQHI4vcGpv7:DECFd+A6YHAxYLRQZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978604, "uuid": "4e9c8fa5-33db-4c1f-ada1-49e80b325ecf", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978604, "uuid": "d29c2a72-5772-4a6b-bbbb-d829628ba2d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978604, "uuid": "5ff754ab-fa34-455d-a5a3-791bbf2e542a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3919e720-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965361, "uuid": "816cce27-aa28-48f7-964c-a19bfeb94f95", "comment": "Malware payload", "value": "60812ce2febb2fdac79d23692b7ca219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965361, "uuid": "c55cb69e-f0d2-45b3-9cd2-adfb5b14cce6", "comment": "Malware payload", "value": "12359c02c8f92cc1a12df3ab7e9359ea5244e7d7b7fb171b3cf11ff0a2289df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965361, "uuid": "e9cf78f8-4bec-4e7e-a6de-346bc31f2fef", "comment": "Malware payload", "value": "976ad4c9dce034ac39e567754ef7d665d344ee1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965361, "uuid": "3fa2412a-bb70-4739-94e1-91346e9e7d0a", "comment": "Malware payload", "value": "d736f1f94bc94e83b3d46a9cf05d2b5d28db574aaa1a2787a673967f6efe028de9710ea18512ed0719c7b2e98718b56c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965361, "uuid": "942eb618-8b59-4728-9676-860973c2d378", "value": "T1F4D3221934284D4AC067EEB4A27CECE63C063772E1E61AD41718B36606FA4FD05A7562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965361, "uuid": "eb2ed777-3393-4757-aae9-935a1c82a035", "value": "3072:gYoWI8kATqCK77IJgZM0OcmoD+s2KXq0T07tXrJexGPcuyl81PK:gYoYkXCmIJghOVs+sF60T0trwGPtyl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965361, "uuid": "ab4d3978-182d-4f20-a9c7-bb101021a32d", "value": 141653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965361, "uuid": "b789bf0d-6b7f-4d07-ae2b-9910eeded888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965361, "uuid": "f1786c75-1d96-4cb2-8504-b0e4eb0a2027", "value": "60812ce2febb2fdac79d23692b7ca219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e43f39-4356-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1692974720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974720, "uuid": "f057a404-ec7c-4392-8c95-29cd2f1b82d5", "comment": "Malware payload (QuasarRAT)", "value": "34f0253df6d63ed2a84e597be76ddabf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974720, "uuid": "9d78364d-3a4a-4f4b-921b-2dc333bb80b3", "comment": "Malware payload (QuasarRAT)", "value": "13f6c9d2b53ff26787837ee6e18e0024682653488ab2a363ecf71b035640d12e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974720, "uuid": "4d430509-1662-42c4-81e8-2a62b4488e36", "comment": "Malware payload (QuasarRAT)", "value": "107ae2e064563555e5c763d688e576cbf81750fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974720, "uuid": "ed050dc5-f47c-49b1-86e7-f1ecddf23603", "comment": "Malware payload (QuasarRAT)", "value": "af076025ad8db6c376da1d2776ba1c490c5b0210503cbd62550c23796e1cc4354d75a07cd55cd4ca4ecd2f041fce6051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974720, "uuid": "d6c8e7cf-7f7f-4aeb-a133-e1d54f50f0b5", "value": "T126B633E1EEDCB591DA5BC9F22C89F031A592944967F2BCAC3EB477D9D333250190834A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974720, "uuid": "89eed726-4fd8-4638-a3ce-e6f39707777b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974720, "uuid": "4772c7a0-ade3-4f55-8ab7-e1cc3e66e803", "value": "196608:jXRZLug6KGz4uN4iXa9V4oHvsFZIwM1A/w7jaAcekxy9Hymy4R0UNrttaOff:j+lK64ziq9KoHUFWoijaXhxIPDaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692974720, "uuid": "25a7ee27-e0ee-4d8e-ae0e-3e00da00e5ed", "value": 11328512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692974720, "uuid": "b579fdb2-9c1e-4ba1-905a-6a8b64117ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974720, "uuid": "7de69a03-a86d-486c-8cfc-83cdcff9e9cb", "value": "34f0253df6d63ed2a84e597be76ddabf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059d62ff-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965274, "uuid": "24d8894f-00a5-437f-897f-1b079063ba99", "comment": "Malware payload", "value": "716406a6640d7ccd41e3afd9fceaa7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965274, "uuid": "1a59082c-a6dc-4059-b825-aede4defaeec", "comment": "Malware payload", "value": "1464b66f8a4c4b1962a9a52ef41190d6cccdeaf5bf775a3beef0e5b06720f9e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965274, "uuid": "8e815ac0-95d4-451c-a130-fa8c0e2c8d36", "comment": "Malware payload", "value": "36b1bbc62c09c4aaa54a716a43477197d2084823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965274, "uuid": "784030b3-45a1-4261-ace1-d6b71b0d1957", "comment": "Malware payload", "value": "7bc74b5cec0e1822a4209e65534eaa3642d6331fbfb4b4a82383adc02c8a0cb79755c69e94424a30b99cbeda5d4e8bb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965274, "uuid": "97aab450-b62f-4d23-8a61-bb04a4f62584", "value": "T189B5F857E8A580F8C1EED164C726E213BD613489473437E36FA18AF11B26FE466BD324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965274, "uuid": "9c17d3e8-4ebf-4109-b1db-90e92415b6c9", "value": "49152:UQsHhbhAd48+Uofrb/T/vO90d7HjmAFd4A64nsfJL8Q/dp/XptIJOXAntEm4u3:54lMBZSJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965274, "uuid": "41ed206a-b3d9-4ffe-bc10-ff214595418b", "value": 2471758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965274, "uuid": "d174d60e-2014-40d6-b26b-c9360f1c48cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965274, "uuid": "e54064ad-72db-4ff6-8ab3-328dc8e7d849", "value": "716406a6640d7ccd41e3afd9fceaa7b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505f83b3-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692950367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950367, "uuid": "9f3db100-a599-4bb3-a63c-1e71399d1f19", "comment": "Malware payload", "value": "b8636be5f5a9b54bbdf8216e3eafe9b4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950367, "uuid": "e591f64e-9c8f-404a-93ab-ab61eef63280", "comment": "Malware payload", "value": "159083afade6effd8e27eef8c3bd9367a26f350128ace620f31b1f90ba03a381", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950367, "uuid": "f4d504d5-5736-46dd-a50f-53c6aca37039", "comment": "Malware payload", "value": "945ea95807ffec6d919eeb94d1a05542a505cf2c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950367, "uuid": "db50ecfe-08c8-4505-b49c-fcc56a847aef", "comment": "Malware payload", "value": "24e91aab431a6ce973fa302dbc6b819d0ea93483f8d43edcc8acdda4dc3a7e6eb27e2790a2809bde61ea2b526512a337", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950367, "uuid": "662e1f56-f988-4c89-ad0d-02534e55228a", "value": "T1C4D423FE90763415610A7E62D072AB456A07BB2EA5F7BF55FF64C01B2A438F40AC071E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950367, "uuid": "4e1aec2a-2a58-4122-a0ae-03764bf25f93", "value": "12288:zb435ROXoD3bi1QbLWkJoPfe5zy3crhUfIMmpRL4:3/Xs3WEsfe0cS3mpRL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950367, "uuid": "001ca8f3-9fc8-4792-bb63-b87bd4776300", "value": 616924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950367, "uuid": "1d1fa934-d826-41c1-a5f2-7f60f9b08370", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950367, "uuid": "8c4003c7-16a4-41d4-bfad-5b966f752866", "value": "BSJ007 Update.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f4089e-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692961918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961918, "uuid": "0a1b8276-c0fe-4381-a5a0-99b7344ef49c", "comment": "Malware payload", "value": "2da7eeb686cee34731548d2d900bbb2b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961918, "uuid": "f7fd9c2d-5a09-4f4c-ae76-e263a8117a60", "comment": "Malware payload", "value": "183a141910d896679dca1aba43df342c1b4fdf52662102d4e36b1b7f6dcf3dd8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961918, "uuid": "61362e7d-5ab6-4948-9401-a6afd4f70b51", "comment": "Malware payload", "value": "9441f6c27fdfa7738acc07c2551183ff10fca98e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961918, "uuid": "2e35a8b3-933e-41b4-8738-8c9a6ee4f495", "comment": "Malware payload", "value": "7169381cb169eab92178d1e6b15527e818b3d3327da73c0b7f5eef5662e2358153000ba740c68766800b1948a6627762", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961918, "uuid": "1f26b8e4-865d-492a-8077-f34e26abe6fc", "value": "T1684197122AFD0514F3B1D9721DBA9730803BB45A4E31D51C01CD42080B33E00E821BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961918, "uuid": "351dec9a-c434-4afd-a2d2-0fe6c3ad05b8", "value": "12:8nGyM2HlqGl4oCYbdpYrn1Il+kOewbK2UcTWl:89x1l4ondd+NewbK2/Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961918, "uuid": "89874d10-ac2e-46cc-8688-13a43a14b0db", "value": 2176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961918, "uuid": "96df7d62-10dd-4da7-9c09-3f2172a4aede", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961918, "uuid": "e5f6eff7-a8f1-4768-98c8-73f8f4cbed10", "value": "BY4213-Order.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1c0551-436c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1692984557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984557, "uuid": "87948fa1-69aa-4939-a9d3-441cc9313885", "comment": "Malware payload (AveMariaRAT)", "value": "f561af5ec94b44e66e8a1792371fd87b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984557, "uuid": "73e15265-d50b-42db-91c7-c54d5f69b70f", "comment": "Malware payload (AveMariaRAT)", "value": "18c71c0ddb3865bab4874bc60e18869e791f95dcc48db64afbcdc07b7a83165e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984557, "uuid": "f1d09087-5e99-44ab-8bc4-2d58324a05fb", "comment": "Malware payload (AveMariaRAT)", "value": "6920b6dffc67a5e11d2b48588515a953b0f5fa7c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984557, "uuid": "25f56d67-99dc-4e1b-b681-3dd52800fbc8", "comment": "Malware payload (AveMariaRAT)", "value": "443d4e919fd2553aa71aca01ec0bbf95b980b376d099fa53b3245fdd9e2cf45156c36ca8a1985edb75793cefa89f9187", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984557, "uuid": "0021bcaa-28f1-4fc5-b646-044285c3eff6", "value": "T1A7D423415E588576E27E4B33D913C0AA8E33BEB14062E61AF8CD3E743B91BC2B567134", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984557, "uuid": "d70fca19-29c7-41b9-ae17-c39d1e791d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984557, "uuid": "ddc70221-df4d-4d88-84ec-70e5d767dd8b", "value": "12288:uSfXuXOAC7le3zjXljw/Vq6F6CjtuVu/jmh:uEXuXOASEjj1M/tsVu/jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692984557, "uuid": "f3689543-1da0-4933-84d6-e45473d38408", "value": 617128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692984557, "uuid": "6382632d-2525-43f4-8bb6-a8f5f2067e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984557, "uuid": "ee2e069f-875f-4998-906f-b1817ee399a6", "value": "donexx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846e0116-4369-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692983096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983096, "uuid": "9b89bdc4-fd32-4ab4-a420-82dd332634a4", "comment": "Malware payload", "value": "644827e95f5ce4b1e8aed615727fba0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983096, "uuid": "0a6ca126-442b-4aa9-862c-ca80f02ed096", "comment": "Malware payload", "value": "1a6ee6bdd10a2f6067cfbdd6d9b5b2a6ff7e8d83a69390225474bd524b33c3b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983096, "uuid": "4a25889c-4076-44ec-8559-63e373ef2934", "comment": "Malware payload", "value": "63916a86af61572dce08d6ef1a7e47c24bb0e829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983096, "uuid": "c82b65d7-5e8f-47a0-8d0a-ab0591684e1c", "comment": "Malware payload", "value": "79faf666044b7c2978bf68eca95e85c700c1620ad9714b16b7c28a061e46e4573daa1c69ab46a549b196f35bbe152f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983096, "uuid": "a488358f-f441-42cf-88a8-dd51ddbd0ae5", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983096, "uuid": "61c68462-5ccd-4c0b-8466-a2e53ce8d133", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692983096, "uuid": "eaf29441-cdf6-4607-b4a1-c12a0c39b38b", "value": 4183552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692983096, "uuid": "27aade41-6e79-4034-913a-2bc01622bcb2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983096, "uuid": "d752e8f2-2b24-4e4f-a697-79ae72135038", "value": "vbs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bd21f7-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692961916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961916, "uuid": "dbafe3bf-e36d-4c5e-8cab-9198eefda32f", "comment": "Malware payload (AgentTesla)", "value": "eacc9c49d66981734044e69304288325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961916, "uuid": "3f5837d8-d85c-40d9-918b-55bca8de3936", "comment": "Malware payload (AgentTesla)", "value": "1ad099ae47a44058fd883aef2e9032b857d2f78b4f14c4ce606f2870b4ec062a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961916, "uuid": "c609a504-93e5-4ec1-b0df-f37bac5563fd", "comment": "Malware payload (AgentTesla)", "value": "5c69027087467292741eba3fa2678a1063e0ca98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961916, "uuid": "3288ee81-9632-40b5-930d-792ec2c6cccd", "comment": "Malware payload (AgentTesla)", "value": "3afdd13ef65ceefb30e43b6053791628f33a3aca97749d55f34baa26596d780318822e2283263e31652f23c3087837fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961916, "uuid": "f78cc81c-5b8b-4aba-985c-e7a904045dd6", "value": "T17EA47003BAC78DE5F34A1B3EC58B14004BACDAD13627D70F794BA3663B423A6A4C5587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961916, "uuid": "93a35fc8-7c19-4f80-8437-a2c89af443cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961916, "uuid": "2e3986fd-02a6-4692-8d07-e974e5d44779", "value": "12288:qetVRoMH0SV64vZ0SNWKErqukcQXNiJSeIoj4:qezRoMH0SVXvZKKEmukfQJSeIoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961916, "uuid": "27aeed64-cc34-483d-9195-0d34bfa4c39b", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961916, "uuid": "33d27173-fa8d-49f3-bda5-59abc2711b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961916, "uuid": "b450dfab-e229-4ba4-89c3-1345e59b2bc0", "value": "Halkbank_Ekstre_20230426_075819_154055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960077c6-432f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1692958215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958215, "uuid": "c8987881-d74e-436d-afcd-c5d6740e30ac", "comment": "Malware payload (AveMariaRAT)", "value": "60b5fa1d33eb8a02355d33e0148e3cee", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958215, "uuid": "0f5e6d91-ae78-4ee9-838a-45a12f03f216", "comment": "Malware payload (AveMariaRAT)", "value": "1b0a269659f690d91d53917f6aa97c63ebc8b3dd27c4f955ca0de19c466c8cf8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958215, "uuid": "cc1d0dd5-9a90-4c62-ae50-581e82fb0e6b", "comment": "Malware payload (AveMariaRAT)", "value": "2e5b92c680ac6496bedf57065880b9b1b6194adc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958215, "uuid": "d98396b7-c7b5-4b64-8bed-18e0624ef1d8", "comment": "Malware payload (AveMariaRAT)", "value": "629b57b04ad18aaf70a604a65895685639d2132a073d4d7034434aec0508396d4fd5fa01498827b9f69573dd258badc2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958215, "uuid": "c068c37c-795f-4668-b23c-ef1ddaecd70c", "value": "T158B4016072795F15D87E97F60920D48007B9BA3B6571E31C8EE2A4CB69ACF805F81F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958215, "uuid": "bfa9c4db-66fe-40d7-8ac7-d711e97f39ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958215, "uuid": "0ce66aa5-9fce-4305-a7cc-b60fa11a1cad", "value": "12288:oKqNT1Dl+CYaKS7/4w7b1n+l7Zpqpk4wwfh5sEul:ckY7/4w75nkqSjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692958215, "uuid": "8186f524-7b54-43f0-8394-fe5a273e0317", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692958215, "uuid": "06f94c08-5db4-43ff-b8aa-6ac1f557e2c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958215, "uuid": "dfcdfe39-bb68-4bd4-be0c-ad88a96e5642", "value": "60b5fa1d33eb8a02355d33e0148e3cee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29431e4f-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692964904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964904, "uuid": "57a36273-9b5d-4824-b11e-51b63a4bbf9a", "comment": "Malware payload (Stealc)", "value": "736c1366c0c3d08fee7f94bca968f090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964904, "uuid": "c859623a-6233-408a-9831-8c88864633ff", "comment": "Malware payload (Stealc)", "value": "1b0da8603f31103a5d90152c983ddd534e128abed1901fe5debb660c0bb6ecce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964904, "uuid": "7243e38a-db19-4a2f-afcd-05471997550c", "comment": "Malware payload (Stealc)", "value": "0afdee62d39e0825400b724a6e173a675c7dd1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964904, "uuid": "a499e1b2-bdd4-4689-a957-4fc673de4a0a", "comment": "Malware payload (Stealc)", "value": "3acfa83739a3fd4c08428c0b7fe6d442cc8b736289e7c94edf51b5fdfc780db5e2793c09e9dc623ceb8ba59fa7cb94b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964904, "uuid": "77a4dd53-def2-4600-ab7f-40bcb9078c43", "value": "T1A544ADA13A92D472C8967037D823DEFC693BB872D699858733183F2F7D312D26666311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964904, "uuid": "3f105e71-5414-44fa-9109-235725e15b18", "value": "84062fc609830957c144f26e843d6474", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964904, "uuid": "1a88c21e-3bcd-43cb-bfd4-000dcd36a048", "value": "3072:TXQRoKGTtoLvw8NVUW8+r/f9Yg+qhuaEHskE1oGK29DMIq6u5MLsNTApRO:L59T2LvBNV8on2qvusdnbLsNTaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964904, "uuid": "76d4287d-8d6b-4354-a52a-60b46a1f03ca", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964904, "uuid": "7fb1a187-64c1-49d4-876d-24e670b135b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964904, "uuid": "812e17fc-22a2-445f-8448-d9152a87a65c", "value": "736c1366c0c3d08fee7f94bca968f090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51daf82e-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950370, "uuid": "2f3cc393-2671-4b48-9c68-c218bb3787f9", "comment": "Malware payload (AgentTesla)", "value": "a1db675acf65b2c9c73deca075bea9b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950370, "uuid": "1d979372-046c-48b5-89b5-17e0297f50b7", "comment": "Malware payload (AgentTesla)", "value": "1b18db45bd47fcb35d17c01d27f86a5f1adca9c54727555e297af3606c56da4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950370, "uuid": "a0e8068b-346d-4075-8d20-df56550c4597", "comment": "Malware payload (AgentTesla)", "value": "bb92ae34c971ed37157824d233ab69ca5eda99e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950370, "uuid": "00903d0c-dee1-4aaf-9897-a77b8cbf4590", "comment": "Malware payload (AgentTesla)", "value": "9b753961b0b3bb12832590a73fbbf153cb00f4abdd8354ead7bae72c24e9e5c499da8bd7b22355fade22ef5548869db8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950370, "uuid": "95c94be7-25bf-460b-bc59-c0ec32252262", "value": "T1FCE4235F0F9414D7E6B8EA297E771C3F3B8BAAF21106736CB4B7D1214A64843146CA1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950370, "uuid": "3c32382a-dfb0-4934-afb8-b5f1bee97010", "value": "12288:MZ6lG+uV+WiUU7b+hjVbz1nyD0u1UaQyXA2tKTrGdntt7AXuyIEccU1zN8psZKST:plGzV+WiU1HbtyD0u1UYgr8tt7A+yIEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950370, "uuid": "1cdb6d1d-d45f-488b-86aa-130e5bccd62e", "value": 713094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950370, "uuid": "50c389db-8a86-4688-8990-9164384daa51", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950370, "uuid": "a2dedf67-15bb-4aba-9f44-45667a45f2ac", "value": "MQPurchase Order (2).xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ec7894-4354-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1692974185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974185, "uuid": "fbaa33b8-d235-4459-827f-4ee59991c82f", "comment": "Malware payload (DBatLoader)", "value": "1aceec87c3fc65540d3f3a93bf7caedc", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974185, "uuid": "51851b91-41cc-40b2-83fb-c19b1db2973f", "comment": "Malware payload (DBatLoader)", "value": "1ba55bb7d2d33d7892669c2e96c351fe59ce60144429508d6251d5dcbfc5ff86", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974185, "uuid": "5aa76e1f-d40b-4195-8c38-21283cbec420", "comment": "Malware payload (DBatLoader)", "value": "e4006221758063d49eaa9c0372a8e89dcc6ae038", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974185, "uuid": "d0647419-79c5-4259-94ea-46cec9531d5e", "comment": "Malware payload (DBatLoader)", "value": "95183e837c9e93e3914483801591c79d01e98fb9dd027b97107425c4f64e1ae93b7644b52ad0a403ca2e3093fd1057f5", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974185, "uuid": "92de0ba6-5958-4e0a-8fab-49c05a395e6d", "value": "T18F65E161E6A38477D5273E34C85B9255D86ABF302D2CB50E5AE43E58CF363C1782A1B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974185, "uuid": "7bcd6628-eaf4-4d64-b266-22093abea634", "value": "555fbb180099f7ea0a0860999295d5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974185, "uuid": "7f49c862-cff1-4ed8-8f38-e01711229c68", "value": "24576:/UWyWyLFqghcA0n9WUS20tFJTtf7BtdZhPKRpUW0YEq0UxX8OCTL5GJ:/UWX7WUktFJT5BtdZtWWqxxX8O0L5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692974185, "uuid": "f5f25db9-85d7-45e0-a4a3-f0503ff4034a", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692974185, "uuid": "c40b4cff-f3ee-4a7f-a070-fd89b8f981f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974185, "uuid": "f71df543-5c05-42da-93cd-d88b87cb3662", "value": "1ba55bb7d2d33d7892669c2e96c351fe59ce60144429508d6251d5dcbfc5ff86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46634e2d-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1692965383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965383, "uuid": "55ee94ed-3dc1-42c6-be83-7c49d0b80241", "comment": "Malware payload (XWorm)", "value": "b7432922236abad04ef98f477c63f14d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965383, "uuid": "266aee81-97e8-473a-aab0-de2ba9bd63cc", "comment": "Malware payload (XWorm)", "value": "1c621cd7b5bb81d20c8b61373075f4754e47ff429e3dd455c9666fa5a6e4eddc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965383, "uuid": "6ab3df0d-25a9-4c83-86e1-83b7e08ba2b3", "comment": "Malware payload (XWorm)", "value": "f55e81804f78dfb8968093ba2531a3d05ae54d21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965383, "uuid": "410dccb2-12c2-457e-9fe5-1b2c817960fc", "comment": "Malware payload (XWorm)", "value": "255010183d983d6080ab819a305184d48df608d6b399dfda8598e4a4517272f79d9aabc922c4ea5556ba6b8235fb7384", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965383, "uuid": "e74a7c54-8256-49ef-af59-bc724ad3c2e8", "value": "T17F54AE16F64120BDE46AC0B8424756217AB6BC880B21BDFF17A4763A7D76BF01E3C758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965383, "uuid": "a62aa9ce-686a-4f5c-98bc-1cccf47029ac", "value": "641b8b17e4eb3d0279afaa5eba9b79e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965383, "uuid": "cae3ec5f-2c75-429a-94dd-43ec9c2ff57c", "value": "6144:v6eUBCQtPecNFJRXD4MDfaQu9vJTyZcBnQn:i9BCwZvJ944pwvcZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965383, "uuid": "280695d6-2e6d-470d-820a-168080ac8fd2", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965383, "uuid": "7ada7941-36ba-4870-b3cd-bf40cc44ab8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965383, "uuid": "707ce39f-17e6-41bc-ab65-6b9dad14255f", "value": "b7432922236abad04ef98f477c63f14d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00620c19-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692964836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964836, "uuid": "2f92c457-d545-42ba-91db-42ce35808843", "comment": "Malware payload", "value": "ee45c5a42b6662ed414c2243c9ebbccc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964836, "uuid": "bc6483bf-d9e4-41a4-b166-6db783a29fc7", "comment": "Malware payload", "value": "1e7c897e34389a28c1ea4704c22d64afd81cf7e53bb38a4954f0d45a2490a971", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964836, "uuid": "cb07db5d-42c2-4d1b-948c-71ceeb0b8531", "comment": "Malware payload", "value": "d924cfec2f4447ce8feb2e02133916ade7eadd6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964836, "uuid": "d85ef479-f2c0-4d5a-a672-94c48d72f6a4", "comment": "Malware payload", "value": "f2706c9617bbae8781041e85e22eacf0565a79416fb80909d8232a5ff34265422a1ddb8198ffaabcc00db9a4ada3d758", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964836, "uuid": "7a5a8760-99ad-464c-a8d1-a48020304c4d", "value": "T1B51633F4686393BBF7CB73B12E62E4FD7790D6BF882558B61C38989635613635C80290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964836, "uuid": "e459bba4-7972-437c-a33b-b8903b371b2f", "value": "98304:emB1kJ62BWOtIR7AzNS3mVmh/sxWruL0UUXoiEjCQYSRyEK0K:ekKI2BFBS3m0h/P/S2QYwyEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964836, "uuid": "475dfb0a-5a4e-4e12-98ff-e46c38edc58c", "value": 4265782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964836, "uuid": "e5fc323c-adf2-4016-89d7-6f255186d221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964836, "uuid": "4ab66f77-433d-44d9-9591-63cec6dc505b", "value": "ee45c5a42b6662ed414c2243c9ebbccc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef47e96-4364-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692981127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981127, "uuid": "3bfba1b9-d47e-4b4e-9669-b2ce21ee1209", "comment": "Malware payload (Mirai)", "value": "c902e5bbaf9219822f95f7b56c340785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981127, "uuid": "c1ddea7d-fd2c-48fd-8740-8f48a91b1a5d", "comment": "Malware payload (Mirai)", "value": "1fb0e3a1b80ec67429edf0b9fe173678f7ff09d5f550ae3de4e9d1d22023a317", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981127, "uuid": "ee7e272a-ccaf-4da2-b872-c087315c6325", "comment": "Malware payload (Mirai)", "value": "e9d3f7f6699ad61571964afdc44e1b6ceba3987b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981127, "uuid": "1bb20cb8-25f5-4100-85ef-93468826fb41", "comment": "Malware payload (Mirai)", "value": "ba3f2e84873453f9617ff3197abf57e7d514561a5995cb17388064f0be28fca19341be948263a0d70b8dca3856bb8e4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981127, "uuid": "9676d0fe-efe9-496a-9ebd-cfcae9c904f1", "value": "T15B336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981127, "uuid": "008bb952-739b-4edf-845b-ac8ff2f2a82a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692981127, "uuid": "10854324-1c8c-449a-bb20-c044d3c25df7", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692981127, "uuid": "3584c97e-6782-4851-9cd0-0be1e38b390b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981127, "uuid": "4b0ae815-12f8-40f9-a78f-02e1bd7f5359", "value": "c902e5bbaf9219822f95f7b56c340785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef14d752-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965236, "uuid": "2cad3225-842b-43e2-bbe1-4c332ac0ae10", "comment": "Malware payload", "value": "298d044eaa53e7516a8e4437ea165b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965236, "uuid": "d5067c28-5285-42ff-8777-d89eae960702", "comment": "Malware payload", "value": "204abec1681b81493fdb85e58cfd41bee21bea6ac719ca74f6fa694966afb507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965236, "uuid": "dbac2f03-e311-451c-8e79-b61e8bdb8ff3", "comment": "Malware payload", "value": "363480b7afbfded1b6d81442c87e450da6260f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965236, "uuid": "af3f3446-42d6-4925-b037-afe3a08e0055", "comment": "Malware payload", "value": "bf8200c79dbc67b7a95a34992213bd27bd9eba5160f5d561bf0eda14ae8d605e4a3874c742ca24d8dc819b88500691b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965236, "uuid": "fb39b2ec-9716-4f5d-9dd1-47db4afc29b7", "value": "T16026E0789D7F093AC07121B5E5C329D2CFC3688E564674F5ACBB68212FB0D3866A712D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965236, "uuid": "16075baa-eb78-4e5c-a3e0-656ab50e7018", "value": "49152:MMcDmMRlBdzs3EThgR0uEqBXLdcJAbtNmbOHaGhEospqOziZXAfrrARS7JL2ozPO:dcdrCET8XeospuZXAf0EJyocDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965236, "uuid": "a097a2e6-ee2d-4f8d-ba11-f71ff0d7178c", "value": 4684011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965236, "uuid": "0e771ef8-c175-4389-9d24-ea2eecceb86f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965236, "uuid": "ab75501b-99d2-4d12-8926-7d6018f9918c", "value": "298d044eaa53e7516a8e4437ea165b30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d321797c-436f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692985805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985805, "uuid": "2704dc28-0c6c-4c14-a3b2-92eca5049597", "comment": "Malware payload", "value": "a79e9f0b0b7079adcbab09632f580dc0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985805, "uuid": "0a8affac-6ec5-4cb0-a3eb-5a95f92dc74c", "comment": "Malware payload", "value": "213a3d54b614e09fa683ebde125bce22ef4ee7245b276374532a2ea8e51f39e6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985805, "uuid": "14346996-2f88-481e-825b-ad47b09068ca", "comment": "Malware payload", "value": "6cc783c2e34db38b1644d227aac65256bd1301d4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985805, "uuid": "eec21262-7498-438a-9e26-c9b297449838", "comment": "Malware payload", "value": "fd6b25c7dc7c80d1584bfa0c596740e76d2e52637c7a724ea1991470ac8a2f6bab11ec1e97d08c0affc9716d37d5d5bf", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692985805, "uuid": "b35db218-5d20-4bf8-a83c-39ca9394b797", "value": "T179B32A5AE7818F03C4922B75BADB42423323DB5497EB63065928BFF43F8279E4E23515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692985805, "uuid": "c857164b-5ef0-4500-b865-e6032aa28ac2", "value": "1536:m4nFTfP6a/Ru1WaUP1qlydimPirBJZY+V2838dE95wSvQzw/94tnskyD45l:ya5u1WnjPirBJZt283WEuM/9Aby07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692985805, "uuid": "ea9cc5e3-415e-4f38-8a05-f04ea18bdd90", "value": 114408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692985805, "uuid": "9b9536ae-44d1-4892-a326-eee860e36a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692985805, "uuid": "4371f135-a84c-4b9a-8e84-140007231d3c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbe530d-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934176, "uuid": "166c95b5-3836-4b8e-807d-c936ab04c365", "comment": "Malware payload", "value": "8d734fe7b0a01e5ff7028c296a172fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934176, "uuid": "ec075050-080e-464f-af74-6b53fa71eb30", "comment": "Malware payload", "value": "216f1c0ba684a52b81799798c2e7afdc9e41338961588753946e44ac45f1d20f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934176, "uuid": "2b2573fe-087d-4487-8250-435dfe4e5fd8", "comment": "Malware payload", "value": "672b56da9570b1181cabd39ea566a80b115a1795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934176, "uuid": "89d74ead-20f2-40b2-acd1-f217e6d547b6", "comment": "Malware payload", "value": "87f940f9df15aed9f19acdc7184c8c33893774dc380fc63d633ffd2f52634baebb76168d405186da7659a163ac613dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934176, "uuid": "feb247be-99e1-4907-8c78-a8acb9681fc7", "value": "T12B159D117BD6C432D4BB05702E29D76A452EBD304BB188EF63D80E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934176, "uuid": "54b95376-a99e-4f9a-99ad-fde43edb4610", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934176, "uuid": "d0f0c859-38c6-47e2-b5a9-416ff3b4691f", "value": "24576:iyyzQyz5io+HExGWUAyiqZhYIBqnGIQ5M6DLrVVdWHA8:irz5io+HGGWxyzhYqlrXVVdWHA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934176, "uuid": "b7a6b3d9-62ee-49b2-ab12-c8c56d2e83ef", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934176, "uuid": "0fb898f7-c3d1-42aa-b894-e11949048f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934176, "uuid": "f61b1b90-fc6e-466b-9abd-8f8d7cffaaef", "value": "SecuriteInfo.com.BV.Obfuscated-O.5868.25555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6b0cb0-4395-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693002145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693002145, "uuid": "80cab476-d984-4b1d-ab67-0372b2c632cc", "comment": "Malware payload", "value": "0cfd96fe0a1e17a166d36ded006c6115", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693002145, "uuid": "0ab8868c-60df-4e89-ab19-1335b5138702", "comment": "Malware payload", "value": "21d57c899677bf400f9854353ce664fda61c187d9df2738c032ac4624c382a01", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693002145, "uuid": "f88738ad-f25e-49f9-8f55-fa73d6b9d178", "comment": "Malware payload", "value": "20240e4696f7b0b32d01caa6c986ee388e157f1f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693002145, "uuid": "ff558782-6db6-4bcb-9c1b-8fa179150c07", "comment": "Malware payload", "value": "545cb134ffc30ab6c19f7ca06bce94817dca7036da53277c83e8ad3b3714dc0db83c4f5ab59eac3de6aa8c199292b81b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693002145, "uuid": "4e8e0da4-f8ae-44f4-8c23-191ce4fb3214", "value": "T167C18511C70D210D79365865F435B769E6ADC1338F422DF0BD7EC0BAEBD60A11A9896C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693002145, "uuid": "04146ab9-79f6-4fb5-ac37-cecab9f0223c", "value": "96:9laHYuxbOrJrg6de2ARGkJTAz8JBRDSKt0a5YppxAu8Y8GQMsj2:9UHYzk2ARGAkqBAKFQpxp8XMsj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693002145, "uuid": "e59a0190-015b-40a3-9cc8-be9f75b5825e", "value": 5614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693002145, "uuid": "b7cf6010-2000-4f73-9e79-b7da7330078c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693002145, "uuid": "812be8d0-31c3-428a-ae56-d9bf0d3bf351", "value": "Your browser version is out of date! 2023-08-10T11_52_16+00 00.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5ec3db-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934152, "uuid": "46ca094d-3334-4831-ba4e-6d1ea8b73cac", "comment": "Malware payload", "value": "638375c0a30b99bf5fb6fb9f38ad85ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934152, "uuid": "4d836660-df00-46a3-b78c-016a39d09c4b", "comment": "Malware payload", "value": "23ca57d815afd63aae4f03945bebf370871a392d0f2672773f4d33caf942ae35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934152, "uuid": "4f9de307-3382-4945-980e-ce6cfc7afec6", "comment": "Malware payload", "value": "06637436e85c86e2964ea6dec8f3005ec80a0ca3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934152, "uuid": "b5f7d6de-28ba-4667-b9f4-7588256eb22b", "comment": "Malware payload", "value": "168cd0abf5af9e1b28008b2f0bc40f74a080bff553ca53361f14002bd7320be38dc592bce13550b2b38e5d116aa2eac1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934152, "uuid": "1855835a-59f8-48b5-a3c5-31cec53aeecc", "value": "T15EA49D1176D6C836D5BE06B03A29D39B4069BD7447F284FF23C84E1E1EB24C1563AEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934152, "uuid": "2d205c6a-c026-44c4-a126-d344563f1d4d", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934152, "uuid": "71267d52-5465-4662-97a0-c2c8e2541183", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHATYQK:yBqnGIQ5M6DLrVVdWHATY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934152, "uuid": "dbe431ac-17d9-4fc0-8643-f3b6e26142f5", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934152, "uuid": "5e6b514f-a5e7-46bc-9301-cd1bd58c40fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934152, "uuid": "0774797c-a815-4899-9adb-6dac14075ec0", "value": "SecuriteInfo.com.BV.Obfuscated-O.15602.20299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a2749a-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692961910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961910, "uuid": "4a805f39-b50c-4bee-b9aa-fe19b7c63c7f", "comment": "Malware payload (SnakeKeylogger)", "value": "0891828f1502941749122ed54cd6897d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961910, "uuid": "6df88ca5-319c-4ac5-9da2-bee32ddc5ede", "comment": "Malware payload (SnakeKeylogger)", "value": "25f7c89c3dcc8b8076ca12cc9365de1c43f3ead9f73fce80ec1ef307cb5f06b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961910, "uuid": "1a936d67-d772-4768-b99b-932e55a25fc6", "comment": "Malware payload (SnakeKeylogger)", "value": "bd4d8ce5e687c6473e7ec4d72311c5e2c6852d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961910, "uuid": "a4d3f7f6-02a7-4f3c-b0ad-81cb64669e8a", "comment": "Malware payload (SnakeKeylogger)", "value": "24e5c9a77230f665e3ed3bf518d23a3f009294877bbdcbca67f0f8ddc698cf64e595485c55a14e0328dca2973a884589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961910, "uuid": "a9c311da-ecef-4e16-90ba-9a37916fbe23", "value": "T199E4CF1062E8860DE4BEB7B547B407040B36767E5632E24E8DF414DEDE627C1FA1AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961910, "uuid": "6b2b414f-b960-43b6-b89e-031d34e64cd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961910, "uuid": "faf64480-fd9e-4f48-8c66-fb8abc706c33", "value": "12288:p8cVVgE3VPMwSnJfsGaYiQKiAysmST4TQ10/hJP05:ecbgGTSJEGOVym4M605", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961910, "uuid": "9ee42ce2-4747-45db-91ae-4895108aa0d3", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961910, "uuid": "92db86c6-4133-42db-948a-7dc14bf13eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961910, "uuid": "71964234-956d-4913-a5ca-3a55eaf30df6", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4894fe3f-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692961951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961951, "uuid": "0df12c3e-ee7c-4760-9c33-4901cadbe32f", "comment": "Malware payload (AgentTesla)", "value": "e10c72c69cb0846385e2e55174f47632", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961951, "uuid": "d9eaf301-b2ca-4cee-97e8-4c6ffecf349e", "comment": "Malware payload (AgentTesla)", "value": "25fd8be2e2dcbbf3707e4aba7be70e8d962beb4a47c9c4a1763b09086fcb1258", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961951, "uuid": "201be98f-5a06-4605-9092-b69ce4e46f1b", "comment": "Malware payload (AgentTesla)", "value": "031f8c191cdbf417f4b7c327d73ec2ac9aa1bc54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961951, "uuid": "83bf60fb-c960-47ac-aad1-401368eb5c20", "comment": "Malware payload (AgentTesla)", "value": "8b7f80a6d0f1505ecf3bb812ea036d16b0c7cdbc5d13f10aa58bb6f912201eedc9a56289340acf10cfd170b2bdee15e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961951, "uuid": "7cb1cd59-b5c0-491e-b118-3caf24bfda3a", "value": "T1B2D4010AE3648B12E5BD87FA78905AF863F8BE8F2552F71D0FD5B0DA2A737044850917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961951, "uuid": "36f7a9b9-7b35-46c9-a9d9-70c87f546ca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961951, "uuid": "8a2c6a3c-40c3-4bc5-867d-2c9d38c3281b", "value": "12288:4CUDrVQZKEvMPDYavB8vtTLd0MbUagRz8XZYftX:4lDhQZ3vMPcap8MYswZ8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961951, "uuid": "e3ea1e95-bfa3-44fd-950a-06fcba8b108f", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961951, "uuid": "7349e3fa-4991-4ca8-a8bf-80760bdca03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961951, "uuid": "7fd2db39-33a4-4654-9905-6eebe7526a66", "value": "UPS E-Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d018e5f6-431e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1692951011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951011, "uuid": "33128aee-978d-4276-99e4-c7a346e774b6", "comment": "Malware payload (Gh0stRAT)", "value": "5454879f400676e1eceb39b0343cd1d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951011, "uuid": "9d4e6732-f6d5-4556-8d13-7efe0fce8541", "comment": "Malware payload (Gh0stRAT)", "value": "264759d16080f4640a94129629fc42e7a9a389b6e960bda88cdd761b0c897aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951011, "uuid": "3631ddf9-1d7c-4eb2-abf5-ee4a133f0b09", "comment": "Malware payload (Gh0stRAT)", "value": "b829415785a53a3e7ca34880b6b7d47eb9eeeb82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951011, "uuid": "2826dce6-062e-404a-b19d-61ba888ef364", "comment": "Malware payload (Gh0stRAT)", "value": "b2a5c965350c9b99be72ae6f89717fbd5f5dcc4a70a97cf4ef5fb881bd5616cf9ab44940c7f6066b546ea995c2800ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951011, "uuid": "1d187a5e-385d-492e-84a4-b87877a5ee11", "value": "T146C4D011FBC1402AE49C01B080D39B79A67CAEB6571311CFE7E4F94E1E751D26A32A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951011, "uuid": "5325a438-dc17-4050-a106-bb59111e08f5", "value": "a0158c18d7c57554131cbbf4101b1cab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951011, "uuid": "a23ed507-50b8-4c64-86c4-47c8aced557d", "value": "12288:nruM9FNatyT3gNCpOdn/uScZNJ7QD7HZ5rbx:q+atynpOd/izJO7HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692951011, "uuid": "d6554f31-1dc5-4e5f-a103-c30854b66f53", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692951011, "uuid": "817e910e-0ecc-462e-b15a-2c85ab566cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951011, "uuid": "34e7c914-2512-4831-a189-9e131ae61d12", "value": "5454879f400676e1eceb39b0343cd1d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98365eb-4364-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692981145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981145, "uuid": "12f1de72-b3c0-4e13-a823-76b01b472d7b", "comment": "Malware payload (Mirai)", "value": "483531a50bb2e0fdd39a1a9a4b18bf10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981145, "uuid": "7cb12cbb-4a11-4a54-80f9-d963ce81449c", "comment": "Malware payload (Mirai)", "value": "264b710e361cbfd286e3bf1e56898f21cf39c8aa4ca7af13da4e295ff215a211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981145, "uuid": "6dc9f989-836a-4c57-97b3-7ce27f12b5ea", "comment": "Malware payload (Mirai)", "value": "50f6085514d43b9df84a7237ef24c3d43671786c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981145, "uuid": "37898d9e-0cf5-4efd-a19e-4e7efff99bf0", "comment": "Malware payload (Mirai)", "value": "dc5ea95fc2cf0a84e0cdb5ca0b5768154e9b68628491e3639a99fddc282b24120bdb4450f2a18c9bfa9e2e7381a116a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981145, "uuid": "5ba2efdf-c8cf-45e5-bcbc-4585488430fa", "value": "T12A82CF3062AB34E5CBE10431FAAE8EC6A7160BF8D1FC36D316586B78894610651F96CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981145, "uuid": "128f7f2d-90da-41ee-925a-ca1974095b5e", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMauwhymdGUop5h5lv:6GV0P6+kom0tVAoNvm+to1Ns3Uoznlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692981145, "uuid": "aeb5f595-1a80-4d49-add1-160d2938c519", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692981145, "uuid": "89d9c91f-b604-415e-bfae-b6fa6660ba2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981145, "uuid": "71274b34-f1fc-479b-aeed-cb59df9cb284", "value": "483531a50bb2e0fdd39a1a9a4b18bf10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9e0140-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934147, "uuid": "f7a02caa-f01a-409c-b4c0-a40790669143", "comment": "Malware payload", "value": "ae206447fffdb475edf59ada0b288005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934147, "uuid": "32502717-1ab6-47a9-ab61-a06664ad24d3", "comment": "Malware payload", "value": "266577e98456a68a31d7af6846f4a2736df148fdc89498c378ff5b1c8c72f9b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934147, "uuid": "c8f8aaec-8266-43f4-a9ad-8e05895434fd", "comment": "Malware payload", "value": "6f3e188a40018725810450991b41fa980171adec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934147, "uuid": "bdb70698-8c2f-4092-ad7e-049ad3023417", "comment": "Malware payload", "value": "95561905b7c5a42ab0907162a81ebec7c8a566583f9f390814d167eab5cda0b1da59d3190be77d09c959aa036fc8edb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934147, "uuid": "744ea80b-0e74-4a02-830c-13b69631f8a5", "value": "T1F2159D117BD6C432D4BB01702E29D76A452EBD304BB188EF63D81E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934147, "uuid": "106d0c11-3d5c-4366-a004-6d2a83493310", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934147, "uuid": "327b456f-498c-44c1-aae6-017564963cc5", "value": "24576:iyyzQyz5io+HExGWUAyiqZmYVBqnGIQ5M6DLrVVdWHA1:irz5io+HGGWxyzmYzlrXVVdWHA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934147, "uuid": "d9940dbf-8c1b-4d83-8f6b-8ff8725c423a", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934147, "uuid": "9865f383-afeb-4e05-a9e6-10471cf34807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934147, "uuid": "b0a95e3f-f72f-411d-a0f2-a9b348bf89b6", "value": "SecuriteInfo.com.BAT.DownLoader.647.9626.4707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31745d86-4386-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692995412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692995412, "uuid": "ebf7d936-0939-47e5-9649-ebe667e434ba", "comment": "Malware payload (RedLineStealer)", "value": "5b2baeda096f53395fa8d8c83c9ef9a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692995412, "uuid": "1efa99a8-6f3f-4509-89c9-e06e4609fbb8", "comment": "Malware payload (RedLineStealer)", "value": "26dfb449f0916c40d7617392ea3cb624c239a23537b87481aa211273dbb93cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692995412, "uuid": "1d380f0d-fe75-4ab6-92ff-caa27d44e18c", "comment": "Malware payload (RedLineStealer)", "value": "4702bbbb46e98d9e788d6e8655a88e2321a5481b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692995412, "uuid": "86067a4e-c052-44e7-ad63-a664e8a1286e", "comment": "Malware payload (RedLineStealer)", "value": "c9701ac1b6dd8dd3417f533f54c4d9eb89b9133fc8a7b16cca9e01ec339eae3433b563fb4803e8e3e840b99c0d23154d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692995412, "uuid": "69c2596f-6ce8-418d-aa4c-e5c01a844395", "value": "T19D94E131B581D471D99140309865CAF03A7BB8329AA58887336C3F6F3F7139EA6E725D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692995412, "uuid": "c329de83-29bc-4877-9271-a83d5b7905bb", "value": "478e1adb03a4046019e6832a1ee52bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692995412, "uuid": "08addee5-685e-435b-92fc-d6476fc7723f", "value": "6144:Sl0Z8yBL8wmWv1yWOx69G4Y7iu58a8NiL/FRPR3yiO1u/74T9R:Sl0Z8yBzrvOE9GZ2u5/8Nyz+67o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692995412, "uuid": "b7c8b9d3-7724-4e44-943c-b44f3581973e", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692995412, "uuid": "75b07a27-bc52-40d4-968a-7c3426987a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692995412, "uuid": "012bcdc0-2bd9-4cde-965b-761b62804bd7", "value": "5b2baeda096f53395fa8d8c83c9ef9a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6b8638-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934174, "uuid": "a0cc8fdc-fce4-49b6-b418-0ad33f5bdeb7", "comment": "Malware payload", "value": "43788a28f5f1b34777e55542ab4553eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934174, "uuid": "14428ed3-d9b5-46b5-9f72-2b66b7feb495", "comment": "Malware payload", "value": "2825ff4d69bcf8ab118417d54ed967301a8adf7b560333ef777b488231f47f11", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934174, "uuid": "36ff66ee-5444-4f40-9c94-fa3271ad1cae", "comment": "Malware payload", "value": "a5a77e7906ad79906b968be66f48b6991fefb6da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934174, "uuid": "b8d3712f-89cb-47af-bec3-f31585baa373", "comment": "Malware payload", "value": "3cd41a068e14b1675fc45d60c02605c8221d09ff2bd4baf9b92cbe9ebc76387447186ece353c45080f39d9125973d8b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934174, "uuid": "f2e2ee38-a34d-41c1-8d9b-65df39d70b8b", "value": "T1F5B49D11B6D6C836D5BE06B0362DD39B4069BD7447F284FF23C80A1E1EB24C1563AEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934174, "uuid": "76de3870-8ead-43c1-8e5c-ded4bc234822", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934174, "uuid": "7430fa1c-2f9e-4972-bae9-b0232a434991", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHARzc:yBqnGIQ5M6DLrVVdWHA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934174, "uuid": "940d733e-bf55-4223-8d08-88933f19183b", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934174, "uuid": "e85e99ac-0153-4b6b-905d-9e87d130f5b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934174, "uuid": "01c77382-1d79-4931-8fa7-41323fbd0be4", "value": "SecuriteInfo.com.BAT.DownLoader.647.27686.9382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fe22fe-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DynamicStealer)", "timestamp": 1692950356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950356, "uuid": "9a65f4f1-8116-44fa-ad2e-d8d76d8d2e99", "comment": "Malware payload (DynamicStealer)", "value": "b5931a67a54c92341ddb47d67c3c967c", "object_relation": "md5", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950356, "uuid": "59fb9c84-5a21-407a-a562-03110052b84d", "comment": "Malware payload (DynamicStealer)", "value": "2976d076565a8739b4da695e29f997a824717364674927a7d2106db9254ac6e6", "object_relation": "sha256", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950356, "uuid": "ab474cd8-863b-401b-af7e-3384e882e3ab", "comment": "Malware payload (DynamicStealer)", "value": "2c141457d423c570ffdb6330f617908a799cc977", "object_relation": "sha1", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950356, "uuid": "23939f7c-2820-4502-a84e-a25b874b137f", "comment": "Malware payload (DynamicStealer)", "value": "e73bd7fd04ee303fd65301b07303452d3e733084372f68684c64bbb15ab05fa486db21d4be7dd11518d9d330d7e2215f", "object_relation": "sha3-384", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950356, "uuid": "8d663935-acd3-4be8-a6cd-b0ca29a269ef", "value": "T13AD401E7FDC28779C307B7B55D018CA3A60C2CFA9CD6E05D1473244AC8A58896BCA7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950356, "uuid": "86f0d37e-5e96-44f7-bd2a-0f2ca38702b4", "value": "12288:WPX5Q1/TbBUjN4tlQpcDg2/7Rz+RPwNivSgSBCRNs38uM2ZsSCdDs6:WPJQlJUh4TrDg2V+KivzwB8uxZvCdDs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950356, "uuid": "122498ca-069b-4ed1-b674-c6006cda4fde", "value": 654979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950356, "uuid": "9cbc9463-f8a6-4f65-99ea-8331d847cdd6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950356, "uuid": "b8b49e69-4c26-42ed-84a8-944280188936", "value": "Upaid Overdue Invoice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263f23d2-433d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692964040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964040, "uuid": "2b68f903-2094-4f4a-851e-bdbd31a194f6", "comment": "Malware payload (AgentTesla)", "value": "9e19789f864bdc23100c80e5505da023", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964040, "uuid": "a0a98558-3a6b-465c-969e-5371abe1cad0", "comment": "Malware payload (AgentTesla)", "value": "2bde8622b7502f80ca27d52bf9e716f969584155ebda768fdc5fdb7e063ded24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964040, "uuid": "3f912062-4d07-48d7-8f75-012bd4acc29e", "comment": "Malware payload (AgentTesla)", "value": "06c940527341122151e37bdfd9e37b5461eefa9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964040, "uuid": "99fef639-c6f6-44f1-a0a3-656d8dc9d0a1", "comment": "Malware payload (AgentTesla)", "value": "bdcacec2c021c76ed7079955ba04e42beed5ef1197e6db94f9e1b6cb5862bd46ad09cc56b8435cce5a61f99c768dc2db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964040, "uuid": "a6b6e67b-47e0-4bfd-ad79-def6baf29288", "value": "T13B459D03B6075DA5C30F5BBAD4AF21040FB9DA51B727E39F3C9E2B91290A3E59581D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964040, "uuid": "a1b25f9b-7ba3-47a0-a5bb-18cacec5412c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964040, "uuid": "c393c603-433f-4163-a0b0-fa9fdc0d7694", "value": "24576:rO/H+DiyYb7GIlRQV0jwNyCgssYriKMU8H1KVTIncYkxXaM+c0:MQfMU8H2Ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964040, "uuid": "838e86c0-4ca2-41ce-a942-0b71c0ec3f56", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964040, "uuid": "d05ae118-ece9-4808-ba27-86a236aa1b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964040, "uuid": "f658d616-c59c-4e69-b823-a7bfd752af33", "value": "SecuriteInfo.com.Win32.CrypterX-gen.13942.7184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95633f97-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934162, "uuid": "52c6375e-a2f4-4e47-9bd7-b43d02d2e038", "comment": "Malware payload", "value": "4583193798e02ff12349ba942a853e18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934162, "uuid": "c9908fbd-fe58-4f78-b855-fadc0e918e4d", "comment": "Malware payload", "value": "2c33ffa2ccde85dc54005f856c241e9f3baed55e51738674447c6de6c91ac2be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934162, "uuid": "7fa8d3e4-a9fd-4c61-96dc-4b00d00bb1aa", "comment": "Malware payload", "value": "4a4e4b5367bd73a57eaf6f713798e76b103a8e01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934162, "uuid": "2c2a4a57-bbc7-4518-8860-e9ab0901db11", "comment": "Malware payload", "value": "2c8c47b0b0954e6461739e93fb01b91a19f57ae92129d362d72cba6fc8370ceccafe87eff6dae442b516a6eccf39fc21", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934162, "uuid": "9b951570-772d-448b-b57f-f8b5c95b68d4", "value": "T1E185AD1276DAC636D96F053465ABD37B15BA7E900BB168DF63C40A3E0DF01C216B2F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934162, "uuid": "0a64bfba-95ee-4a65-abdc-6f85796aa2e8", "value": "990959907d6970814f63a35900324eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934162, "uuid": "0f707e39-12a5-487c-8ff1-849fa89795b4", "value": "49152:h3M6FH02p6RnwqKFBKLfjwP8BlYclrXVVdWTAeker7CUXo:dM6FH02p6RwGYcl8AekeXBXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934162, "uuid": "7cb5bc4c-af48-4160-9a95-90805744be0b", "value": 1707520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934162, "uuid": "6c587a36-142d-4e30-96f4-d9b9f17e1ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934162, "uuid": "72a79a7d-68c4-4eb4-b63b-79c98f045229", "value": "SecuriteInfo.com.BAT.Siggen.197.20870.5381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462a8ff7-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950350, "uuid": "3c01547f-6e33-4359-a8be-17e7dcfb59aa", "comment": "Malware payload (AgentTesla)", "value": "aca0fd54a8846dd69444e2c961098228", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950350, "uuid": "b3777eb0-dc6f-4d44-99af-ec92829ea3ed", "comment": "Malware payload (AgentTesla)", "value": "2ca750e641d81270a9ca70b2c38627e178f734126673480c3de97e7e2fb2966a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950350, "uuid": "d8e72f8b-a4e0-4fcb-89e9-7fbdd5b615e4", "comment": "Malware payload (AgentTesla)", "value": "c4a2e2257e7b9c956d8a52945db7d6ad827fd26b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950350, "uuid": "2c1be7fa-16b9-4a40-b0e2-0afd61c1e46c", "comment": "Malware payload (AgentTesla)", "value": "d6078963a25409824fe6f2be21f41d7f1fb2cbb04dd6be6201080c33c7b4e478228037885a775e48f1664c0ae1336f3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950350, "uuid": "77316636-fd6a-4c80-858e-74f8552e99bf", "value": "T15E45BF5E32F61EB0FD05D939F1D58E61B6975E4426F1AAC66C413C5C1BB0ABC0B0BA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950350, "uuid": "4c1d962c-74f0-4284-a0c1-8f26b4021980", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950350, "uuid": "ffb320b2-51f0-4a90-b681-eca2d3cd1724", "value": "12288:B1wzapwTwIhJU9RIY/ykh1xjLELXVFyFZ6Kf1kats892OVaNUZ9pwVg:B1pwMIhCIZ00FyFhfmatsSkNw7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950350, "uuid": "0e8b69ee-1a3f-49f1-bd7e-44fd695f8e6e", "value": 1255184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950350, "uuid": "815a5c54-020f-45ad-a92a-a664eedcae3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950350, "uuid": "d226f0f7-3a2e-4069-bd35-c56ef9c69c5e", "value": "ORDER LIST_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112e4ef5-435f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692978608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978608, "uuid": "af66e6a8-6225-4cfa-8fe6-37e09ac0d748", "comment": "Malware payload (Mirai)", "value": "de718acf868d06d11012a215494adc4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978608, "uuid": "c9f187dd-e8d5-422b-b1b9-c4443840aabc", "comment": "Malware payload (Mirai)", "value": "3043aef907393007c419d0d786a98a9b25ed454510ef616e7d20074bacbb2251", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978608, "uuid": "0c8c312e-9bf7-49ff-9879-bed52dccc9e1", "comment": "Malware payload (Mirai)", "value": "ce476c022ca08eec2833bee0ee2b6b6c0cc9d0ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978608, "uuid": "0532f40c-1b58-4f6c-8524-c03166f5a30e", "comment": "Malware payload (Mirai)", "value": "e4f31808f3be281875dd709cc59f90d551f6cb8c1a3a2b86580f8a4fcfae0a31cfa20cfc23983c6c8729eb0e79614e14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978608, "uuid": "fcf070c7-54f9-4204-86f0-f32140009106", "value": "T18AA2E01172632D65F3DD1C3CC96AC357F9A71BFC90F6327669411A20C94D24A3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978608, "uuid": "44b6598c-c384-45b1-ab07-61a549e95138", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjEKmhymdGUop5hX:UvQn4j+ZO5fKAlxNms3Uoz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978608, "uuid": "edf1d82e-6312-4e9f-9647-b728e7a12f9f", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978608, "uuid": "23ea4a1b-f518-435f-9230-8163772bf5cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978608, "uuid": "ac440e1a-e3c3-4339-a769-d9aa006faee6", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684f9633-4332-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692959427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959427, "uuid": "887702b5-d5d8-4ab1-b774-41034005e3de", "comment": "Malware payload (Loki)", "value": "cd16526e831c7d9763881815162aa03e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959427, "uuid": "61af08e6-5591-4571-b5ce-0ca64982e9b6", "comment": "Malware payload (Loki)", "value": "33fc6a56478fcc172306018e4de7b96684a5ee5d839afc3d0ae8573072ec92b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959427, "uuid": "db9b1659-bb9d-43a6-9166-3c519b033cda", "comment": "Malware payload (Loki)", "value": "45c0baac4d81875ccfc30e162a2745c05f43e7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959427, "uuid": "a901582b-a7d1-4027-9dbf-2983cf4df3f1", "comment": "Malware payload (Loki)", "value": "caaf2c18b9da3005734474c29310923657fa0853bd7c750f476344c3ac8dce16d5ecbdc4d1a1e2520b3990429d7d0a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959427, "uuid": "4c607b94-865b-4bc7-953d-507eb9835b0b", "value": "T168A49303BB6B8DF5D38B1B32C5DB70104BACD691362BC71F798E23663A037AAA545507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959427, "uuid": "ded25db5-fb03-4847-ac52-294ca11b5810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959427, "uuid": "61cd64cd-c84b-43b5-b076-bc638474b9e0", "value": "12288:g0HxIEfEsJklfmDGJA4SYDEfuR4R9380Q3a/INi:g0RIEf/JkhmDX4qmRSLQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692959427, "uuid": "5f045aa2-3056-4f1a-b992-991a8ebb3bae", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692959427, "uuid": "201f2673-8894-488f-bed4-a90547b8d2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959427, "uuid": "e25f963c-ad1c-4b6f-b50b-4c4da15155fc", "value": "SecuriteInfo.com.Win32.PWSX-gen.13001.9206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad2f0be-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692961927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961927, "uuid": "3cc00c86-a703-4000-afcf-ca18c70013b5", "comment": "Malware payload", "value": "ec41748429a2f554e46b265202bcc1c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961927, "uuid": "9bc6a6b8-8ca1-493b-b1a1-2234b2b4fe42", "comment": "Malware payload", "value": "3544f9eb3348cfd7badd957a0fbcdd4e1e843fbbf0f468f109974baddc7038b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961927, "uuid": "9d3adc49-5d8c-4980-8419-87bb1bd60ec1", "comment": "Malware payload", "value": "6d19c2c3787aad2571e85df043a8d8f0f5866035", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961927, "uuid": "d79e6b5f-671a-4e96-b00c-d517b3dbf948", "comment": "Malware payload", "value": "a3892e290091b5beb32e7360a949cdb6908de162399f7851228467e73a93de75b0ae59240054c2570d764267e1da5886", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961927, "uuid": "4d9be018-d130-4fc9-bfe6-15097d851802", "value": "T1CB64B81065EFA88CB1B33F8317ECB69A4F6FF7A55B2A519D2104430B4B66E44CE98731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961927, "uuid": "881df034-bbf2-4d94-9984-1553016698b0", "value": "6144:fyfyayLkyF6T6T6T6T6TA1yQjzpbFKJJJJJ1yIyQxyL:fyfyayLkyF6T6T6T6T6TA1yNyIyQxyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961927, "uuid": "478d03f7-0d55-4928-98dc-f1de04466c12", "value": 317356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961927, "uuid": "06934a3e-b838-4e1a-9cab-d3b9875cbf11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961927, "uuid": "10e3406b-3498-403f-81af-c068f728df1e", "value": "New Order BSJ007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2789ed41-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692961895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961895, "uuid": "4bab0d76-de95-47de-9b88-cd6a8ef3a8f2", "comment": "Malware payload (SnakeKeylogger)", "value": "8f640a0035e12ea1122856ae2c6e5eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961895, "uuid": "3f9ea53f-c804-4937-9f0c-f5a412a29ca8", "comment": "Malware payload (SnakeKeylogger)", "value": "377113e1a7ba66c25bc72f9bd79e9dd26ecbb6c9128d07f2deed92a1f0803f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961895, "uuid": "9c19835f-1ccf-46bd-9625-02ece2aec8a7", "comment": "Malware payload (SnakeKeylogger)", "value": "bbca60cf2a5395b1ba00171251c114ad1f3736da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961895, "uuid": "39b97cf3-96f9-4ab7-99ab-fe5e97b697d1", "comment": "Malware payload (SnakeKeylogger)", "value": "6c48c52a910d15b84219d34fd8206ebb5d299a6b68bb267d4499cb74e04ac7fb8a719d1542caf95e9e973fbc15cfc8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961895, "uuid": "965f326d-6ef4-4383-8665-16bf7fe9136f", "value": "T13805F10072EC8615E4BEABF646B406180B3776166633E34E8DD418DE6E727C18F1AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961895, "uuid": "9b6dfda0-916a-4bb8-ae52-f4a71949eae3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961895, "uuid": "7e2dd05f-6862-4720-9688-ffe8b92f6cb6", "value": "12288:n8cpVgEe+AapAhPXX1eqOLWNV2YgGg6xIb4dupGOwI7AFQ4Sp:8cPgR3hPnIPLWXI3fqiDvEFSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961895, "uuid": "36a9bca9-80f3-4e71-89bf-233cc4ef8db8", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961895, "uuid": "a46469cc-2740-49a5-9068-68a3cc2f9069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961895, "uuid": "1eb4a17f-3922-44ce-997e-d27c9c8c3fe1", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5154d463-4358-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692975709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975709, "uuid": "bbdf9bbe-48a1-4fcf-b3af-6e4563ff1f9d", "comment": "Malware payload", "value": "ef485efc8a94d9e7fc3bb0379a44f084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975709, "uuid": "bed9b95c-d977-4f5c-a03d-0d5aac761df6", "comment": "Malware payload", "value": "378f4daa6190153fc7f9cac724c04ad425e83918d92cfd3a186bceab66bae343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975709, "uuid": "27cd51ce-ed1e-4c9d-bb2c-fe2c76f95640", "comment": "Malware payload", "value": "6aa85df83a914bf32bd5165cd1299d26f1905dfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975709, "uuid": "34b36924-3d3e-49da-9030-88606abed89c", "comment": "Malware payload", "value": "961a417d56867631eed232fe6d779eaf200a01682a007dc7641db824e1479b1c4cc6ba35f9a017f938d85331755036cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975709, "uuid": "3cba7a07-2086-438e-a73d-5bd4440b2728", "value": "T13FB4BF3963EABB55D6BE87785931010887F8F407E726E39F3FE1209D6CA2B448663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975709, "uuid": "2867731d-3f03-46c1-8f2d-a4ec18c66f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975709, "uuid": "a19413b4-c8bf-44df-89ad-aabc1213c4fb", "value": "12288:2nXB9dO8KsqQnirS0DSngIE0SCAtRnZagLCWh:2R9M8Kj9SJgT0sVZnLCWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692975709, "uuid": "1a120c09-42e1-4862-b561-7d4cf1864998", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692975709, "uuid": "56579204-7cdd-4e39-9bd3-92b4f7cfce66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975709, "uuid": "8f7d78be-bd00-483c-bc50-040cf147ad3e", "value": "PAYMENT BANK INSTRUCTION COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da1fa19-42ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692930552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930552, "uuid": "3c571dd2-3857-40bc-a22c-cb1415f21eac", "comment": "Malware payload (Formbook)", "value": "caad4080fe6a2f033fe257ed1c9fadd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930552, "uuid": "5867e493-bbc5-4d4e-a65a-d2ec59449072", "comment": "Malware payload (Formbook)", "value": "37ae2eea990aef5c0e85a2d5deed27fe59347f310129c5387992ed21790fa7fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930552, "uuid": "a1aaf487-c910-4b23-b80a-fc8347619b88", "comment": "Malware payload (Formbook)", "value": "e8b9ceaaeeaae1cd85c90381a4a137ef86676333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930552, "uuid": "3cd2fe6d-a3a3-4c0b-86e3-1fcb3906b95b", "comment": "Malware payload (Formbook)", "value": "a65de53fd5e886696b37384fc69e3238ea33f421a9b6e9b36a002985a835b84012d1946f3d92a23ebb1868667e4ada0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930552, "uuid": "e28de815-ec0d-42f5-a4fa-6efb6a8fb86f", "value": "T165F412054ABD8A78C27DE3F139E189443FB22A1F9074DF591B9A349B367236402C776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930552, "uuid": "08887b61-fe93-4b35-a460-12a25d2047ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930552, "uuid": "7d48ea51-c05d-4704-a3d1-b8858d27df8b", "value": "12288:HvjojIkCkhQRbg7oo/Y26AZgEwvdnZfja2Ia+aocKGfW3ST:HvRkjhQRbTo/YKjYj+2IrnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692930552, "uuid": "0bc2f18a-5551-4788-bace-25f76c4a7572", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692930552, "uuid": "8de137cc-2cbb-44ae-8ce6-cc15db3fe512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930552, "uuid": "d6ed2fab-36d0-48a8-b174-871138e2582f", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.JMU.gen.Eldorado.3629.4949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2d6b56-43a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1693007728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007728, "uuid": "a738c223-cc0d-4c6f-8b45-48e470bfa376", "comment": "Malware payload (CobaltStrike)", "value": "190443cbf65c0898f914fc760934caea", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007728, "uuid": "b7239e33-5807-43f8-aa29-8c3e9974f512", "comment": "Malware payload (CobaltStrike)", "value": "3922b22af71946fc376884c6bd78cb725e903456a3e5481819b55312c745367f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007728, "uuid": "a4888ea6-12e3-4a92-8a1f-6e091b09f8cc", "comment": "Malware payload (CobaltStrike)", "value": "2038226438b0d02d675bde2253866329c69af1e6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007728, "uuid": "7bc691b6-563e-41e3-b843-020e62aa1407", "comment": "Malware payload (CobaltStrike)", "value": "8cb2080192fc60481dd4c0c19fb9331e5b90ced2fcb040ca27d5896ff91123a9502a4a4678fc6269a261d65207680a6c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007728, "uuid": "bf7e8bd1-4b4c-4351-a073-6a1acd1fe60b", "value": "T143B4BEF0B40E9B6BCDD1DEF69C963354E0FE17C5760ACB23842413D6962A89A51B3837", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007728, "uuid": "12be9814-236f-4bd4-af03-adb1af25d2b3", "value": "f3fdd2fad38061d0ad3658e2a88734f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007728, "uuid": "46165445-5cc6-4017-ad15-533d3f028d12", "value": "6144:EdmZWccb2kii5Z44P/fBlqjQJWYgARXIQ6BDDm5nYh6i74H:qmYHfia44PvqIdPXJ6BfInxi7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693007728, "uuid": "9136c639-280d-4520-be61-7908a003bb86", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693007728, "uuid": "2b809d3c-f977-4375-98e2-96255ab3bf28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007728, "uuid": "41a8ba8e-be0b-4f6b-bf6b-40ca5c1718f2", "value": "190443cbf65c0898f914fc760934caea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bfdc27-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950348, "uuid": "655d9712-5458-4b13-9ad2-64eada9ee92b", "comment": "Malware payload (AgentTesla)", "value": "8c9704d419ca9a5a7f3fb7388bcaf61e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950348, "uuid": "36e6ca37-de05-4992-991a-c0aae4dfba26", "comment": "Malware payload (AgentTesla)", "value": "39332270e15778b5c51e1c2339d67f9d7572d54fe92b53636b39bbbc73f73830", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950348, "uuid": "0bd5a9c7-05da-4dfd-ba16-ac47ae9c406d", "comment": "Malware payload (AgentTesla)", "value": "9c99d0f178615463ebaedcf4d032d6ae06b3ebb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950348, "uuid": "f8fc289d-a509-4c70-b8c5-49da36799131", "comment": "Malware payload (AgentTesla)", "value": "4ca9a361785865a2c892dd69a3ecbfd93c236ead94d8895daa3048c1fd64c93f948ab43b9d30713d62e3cdd3afce8580", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950348, "uuid": "adc3d670-60d7-43df-a5a6-2448dad7332d", "value": "T1A8C4F113BB06EF3ED53A93FA3C6591104BA3DE4EA950E3151D8A71E56C767038438E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950348, "uuid": "7dca20ff-3b21-4325-abb2-41855c223746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950348, "uuid": "fff65fed-c554-48f7-9332-302b207ec46f", "value": "12288:OWb6DNdh8Z72d1mbTYaMjumpQ5rFDr/gS2jdSJ2e+E5jpediqOh8u:/hZzjxrlrp0dze+MjEiqU8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950348, "uuid": "6c8f572a-beaa-493d-b877-c1b36108b806", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950348, "uuid": "ceb4409c-f5fd-4156-b1a8-f6021108ede8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950348, "uuid": "71b0092d-095d-47d2-b060-b7076a769c7c", "value": "Booking SO_\u52a0\u62ff\u5927\u591a\u502b\u591a_0830_\u842c\u904b.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedcb9dc-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692965182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965182, "uuid": "97c0cd0c-45f0-4682-89f2-926fd2d22e15", "comment": "Malware payload (Formbook)", "value": "c8f21652ef65f96245689ba30534558f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965182, "uuid": "6dfb41fa-4872-4dbe-87d5-4fac4893b260", "comment": "Malware payload (Formbook)", "value": "3e10798328d85925f056603ec4f7cb11cbf929f4dd053707d2327859bbea00fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965182, "uuid": "28789087-77f6-423d-a2fb-0ec39c06b379", "comment": "Malware payload (Formbook)", "value": "6fcfce27b4b6e1118e9aff3c8596912d07cea40b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965182, "uuid": "9980f966-3074-42a8-9273-aae7978e3423", "comment": "Malware payload (Formbook)", "value": "cd84f04a19d47625948bd4e3e1b2c223b74b1fb79115aeafb448351f20254381419f6b4f48a2e6d8fc15488117f2c431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965182, "uuid": "f38fad1b-0f2b-4f31-8c16-3baf3aff4b96", "value": "T183D4126D62FE4358CE6F5A7110B7522947F4352B3422EF1C8F5E78E92E217C24608BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965182, "uuid": "737a0e3f-056e-4940-b606-6939e9b06078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965182, "uuid": "145d6f71-f36e-4f5e-833e-fe25c374c25f", "value": "12288:rYjIkCZsc3/GfS7EKqlyUe1UBzJeXNYYjGfhxGDANVLjg:hkZkGSEyAzJe9YeGbGDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965182, "uuid": "48117d52-5d11-4985-934d-4420207ca225", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965182, "uuid": "afef89af-42be-4705-b4ae-c62d63f9d2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965182, "uuid": "b37407d5-2ee8-4724-8a8b-f74f3ad93ecb", "value": "c8f21652ef65f96245689ba30534558f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fe52a0-4364-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692981141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981141, "uuid": "15fcf643-a152-4fc1-adb4-fc733567b13e", "comment": "Malware payload (Mirai)", "value": "b12f06365beb9c71d44d1401ac252607", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981141, "uuid": "397a6a43-87b9-4a93-88ed-467e7a98b5c1", "comment": "Malware payload (Mirai)", "value": "3e4e2abcb85b55b0e6e7a493f127337565e192f98ac8a2df26ff9141c8a9a039", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981141, "uuid": "9162a4ee-f245-48e6-bbee-98a67690df7e", "comment": "Malware payload (Mirai)", "value": "d4dead1150e5977c3940e141475366dc3edb314c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981141, "uuid": "99072dd2-cf1e-4fc6-8c45-a51290e7b7f7", "comment": "Malware payload (Mirai)", "value": "260cea95c43ab76c406e8a98df8190291a11ebe8260885089694fac8facbfae8eb8de7f31a4f124d546c56080c5c5665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981141, "uuid": "41ffcfae-277f-4987-ab9a-844bb9e6e339", "value": "T1DDC2D0E07726EA31C420AC3DE53A4D863A51063C91FE393664259D398EC165A67F48B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981141, "uuid": "d8fed9b0-846c-46ba-887b-c7b6b532e0b9", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrZh9q3UELuD:OKy4qfqoeJdXWgZULa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692981141, "uuid": "7da63918-5d1d-48e2-9c36-e1c44e240128", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692981141, "uuid": "4131289b-e74d-43c9-bf57-cd57824fac8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981141, "uuid": "843e1862-1cc9-4253-b772-9273bf2372e4", "value": "b12f06365beb9c71d44d1401ac252607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be2bdb1-4322-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692952507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952507, "uuid": "92402956-e164-4401-bd9b-f09a2d4bcb38", "comment": "Malware payload (DCRat)", "value": "5e62f24d4b0dfafb3c781685cc56ee8b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952507, "uuid": "500b54ea-a598-402a-bff1-7cb743ad2c08", "comment": "Malware payload (DCRat)", "value": "3e4ec67d069b0fec4c6ca4dfd712a86d622fffe7220e39524cf31ce9400fda51", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952507, "uuid": "12a5e877-de03-40d9-9394-ea97778921bd", "comment": "Malware payload (DCRat)", "value": "ea397d7f0c460770b3b62be9613220209b4b9d8b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952507, "uuid": "428611ec-4da2-4e9b-beeb-66a8e2a10428", "comment": "Malware payload (DCRat)", "value": "81ac8d8c46658750d7ce684179c5c06dcfed5ef8032bdf8efd7f1a19a2b44b4c2acefe2ab4ad7478059d563b1c26c373", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952507, "uuid": "2d27ff51-fee5-4128-90c8-392db91e76c1", "value": "T1EB859E01BE45CE11F0891633D3EF46484BB098516AA6E72B7DBA37BD16123A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952507, "uuid": "a18e37e0-8afc-49b1-a586-c1e0e9ff1a1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952507, "uuid": "99ae3b6d-a702-4339-9767-cf0404bfe305", "value": "24576:1OOffZBKqMzmSzDguZhMFHv+Pc6dO/t+NPdiVkJO96aQK2KklcQR4e:17BymXIKFPQd8t+/iVkVK2Kec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692952507, "uuid": "5300dcf6-5c0a-4baf-8421-2bc53c15f674", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692952507, "uuid": "5d05d639-3dc8-41f8-b737-f1ee1add504a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952507, "uuid": "a499c06f-c8ca-4a6e-bbe2-edfea943c339", "value": "5e62f24d4b0dfafb3c781685cc56ee8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6359a6fd-42e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Quakbot)", "timestamp": 1692925918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692925918, "uuid": "37302913-e420-45ba-ba68-ae8b8fc11fb2", "comment": "Malware payload (Quakbot)", "value": "48352eb8d435647c653d104d195ada3e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692925918, "uuid": "24a5dc73-70ae-48e6-893c-9f0c133e7050", "comment": "Malware payload (Quakbot)", "value": "3f004293165057ac40d7d2dc663cc62c877ebe29601251dcca24b6aa1062b7af", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692925918, "uuid": "49e52c49-9da8-4144-be29-55e013ce3848", "comment": "Malware payload (Quakbot)", "value": "7d82f8242a7317e7bc01244a43ce46288f4e2941", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692925918, "uuid": "f9d8d64b-9eb0-4c16-af9e-3933a92ce3a2", "comment": "Malware payload (Quakbot)", "value": "abddcff004d8386b75603c5ef52a3f606ed73b417303b803cb8dfcf57425f01afbfda8400bbf274680a3c42cffcc6626", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692925918, "uuid": "e8298ea9-ec07-40cc-8315-a25088aecfaa", "value": "T13E63025BCFD94FD1D3594572A791B32269001D2164E5BE32C448BA98A02A4CEECFBFD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692925918, "uuid": "62764340-f534-4214-a316-483b472ccea1", "value": "1536:U6yAAVMwQzPOPBbhDIi9efm6RbP1444aQl/6GZByb/:U6zFwQzPuhDI++m6Rj144bQl/6GTyb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692925918, "uuid": "36e9e1b1-396d-48da-9c66-7937ff61343b", "value": 72472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692925918, "uuid": "a542b5e2-73c7-486a-bf11-2c11025e5889", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692925918, "uuid": "3b58c961-cd85-444f-9070-5b475b5004a6", "value": "Qak_02CF0000.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae88f13-436a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692983537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983537, "uuid": "081e6a8e-5c56-46c7-91a6-07519bfd60b6", "comment": "Malware payload", "value": "fd0315163b652a15384a1535708cd6c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983537, "uuid": "5d870522-f625-487f-a63b-a64835c6d71a", "comment": "Malware payload", "value": "3f52cf31c78488f9308c0117fbea8bfe1b5f81e988f00c827339079c4e475637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983537, "uuid": "5cdb32f9-6874-45d9-bebf-38c4049dc987", "comment": "Malware payload", "value": "ae689d329d3749b3b42663ee8b01c30a518412e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983537, "uuid": "1eeae010-c157-4714-8f88-6dec863f3039", "comment": "Malware payload", "value": "26bcf49f8c90d62f1ded64aa93017fca1093574e0a2ff315a498087d676f59404347c403630c497ae47ad1e1954094c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983537, "uuid": "5e25fbd2-2caf-40b5-8bca-78d457bd2da9", "value": "T1AB651242BEC1D9B2C4721D3206655B21A97CBE215F75CEDBA3C8666CCE324C0DB317A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983537, "uuid": "7d44d6ec-a7a9-4a03-bcda-d7bf136c484f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983537, "uuid": "d0b9b485-2ce5-47a5-bf44-fe990b42e77d", "value": "24576:2TbBv5rUyXV40fZ9qbE/V3O6Y12Rdg3c7qg/yFQtl/EqmCk/:IBJVTqbS3O6YERC3cemlsbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692983537, "uuid": "4eaaa520-713d-4b2b-8953-64de1dbbd900", "value": 1536297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692983537, "uuid": "6efe4d36-be30-40f8-9a11-a657f5175c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983537, "uuid": "5f0db57a-d294-475f-a4f8-1cbb49b38a55", "value": "rumba8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553c89a4-4311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692945221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945221, "uuid": "b9e01a5f-2905-43a3-adbd-d8ebda079cb4", "comment": "Malware payload (AgentTesla)", "value": "d0a01651d09ce518498d372446e1b963", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945221, "uuid": "6231ffe7-773b-4041-adde-d52cec271351", "comment": "Malware payload (AgentTesla)", "value": "43dcf51a9c64834f8f5e50054eaa5042f90db1c486cc5670956f612c3931522e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945221, "uuid": "c3a7edb6-b213-4682-822e-08ab0c8faaad", "comment": "Malware payload (AgentTesla)", "value": "7bbe733c205d2a76144251b36041d21f75ad3b8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945221, "uuid": "c7d229dd-bb68-4528-a93e-1873df90fc83", "comment": "Malware payload (AgentTesla)", "value": "fdca1ca4b728019ac84f637d0d14b8ebe9fa6bdb995f68cb202bea09581a5427d391e95c3c6ef927f9aa97786b5912d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945221, "uuid": "10b4ca1e-0429-4d8a-b23f-eb0bed897c97", "value": "T1E30512146BBD8A3DC47ED3F135A086097EBA580B8035EE7A4B8534DB343166805D3B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945221, "uuid": "ba619196-2d84-4c5a-bd78-3c69eddd0c10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945221, "uuid": "492baf1b-7cb5-4b4a-87f6-de40e1444dd4", "value": "12288:/2jojIkCd2VcUvWRNU0bKouf5bpHD8GiA9fulNKxVSAA8jNpT2nMBkY:/2RkpVcUwNluouf51oA9fulQxNt20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692945221, "uuid": "146f91fa-7dbe-49c9-b165-f2fcc4e62611", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692945221, "uuid": "dcecc1eb-d3b8-4e2d-87d2-cd89f47b9cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945221, "uuid": "c938e9ad-ad18-4a5e-95a0-a8d404d30a8d", "value": "SecuriteInfo.com.Win32.PWSX-gen.28169.27913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936077e9-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934159, "uuid": "0da25585-4cbe-4177-bf04-fab8a3330a8b", "comment": "Malware payload", "value": "44e47855d495b729a0651945d9a63c98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934159, "uuid": "5d25b9c0-9adb-4fcc-bf16-8e4967b0c4e4", "comment": "Malware payload", "value": "43f6b1f2fd5c9ce480deac354b61ac4fb3852f6be103503314e5f8c46ccdce5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934159, "uuid": "c4e56a46-9ccd-4657-9aeb-9ba32e871c41", "comment": "Malware payload", "value": "382ba36416151521648ce8e7faaff8f17182727d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934159, "uuid": "d4d7c421-4f0d-4f95-a0ed-8fcd0ba56a42", "comment": "Malware payload", "value": "e1978de377079af77fa33608f6e2a6db43ee5ee4fb619d80d719143ef999256c79c66cb0045d3467744167dbd667fb8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934159, "uuid": "797bdc36-22cc-4c44-825e-eef1b848ed6c", "value": "T18AA49D1176D6C836E5BE06B03A2DD39B0069BD7447F284FF23C84A1E1EB25C15636EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934159, "uuid": "91c4d307-063c-4ba7-bf18-f83696d128de", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934159, "uuid": "b665a0ed-bf22-4e5f-a2d3-daa9e1ee16ad", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHA+A8:yBqnGIQ5M6DLrVVdWHA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934159, "uuid": "0a5af4bd-89d9-45da-ba32-037c466ba0f1", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934159, "uuid": "174f7e74-d204-4a45-b6fd-93a6abec8c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934159, "uuid": "20cbb566-967f-4e14-815f-2690d5ed4fa2", "value": "SecuriteInfo.com.BV.Obfuscated-O.28644.13294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd60504-4335-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692960617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960617, "uuid": "0a27827b-cd17-4b4c-beea-cf9d52cb2e23", "comment": "Malware payload (NetSupport)", "value": "649b0900a405b0b8acbe0014635217ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960617, "uuid": "839ca19e-ef32-4f7f-b51a-75449c9de353", "comment": "Malware payload (NetSupport)", "value": "440bd28a243962febc04beae9f1a0a315a3d21a5eb9f460d21ffff7856337b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960617, "uuid": "da057258-9867-4b61-aeca-929d933b048a", "comment": "Malware payload (NetSupport)", "value": "8799fa4fe503c5362fd5ee7e26689654b3aab71f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960617, "uuid": "3436d60e-4d9a-45b3-9786-c94188db6b6e", "comment": "Malware payload (NetSupport)", "value": "6a24dab65febf4a6b139a83653b4a59e2830f5ed22cf4c5edd066997307579fb9f110e51cb430382d2ae7b7ca243ce46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960617, "uuid": "4151b342-2985-4b2d-9a85-d95485e895fc", "value": "T19924D03276E0D072C19B51315830DBA26B6EB8725771958B3BA407BE5F707E2A33631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960617, "uuid": "8ca8a3a7-a60d-4523-b496-a3a6103066bb", "value": "7a075be7d11d8415d65b04ccf7d4602a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960617, "uuid": "c0ded772-3d30-45f7-9692-f16d2748141a", "value": "3072:uOBl15FLVEkKy2J2RrYGtp2tXfjHacHhxfASU3cg+CrTE5lRJlb3A66GHg:uuLVBKyKKrYe2tTLfvgHrgjblD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692960617, "uuid": "28503ef6-6b7a-4b8f-826c-96f87cea31bb", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692960617, "uuid": "825df699-1ffa-4430-9f83-9a1b8918c896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960617, "uuid": "c5921333-0bfa-4732-9065-f0f1593017bd", "value": "649b0900a405b0b8acbe0014635217ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f474427-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1692964941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964941, "uuid": "236a85b7-6cdb-4459-babe-46d9b9c4fc58", "comment": "Malware payload (MarsStealer)", "value": "c757b2a26b5de65ae11d70bdc98439b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964941, "uuid": "c86e3389-e84e-434e-8fca-9c974211058b", "comment": "Malware payload (MarsStealer)", "value": "480afef1f95b2130b1dfceafb7f5639d962c9957e003863dc30f6f7ed40ee79d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964941, "uuid": "c24addd6-91c6-4df9-aeea-6859f03af341", "comment": "Malware payload (MarsStealer)", "value": "54c9fcae3ac63003fababd6e6bf847f5a877ae09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964941, "uuid": "6abc7e08-fda0-4a74-9fa3-1a1acd68f7cb", "comment": "Malware payload (MarsStealer)", "value": "97330be2e96df19819a825aa200a82b89de417f70de6be54be6f7dd3e9b23b4e399a4c6b6e9e140c1161f8885eae9ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964941, "uuid": "cc000752-a299-4520-886c-899101edf751", "value": "T1ED44BE127682D471F886C0F09834C6F7297EB8729695894F37683F2B3D73391A6762D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964941, "uuid": "5d329d08-7341-47ea-948f-a4faa53d15af", "value": "d486cf0d009e476ba5dbcd1e658bee6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964941, "uuid": "d531b1a1-804d-4d08-8693-48531a5d6b8d", "value": "6144:MMpTULJ6bxrM//czTECaTnkpadmTaRrN:MMpTU16FrM3cHbaTnsFa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964941, "uuid": "1b139c8f-294f-469a-b804-a25da7d945a8", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964941, "uuid": "fec3d0d6-bf5b-49f5-a641-4674cb63a719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964941, "uuid": "f4955183-4a73-4e29-8963-126437baf586", "value": "c757b2a26b5de65ae11d70bdc98439b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2efa61-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692961905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961905, "uuid": "24db70ac-d66a-4b92-bb4b-145ab97bc9bf", "comment": "Malware payload", "value": "843d1c74272e13b2d539e9e55e311b74", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961905, "uuid": "87fe96ae-8801-4c73-a6e6-95c10b76c625", "comment": "Malware payload", "value": "4a756373b379bbb33dcf1d48d050ea370440b2390f2bfd4d20ae3e8ab46ca2f2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961905, "uuid": "b8113f53-27df-49d8-91b6-34a475f88ea1", "comment": "Malware payload", "value": "25cb0dc6dcd6b348cee2bf11b10d8d1347507c7c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961905, "uuid": "e5893b52-e21b-4913-8b45-3a6ba39c1e33", "comment": "Malware payload", "value": "d84de5e0e1b87f6ae30e584b7a819c926b15e593ba6a75237bb852df301ca0ea44ed8652c2b9595586f1a4fe93392b39", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961905, "uuid": "934fe5f2-437f-4ada-891c-ab48b6990210", "value": "T10085F103A900C787D42D87F86E5309E80E4E7F19E9A9A9DF24573F9F3E32662195E10D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961905, "uuid": "7ed1772b-a36b-4bad-9870-e92ced3e72c5", "value": "24576:yr+Zy/w6VjW3TZyow6VvF6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXyWn/jWe1rF:yrov6VaU6Vt6MLr8sfAwbTNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961905, "uuid": "5e57fb71-cd87-442f-8019-606bf6dfca86", "value": 1704448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961905, "uuid": "252569eb-6e3d-449e-879f-19bd5b5d30ae", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961905, "uuid": "63f7e9b0-61c9-4de7-a637-882c945a6ea4", "value": "Vertex_PO3760987.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f98c0e6-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950285, "uuid": "5d83e28e-59ce-4336-b736-b1f94f1e0016", "comment": "Malware payload (AgentTesla)", "value": "4e3d15db64143fe6eba7e50fa79fdd18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950285, "uuid": "25031782-1e2b-4b76-a004-bd6b85b98586", "comment": "Malware payload (AgentTesla)", "value": "4aa299b1b706416d966cec8f9207e9c0af6e2fa040ade447d74091aa6a814304", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950285, "uuid": "d4501b83-f3d0-433f-bbc2-61195b97c718", "comment": "Malware payload (AgentTesla)", "value": "a58b40a1273fd3fb5d2f1cc6e634a4ec4ec022c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950285, "uuid": "e3221ede-426a-40da-a916-ecca86e4faa4", "comment": "Malware payload (AgentTesla)", "value": "3772625a191e09a4a60ac03e8a5e209e253de8c422f0c3becc281b8e155d0ffdebe1e4b7eca1d7dca6c70c8ab5018962", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950285, "uuid": "3ea41437-8a25-44eb-a6e8-5207c2695841", "value": "T181658C26B63556A1C690DB32C5C6840283538EF46BE3C55B298D33C91A3B7BE6F0764F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950285, "uuid": "d046695b-968e-4ea8-bbfa-504de493930e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950285, "uuid": "2742a3a9-d718-4d4a-accc-be7f682e2b9f", "value": "24576:a34TManOtjYviO3aLTCElnZciJ5PPLz4iQiTFAg2Gcr0V07aa44v:OTXzPPv8iTN29zaPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950285, "uuid": "b5e4efd9-99fe-4e42-8496-8fb72c606b32", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950285, "uuid": "385fd48a-e1f8-438c-a646-79ddf771a75e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950285, "uuid": "779ef60d-2ec9-4aac-a6a2-f5b6d0fd4e03", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ffd3d2-43a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1693007126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007126, "uuid": "518c67b6-6664-4537-a171-c382c97472e6", "comment": "Malware payload (Gh0stRAT)", "value": "3129bad1394c01868255e3807a44ce0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007126, "uuid": "00219969-463d-442a-8702-e9fc4c715fbe", "comment": "Malware payload (Gh0stRAT)", "value": "4ac456e94337582de97dde447f973213443fd1e9d6b9c3f7dc6c571800ab9d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007126, "uuid": "e426c56f-7659-422d-ba12-a2c5bb2157ef", "comment": "Malware payload (Gh0stRAT)", "value": "29778ee2622456adf1773d6038b659f05a431788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693007126, "uuid": "3f9ab550-7e22-4023-adc0-a0c9ddced34c", "comment": "Malware payload (Gh0stRAT)", "value": "989a6b56655f45a6f7ac1b6a4355d33690089a62d74a2acfd800e7ba039b6a5ef47a5c145b14e3f498553a64a9d6e107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007126, "uuid": "0ffe4b6b-1c2d-4192-942b-3ad5263cb471", "value": "T1C614F10D6E934117D9848AB0C2E00ED90BFCEC47399275AFFF609856196409DA5FC9FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007126, "uuid": "9b4ed8e0-8453-4c9a-b6ec-bd5eb1866bd2", "value": "ef39d474ee88b9215814d74ee695b02b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007126, "uuid": "d0639278-29e5-454a-bdc4-edb49e945093", "value": "3072:V8B9tMfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIRu:V6M96wgvRHCzOYtqlGyzcsX3KA0LQIQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693007126, "uuid": "8b6e3cbd-0541-43d6-837c-a1a5354bcd03", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693007126, "uuid": "33988889-40b5-4461-9e23-1c0343392591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693007126, "uuid": "2ac734bb-8b4c-47c2-9d13-6224f18c92a8", "value": "3129bad1394c01868255e3807a44ce0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177a10cb-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950272, "uuid": "5297889b-e435-44e1-8153-924d8a4cdf5f", "comment": "Malware payload (AgentTesla)", "value": "f383adacdac479322a5c37c90edf8162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950272, "uuid": "5aea6b01-3ecc-4700-8164-45143284bbc4", "comment": "Malware payload (AgentTesla)", "value": "4de715cc8efe759c913068845833cf69bc46e3ab96ce6ee9a005468638b4415a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950272, "uuid": "0e751b0f-3512-404c-8786-a69dc4474b49", "comment": "Malware payload (AgentTesla)", "value": "d3bf7075832e55aabe76f5256d58bb45f18f9704", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950272, "uuid": "fcbc8acc-3b6e-4567-915b-d85a5b8d6480", "comment": "Malware payload (AgentTesla)", "value": "a4ea14e43ace60265b624d5c28c8650ce4ef811bb7531c733b3b4c7b977f3bd0e3a025a2611865f0a26d627841620f03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950272, "uuid": "d12de1a8-f962-420e-962d-0e50e661e752", "value": "T170D423C02DAF4CCBF7AE58536788B1E847925E5FA013233C6531EA4A9D8B58D9714F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950272, "uuid": "abe79daf-36dc-4303-b51e-c2d3962d5843", "value": "12288:EEnW3raLk/10xzHtsYpjRLh4Oj0zkRaFwGy5OQPF5EGfeKLRh:NZXFOYpjh+I0gR/MQP3Jfeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950272, "uuid": "fe1da670-8d06-4940-9766-1d857deb413f", "value": 614057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950272, "uuid": "6644453f-fc0e-4677-b19c-48deb2bbdf89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950272, "uuid": "ce0d1971-7e01-4867-8ed4-a5cf0a1c682d", "value": "Air.ship5674389.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2560fb-438b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692997526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997526, "uuid": "07d40067-7903-4319-8516-61e9cd94a0fa", "comment": "Malware payload (RedLineStealer)", "value": "005c22fac9c769906f4b87e0438abfc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997526, "uuid": "23464141-2a7c-4984-9795-0693a08cfe75", "comment": "Malware payload (RedLineStealer)", "value": "4df0f56f1d35031185dc8e5431d2ec804bdc37f70ea1bebed20b4a9e903dc535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997526, "uuid": "e5f2a131-52d7-472a-a0b9-9d0720ff06fb", "comment": "Malware payload (RedLineStealer)", "value": "7e97fc8440e6f6fc64081309e354ea51c1a6a42c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997526, "uuid": "fa855331-4305-41e6-8b63-9bcbf8f20547", "comment": "Malware payload (RedLineStealer)", "value": "3b391a86a390252d25e3a8b201a954978248123274ecec84d3618b8e32f2176780934994d8d3859c2abe753a37a4d3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997526, "uuid": "9b8bc399-b81a-4fe5-91fb-5cf800f0d561", "value": "T1E7A35D30679C9F19EAFD1B75B472012043F0E08A9091FB4A4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997526, "uuid": "bf0acf01-dcac-4239-bfbf-627b6e6b2370", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997526, "uuid": "18573893-415a-4228-8d50-1477db2d9962", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed263tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692997526, "uuid": "e02e2427-25d3-40da-8f71-47a6c159db95", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692997526, "uuid": "4bf6eb59-9615-46f0-a698-01e978c6cda7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997526, "uuid": "d5ae511e-e47d-4600-a4f7-189eb2f61ba7", "value": "005c22fac9c769906f4b87e0438abfc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41ac489-4350-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692972466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692972466, "uuid": "751ea68a-a02d-47d8-8638-3c87d1b3246a", "comment": "Malware payload (Mirai)", "value": "09e321ddadb6079222059d3842a29fb2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692972466, "uuid": "99d6a218-f2a7-441d-aa2d-3a8c660584c1", "comment": "Malware payload (Mirai)", "value": "4e41b6aa33b981cc188813374b48d0dd1f0d37a0f10cbd5e4e14d3469d90420a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692972466, "uuid": "e96d5862-ce6c-45f5-8ef0-20d158f35f91", "comment": "Malware payload (Mirai)", "value": "46f87ed43262a6bb3b90b691cf2340491186794d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692972466, "uuid": "daf46523-1fc9-4845-b9e8-99b2822e2ae4", "comment": "Malware payload (Mirai)", "value": "be354804c0d05a05dcfe4695e3db51141a286a8ad3f0e00fa9875f17d5d6e620d89fa953e662d137153b1898920f4066", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692972466, "uuid": "b0ba3f62-f840-4bfa-acaf-e1113913bf58", "value": "T18FB34B02B8C0C8FDC4C9D0784AAFB17AD871F86D5275B26727C8EF163D4DE205A6EA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692972466, "uuid": "f5f31e48-b62e-4f5f-8784-5b69633e4338", "value": "3072:g3vedrIx89z5nZ0ZBYcsEJViWwB//O7yuatXfk:AvedrIxuIbJkWByuatXfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692972466, "uuid": "8fbda3d4-cbbb-426f-9dd8-c4b6f391c2cf", "value": 115080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692972466, "uuid": "3b6e4360-9de6-485a-b977-432270444db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692972466, "uuid": "b40d0c3c-b59c-4bff-a61a-dc455d79c56e", "value": "09e321ddadb6079222059d3842a29fb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bd2090-4355-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692974446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974446, "uuid": "c1112ccd-6b20-4ee3-a277-34e5391ee2a6", "comment": "Malware payload", "value": "73463b956f8a1a141c91a74819b46d63", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974446, "uuid": "7d0c238d-8c7d-4648-9d35-c290736d3937", "comment": "Malware payload", "value": "4ebc096e18c81b61cf1f79da44ee1e3d3b2719e0b2aaba1c2d4af986c5227289", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974446, "uuid": "abfa22ba-d731-4997-aaf2-8a7ea00b2cc1", "comment": "Malware payload", "value": "61a1c1a583cc2627abeb20159c78a37d733a3784", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974446, "uuid": "472066fb-8fdc-4212-affc-cd9309c2b08d", "comment": "Malware payload", "value": "db8dfa967f7db4e6178a113da065d543b535e8663c22fe313dca504ce43c17900f363e58994f9d68b5a8270a7177e4c6", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974446, "uuid": "fcb04b7f-d434-4e9a-8223-cae104889570", "value": "T18C45DC34397A7C2043DBDA0334F14BA65CD9568FD5703A3B199AD423AA742C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974446, "uuid": "fe41030c-a78a-41a9-a65c-f80522751c3c", "value": "1536:HrdVZZdp9Sb3bgE7p+9wGhbHSCQKJdsrBNDwIm+lIWFCxZA+rnMXAJm/VV6HBOIo:HrrRp9SbZN+9wWbH/9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692974446, "uuid": "61a3af7a-f4aa-4908-b000-06e0f4f3c3fd", "value": 1172585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692974446, "uuid": "f9d8b3df-1a24-4cac-a8af-e7dd07c5ccf3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974446, "uuid": "395e5038-5795-4102-bc72-9495cbfa3a69", "value": "uhasdiusaosnvkfdjvnefnvipss.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af8f7b7-432e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692957606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957606, "uuid": "fe618e5e-68ea-443f-ba43-98d529c76401", "comment": "Malware payload (Mirai)", "value": "99dcfd8f1c8240289fdc3c505c3e5e32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957606, "uuid": "8accb271-4f4a-484f-a365-6c5e88194bfb", "comment": "Malware payload (Mirai)", "value": "5088a5f68e7e91e1c5b22bc17d3075dcf38fe3c49e8f7ff938272a4ee5f02f44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957606, "uuid": "70249070-1303-4e44-8080-c6a1b7803722", "comment": "Malware payload (Mirai)", "value": "e3f38fe24fb07097c7bfe8499dc7bca005e0009e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957606, "uuid": "5a808a5c-35d0-4fc5-80f3-1de0e433d00c", "comment": "Malware payload (Mirai)", "value": "95756dd2a2f6d36e4e04f75f2db3252019d52697e84d482de2780848040da1b03803694483f880df5722dad06d0da413", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957606, "uuid": "28e625e4-2275-4200-a8cf-bf017a34c4ed", "value": "T1E1E33B56EB408B03C4D62776BAAF42453323AB54D3DB73069918AFF43F86B9E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957606, "uuid": "dc940a91-a5ab-41aa-a5e4-9dab8d00cb0c", "value": "3072:jHi0YdxraNGgu6+zdOvTfdEJbAiueiiM/9hwDf:zqraNGgu6iO5eAiuefM/9hOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692957606, "uuid": "04cfd263-6ed3-45e7-8c79-cd8ed77af246", "value": 143300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692957606, "uuid": "76852880-b5a7-4955-a5c1-0427585881a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957606, "uuid": "b6d31d29-086d-4ce3-b3a6-b6ebc26f9574", "value": "gucciarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b0f8a9-433d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692964036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964036, "uuid": "c3e134d2-73eb-4c37-948b-987861b5de4a", "comment": "Malware payload (AgentTesla)", "value": "54417bef7d39258beab8693c9b9a036d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964036, "uuid": "7c52c0fa-bb4a-4ff6-9bfa-a6963036593f", "comment": "Malware payload (AgentTesla)", "value": "51facce8035a547ae04ce3a005709418d6460bc49ca5dda71e8f32cc5ca2e137", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964036, "uuid": "cfdd5e8d-9d50-4f9b-9c6f-fe89a292ab39", "comment": "Malware payload (AgentTesla)", "value": "959e2cdc8d06409e11be1920c4b283a117aadcdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964036, "uuid": "a2648ea3-b2dc-4d73-8631-6b0e1605f4b8", "comment": "Malware payload (AgentTesla)", "value": "a353e428ba612d418ec140f354b340b9d62203fda8ead8577ad6e19243314a5f868ae40e0c01b574618a8c7e1f94c88b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964036, "uuid": "1b0d8135-006b-425d-a24d-55bacb412102", "value": "T1FD05F110A2E88655E0FEABF646F106540B3B79166633E34E8DD514DE1FB27C18E0AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964036, "uuid": "293961ae-5837-4ff9-8b46-9519fdc7b88a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964036, "uuid": "69ce5197-b80c-41af-85fa-e303de2e8d6c", "value": "12288:j8cAVgE0M07GMqR/1fudGduNCMdxVw1TpWTRtrxi9hg/6efSp:YcGgrGM4uNCGVw1NIbxiT1efSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964036, "uuid": "e8164c22-56e8-4497-b19e-4a09c2476f52", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964036, "uuid": "83c42b2a-ba3e-4d55-a43f-b43bef80d435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964036, "uuid": "64ae66f8-e3f8-43b8-9d4e-f8df279ccaf1", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.30463.13297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2f714f-4334-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692960317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960317, "uuid": "a7e2261b-d3a1-46a7-baf7-5ed2b83fa40c", "comment": "Malware payload (DCRat)", "value": "64442f8a0ff009425c0f146e593aad61", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960317, "uuid": "8680fd55-abe0-4704-bef3-63dc1b20af93", "comment": "Malware payload (DCRat)", "value": "522c38b4d924d4e06c8e676a960af05e168ac8ebdcdfb6c3e9f84f9592aba178", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960317, "uuid": "57f194b4-76ed-4f1e-a3aa-1fb87b6393a8", "comment": "Malware payload (DCRat)", "value": "251d6f9df60949c785b317d427e5e7b4cb3c2536", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960317, "uuid": "85b48b6d-3c87-4eee-8796-161f004e2ee1", "comment": "Malware payload (DCRat)", "value": "6a487ce5f7f4f8cfe9b8d053b00f6db142364d3ab8680433f7e41c29b54c746a9f137d6e147b72d2000c7ae6c5496566", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960317, "uuid": "4712a6a6-e5f8-4747-83c3-9637e44cf863", "value": "T11CB5CF017E44CA11F0181233C2FF454887BADC5166A6E72B7DBA37AE55123A37D8DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960317, "uuid": "00f96bed-8810-4a69-8631-cdc2de14bb3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960317, "uuid": "cce6160c-b30b-46a9-b634-1b4cc59156fe", "value": "49152:OKEwEw+kr4vHY8bohglyOP3pBW7Po5qjUR1K4BaEOXc:O0Ejmz6oh8jP3V5CUOGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692960317, "uuid": "334e4617-09a4-4a83-a014-ec095ccbdae2", "value": 2384384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692960317, "uuid": "bb53a35a-9da0-4d49-91ad-69be863ae75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960317, "uuid": "ca0e0974-3b0a-4693-bf63-7a5af4802fef", "value": "64442f8a0ff009425c0f146e593aad61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a063289-437b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692990622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692990622, "uuid": "b3a36431-3104-45ec-8a71-e13d3621d3a1", "comment": "Malware payload (RemcosRAT)", "value": "ed53959661b813c82605a889fc6e5d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692990622, "uuid": "e4b605b8-cb7f-4ce8-b8b3-de00fc14ad3b", "comment": "Malware payload (RemcosRAT)", "value": "54d8f4bcf9e38d05ef12875a7a9400ffcaf3e71175019d655129f2727c58e65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692990622, "uuid": "6abdd158-701d-40c4-9c09-f7f0026f8e66", "comment": "Malware payload (RemcosRAT)", "value": "4e89de8806e2bab0dd53c7a8650bd1c80a2d5a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692990622, "uuid": "fb2a9aab-a90b-4b6e-861a-fc270cd6a06c", "comment": "Malware payload (RemcosRAT)", "value": "0f012fa6c4f3ce160d0c4cc708866fb31ffb6188c2c2b4ea985abdb90fba5a8a6e320e070533bee840517c51787e8418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692990622, "uuid": "ca25fa6a-efbe-4fb9-8474-80df25461cb1", "value": "T10AA4BF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692990622, "uuid": "cb714f98-ace4-4dcd-8e3f-68d3608db53a", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692990622, "uuid": "0d550029-c7b6-49c0-a3ec-83eed5ed0bd3", "value": "12288:BRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO29DU:Bx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692990622, "uuid": "6a3bd518-036f-44df-a59c-d87abf118bde", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692990622, "uuid": "14b4718b-3985-4df4-b435-b6dac48963d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692990622, "uuid": "f0da8811-a72f-4303-89f8-66b8632c3d05", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b838f3bf-4389-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1692996927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692996927, "uuid": "a1950778-93c1-4eb8-86f8-c829b053adc2", "comment": "Malware payload (CobaltStrike)", "value": "0a1f4bc56f6e1bf9d02451ceae8ac22d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692996927, "uuid": "c2651bfe-4616-480b-8416-5e521748b083", "comment": "Malware payload (CobaltStrike)", "value": "54fcfbf975b4e712634ad0e196242bbec304029d3ce0ae2a6a660e27d1e64def", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692996927, "uuid": "0c9e41f8-74a0-4d05-8500-cce6debe6d29", "comment": "Malware payload (CobaltStrike)", "value": "c9389182ded27cd76200eeded3d68bc39ac6d112", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692996927, "uuid": "5d11c20e-edd0-4e63-ae17-1c0255449b32", "comment": "Malware payload (CobaltStrike)", "value": "f13115ab307dcc8c2ec7c7e00351e0aa4855119dde55d409ebb612a278d4759a10d4e89db430a1917e5ead893a81c48c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692996927, "uuid": "bcd2c1d9-bc12-4af9-8c74-a2620ec2bbb2", "value": "T141654B10B750A028FCF711FA8AFE216C953DBAE0076894C752C82ADD972AEE17D31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692996927, "uuid": "cc241920-3d57-4e80-b5c0-1467ddd11ea7", "value": "5cf47a8f664cb90aa3fcea1e4a53d769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692996927, "uuid": "41973ea9-cc19-42dd-8248-a1af77d90bc8", "value": "24576:vQgZjOv+l306Gs9UfpIXiwJfnfSJsb5tJ:vhZSGh0AJfq2tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692996927, "uuid": "3c258759-d61a-4653-b1ce-056f5e7c2c2d", "value": 1545216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692996927, "uuid": "3455248f-dc4a-4568-9e8e-2efca058bdb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692996927, "uuid": "eab28ba1-230d-46f1-8f09-6722725b2978", "value": "0a1f4bc56f6e1bf9d02451ceae8ac22d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c45958-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692965456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965456, "uuid": "2448172d-b82d-41e3-8ccf-2ae3fdf39bc3", "comment": "Malware payload (RedLineStealer)", "value": "ccc3d42253e1bf0c78cde794a86c5693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965456, "uuid": "68bbd4c5-f888-4834-94ef-860c1d267085", "comment": "Malware payload (RedLineStealer)", "value": "55835ee0d6831c4bfce2485d71b884881f5cfff7e66b4bd3c760b9a1fb9dd4d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965456, "uuid": "31f8e8cb-c41f-4b17-a1c5-6c35598f71d4", "comment": "Malware payload (RedLineStealer)", "value": "ea792cdd8dae77c7ea22b195e5fd6a2e6da402c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965456, "uuid": "b1de0b37-35d9-431c-a7f2-c55873e0d3c1", "comment": "Malware payload (RedLineStealer)", "value": "985cf2eb0afb911345fe235c1d4e8b9452b2cd47f72bb862956f1a76fb81dfb855589f2c1c40dda08a00909311ff77f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965456, "uuid": "31a1b440-093a-4f93-b7f4-58b2ec69608e", "value": "T15315124197E81433E97A277158F713935A3AFCA2AC7A866B37099D0E0CB35D4B13532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965456, "uuid": "0e6cdb1e-933f-42ac-ac20-328b379897dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965456, "uuid": "16047bab-9cb3-4688-857c-4167b7a8a53e", "value": "12288:3Mrhy90u10zuiMlgrskr+ZLSgLKN2s2FGyrOtiQ1EWztWqLm+lr3wa1F3VgAGsR7:SydwutCsab2scrD+EWhW+lr78sR4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965456, "uuid": "0a024d04-4d6e-49bb-a22b-ce0a834a6bdf", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965456, "uuid": "48f85a57-ea62-4fdb-ab00-ae9fd6f3cd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965456, "uuid": "f599c144-25d2-4f00-828e-b129280192dc", "value": "ccc3d42253e1bf0c78cde794a86c5693.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33871b6-4333-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692960036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960036, "uuid": "e74ec676-7323-4baf-95d9-9166316d2bd8", "comment": "Malware payload", "value": "231fecc6a9a7e5cf2a76c5025d847cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960036, "uuid": "277b5cc3-a865-4c2d-a34a-a8497bb35e6d", "comment": "Malware payload", "value": "56915893fe760c8c3b33595771048deefcb23bc8be505cc3237b023eb7815924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960036, "uuid": "bb6206a1-cb5b-4bb1-be73-421d3e5f9459", "comment": "Malware payload", "value": "0f54a07654387df5f440c64a64b4bc0d57a449d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960036, "uuid": "71652180-8faa-4e08-a0bd-d5bf6c18a5b4", "comment": "Malware payload", "value": "0cfb627edc43d0b295847f10d8cfc0fe3741c4854856c33b0c46b087b800bdddba8b82dcb0177b121b2042b31cb964dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960036, "uuid": "bc1f7809-4e83-458d-915b-c2053c1f8ccc", "value": "T1A9E3889C725472DFC89BC4769EA81C64EBA0347B930B9243A45756EDAE0C997CF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960036, "uuid": "67036d5a-3870-4352-8172-7f8170e3ad1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960036, "uuid": "083aae2c-efe9-48f7-83bb-c51c7d4111a1", "value": "3072:X5BhacnInGv5FbwN2Fl7amENap+AfHFAd:HEnn8bwN2Fl7amENap+AfHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692960036, "uuid": "1bacb686-0d83-4516-a04d-2290913fce66", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692960036, "uuid": "6e902c37-ffb3-48c9-825c-e24564436f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960036, "uuid": "7fe07eda-65bb-4523-9789-0e21c2b84d43", "value": "231fecc6a9a7e5cf2a76c5025d847cbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cf9864-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934168, "uuid": "15a9dacf-ecd6-4e7a-ba04-bf4277c08710", "comment": "Malware payload", "value": "3862db8d0e9eef5187981b2d9fad4ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934168, "uuid": "5752ca47-de77-4301-91b6-26e8d0740fea", "comment": "Malware payload", "value": "56f29a67eef1b69e55b2331a5b058bdc38d943c2de5c24d2b74e841662d8a167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934168, "uuid": "3a723e6c-b590-4f72-9553-3118527218cc", "comment": "Malware payload", "value": "ef3bef13ba435d36c9f789266c22b54c3f7a3461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934168, "uuid": "c104cd7c-ba81-489b-a853-efa556e8fd78", "comment": "Malware payload", "value": "69ba2306b68cb4b721a262efea5bcda855db5d6eadfacb4038158febc7928e4dccb6b8c165e01c6df3ce507241c43006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934168, "uuid": "2b81db4f-c24e-4d7d-b039-4ed4fea92da9", "value": "T19CE50130B691C031CB2722714C1799AD4E5F907042EF77AB73AD42355F0B6AE8E74A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934168, "uuid": "d1b99427-729c-4c6e-a05f-aab72b56292f", "value": "49152:gpTUaJS6OBmJRy7afc9ZhPOLEEeEy49ghsihrbmQJZi8/c0nRvNCgdvCweIcSO:gCaJS6OBmJRy7caZhPOLEEeEy49ghsi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934168, "uuid": "d9806cb3-2b97-4681-bddb-6cae156ed594", "value": 3080192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934168, "uuid": "e38996b7-586b-4b56-983b-42131ddc9b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934168, "uuid": "f79fe543-c686-43c9-99ad-2925c9fe06cf", "value": "SecuriteInfo.com.Trojan-Spy.Agent.24997.6669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6048833-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950538, "uuid": "72cb53ed-eb1c-4a38-9c14-dea9382d2963", "comment": "Malware payload (AgentTesla)", "value": "adf6cae3af39921249af21966be44f25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950538, "uuid": "587ebc9f-aedd-4c7b-9f97-876132b1fd19", "comment": "Malware payload (AgentTesla)", "value": "5721c7389078c984535ab27ac77a2554222059a441ef98e0f5ff148b0b8170cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950538, "uuid": "780a2dc7-28cb-43ee-a079-ec2e0329a8fb", "comment": "Malware payload (AgentTesla)", "value": "beb7badf217cae716cdceb0c8750f1488cb4b677", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950538, "uuid": "fe3b5360-6a8e-4b19-af7f-3535fbb7b4b3", "comment": "Malware payload (AgentTesla)", "value": "264d17052ec9b4ca637122f4d0eae7a96f8baf71fe79313d8369771fcfc57dd6c7dd681929bacbdebb57963fb18defbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950538, "uuid": "147a5204-1047-4a93-974c-d974cde8c528", "value": "T1080512004E2C897FC6BDD7F6319242913DFC554BA151EE89AF8834AF70326E942D729B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950538, "uuid": "eb3293ca-f7b4-4f8e-b177-77a8b9b8d6f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950538, "uuid": "39ff4496-56fa-4f11-99ad-24f112e22983", "value": "12288:rrojIkCDMpqhv1aZsfc36aEgzrGX2hh4oy/9HGILjN6Fw3uPfLS:1kbqhv1aZseE8rG0B09HGIt6Fuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950538, "uuid": "943bd3b5-9825-4bda-b448-127ea6792cad", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950538, "uuid": "05fe92f4-f735-44f9-b414-5f4521b438db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950538, "uuid": "9a4ab63c-af58-4bad-8b71-1484416c6f43", "value": "DHL Expres Online Customer SHipment Advisory Notification 280820238393.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf88d13f-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950554, "uuid": "e7f341c0-ef08-43a0-9133-0f8ec37b7940", "comment": "Malware payload (AgentTesla)", "value": "955e0b656cbea87a664b814a680c7039", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950554, "uuid": "94431c20-58f0-4719-8bdd-e9e8d5adc82b", "comment": "Malware payload (AgentTesla)", "value": "5cd4e6485d048005b1a52079a5b0a10a3cad3c2b928b03c110e45d18025482b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950554, "uuid": "8630adea-b83b-45d5-b27f-fd5706492559", "comment": "Malware payload (AgentTesla)", "value": "6ce5c52c16134086875cfaff92eff909216684a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950554, "uuid": "ff9b0a7d-7346-42c5-b13e-92fcace0b192", "comment": "Malware payload (AgentTesla)", "value": "d5f9e93782bfd36acc042827d52879c4eda86b9981f6b8e370bf85fd97269b4f9c874699d3fccc893912b7b5a8d6cbcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950554, "uuid": "236a43dc-e62a-42bf-aca0-1ac147661c45", "value": "T161D423A425C60AE3CFFC3D48433112AE9FDE89D701D60CAB293D4A1546ACADDE9E6534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950554, "uuid": "75a40f4e-b6ee-4460-a667-e43e9e6a33f7", "value": "12288:eamT9arNAMKQxWTzRGQLhXHmdKuSeKj+f3AOn8jzRcP:eam0AFQmzRpholSwf3AL2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950554, "uuid": "7a93cb7e-4361-40f2-839f-5075e95a69c1", "value": 621363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950554, "uuid": "476ee833-47c8-4976-9784-f71e03bb548b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950554, "uuid": "067ccf74-87cd-4729-9427-70098e748b3f", "value": "New order for PO_1211992.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfaf90e6-42ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692937723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937723, "uuid": "45709ecf-6627-4648-8353-34d7d99c3113", "comment": "Malware payload (AgentTesla)", "value": "ca2ace4d35cbd9ef6e71fd548e5fddad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937723, "uuid": "2d9b1a65-3425-452e-b519-744220d7c85b", "comment": "Malware payload (AgentTesla)", "value": "5d5a35dc274ddccbb4cd1894805500e7847c262874fd03d21fca8737f2c0ed11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937723, "uuid": "a696ce31-0bbf-4e9a-a758-cee3b6193f43", "comment": "Malware payload (AgentTesla)", "value": "69ad5c5c2faa66618a4b5d07e59cbb83059e8faf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937723, "uuid": "0b88e10c-394b-41d6-b184-e34d1f93bdf9", "comment": "Malware payload (AgentTesla)", "value": "9f6ebf47a1a1e679af2ce9a9920102be655766cd6aa60a1cfd45c383d5af039d58747103ce751b3d49857fed08125c8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937723, "uuid": "8a8ccd08-1ae7-4e88-a6a6-476dbbf93f3a", "value": "T19E253FACAD9C9187E728DD28668F253C1C66D2126D6AA380DFB6C4D71FD01073A5DCE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937723, "uuid": "48e56cee-6fbe-4295-8fd2-1edf78065dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937723, "uuid": "ff99abe7-adea-44a3-bc51-3b74732610a6", "value": "12288:sOVL59SWrS3mGyTqTS68ZTObbB3F2jK2z5:La6SlyTqTeZy1Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692937723, "uuid": "05b79b54-b037-4644-82b7-cad570ccd21e", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692937723, "uuid": "f96aa52d-f53a-490c-a72d-ea2a94a06602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937723, "uuid": "245ec0ae-673d-4d69-a3fc-bd91fae37ed8", "value": "SecuriteInfo.com.Win32.PWSX-gen.11720.15365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce5218f-4330-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692958817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958817, "uuid": "f4b4ec19-23f8-4f11-bd37-03efc63b608d", "comment": "Malware payload (njrat)", "value": "62804f699b6590666616891143e40944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958817, "uuid": "183fe074-4b49-44c3-a313-f753e3e8ab74", "comment": "Malware payload (njrat)", "value": "5ed5edf3e1b4021d3ccc3c3ba586ca6c529b9cb0923232a67c77706844d95cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958817, "uuid": "cad3ddbb-b05d-48a8-a339-d1fe65b9662e", "comment": "Malware payload (njrat)", "value": "f194b16ac8c945335daa5b1395654cd5c57f9fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958817, "uuid": "193ac336-7a26-491f-80bd-5c98de8e28e6", "comment": "Malware payload (njrat)", "value": "49b8d5daa3fb8259c34e3f1376ea0e2d179c8b9b98137f0ac0089b2044c9d8d95b6c13f6d94ec98ddd0dfd697d44ca7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958817, "uuid": "58c40635-d51f-403d-a3a4-5c8ecdfb0ee6", "value": "T173B21A0E3FA98856D4AC17748AA5965003B5A1470413EE3FCDC550CBAFB3ADA1D4CEF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958817, "uuid": "ed4488c8-0d9d-4f6b-b13f-7c25b437fdad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958817, "uuid": "108780f1-5c2a-4252-892c-d0b8a0f053d2", "value": "384:0k8aSyS9gB3Y1KIay2X8cLZI6XgxsGJVPpmRvR6JZlbw8hqIusZzZkK+:y589tXvRpcnud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692958817, "uuid": "249d6e2a-40fc-4559-b663-cc6119032d7d", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692958817, "uuid": "d6537c37-8156-4c21-821d-76295c3b029b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958817, "uuid": "b7feeec1-a695-4336-8f65-a5df2c7804aa", "value": "62804f699b6590666616891143e40944.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e65b0d-4337-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692961818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961818, "uuid": "53bf33a1-b296-4946-87a9-5df06fe6eea7", "comment": "Malware payload (STRRAT)", "value": "585fd27f8c4154c5c343571037aba9ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961818, "uuid": "c62ac6c2-f6d3-4b94-b55b-1dacbb734525", "comment": "Malware payload (STRRAT)", "value": "6372a7f93d8048d9105f81e38d773bffd87ab441e8354bc2100ca781d9b43037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961818, "uuid": "cc47b6d9-dc22-437a-915f-1cd2869b076c", "comment": "Malware payload (STRRAT)", "value": "9a1a49cac87033f16b2a18592fd900c6d5a6d1a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961818, "uuid": "1f71304d-8d3b-4f91-aa5a-208561549255", "comment": "Malware payload (STRRAT)", "value": "a9d2e32dbd38d5e8b7b2b2bb2440e0e5d52d9333166d08d0494abb726a3c763a57f272137bd0ca6ce38f108e123e311a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961818, "uuid": "c37a249a-6b5b-466f-980a-6188f3fb5f70", "value": "T1BC65AE07A7F74AF1F1091736E18B44501797EAC833BBDADA794B0E5F1A86B59CE08603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961818, "uuid": "7f8ce483-05dd-4eb8-ba45-f96103f0802f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961818, "uuid": "757e7dac-001d-4285-9632-2062cae1818c", "value": "24576:hluEXY+mcfNSFgVlqWpnkBxWyuEbQ7p44aZe50HTFQ6Ksch5D/334qo:uvgkSNEbQ7hkchdP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961818, "uuid": "45b32cca-0b8c-4e57-a4d1-eebcad4a349e", "value": 1424384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961818, "uuid": "b4eb7f5a-b56b-458e-b975-05d5a7780221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961818, "uuid": "0656cc14-2485-48ae-93eb-ba3545cc4526", "value": "SCANXEROX25082023.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c85443-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965185, "uuid": "540150b4-49a0-4abb-91c5-e542211b7d6f", "comment": "Malware payload", "value": "877075c3dc40355ad4c4da167fc6cc3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965185, "uuid": "51da10f5-072e-4ae6-9b85-d3363e8d071b", "comment": "Malware payload", "value": "63ca43cb57d0f7cd204631a9e9ae8e9856787fb246b84bd99ec3561f5adb24ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965185, "uuid": "c8dfda07-49da-4c77-9a2a-61562c5248f8", "comment": "Malware payload", "value": "95431564b79ca038cdbfa28903e99f791cc421f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965185, "uuid": "f362b816-e00f-464a-983a-293f74537462", "comment": "Malware payload", "value": "182044962e2cf044917f56a1b915ac6ac9ea50f62e7eb4fa982fcfbd1300b90f0bfefbf49285b3e44462f9e5b82e4c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965185, "uuid": "566ffeb2-1388-49d5-8c99-e6d787f4d9c5", "value": "T19E163341ADDB5FBBE6DF99F2D5648C2D031A6510FB6145E7C2810E68F0DEAAE78D0B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965185, "uuid": "325ec51c-1553-468c-802c-1b71c750b571", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965185, "uuid": "1ad1e712-222b-4031-acd7-50f2f7ab8478", "value": "98304:/1IGkrpfCFNxteZv3Fxcf0aTW1QSgp8txSmALv:dIVfiNxc3fclzSgetImAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965185, "uuid": "829f6a3c-1654-43d4-b5cf-4083acfc66f7", "value": 4068393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965185, "uuid": "131d4d28-49f6-40a1-b31e-c20f2cce0fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965185, "uuid": "0011b7a4-2dac-4e7f-9de8-9c008f460603", "value": "877075c3dc40355ad4c4da167fc6cc3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d226176a-436f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692985804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985804, "uuid": "dc10b1fc-41c5-4466-a96d-c82cff5e2b08", "comment": "Malware payload", "value": "b545bbcf66fab1c246d00a57382f411b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985804, "uuid": "1cb9eda5-4546-4a9f-9196-7a72660fa4eb", "comment": "Malware payload", "value": "647aca163edb17b5cf33a05a0c47809ea635ebd577845256b2c07360ea19ef27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985804, "uuid": "9d991caa-1ad7-4aee-b5a4-9f2919538b5c", "comment": "Malware payload", "value": "457cb15a3b8fc45f02b9575fea30a936a39aff39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692985804, "uuid": "59d2deb8-655e-4fe9-ba6c-e7673386f2f0", "comment": "Malware payload", "value": "3e63316e66438cc662f8941ee36efd0cd43fbbde129621e11e4e98bee17b82b77db9c73fb47d629f7866ebf032a06fff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692985804, "uuid": "18e24b8a-18b3-4b1e-a372-9c09e49ff4a1", "value": "T1ADC26D4AEA83D4B6F80701B6553B63B3BB37D13D4018DB12CB2E9935DC52914AB277AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692985804, "uuid": "97f67296-3181-4e3e-828e-b1d45cd7aa88", "value": "768:JBSIxzsY3rRm6O/FiX3Xf7t08T8X1oLTqeN8rAVnvSkIV:JBSIxzsY31O9mnRgXS3hoQvSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692985804, "uuid": "86d07ebc-e0ce-4f1e-9c11-0d2384a86f02", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692985804, "uuid": "11f85816-dce3-48ff-bd2b-7fc4a0a32b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692985804, "uuid": "bce69001-7954-4523-aeef-3810d76bc4bd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a91bf57-42fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692935835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935835, "uuid": "a3dead0e-d319-49c6-a109-653d1474de59", "comment": "Malware payload (Formbook)", "value": "c573e900611f78a87d128236180d56db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935835, "uuid": "dbdf1be3-4756-467d-a484-218e752b6b66", "comment": "Malware payload (Formbook)", "value": "648d1707c269dd6067524d0de5cf82e39b5141fb0556738aa13b31c2402b79cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935835, "uuid": "4ac68bba-6218-43b7-ade4-eb6b6b30c1ac", "comment": "Malware payload (Formbook)", "value": "dfa3df7f60fe32b193361603b1ced099c62e4bc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935835, "uuid": "ac2b5d92-c0b4-48e3-ac96-6f064c9388d0", "comment": "Malware payload (Formbook)", "value": "5b5a0fa4f412005860e2a370d722d8db81f4c71888f74f92188bab18caf117a670226ec1d4d092c8c085b0b2b8386dde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935835, "uuid": "3fdcfc77-44b9-4b90-9425-90fd2dead103", "value": "T13F0459F0317D83C3E1A58EB11FCA86B079F136ACA8D0560DA0F59B2E93D2355149D9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935835, "uuid": "5bdabe9a-c6de-44c5-8d56-7f12c28c7db7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935835, "uuid": "e852e625-d7a3-4db0-9769-31645592b359", "value": "1536:Ye8AY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgk:YeE+9wqY+mhhhmitqOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692935835, "uuid": "3a8d24bf-9039-49c8-af7b-d5755723f250", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692935835, "uuid": "3de449cf-59ae-4917-989b-52abd5eed8e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935835, "uuid": "7d69e09e-44a0-417c-950d-3f5c2050df88", "value": "c573e900611f78a87d128236180d56db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c30dde-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934154, "uuid": "abab1a6c-bc7f-49c2-8694-2f0bc87284aa", "comment": "Malware payload", "value": "db834f902ad19797c58eb953b14cdb03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934154, "uuid": "49d0f52b-7308-4195-8b73-fe20e3418f1d", "comment": "Malware payload", "value": "64fca7fd3f5aa30bbf9c9d4bf0ea01798b1c2203f3f42b1bb8d811e4ae4aac5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934154, "uuid": "334a2224-8779-4207-8be7-9a5af21898c7", "comment": "Malware payload", "value": "040abe2e37a114c36671515c4ed99e624af5278a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934154, "uuid": "34ba6657-b921-4052-9281-93503cce429c", "comment": "Malware payload", "value": "f76daac69777015c4e004f9b10d534c31b83e69e84d38b32b56fe7037838a523caff75f1ee8568520e9eb1c7a9dc680b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934154, "uuid": "fe36a619-c2af-4a2f-92d0-62557b923eff", "value": "T1D985223486ABB939DFED49FAB4672662F032A00C5E5EB44DFD01874765F5B4C022B48B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934154, "uuid": "b2ccda61-1b6c-48a6-8c7a-c675e7c5f90a", "value": "0bd4d0ada2d5f94673b9609cdb38942f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934154, "uuid": "2a0123ca-a6f8-4aae-8d5e-30ad6d78ad88", "value": "49152:5ZvBpS9//64jJOjDrR1Rky63LXZFF+JTRBq6duxcVps8IBR:5ZZG//lFOR1Rky67JFFIPduxcHst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934154, "uuid": "42c93bc8-1e38-4a68-977a-1193a91329f7", "value": 1800704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934154, "uuid": "6c01e994-bb4d-4c89-9017-d228c3fd81b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934154, "uuid": "34336212-f58c-4cb5-90b7-9cbe6fd7cfc4", "value": "SecuriteInfo.com.FileRepMalware.23042.9340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8557b4f0-431c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692950027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950027, "uuid": "1a217fc8-c569-4bdc-a30d-95ff17f73c4f", "comment": "Malware payload (AsyncRAT)", "value": "7ec73c3cdb2ab4d8ead126d75d8e75e6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950027, "uuid": "2495bc05-e2b0-4b3c-b413-5aa4dc10b226", "comment": "Malware payload (AsyncRAT)", "value": "662373470e1e29fdc50870c0296a21446f2231455ae93dfb9f4339e21d8eaca5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950027, "uuid": "a8bc2ff3-c18f-455e-9bfd-724e456126a8", "comment": "Malware payload (AsyncRAT)", "value": "72932cec27122ff030c4e9300026be77c91da7f3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950027, "uuid": "b98783e1-c322-41e5-999e-90e7e12d8d66", "comment": "Malware payload (AsyncRAT)", "value": "b460f82aaea910265c7966f5834f644ce7f64991903e0fec6ff81b43c5ec4b0732d9834eb7ea1f5fdc90a8958afea418", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950027, "uuid": "af00b5a9-d469-4e0f-8c11-124296432ac0", "value": "T1F0948103BE4785FEE2891B76C19B150043ADEA8337ABDB1E798E235615437EEEC41607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950027, "uuid": "3671b8d2-186f-4e4f-afc0-d9e988ab2648", "value": "12288:7DbFgXY5JxdtIeCP5BRQhgRHf0e9c/j0xMZ2t+4GspUx:3FdtIe+e+RHf0Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950027, "uuid": "7a87651d-60a0-447e-bff8-12ac09a00440", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950027, "uuid": "32b6e89e-6f31-44c3-bb41-a93a62681a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950027, "uuid": "56a6c0d0-9bee-4fd5-a502-578fbb29f3cb", "value": "7ec73c3cdb2ab4d8ead126d75d8e75e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c81a5b-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692950566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950566, "uuid": "b22235c9-ae49-4869-86d6-70c155c163c0", "comment": "Malware payload", "value": "772c8e164c5ebb98fcfac2c82caf63fa", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950566, "uuid": "293379b6-ef35-4aee-8c4e-c8e1abc1939f", "comment": "Malware payload", "value": "675a33dd889e6b6b9e0c293ddf67e9148e57f1156f05ea64cafc3d351cf3b00a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950566, "uuid": "8b747703-1368-40f9-9015-b099b83c1a4e", "comment": "Malware payload", "value": "ab7518b14ee52cd0492fceb97a3c013a8843a8e1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950566, "uuid": "5ef3f001-3d94-481f-92ec-5df1c70f6b42", "comment": "Malware payload", "value": "dc70f15e2b97b029d5ff81542e9f187809b09b977716ee1dbd7f376b3a1d820c5869d2cec61774cb2d118251c37072dd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950566, "uuid": "528a1a2e-e7d2-43af-b869-ccddd43ae998", "value": "T1DBD4232B1AC3D44D3B73ACA31C850F694037B87278871DDA1391FC6D26A5FF04AA975A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950566, "uuid": "de1c90d3-7eb3-478b-9c1f-e4d303cd3e5d", "value": "12288:FJacStFfW77f/HWwpYMne9DdrS741ttndub0l33U4w14n6jxv:PaLffo/2Ate9DdrS74PtnkbC3nw14nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950566, "uuid": "eb49ebe8-512f-425d-85e9-95a8d99c7342", "value": 617090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950566, "uuid": "a2888b61-02d0-4cc0-863e-09ab929c5cde", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950566, "uuid": "ff0823d8-d895-4812-a5d7-7f5d37baa3a2", "value": "Packing List 15028 .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b58e6e-432b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LimeRAT)", "timestamp": 1692956414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692956414, "uuid": "92538cac-0175-4087-8119-82912dde5a27", "comment": "Malware payload (LimeRAT)", "value": "60ecec208aec47ba334995d58a946e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692956414, "uuid": "0c145beb-9bf4-4014-b539-b40d62ae85db", "comment": "Malware payload (LimeRAT)", "value": "68a220e11cfe5ce5e75599dc00064178b727d1fd83b9a6ff570163c62847ffb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692956414, "uuid": "674c3125-695d-43f1-91d6-cf9572866c98", "comment": "Malware payload (LimeRAT)", "value": "19c8cd90f34551d5a026d38a01bf283794f85fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692956414, "uuid": "7f97e7d4-80ca-4c48-9e54-4a4e656a5f36", "comment": "Malware payload (LimeRAT)", "value": "c132adfd1ceab014c82c70aed3a0276b4f2ed796224202e7a4d3646be1bc28fa8349b7af1be4be68aaec4ff9ecbe8c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692956414, "uuid": "3c237285-20b3-49f2-bc3f-705c43a2741b", "value": "T1ECE26C043BD59A94E29C26B40BA121694FB18A17E927DB1C0CC974E11FAB7D4078FFE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692956414, "uuid": "bf6f9882-392c-4532-922f-38ef97574bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692956414, "uuid": "3b0b1a0f-1d5f-4919-9ae8-f0113e51295e", "value": "768:akvb9ygQhMuc99uBBptUDOVW3K+ghmGP1r:aybFYBBfUDOVWKZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692956414, "uuid": "f7eace75-5eaa-4386-b334-aa180ec95174", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692956414, "uuid": "2e67597f-bd25-43a7-9d54-acc104fe0229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692956414, "uuid": "d0af1a9c-2588-465e-900b-5f90653c8600", "value": "60ecec208aec47ba334995d58a946e27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f24e64-4301-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692938320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692938320, "uuid": "8fc977bf-9f69-4a23-83a0-c2eafe8d4f8f", "comment": "Malware payload (AgentTesla)", "value": "554a40726167555954ffb9331b339ddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692938320, "uuid": "b7195b1c-eea3-4ced-88f1-d8fd285bb46e", "comment": "Malware payload (AgentTesla)", "value": "6912b037f982a7f15515397d5acad1f246bb27d21db87439433773149edcac18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692938320, "uuid": "c8ee7241-0537-4a26-aefa-17260475623e", "comment": "Malware payload (AgentTesla)", "value": "1669129fbdb6db9961880e1eb141f27a333a1666", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692938320, "uuid": "40337989-5dea-4153-9138-109741c21a9e", "comment": "Malware payload (AgentTesla)", "value": "c81a909d61e69173692ddd2c83096d04239f09120a947bbcd2ee9d1286f303daba8a2b38f5797cd9a9f67bcadc792e85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692938320, "uuid": "a8d327ae-1bff-45ca-b46f-c3afdf60d0dc", "value": "T1DB856B2178808131EEE710B7C6FDB829411EE1B4272755CB76FC57EEC7706E1AA32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692938320, "uuid": "3e8a985e-4b8c-462d-ae6c-7232ffaa9f51", "value": "7ca28186d68c9a22a0e816e570aac96b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692938320, "uuid": "975668ad-c4b8-4e3e-b34d-1654a5afbbfc", "value": "24576:odJvYOQ9jN9cDubeOxrV/J8BlyMoIDURYkv79:odI9jN9cD8eaJ2lyMBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692938320, "uuid": "c9e3bb21-81e1-471c-a4d4-3f12344adeb3", "value": 1798144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692938320, "uuid": "d8c69a91-d6eb-4086-8c11-5263a88a499e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692938320, "uuid": "c1be5d7f-c6f6-4216-b443-68491697f7e1", "value": "554a40726167555954ffb9331b339ddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5487e08-4310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692945007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945007, "uuid": "932e3219-990e-47d1-9181-5f03c59fd267", "comment": "Malware payload (DCRat)", "value": "22af9f47c40e08e5d5f785a026657a60", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945007, "uuid": "8d74a7fb-a5e8-4584-9f53-9fa34b05e4f0", "comment": "Malware payload (DCRat)", "value": "6ade40b71ee50ca95629aaa593bc8f48335ff0eee6c47c3a1dcaacbd9f1eaf42", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945007, "uuid": "eb98a633-b03b-4965-87c8-3ebffa8e0d5f", "comment": "Malware payload (DCRat)", "value": "e528b7cc9ca32e65d6c9293e68e36a098a83c15d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945007, "uuid": "8dd05c0e-c757-4bd4-a71f-2c12194ae453", "comment": "Malware payload (DCRat)", "value": "3a6bb53e5e06856b1e34a330d526f5e19a203ff10e8cecef47a3facc293af33b4b5395069a987133623ca947af020257", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945007, "uuid": "7df6e7bc-3ac8-49b1-a666-939d78825ab5", "value": "T1E9D5AE027B81C561F9251573C2BF4A540B38BC246B79D7EB7AE8362E95313C23D2879B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945007, "uuid": "02f38ada-de3d-4328-a091-f4586686ef04", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945007, "uuid": "f8d3dd64-9dfc-4ba6-a35e-a69440229706", "value": "49152:kE/RbA3j8QfrCr9BeogEdfwV4VnaT8WrEFmaAyUXccU43WE/Q:kE/Rbl4Cr9NYCVnUEF6rhUrE/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692945007, "uuid": "e9aa13fa-aba1-4e5d-97ef-3fdca979cb43", "value": 3015680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692945007, "uuid": "b4aa796f-3f72-4144-999b-77131d0255de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945007, "uuid": "b2fa4864-79bb-416f-925a-b68dd62bd8c4", "value": "22af9f47c40e08e5d5f785a026657a60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84db6e01-4318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692948308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692948308, "uuid": "38dc4866-5af5-40e3-9091-d733bb2db309", "comment": "Malware payload (RedLineStealer)", "value": "7278b6ce3ddda7dba2473e0392e54ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692948308, "uuid": "3b30e6ac-ac06-4aca-a4d6-852ec312b45c", "comment": "Malware payload (RedLineStealer)", "value": "6b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692948308, "uuid": "d8f38260-1a31-4804-a8e6-f38f2b1b67f5", "comment": "Malware payload (RedLineStealer)", "value": "3b406f221237fe9bfce48daa9033eda93ecc9b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692948308, "uuid": "176d6566-c835-4610-a8b8-ea9e62481f30", "comment": "Malware payload (RedLineStealer)", "value": "55a89f3ef7eaabc32b2d57d95184eb28f6a480a53feec0584eceb7f9190cb4b1989cff6fdc1fa990718176621de28429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692948308, "uuid": "9fb0e614-09cd-47cc-a0fd-3fee561e7d8b", "value": "T1C676F088F76DE370C67301BE2F6DE54942211D685BFDAE6E0C423D59B63611E6EC8223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692948308, "uuid": "ef16b80b-ce0e-4c43-8205-4c315d8b8343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692948308, "uuid": "393ae44f-7430-4440-abd1-36ca42f557d7", "value": "196608:+dgX4LVznF3zQgkIRflnOzSc4pGRo9Jvy:3UzdzqIRtnYSi6zvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692948308, "uuid": "3ae14059-0d8b-41f2-8f52-ac3d3767bea7", "value": 7696896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692948308, "uuid": "033600dc-495d-4afe-a164-1c2f073e567f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692948308, "uuid": "932a2cfa-c8c3-4ef3-b994-d9d129cd1f34", "value": "6b11e77eee3f401356c240303da1b819ec0b12fb82bfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f556759-42f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692932676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692932676, "uuid": "38319766-78c4-4c68-ba1a-3c9723180c93", "comment": "Malware payload (Formbook)", "value": "e18b9614cf477714f9e62cde005cd22d", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692932676, "uuid": "b53f7457-a7bd-4ab8-a77f-374c9b4ebc7c", "comment": "Malware payload (Formbook)", "value": "6ea86039dd0bb3fd430dab6c8d367b218c7ce7ac9939397cffe5de69f4cc3288", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692932676, "uuid": "2355698a-d93e-4134-be62-ee8dd0b1c8e7", "comment": "Malware payload (Formbook)", "value": "11b6130661abe1b4d2e1f3a4096fc5623d3ec42c", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692932676, "uuid": "27ac9eab-b955-45fd-b690-d5816769e33f", "comment": "Malware payload (Formbook)", "value": "50efa266b16d1973a2ea5b157c10762b5f9dd1c23b48153fab40e03ae253b33fb7a7a6da3c74c31a8fe0a79e5fd29bee", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692932676, "uuid": "75003a98-0aff-4bc4-9eb1-801f2875d299", "value": "T148D312270169295D0ED4D9FF43A3DA4A9DF8394F6932962A486C7EC70F1B33CA12C563", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692932676, "uuid": "b4bf9abe-fab7-4351-947e-594f50edfe16", "value": "3072:1NxNZACoZ4L+k2qZ4TRRbuA/tbsPl55gecIesCnAqakYRhD+j8:HxboZMqRRbuA/t4l55g/IelTYz+j8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692932676, "uuid": "d174d51e-e191-4461-a0ac-cc4c16a433b2", "value": 140014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692932676, "uuid": "cbef6f13-2b5f-49c4-9e38-03047e20eada", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692932676, "uuid": "e48f76fd-dca0-43e4-8970-26fc0562a350", "value": "Archive.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b396041-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692950359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950359, "uuid": "0a322c9f-a3cb-492a-a8a3-570a0b190fe4", "comment": "Malware payload", "value": "afd8e5cf16a995fe756faf6ccf8e15fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950359, "uuid": "d37e9b48-ed88-4c55-b51a-894c47d9695c", "comment": "Malware payload", "value": "6f3dbcffcbe63ba6106c43f0ea704f14ab24e5c9247ab246b17d37e9da86797c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950359, "uuid": "215addb3-1a8e-4ef4-9370-e6f5b11d321a", "comment": "Malware payload", "value": "0bca0468df0e23d222747ee186d19939d70d6075", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950359, "uuid": "721f916f-60c8-40a4-801a-347e37ed5b02", "comment": "Malware payload", "value": "87a0dc92205be99e4f7a5cac3ae3d91a505c989707b23bef1d3b2b9893b418bc45b75663ca7437797d649e8d0dc8964b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950359, "uuid": "18bc6b5c-26c8-4ef3-8d55-eb3b57005c0f", "value": "T1AF64CA1061DEA88DB1B33F9307DDB5EB4F5FF7B11B2A829D2144830B4A66E44CE95A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950359, "uuid": "c2dcd19f-e2e8-4161-8469-e50ac05821b5", "value": "6144:hAGQUj1pPA4DlDlDlDlDlDlDlV7/tQNQNQNQNQNQNQNfC9ApsCKQAnAMAMAMAMAR:hAIPA4DlDlDlDlDlDlDlh/tQNQNQNQNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950359, "uuid": "3e327de9-9224-47f6-9c39-b4965e5e0292", "value": 317356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950359, "uuid": "dfd2d88e-6733-4c37-9081-a935057bb8d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950359, "uuid": "742f00fe-1cfa-4fa9-8bc1-82cdd1bacafa", "value": "Data Sheet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9ad414-4346-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692968101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968101, "uuid": "dc5e40ee-5f5f-412d-b24a-a2a060c2950f", "comment": "Malware payload (AgentTesla)", "value": "cd906bc5eaeaec0ab92892fa08e8167f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968101, "uuid": "485cdfd6-5993-48d8-84d8-4b4fea41a85f", "comment": "Malware payload (AgentTesla)", "value": "70249c14b1e622eef7f76f457250cb280f7f6a1e76b76510b5158821d00ea47a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968101, "uuid": "bd9b6294-41ab-4375-8be7-bd8d21964116", "comment": "Malware payload (AgentTesla)", "value": "af7f8e1839d55bb61ac2b715f657aec63eea7e09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968101, "uuid": "1de5a43d-9b62-4c01-934b-732c245b7a98", "comment": "Malware payload (AgentTesla)", "value": "c616af6c6b786108c34f80d4e12908fcfd46073e4bdc49ec77e4a3979447408f14b225df2598b13e1e521d4a83e5ac6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968101, "uuid": "ed736d64-82a4-47d4-8394-7406d9b6ab76", "value": "T1872523109D145DE18E59827B58FF5E1C0A5F4BF00E4E6893E2A022DF725ED83A39FD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968101, "uuid": "16e179ed-02e8-4938-aea7-d53447dfb89f", "value": "24576:Pe+BQLGhXLwTYqsMsAmMTqBx117pMItUOM0p6d:hzc411mEUGUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692968101, "uuid": "d33a920f-6049-4a4a-9bb8-595f73fedc53", "value": 966597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692968101, "uuid": "3b64eebb-bd93-43ab-aabf-d298e7bf1ba1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968101, "uuid": "3f55dd82-6876-4303-bb32-97a03bd0d6e7", "value": "SOA 24 August 2023.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6719cc-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965341, "uuid": "b5319883-0b53-494b-9ecc-6cc1cd718a68", "comment": "Malware payload", "value": "fb386f0befcc837eb16437965becb51a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965341, "uuid": "7dff479f-4ade-447d-962f-8a80248dd7aa", "comment": "Malware payload", "value": "70283df045d35a84dad84ea8a4809e7fbdaba6aca5fb896409c6f195ab4bf7a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965341, "uuid": "d65ab60f-e7ee-430d-8fae-d47a5f7bade2", "comment": "Malware payload", "value": "0e872fde5242a3296bb65eabc8adb3c215fa0f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965341, "uuid": "6dc06fb1-b641-4826-a215-5305e000c378", "comment": "Malware payload", "value": "155b714537c94359c86d6cedc91c62975eb142c23910d4e500c2ea2a2a530022a11029a03037694f1290ef2828d3bd81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965341, "uuid": "77849f0f-7cd1-449c-b6bf-aec14c13e128", "value": "T1AEF53329AB6A0DA7FF76587C434224BD3273A9C400868D73732D1DA4892F59FD44CEA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965341, "uuid": "f529b441-710d-4cc7-8999-e82e1fe2b972", "value": "98304:XRbj92scwqfy6aBXjDtqFSRfBl0GoNjgwDY7SIu:V92sc3fyjagcVuNHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965341, "uuid": "82df27a4-58c0-4276-96cc-7cadaa8f3877", "value": 3323185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965341, "uuid": "99529220-f336-4e3e-afe3-8424358f9597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965341, "uuid": "d28323a7-f0e4-4294-a5a9-a0776059e511", "value": "fb386f0befcc837eb16437965becb51a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb792bf1-436a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692983699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983699, "uuid": "c73b5a6c-5372-44b1-a7ea-ada9523f7bbf", "comment": "Malware payload", "value": "b48808aa48def99c1d4f23332e8aa49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983699, "uuid": "f71863ea-d3c0-4e9a-b111-975f985024bf", "comment": "Malware payload", "value": "7030cf57b71fd090d5f606baffcea09b21849d996c5931419b2b93d6cf05b481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983699, "uuid": "88d5d384-9ff1-47e8-a66a-e9084722125a", "comment": "Malware payload", "value": "1853ca237e234f6f3683704dc4a19f57b69ce57a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983699, "uuid": "3ccfd4d2-cab9-4c77-abab-137c753b8e2f", "comment": "Malware payload", "value": "4acb5e42af11eff18936b30ee38da0b291a73ef60686d3b3e0bd58bc811cfde8128bf8623c611dc81c075e0c70f37d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983699, "uuid": "4cbd15fe-2e83-4563-a1c8-83d11d8d4c0b", "value": "T15F4522243591C5B7C4B2423542F4CB769E7631614329B6CBB79C93BB2F323D5A2392CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983699, "uuid": "76196f55-2f1b-4f17-97e3-befd044692c7", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983699, "uuid": "cb729b85-0158-42b7-b373-6d116ec1525d", "value": "24576:ik70TrcBDS/u+K2aQB1dL12pSZt5cJPG/Hjhm5nsHsM8vgc4ak6yQBK:ikQTABDS/VpZrj2pSZt54PGLhm1sN8vA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692983699, "uuid": "d5fdc39a-f707-4893-94ea-29dcd4d1ff36", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692983699, "uuid": "588490dc-dc8a-42a7-9614-177b19da16f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983699, "uuid": "75df8852-70f4-4dd6-a2da-04b4053196e6", "value": "SuWar3Tools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7886f125-437d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692991666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692991666, "uuid": "2d2fcbca-fa88-4ab0-b1ab-c0c32cb50519", "comment": "Malware payload (AgentTesla)", "value": "1f660b2a64ea656dc74fbd81a262a398", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692991666, "uuid": "534e133c-eea6-4e08-9d88-f9c1f48eb014", "comment": "Malware payload (AgentTesla)", "value": "710a6daeac2efe249ea8fc44279636ac5872fff111b4408c33b215171a564977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692991666, "uuid": "2ffe413c-8399-4bc9-88d7-f97a9f66343a", "comment": "Malware payload (AgentTesla)", "value": "ce67cc2c4d78f06552c2c6345bbcd745c0c51dd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692991666, "uuid": "8c76e918-e26e-4364-8384-59c8756fe145", "comment": "Malware payload (AgentTesla)", "value": "e0b97fec1461d4b25ad444213635ca0bcd5ec818ae9f2775684b86ea10ce88c2dad51bcce7b04f6f6ecab575352b85f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692991666, "uuid": "8ddb2b57-5234-4c47-8923-87fad73f5f0d", "value": "T16305F11062E88612E4FEABF546B016140B3BB9665733E34FCDD514DE1EB27C18A1AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692991666, "uuid": "9871ac9f-2aa6-4da0-ad34-753e5af2f9cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692991666, "uuid": "d396c59d-e90a-4e5d-93c5-3d2583e5e69d", "value": "24576:Lc+kcgcnAhChPD9izmUgELI9fpsbg1ISp:Lj1goVFZiyUgELaBsMi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692991666, "uuid": "93f7860d-9737-455a-a291-559871920e5c", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692991666, "uuid": "bbf0e715-a654-4c91-9df2-572bcf130e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692991666, "uuid": "df374e07-df01-4718-a5fa-5727414d1357", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.4080.20770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfbe353-433e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692964832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964832, "uuid": "f6ff52ac-c93c-4afc-8183-46922efff369", "comment": "Malware payload", "value": "565c04530e6ce4525fcdf633a553f805", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964832, "uuid": "192a4d1f-3424-4ac0-a0e1-71f448d25510", "comment": "Malware payload", "value": "712cdb242e09199be4674b93d488617e014e4fe184cff7a7422a8573a5e7cf1d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964832, "uuid": "ff1e5d92-0e7e-44f0-bb5b-c3c11e5e87c6", "comment": "Malware payload", "value": "e3f8a5165cf037421f30712d2836ccf0bf6e2be1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964832, "uuid": "242258a4-772c-4ef5-851b-ccc9dc777018", "comment": "Malware payload", "value": "6db849891da5b71a42ddb812530e2ca63ff65d5cf65f01fa1682a5ade0ecda3c9f9ac227e19fa9e5746c6a77eb06a447", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964832, "uuid": "7dee5d00-fa55-4888-a469-60e4178988db", "value": "T190D0A9426C8DCA0500A0C8F6023CC4FB6F8A3A60CB1C7BB13F84400812B087104AD10F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964832, "uuid": "a315abbb-3104-4d13-a380-0f2d7602825d", "value": "6:VtGTPxkYM/2jL4P5PaHrxSTSu5cFaqgPSxf:VtTYeULkMSTXUsSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964832, "uuid": "596a17a9-7295-43ed-951a-675e2d6daf9d", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964832, "uuid": "f4d869c5-c3f3-4ee0-9829-9e32d7e5ce0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964832, "uuid": "24d95201-24fb-40c6-9119-58006d71736b", "value": "565c04530e6ce4525fcdf633a553f805.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abde99f-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934171, "uuid": "899f10cd-f9cc-493c-a75b-e943295f03a6", "comment": "Malware payload", "value": "a755367c6fb9f0577ec7da61a67202bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934171, "uuid": "dd7a3db5-2d00-4d5c-9048-bc4ebf8bccc4", "comment": "Malware payload", "value": "7227f685190fdbc1fc283d54f2d37c1f358580e45d0e10cd710ddd7ad8b7c261", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934171, "uuid": "c25e2a11-cdcc-4a41-a516-28a78c709a68", "comment": "Malware payload", "value": "7a1318666010f8df15d744657b8d947dd19b0971", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934171, "uuid": "ff62dd06-a873-40d3-98ec-94dc0b17ec6a", "comment": "Malware payload", "value": "a736e5c76d8a9be33a6795a980533a09447121e58021b887336a2325e895152bbbddcc3daf2c019a613dacb5b39929b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934171, "uuid": "27b0dc41-029b-4cc5-a265-fce10f313d1a", "value": "T1829423DF3A4B452DEA9172319A482B07CD023FD55F9AFD4B9A547AC408B1EA092BD708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934171, "uuid": "43240fff-4df3-4f11-ba11-f7fe5673dc36", "value": "14905dba7f800ef66e7d7ca9c6cb804c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934171, "uuid": "07c8d4f3-4348-414c-a5a2-23e10f04dbb8", "value": "6144:x2HFHkDEyeakrZ7DRosufiGui0tHcyvB8Hy92yOOaeNbjb15POAozUg2K1wttaOY:2Hk2prZnRoliy0pGS9SOfhb32Co+CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934171, "uuid": "a83b6a2f-a890-4b01-b6c1-69965fb9a1d2", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934171, "uuid": "bb02d1b4-a22f-4cd1-97ba-5776d7f3f501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934171, "uuid": "8f64d79d-0cfb-47a1-9471-513c3a58ff19", "value": "SecuriteInfo.com.BAT.Siggen.197.4891.210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57fa92b-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965220, "uuid": "27b1fdaa-b50f-4a89-93bf-f87edb3d7fa5", "comment": "Malware payload", "value": "ace775059d12342c2acaccba11998d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965220, "uuid": "e337e126-f03b-494b-be2c-941112f656aa", "comment": "Malware payload", "value": "7238971f65e75209d212e917f84b28fd0d78c2c0d0b2188a65b24d16ebd8f047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965220, "uuid": "c6115afe-d032-4af5-bc24-4494f3d12030", "comment": "Malware payload", "value": "b4b3ed9f1a46b638ec32d0766459442a76efbef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965220, "uuid": "b62f6b4f-8e73-488a-bce5-de1f5e54dd76", "comment": "Malware payload", "value": "23be4e03964fda95c7d2c3a4dd600d8a68f8b8dc2583d782f1417978af423477cbe6aca0628c942fef54133b2a2ec52b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965220, "uuid": "1affec93-b588-418c-a215-7a747f4a49a1", "value": "T112653332D3D74EE5C82B78BE182B498BB4B2E0598E8B19E1C5D95F74812DC14C9CFB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965220, "uuid": "9be98acc-17ce-4990-baa4-94bbe2eef1a7", "value": "24576:0xfa2oqAg0dikLjbI3X5eQabnUQ64ByZ7rHMhPaYtCDAH49h9lY68TaFuhfW4Hzz:Qa210dynSnUQ64yZPM1aYtf8/YXO+fE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965220, "uuid": "f28f0b3e-960e-4ad1-9c20-386bb08320fa", "value": 1477816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965220, "uuid": "c1eb290f-ab64-47e8-8044-c618f099e106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965220, "uuid": "83d5d43e-16f7-4cd9-8ee3-cb778f9d9cf6", "value": "ace775059d12342c2acaccba11998d79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537852c9-435e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692978290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978290, "uuid": "581786b1-018b-4e77-9020-6723a0d3df7b", "comment": "Malware payload", "value": "5e6716377dc71d7fa5c97d778c154ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978290, "uuid": "a64ca7d2-4ac1-40a9-8542-926ffd1fcef4", "comment": "Malware payload", "value": "724bfaabd60cc24321154d31edc012830a85aa2597275702364e7687d3abcf8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978290, "uuid": "f54c9f31-0268-495c-933b-58a91b35d4ec", "comment": "Malware payload", "value": "b7622c83b0dfb2250e87b70c189925afb6abe5ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978290, "uuid": "8e19dc93-7ea8-4938-80b5-bb7f919b6107", "comment": "Malware payload", "value": "dd9d58ebbd557dcd77bddb887370e6aeb2d7e5f48fd372615ef7f4e8e6a477ecf0b0107a876696813e2b3002def2c379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978290, "uuid": "33d7f545-f982-4e2a-a65f-efe2094a3add", "value": "T1B7A63314DF97253CDBA8833C705F0F2E63805FC900B8A2EB43D2388759A5B5B59679B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978290, "uuid": "a5e5ca05-608c-4a4d-a4bb-0aeca6daa817", "value": "c9a3edae9204609d90d0770c3583acd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978290, "uuid": "cbef18a8-72a6-4444-b414-7f241ca25a59", "value": "98304:dG94hQQPjg4HU+DTwl9zOHz7t1Q5RRlWY9HJ3CChZfYQmGkHxEWmUbpapq6LC:dGmJg+U4TIqY5BZdwnGIIUbpa3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978290, "uuid": "8fd6d827-98b8-4507-87fe-9c73cf67de0c", "value": 9980956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978290, "uuid": "1b99ad20-81b5-476e-a36b-fa4b4179382b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978290, "uuid": "4f2188f6-e221-4b11-bdd3-d7ccb86fc84c", "value": "up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0e92ff-4312-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692945607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945607, "uuid": "7d1de83c-54b0-4911-bdfe-c78767ccaaea", "comment": "Malware payload (DCRat)", "value": "4b4ef852a2147cca41bf3c73e79da6f2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945607, "uuid": "d5d1fc0f-d4c1-4c30-aa64-0d5f5129d6d5", "comment": "Malware payload (DCRat)", "value": "7295000cbc8bae3dcdc6fce425968de7e6afd4929b8799c579c8b00859fe1af2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945607, "uuid": "00c5fddd-b39c-484e-89b4-243d0272d76e", "comment": "Malware payload (DCRat)", "value": "6337e2f6032cdbb1bc259355f04e2ff610233b55", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692945607, "uuid": "c0b52d1e-d652-447b-be87-dd81435c2032", "comment": "Malware payload (DCRat)", "value": "93f069a8494a858243096a3ed48a2f788d255bc39a27ffdb92bc803fdcb295ff283391cf49b25d40ddc289b604db30f5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945607, "uuid": "bcce81ef-5c11-4bab-b8fa-d8bfade745e9", "value": "T1EBB5AE017E44C906F0482A3BD3FF770857B498912E56E71BBEB937AD5A123827C1D9CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945607, "uuid": "3a13f44b-a606-4a63-8ca0-a6dbd2c3bc77", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945607, "uuid": "e19cef9c-878d-4cca-a169-f1e0b2479a11", "value": "49152:lbA3AwqEjBAtuU9iv9u7BymXIKFPQd8t+/iVkVK2Kec2:lbd30ePQdObVUK32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692945607, "uuid": "93c5b152-39c1-4920-b977-57bb4ff5f52e", "value": 2288765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692945607, "uuid": "618f6458-e010-4fc6-a5c5-e63ffca6f26a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692945607, "uuid": "76d9ad12-7b95-4241-bc16-8327aa8682cc", "value": "4b4ef852a2147cca41bf3c73e79da6f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3595e4ac-438d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1692998426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998426, "uuid": "dc408cd0-2c29-40ce-a7fb-f6d05df10fed", "comment": "Malware payload (QuasarRAT)", "value": "10391a2098f163fad5e1135951611bb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998426, "uuid": "cd3cf8e9-a51e-4737-a5a9-991daa8f2921", "comment": "Malware payload (QuasarRAT)", "value": "72e8ea93fb9881413437161535b9a6206f7aabeafd9b86b025f2b7e32025ffdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998426, "uuid": "d21fbb58-b9c7-41ac-9159-30e2d40e43e3", "comment": "Malware payload (QuasarRAT)", "value": "cdab5eb1e1e96bd33cc033945d936b4b294e1143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998426, "uuid": "673cb42a-fc89-4643-be07-4766d7a19782", "comment": "Malware payload (QuasarRAT)", "value": "3b15a21c9bc20dd4514976ea34b4f76effc2909208d5a3a5013394e53a7cfec3c5667118c6031b894eead27b1315f751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998426, "uuid": "1895cd4d-a486-4e88-8902-8c738fdd7556", "value": "T1CF86F131368AC53BD56205706A2CDBAF5168BFB90F7294C7A3D81D6E14F48C29732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998426, "uuid": "42b92309-c3af-497f-9bac-1ebf0dacc1c9", "value": "1ee3b0da38e7b7c567f93f357ca3751c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998426, "uuid": "e4bad220-eb09-4227-930f-a4603ce23cd3", "value": "196608:svGacofn0Xj7N1taPox+MKCSKVSn6rhyyDryI/wTC7xhw/oC4KEgU:sveof0Xj7rL+MGYSn6QSvNhCnjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692998426, "uuid": "0a6f8249-f593-4d4f-96e3-8dd28940da01", "value": 8352971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692998426, "uuid": "ea3703f6-a0c7-48d1-be69-01697925cd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998426, "uuid": "d774ee91-c0e8-45c2-beb4-55eb89ae42ba", "value": "10391a2098f163fad5e1135951611bb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee049dc-436c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692984322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984322, "uuid": "3bb326aa-85eb-4e53-bcd0-d85d68348e82", "comment": "Malware payload", "value": "272aed61688de87528ba5af6065ef3f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984322, "uuid": "3f1482a0-44f9-4af0-b513-31387b6c718d", "comment": "Malware payload", "value": "73d0ca4e9556aa9f556f24eb205fb741584f053551da5943500afc227e3cdce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984322, "uuid": "3c125614-b3ca-4271-a6c7-13e688728954", "comment": "Malware payload", "value": "6c98b9238525d8c6a4c496b848e86053af2cfc4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984322, "uuid": "87560693-431e-4bed-88db-9d70e49c8ca2", "comment": "Malware payload", "value": "a60f3f479c6c6198bf95a1e791a8415e4b97757eb147dc14a6226af897123a747065a6277a1680ce63b7a1ed59427064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984322, "uuid": "bfa66c16-0c79-4ae9-8b54-bfcb1007e770", "value": "T1AF15230BB7DCA076ED7163B028FB16974F36BCA05D74476E2702A84B4DB2646B930367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984322, "uuid": "60b80142-4584-4789-93f0-657b3c3d0250", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984322, "uuid": "fd61f0c6-18f0-4982-85ec-0c38668d6537", "value": "24576:RycVc7K5e5wFV5VhXBZlrhjekh9yueyw:E8cu5WwrBBZlrh6kuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692984322, "uuid": "ed0e8a7a-cb10-439b-9568-8c932fec8013", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692984322, "uuid": "22c6a329-cc59-44d3-9352-7bab31847c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984322, "uuid": "2f6a7779-b542-4e06-b797-9621de68b064", "value": "lega.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5d1943-436c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692984507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984507, "uuid": "3692eb52-a416-424c-b5d1-a27910bb3751", "comment": "Malware payload", "value": "0d1406a11352d6f3b9c5dafe7e946766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984507, "uuid": "1f1b44dc-41d8-411e-8a23-db54c804b995", "comment": "Malware payload", "value": "748d2d83f341bd9b2addd275eee5fee2abf10dabbde294446d37461eabc11c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984507, "uuid": "89481e92-af50-47db-a0b0-f454901926eb", "comment": "Malware payload", "value": "6cf8d28a621c0718e3faca40abcc4b9f9de93d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984507, "uuid": "8262f21f-4c61-49e8-bf06-70d37c01f122", "comment": "Malware payload", "value": "e42d2a5e9d3451eadebefe90d612be631096eb9f4b4387ce7ed01d2ab1840e146f0b599c4dcbcb134a978ff52d3a194a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984507, "uuid": "7f2d0759-8fa5-417a-a7d0-1205b9f57125", "value": "T1A7E42302ADD4E043E893FBB512E496FB8DF4760425795A472FD4539D39F1EC2AE2E202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984507, "uuid": "4d816e05-8c52-4dda-9b74-7a9e3d5a63ef", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984507, "uuid": "75da1858-c112-415d-910f-e978619573fa", "value": "12288:uZ6+WF+RKaDPNKT1zH3ptaR1sDfOQSvJqFZ6qMa+sl7rfcnuE4AcUsl:ukT+MaDu173pG1szLSvJw57EnN4Nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692984507, "uuid": "90d3b663-45c8-4e20-a9fc-ddd5fecc074e", "value": 677016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692984507, "uuid": "00a2e67d-28c9-4afc-a2ab-d3957bce8dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984507, "uuid": "4ef246b2-dd02-46c4-b410-547cf6a772af", "value": "Click.Here.to.Install.Ouroborosbrowser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94acd056-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934161, "uuid": "9e002cc7-89a7-43ba-ad3d-baefb56a1547", "comment": "Malware payload", "value": "78675ab97001530c67f97f50778d253e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934161, "uuid": "32c12f84-5cc5-4fe1-81ed-cc8e2a71c259", "comment": "Malware payload", "value": "764079083ae9b54892a2da1aa4dc2b6ad581072bda335d3f3bc65b08673ded01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934161, "uuid": "354fffcb-61e5-48e7-82e0-efaeec453407", "comment": "Malware payload", "value": "9d2fa20fb32f091ac6b755a0fb4268c9a580d475", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934161, "uuid": "f6e899fa-6381-4738-8d3e-e19f0bd87863", "comment": "Malware payload", "value": "a0b7748cd5b99bfd403a968db248c9ee629a670748d985da7ad5a92017cff498929472a2621514e8ac667923936a818e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934161, "uuid": "db1d3c8b-f4cc-42b7-94e8-9e29dfe601a9", "value": "T180A48D11B6D6C836D5BE06B0362DD39A0169BD7447F284FF23C84E2E1EB24C15636EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934161, "uuid": "b5561fa6-6b1c-46f6-9272-d1a2a988d530", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934161, "uuid": "7e976d78-fa82-4953-9c8c-9130928e1433", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHA8f:yBqnGIQ5M6DLrVVdWHA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934161, "uuid": "c0c58b89-6c73-477c-9736-8f75baf0a6b2", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934161, "uuid": "a82407e2-9b9c-443e-b095-cdc17b89445d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934161, "uuid": "9108d539-32ba-413d-8b5e-75ad14d1eaa0", "value": "SecuriteInfo.com.BV.Obfuscated-O.22294.7195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8c4631-434c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692970821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970821, "uuid": "b35da277-6606-4509-a574-9884407c9b6d", "comment": "Malware payload (RemcosRAT)", "value": "2fb6784dad98d36b5b0dbf94bfbaab88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970821, "uuid": "a599b53c-a4bd-4f5a-aee2-a7cf4453387c", "comment": "Malware payload (RemcosRAT)", "value": "781ffcd3281973496019906d76fc8c52786e7ab953292d8bab44865c8d6c9207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970821, "uuid": "638d4d89-6391-443e-854d-b621e12c9a76", "comment": "Malware payload (RemcosRAT)", "value": "b6d2c04ec5df02c02695cc7b83aaca8a9f188edf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970821, "uuid": "8b2dbbcc-d6e5-427b-92a8-8ce66822fa55", "comment": "Malware payload (RemcosRAT)", "value": "6cfd13d6c2a388e7eba1fa29588cf9761d4b0398e3eef3ecd497a9bb7b47fb7c4827ce676f3fcfa1ae435dd25357e940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970821, "uuid": "73056006-6d01-456e-b154-bb4bc363eed6", "value": "T1FF65E051E2934477D1777A34CBAB52D6D86D7F302E2CA50E66E43E58CF3638138262B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970821, "uuid": "c391e1b1-43f2-4097-9ef6-bd1c7853d3de", "value": "555fbb180099f7ea0a0860999295d5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970821, "uuid": "5fb53a6c-6439-4b93-a9d4-d06bb3ce6d53", "value": "24576:/UWyWyLFqghcA0n9WUS20tFJTtf7BtdZhPKR/UW0YEq0UxX8OCTL5GJ:/UWX7WUktFJT5BtdZPWWqxxX8O0L5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692970821, "uuid": "bd44d659-c76f-4d9e-8238-e92952f2ea8a", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692970821, "uuid": "ddb90c83-5223-49e5-abc1-1d5cf7770228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970821, "uuid": "373c8780-35fe-46ee-8bbb-6ea04e893a34", "value": "2FB6784DAD98D36B5B0DBF94BFBAAB88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d169e84-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934175, "uuid": "d5d9e028-a72e-4980-a914-164390970042", "comment": "Malware payload", "value": "36e98d4c2ecd65705b620f9d163629ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934175, "uuid": "2e47353a-50e3-4ca8-94ec-b9af81e30a2f", "comment": "Malware payload", "value": "791fb3ec6331533601c6b84581dd86977cbf6b1222819f4bd8f60d21ae3379ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934175, "uuid": "f735af02-096b-4421-961c-51396ce72151", "comment": "Malware payload", "value": "fedf37787358a9cbd4b148cc50e2ba33498eb67f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934175, "uuid": "75f2c79d-ac89-4c42-bde5-6848ac9cb40c", "comment": "Malware payload", "value": "9f0c251347f6e4849bb370d700e54797877015d863829b386088332ff79dc8e294636ac3b10610faed676a7bcc6ea372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934175, "uuid": "5059bbbe-2612-4b6b-9ced-f41353ce2a20", "value": "T11C159D117BD6C432D4BB05702E29D76A452EBD304BB188EF63D80E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934175, "uuid": "df3c153d-5d43-4b7b-b72e-a10ad197aca5", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934175, "uuid": "c35e6d37-8082-4734-a567-f7a130af2680", "value": "24576:iyyzQyz5io+HExGWUAyiqZmYkBqnGIQ5M6DLrVVdWHAt:irz5io+HGGWxyzmY2lrXVVdWHAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934175, "uuid": "48377c61-07c3-48cd-902b-370980825bc1", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934175, "uuid": "05022cfe-7932-4206-9c49-650b3976af15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934175, "uuid": "34ca80d3-dbe6-4f6e-9982-1befbc9ea66c", "value": "SecuriteInfo.com.PowerShell.DownLoader.1445.32391.18171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960b26b8-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934163, "uuid": "4eac96ea-99f4-4d8f-9823-f3e802b4bbae", "comment": "Malware payload", "value": "58a100c519218166c6b5edb9a2aa85d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934163, "uuid": "15a48cc5-662c-4825-99e2-1e2bc100c7d6", "comment": "Malware payload", "value": "7ad772469e294eaff7660e3970e4fa47c0e6a5ef8a1b80fbe5edf4bf11d3326b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934163, "uuid": "7d1e0d30-2fe0-41e0-b604-edf8343f09c2", "comment": "Malware payload", "value": "41eaea78d543b23222fa217056a28c6a1ed6e497", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934163, "uuid": "746bd8e9-db68-45f0-a28f-14e0b74a7082", "comment": "Malware payload", "value": "70a1b8507a6e0571e2477b261e1d72040b4a165b307e812cb405cd30acf33676b01a0fac25cb119168f5b4cd376eb5a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934163, "uuid": "b4e8b5e3-daac-4b83-bddf-9c3b82f13010", "value": "T12615E01276C6C836E5BE06B0361DD35B442ABE6447F284FF23C81A1E1EB25C1563AF97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934163, "uuid": "ea4152ae-fc7d-42bb-977f-53bb8bcc91a6", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934163, "uuid": "fc800176-0005-462f-a646-f397bc23564d", "value": "24576:yBqnGIQ5M6DLrVVdWTAekerRRolsGkXf9mCRCZ:0lrXVVdWTAeker7CUXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934163, "uuid": "68cc1ba0-0194-4866-a13d-e895e60110e0", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934163, "uuid": "0ebd64a5-fee4-4e4b-a262-e8c0b8984022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934163, "uuid": "c53a3df5-80ee-4eed-b154-3aec6276633b", "value": "SecuriteInfo.com.BAT.Siggen.197.9325.11946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7eb95f-4372-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692986945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692986945, "uuid": "4b5db35d-a24c-489f-b498-9fb7f2a25869", "comment": "Malware payload", "value": "b427f0da0de80d69c4ecaafd3a8ba4b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692986945, "uuid": "a8d60d04-0b66-404a-a8e9-0579362e7b3d", "comment": "Malware payload", "value": "7b715d06a2244e155af705038afd7617a9a91663f488ca7486f669491246ee0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692986945, "uuid": "c5b1cf9d-0085-43e3-abf1-abafab52c705", "comment": "Malware payload", "value": "45792e0799395f50f805bdf4fca1a661962c1731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692986945, "uuid": "6fd7e156-05a6-418f-a7c8-b3b9b0613dec", "comment": "Malware payload", "value": "638c0dd372b4d2c2996f7addf2e57ede7ade8f9b33ca1b38533ffdb885915669eb5a5175102e6bb8cca1c4283c5c8ca7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692986945, "uuid": "fce79f2b-41b4-4843-b620-40a41a36cd65", "value": "T19AA4B403BA4786E5D1481B36E59B130043ACDA91F7B7D70E794A13A6D923FAAEC0DD07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692986945, "uuid": "ac0c3f55-fbf5-47ea-8cc8-6ea67bd402bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692986945, "uuid": "180076c3-948f-44a1-97a7-2f8e47411bc7", "value": "12288:tGT+hKgdBsRtSeY4OeTaUXSkt7rZ/iirsO8mHwUar1ACB4F:oTJgdBsRoeY4OeT7Bt7F/i+F8mHcBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692986945, "uuid": "6eddf304-c2df-4e0b-84c4-12efb9dc9d79", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692986945, "uuid": "77a92e23-cf05-4b24-8423-be5e2ae73bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692986945, "uuid": "c3fb837a-bf26-448b-a866-95c636760243", "value": "b427f0da0de80d69c4ecaafd3a8ba4b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa09bde-4308-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1692941526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941526, "uuid": "40a52da0-8289-4501-bfca-f3761a57e4e3", "comment": "Malware payload (DarkCloud)", "value": "d3f9c27bd4524cd81dc5b5c7949e48a4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941526, "uuid": "0a8856e0-4b07-48df-89e1-e7e44d04a09c", "comment": "Malware payload (DarkCloud)", "value": "7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941526, "uuid": "bf0a06bf-e57b-43ce-ae94-33383c9b5a5d", "comment": "Malware payload (DarkCloud)", "value": "461fdb08d2c272897f3adee0f0668dc462612c71", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941526, "uuid": "c4f5f865-8708-406e-940b-8658376b2b71", "comment": "Malware payload (DarkCloud)", "value": "d29f036e88fc921bd96371df17a35eebd165d5a76332d64eb37d29ea3e9d8a9f21ceaf33498cad723429c731dca67d9f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941526, "uuid": "97396700-aa6a-4e1a-9e3b-e4e95aa3c31a", "value": "T1B5659C03B64B4DA5C34B1BB6C18F24444FA9D5913723C79F7C9E3B92A9023AABD85D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941526, "uuid": "5cb9ae42-c224-4945-af3b-7af405b9b385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941526, "uuid": "9ad438bb-d3b3-4da8-91c6-bf4a6ba86500", "value": "24576:P8OP09xqIi4CdeZaqW1a8soHcxdBz7U2oGm8aO3ZmcL1UoQPqhnATyHtTI9srDru:eZKT8xdl7NlawZlGoQSniyHvrnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692941526, "uuid": "c39320e8-f49b-409f-9a91-bc0181ee4b13", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692941526, "uuid": "c92fac45-d18e-41ce-b565-066460a6f08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941526, "uuid": "bc8bfb63-711b-4c8a-a9b9-02c99a6c2ec8", "value": "SecuriteInfo.com.Win32.CrypterX-gen.4163.17450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648b082f-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692965433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965433, "uuid": "a317905e-c2c3-40cb-9345-e513db11d80b", "comment": "Malware payload (Formbook)", "value": "82509179ae02b794147a0c601d18a68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965433, "uuid": "97c36356-b58c-479f-a930-566dafebfd98", "comment": "Malware payload (Formbook)", "value": "7c0bb2ead00541fc272a4aa0b7b66f2471baae88f5ac6c186e37f5bab0615886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965433, "uuid": "28fd0db2-d29c-490d-881c-b5617a902a26", "comment": "Malware payload (Formbook)", "value": "bb84ddec60aaa0f713ed7129c389d2d87297c6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965433, "uuid": "c7b581d6-aa79-4870-90eb-402847bccd36", "comment": "Malware payload (Formbook)", "value": "6229350f8100b1bf99eb47c5661bcec37d85dc860c266c45c16e81d3d57f7d6daee70e168d6308b9a8784c21b01e53f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965433, "uuid": "a62f125c-f1c9-493b-a6fd-f353d0f04d3a", "value": "T125F4E01062E89605E4BE6BF54AF406480B3779661A33E34ECDE524DF1E727C08E5AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965433, "uuid": "6a5a5ae9-d124-464c-b3af-310fd6a9d12e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965433, "uuid": "94ae8687-17ad-4bbe-8241-64083d714c98", "value": "12288:X8cxVgEuYdTuexV8LR9dEj+y/Dp9Ea7Pl6MysCVC9x0e9daDtN5nEWSp:scHgytxmR9OSy/H1p6nC9xr98xN5EWSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965433, "uuid": "76f7155b-412f-47d1-9731-fd3f11a4af95", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965433, "uuid": "fe91e121-4c7d-4f47-b016-8d7c8a87a19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965433, "uuid": "2770e104-e6a5-4c08-8696-989d7f388ba6", "value": "82509179ae02b794147a0c601d18a68b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3462a8c2-435a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692976520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692976520, "uuid": "2940a73f-b7d0-4695-bf25-7cb6cbf50b16", "comment": "Malware payload (DCRat)", "value": "1f8400692470dd121cfda6737c807e50", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692976520, "uuid": "7f75a237-f8ba-4fc8-83c8-208e11b8c636", "comment": "Malware payload (DCRat)", "value": "7d056307a41192d01f802f44ebcaf1de115e0bfaff589a83fd3bbe6d44dec2d6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692976520, "uuid": "3aa934b2-12bd-4513-ac94-d9260835179a", "comment": "Malware payload (DCRat)", "value": "f48cca396228eb9884518c4ce6152f70c1dc8e1a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692976520, "uuid": "05a6eb62-9be6-4782-b664-bf8921c6c9da", "comment": "Malware payload (DCRat)", "value": "194d8efa124e48391f235abc1b699e8a8ecfe7e26da409eb24fb46b451ad5e4120248a3039756a45c3fcb97cd54dc18d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692976520, "uuid": "fdb3f044-a369-4684-93ae-25ea79fdc9be", "value": "T13AD5DF027E44CE12F00912B3C2EF454847B4DC5167A6E32BBDBA77AD55123A7BC1DACA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692976520, "uuid": "c4eb2b01-df4c-47a1-be1a-afb12a9e4bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692976520, "uuid": "5c7c0a36-6a37-44b8-81a3-3694dcfc4ad4", "value": "49152:qdBV+rOLgir3SQgHPmfW8RHWJGLEnq3IsfQTOOxp:q3p77SQsOfn56G4nmI2QT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692976520, "uuid": "81fc5e9d-36c4-4207-aee3-23e7724a5393", "value": 2850304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692976520, "uuid": "c3afdfe9-abb2-4492-839a-d3adb97e9105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692976520, "uuid": "c8b757f5-b11c-4578-99b5-fc559527d76c", "value": "1f8400692470dd121cfda6737c807e50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e042d60-4323-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692952860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952860, "uuid": "b9efba6f-479e-4b68-a885-4dc60917fee0", "comment": "Malware payload (RedLineStealer)", "value": "e77b875d3c8979eee735cccb9ff72be4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952860, "uuid": "448411fa-afac-4ad6-a3de-1c48bd816718", "comment": "Malware payload (RedLineStealer)", "value": "7d5fffbfe8d098e369466164f705b4d692517a2b4659a03901daf67cf78553fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952860, "uuid": "70b4d6d4-7a5a-4002-bd78-7956c6be5419", "comment": "Malware payload (RedLineStealer)", "value": "1418a64cbbe8a0233628f484e32f63d756729c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952860, "uuid": "870650ca-15e2-4579-afa5-4626a2b7de68", "comment": "Malware payload (RedLineStealer)", "value": "96eb8cbe1a735e051b015bdfe76618c0203c9dbaaf52032611dc1aa0d45a93c249e07414b426a9e65af29e5cd9f217c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952860, "uuid": "7286671e-f063-49f9-9ab5-5a2525f09cb1", "value": "T1AA653C0176F95B59F6F31FB86A7AA611487AFC6ADD31C79E1260500E0D31BA0C970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952860, "uuid": "39d8e50f-c5a9-4d74-9c70-c2ea72ddb87f", "value": "0ec4a323102601b2420df41f5a796f75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952860, "uuid": "f298d2f7-17b1-4cb0-abd7-3173b85954e6", "value": "24576:clWxgH/mS5gddFDyhZ2P7ZZJ4jV248XTka6NThfg266:cnmS5gddFehZ2FgV2RTka63fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692952860, "uuid": "e258edca-3ba3-4457-9752-7ebb4672ee08", "value": 1478144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692952860, "uuid": "ab960ce9-163f-4eb8-8f9c-e07597aa473e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952860, "uuid": "6423a3ca-67bb-4a6c-a33c-95f6174c2562", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56739a9d-431b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692949518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949518, "uuid": "17f4aa2b-e91d-45c2-8f05-5c3c37c12ff3", "comment": "Malware payload (SnakeKeylogger)", "value": "fe01485cbbdf339c247aac12d530e864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949518, "uuid": "31d3dac2-b128-496e-888f-88368bed6a68", "comment": "Malware payload (SnakeKeylogger)", "value": "7d791babd4dd8e2525bd8d999289756b1f4d145e3c0449d6c1cf7232676b4458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949518, "uuid": "867e945b-c024-4ffe-8e61-11c1917baa13", "comment": "Malware payload (SnakeKeylogger)", "value": "6cc7b0291b0b16b58cf03db577022b77925ed19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949518, "uuid": "601096e9-1262-4cd1-b9cd-938146a006c6", "comment": "Malware payload (SnakeKeylogger)", "value": "43fc66ccf65bf75debc68e1b31069873c947f765626c3e225b6595f28aa9fb35270821e28d7010fe8e89230ca36e77c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949518, "uuid": "2be96356-8b95-4bda-b150-04a914ea8746", "value": "T1DF152FACAD9C5187E728CD28668F253C1C66D2126D6AA390DFB7C4D71F902073A5DCE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949518, "uuid": "5ea43ceb-6e35-4aa1-951e-b81595a00727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949518, "uuid": "1fe35927-c450-45f2-a3ad-40656d031da0", "value": "12288:mQm5DtTDx4bXIJfucnFedt2afmK+gHZ0SWr:wv+XIJmcnoPYgHZ96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692949518, "uuid": "a6a07c96-6013-436b-8a0d-ec495b3bd08c", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692949518, "uuid": "b2acea0e-7099-4587-8078-ca9ca582f4c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949518, "uuid": "8936a4be-82e7-414f-904e-81914f75a59b", "value": "RFQ - 0000565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c631d3-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1692964957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964957, "uuid": "95affe6d-6c93-47f3-b7bd-3b8cd494e46c", "comment": "Malware payload (Fabookie)", "value": "c9bfc252f334efd39b71a676aac1722b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964957, "uuid": "83f6416a-e245-4d50-b153-0db3e162bf8b", "comment": "Malware payload (Fabookie)", "value": "7db03ff8a8f7a96bff02870cd5975b06ac52f2816a7c4ee8f2473a301bea133a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964957, "uuid": "799a5d8b-8531-491f-b81e-27214827c24d", "comment": "Malware payload (Fabookie)", "value": "882c540a3d5e3b4a365408535c036f7386fc7814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964957, "uuid": "4bf5bc6d-77ca-4720-aa78-ae4aa14fdb2c", "comment": "Malware payload (Fabookie)", "value": "1aa3a3b9ea2ccf44f9f2878214e6f78728f7c2b87375e158ec2cec7c3e9edd458e3a06628ca4087af040fbf4db2b5cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964957, "uuid": "7de7a522-adb4-4978-aba5-53329f677090", "value": "T19184DD64F0B2ECB3DA126B7039FCF91C91AD71551386869E365AF0B692D330031DDBA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964957, "uuid": "111fa9f0-46ae-40d2-81ed-c504b1c223f1", "value": "96cc98468ed325b3857363887597bc67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964957, "uuid": "f56dd82e-ef81-446d-87e1-51992591d560", "value": "1536:qyK9MV0CLSuOCWqeyGaOi2K+Sm6uCWqe+aOi2K+Sm6uuCuCWqeyGaOi2K+Sm6uCN:qX9M1uuNnAYy4AZ67vcgJFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964957, "uuid": "2c6f88c4-3e52-4c3f-a598-f825d8539cb6", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964957, "uuid": "9472b948-cd11-4993-8192-ba369f7eccd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964957, "uuid": "4824e00f-4cdd-47dd-a1f4-5e1f0e452036", "value": "c9bfc252f334efd39b71a676aac1722b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9217fd3f-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934157, "uuid": "33d09951-c159-4ec1-8e6b-123e32ac9266", "comment": "Malware payload", "value": "ef7e03e9497349350e35e4067296b496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934157, "uuid": "a7bbdefd-12da-40b3-af39-c20d7234265a", "comment": "Malware payload", "value": "7f6a22cc0e0b5ee908e631cfd8b4d0a4613109b97c5df7cf91f755099330fc5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934157, "uuid": "8dd953f0-4405-468c-8f5e-409608eebce7", "comment": "Malware payload", "value": "f04086877332b358213ae0f657d5b0abe613c566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934157, "uuid": "159b72c7-da31-4cc8-8660-5252cdadc9a4", "comment": "Malware payload", "value": "c70125cf9dda95efd3310f491fadc0074393296c0bfb57da85251399bf7e9086579ff85c768fd5b7fddb46253e64b7f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934157, "uuid": "34a1af4e-a05b-4927-9369-cdbc7adcf380", "value": "T1BF159D117BC6C432D4BB05702E29D76A456EBD304BB188EF63D80E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934157, "uuid": "0f7f373f-2771-4eee-ac61-77152a94e767", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934157, "uuid": "216b6220-f71a-47d0-8404-c00e16366130", "value": "24576:iyyzQyz5io+HExGWUAyiqZmYVBqnGIQ5M6DLrVVdWHA+:irz5io+HGGWxyzmYzlrXVVdWHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934157, "uuid": "4a55d004-03ce-4464-9b5d-01e7c9ac69f1", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934157, "uuid": "ceca5c5d-074d-4482-b075-85117446b5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934157, "uuid": "7f21e86d-1da5-4161-a595-e80fd628c1d0", "value": "SecuriteInfo.com.PowerShell.DownLoader.1445.18323.889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebe9825-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934151, "uuid": "d5d08c49-dc99-4e4a-bae4-efb072f3c900", "comment": "Malware payload", "value": "98346774f9e40150a2e51fb7606241f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934151, "uuid": "7be1d9d9-5f86-493f-aa63-78f4917fff24", "comment": "Malware payload", "value": "812a606631057490aedf634b7dd4d0048e18ae5fed8d140866db14307f73837e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934151, "uuid": "b75da85e-ba57-436d-8206-6b65bf4d32d1", "comment": "Malware payload", "value": "435405bc7dfb25a64da7414be0cda9753c6e7c70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934151, "uuid": "e55626ce-5b12-475c-8ccf-ad7be302c57a", "comment": "Malware payload", "value": "ed01f79df0b83355fa71e850998dce481f9915443e21983234bbda57027f3a37b9189f4966c809f6a196cf42ec5c2ec4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934151, "uuid": "89f20685-9edb-46fa-8ae2-c82cee7f2cef", "value": "T1B0A48D11B6D6C836D5BE06B0362DD39A416DBD6447F284FF23C84E1E1EB24C1463AEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934151, "uuid": "cda6e5b5-286f-4b31-8cc1-b110c52ef4b8", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934151, "uuid": "c33e7b13-0705-4cb9-aaff-8227c60230b2", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHAts:yBqnGIQ5M6DLrVVdWHAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934151, "uuid": "4dc92532-27c3-4b20-85e5-0816d0b17c9f", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934151, "uuid": "7dc75420-0549-48d4-812a-be638022a69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934151, "uuid": "f8d3ef83-f109-45a9-839c-25b9d397efb4", "value": "SecuriteInfo.com.PowerShell.DownLoader.1445.3289.5729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d03c612-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950254, "uuid": "ca1c6df7-360f-401c-a3ed-6c4f928b701b", "comment": "Malware payload (AgentTesla)", "value": "44d36dd6dd2a1a84815e0b68cb94f585", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950254, "uuid": "02cf93ca-b670-4e75-a128-3483122624d4", "comment": "Malware payload (AgentTesla)", "value": "822cc90998bef7d1ac4db36584f0d273cd2b2ad957206f577ee3947cf6aec3ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950254, "uuid": "b7d30d71-704e-4543-893e-0e8db159c19f", "comment": "Malware payload (AgentTesla)", "value": "aea0db7abecdb7480622985899dc36ac350156df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950254, "uuid": "fd952010-6235-46be-b523-14e01ed4b83d", "comment": "Malware payload (AgentTesla)", "value": "01c91bfe42c741b94e10fccec466cc5e3ba37a6de09f746bd4ec1ae8a602ab3506bfa0e7a452d090acf4c373f83c67e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950254, "uuid": "21c15b94-6d7c-4c86-8db1-38c91400e6d2", "value": "T183756A0772F64AB0E904C736E1C7141073DBDE812BF6EB8A684A36591A72BBDDB07543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950254, "uuid": "5778647a-3bba-43ec-9ee6-c65558c5247d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950254, "uuid": "41efface-69f8-47cf-92da-7e3379228d03", "value": "24576:YX+hV/tiQNLt0OfFxgnT5CO6bfkn6T7xAJSMn:ZtkCO67knnSMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950254, "uuid": "5037ec69-e0ca-4ff4-b214-3068117a8103", "value": 1561600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950254, "uuid": "134a17ce-f72b-415e-b2aa-0aaa9f1827c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950254, "uuid": "6b4817a2-41b2-43fb-9590-3e4bfdcec8cf", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa311528-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950518, "uuid": "6d698df0-a1a4-40b5-b5a2-d3779f5bd267", "comment": "Malware payload (AgentTesla)", "value": "fdd1058b46f801f95b3a79470a40cc24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950518, "uuid": "2d458839-10f9-4e20-b519-cd198c2b0373", "comment": "Malware payload (AgentTesla)", "value": "82403a4a928f74382b43c1d34fdf0eb903d607ab92b99c55c3c51d9749205e14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950518, "uuid": "0e5fb755-e1fa-4e8a-bd4b-491fc84dfe05", "comment": "Malware payload (AgentTesla)", "value": "02d31094e775fa46af4936996bb09eeeab0253e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950518, "uuid": "15a62ef1-2022-4866-b0f4-9eb146105ddb", "comment": "Malware payload (AgentTesla)", "value": "a9b0cd72f4f4a6887f5d25f4c46f9bcada8b4f5e1a731fd6b67bd3100e1316863f355ee375c75aa6c9d63dc94cd2733c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950518, "uuid": "d15c15c3-a03c-4355-a5ac-16d0e52feb02", "value": "T1EE05120046ADCB7DC2BDA3F139E685843FB6510B9031CE9E1B95749B383266804DBB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950518, "uuid": "5fa915b8-2bfa-41cb-9b40-4326ced30605", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950518, "uuid": "461b6bcd-f4ed-4045-aec4-006db1e0853c", "value": "12288:sbjojIkCFDesxC1E2mg/HNAGHUl0H5EGtEIgn/uHFvsPa4fLv:sbRkE2R/HKzOZfun2lCagL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950518, "uuid": "4657982f-f2ba-4232-b8ae-78b10151a43c", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950518, "uuid": "eb4ba9d0-2135-493a-a91b-9cc702e5d061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950518, "uuid": "701f3a56-d1df-4b40-a6bb-c4bf1c94707d", "value": "FedEx_AWB#5024092746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99f04e3-438d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692998647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998647, "uuid": "c93ab1d8-dd9b-45ef-b98a-038ffb08177d", "comment": "Malware payload", "value": "1c309230213e28a4361ea3990b44aa22", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998647, "uuid": "778a7259-41d8-4de9-bf87-adfa21d8dd5d", "comment": "Malware payload", "value": "825827fa914f10451d4cd390612ab16742e10601b51ca04c440569a66dc9fe46", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998647, "uuid": "225e5376-a8db-4839-95c9-97f411a0e987", "comment": "Malware payload", "value": "c91605dbf4f06a7a95560a5045e689cc7cc043ee", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998647, "uuid": "c7cd7e59-bfa2-4842-ac94-0ca5c533c1f8", "comment": "Malware payload", "value": "7d8dcb8f8cffa91b57fd304a9e308ba17065e710861eed10e92b57f8d9e2bf79747a10e620514431eae6dc70d66df0f6", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998647, "uuid": "1d151f1b-31a3-4100-af68-224a00fcebaa", "value": "T1A0E5CCC780E10ECA83FB6414A047DF76B6B95580A079C74F3A469DDB68EE964C04F3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998647, "uuid": "52ac65c2-f68e-4293-ad6c-fa244eef387d", "value": "24576:KcRzkgATZ43URSU4dw7davFc50GxnF+bku+pTiG6Dh5:KLgAagSUhdaMfpF+bkuH9Dh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692998647, "uuid": "4590f8d9-ec86-418b-a47f-88bf2700b127", "value": 3216797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692998647, "uuid": "2de67505-7c84-470d-81b1-7aeeffe09750", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998647, "uuid": "0b8346e2-7305-464d-90b6-cbd6d70fd696", "value": "installer-package (1).exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ff1130-4343-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692966939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966939, "uuid": "529aa539-371d-4706-bc50-d00a693718e2", "comment": "Malware payload (Formbook)", "value": "055134c1a000722c97df9e3016d94619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966939, "uuid": "caf8b129-5164-4ab8-a6d6-231e1a2d3907", "comment": "Malware payload (Formbook)", "value": "8358c009205dd4bc938b07ca3adbd41e3e84b4e3c639cfecb779be0ded5671a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966939, "uuid": "2302a719-1da2-4ad4-8f69-29d0c18c5df5", "comment": "Malware payload (Formbook)", "value": "9caef6b14811c8f91ea3655c78d9bb10bc94f184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966939, "uuid": "7f3a0dee-51af-429f-b597-934eda0fd933", "comment": "Malware payload (Formbook)", "value": "55f3534e161a552a144ac31e1bf21aa2f8f7ef1754a9166b695d80495420bf904ebe7e01d12ba9cb661885cea535da55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966939, "uuid": "ee1f1404-baf9-40ae-b2cd-cfdcbf5f20f9", "value": "T14BA48203BA468DE5D38F1B36C58B1000CBACDE813627D79F798A336639637AA9D47507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966939, "uuid": "b378facd-4757-413e-91f1-623f25d8417e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966939, "uuid": "104e33d7-b365-4f5e-ab31-209e286ca81b", "value": "6144:3m79rPD1qXHwNEyqe0Opvp87VnQOkh7nnUY4JlezTkUV/zWWfMC2ZWgNUBJ0xW:WxrPD4dyv0OgBn3khLgrcTT1C0SOJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692966939, "uuid": "20c815d6-57b4-456b-be79-69247d0b8af8", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692966939, "uuid": "cc5cca24-b2e7-4b40-a625-ad717c237584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966939, "uuid": "0413e1e0-c5eb-4880-a72a-3dd2070f5d47", "value": "TM3521_ST135_TI05093550.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e54b2cd-435e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692978200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978200, "uuid": "036bc6cb-290c-49e7-9fd0-4cb5b06ec135", "comment": "Malware payload", "value": "1c524e39659c8e189c4947c66599a511", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978200, "uuid": "21d18188-0b6c-4bee-a340-3253971ff535", "comment": "Malware payload", "value": "84984a52341753bae399fb43653b99a83985bfa12a6d4ee9f09229cca23138be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978200, "uuid": "daddcbcc-8a74-440d-9ec7-8aa53fe73533", "comment": "Malware payload", "value": "1006d5b35d5952d4b9888ed935f174de88908984", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978200, "uuid": "c628957a-8359-489f-86f0-f2d580935dca", "comment": "Malware payload", "value": "efce2fdb2bba87e5e821c04c030a53f96ca608a033e3e633e1101e62b3619890d50d8e09b8422157cea7e0cd69c91fe5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978200, "uuid": "8a235134-8011-4b4d-ae26-a4c20c7c317e", "value": "T1D5C52287CFD5AB06C63816326F07774A4BABCC97232175476828BEA5F8E310B8D35653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978200, "uuid": "f65088ba-db0b-491b-bd76-8cd0c881a2e1", "value": "3cd8fa62cbb1d74f465b60130b9d6652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978200, "uuid": "3b7e49fe-2859-4fe8-8112-ef74a97e1c31", "value": "49152:Du041P1+kvbZ7c8DEm6q5k5rZdIJG6kmSLHHcD:/MBDZ7c+KPIkdmMnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978200, "uuid": "a936c37c-b8a4-4f79-9d49-b266c9ee86fb", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978200, "uuid": "87494fe2-209b-4ab9-917a-07e4c138b9e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978200, "uuid": "5397dccb-ba42-4ead-a945-92f632b5a8a8", "value": "SecuriteInfo.com.Win32.CrypterX-gen.26068.27551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d644c1-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950559, "uuid": "98a4c78c-8c99-4de3-8468-c9f1e80a2ede", "comment": "Malware payload (AgentTesla)", "value": "8f38500c358911dc3f37dc37296c0d8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950559, "uuid": "3fa34235-9151-4434-8b5a-dfa8ef180d29", "comment": "Malware payload (AgentTesla)", "value": "86e5490c033b875a3c4380c0e4dd291b037438f11d2818977416cf313c8ee08a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950559, "uuid": "7c0dfcb0-9e72-4934-bf61-708d88ac15ea", "comment": "Malware payload (AgentTesla)", "value": "597cd9deb6cdff0ebe53aadd05e16cd0f26111ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950559, "uuid": "20254fa5-9698-467e-b5e8-116aa6d29b89", "comment": "Malware payload (AgentTesla)", "value": "c83906fb739600c481bb6fbb11771a96153dee9596f63dba6553bef02f5fa4e11e59e855ef49c092e665d25ae68aa929", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950559, "uuid": "464cdea8-8f98-42e4-90a1-87ec09403d93", "value": "T14BF433FCAA2762CEE98F42B993CF02C5001F15F8426237AA7D169B3A976BCC44454F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950559, "uuid": "6bf24f49-2c2c-48ba-9911-e76c8f0eca5b", "value": "12288:6EnWqlBffkEk1D6kIG22tLHzGt7OaEDibokMPd6iYLZ4h0od/r9EMPhsUW9MVJoS:DfLGfA2RTGRK81KB99sUW27v6zl3wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950559, "uuid": "48f17676-53bf-46eb-8df0-bed0ee4215ee", "value": 725371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950559, "uuid": "6de31246-b269-4e16-bea4-63246807a17a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950559, "uuid": "6905a22e-3adb-4cef-a12e-10509f199cc5", "value": "New Order #64717.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4284deea-42eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692928869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692928869, "uuid": "42e60ed1-4b5d-48cb-b5ba-13fadeed3829", "comment": "Malware payload", "value": "c19f2c0342a2a60a89c7860865400aeb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692928869, "uuid": "0206b0ba-5678-485e-9c10-3725f585adc0", "comment": "Malware payload", "value": "87396d68345c4d7825be02221868f3897e11333afd0fb2b4f8070d8ba8765e80", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692928869, "uuid": "d40cf9b4-7d45-4b7d-b3e2-06526bb45763", "comment": "Malware payload", "value": "eb28881f4a5c131d088410da935dd389a899cc5b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692928869, "uuid": "ef986986-74db-4bd6-a7d2-b40ccff5c6fa", "comment": "Malware payload", "value": "58bf741294ae844ab49c2f3ddb30c75bcc9ec816be1f7414c35a594b2176f2c52b3a1262c76d14ab9ce385014a51e062", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692928869, "uuid": "e602ae13-a985-4fa4-abd4-df07f255a3f7", "value": "T1A286119BF719A92FC87704F2197E523126874D168E839B436D48331C297B6D82F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692928869, "uuid": "308afab7-6dd6-4c65-8d88-f95648dda503", "value": "196608:ROBJVXx32syCtRXBgYbwKJZ3JIVAZncs4b+IbtegvBL:OVBvtPgEwYZ3J7nub+ytegvBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692928869, "uuid": "77968122-d913-4694-aa2f-f55cf91c2943", "value": 8445424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692928869, "uuid": "1f06e8a2-1431-4752-9054-5629446daf29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692928869, "uuid": "3dee4b05-69fa-44cd-8db4-025f76cd9092", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb563bc9-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1692950547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950547, "uuid": "46d5e445-25b8-4172-a922-1967a7e295a8", "comment": "Malware payload (DarkCloud)", "value": "5350293bf97020aa48161cfd81fe1789", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950547, "uuid": "eb22e029-dc69-4f85-883b-648fee71c020", "comment": "Malware payload (DarkCloud)", "value": "8834a687f720ac91833ebe3e20b0a62dfa3d9e9411e4ef925372f2307da15d6f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950547, "uuid": "d5f3427e-e646-4afd-95ae-4258c42d5371", "comment": "Malware payload (DarkCloud)", "value": "d0ae692132b298ff0daf77c42923881d4d83aa3b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950547, "uuid": "f70c5b3a-3440-4251-8ce9-c0d7505b3b1d", "comment": "Malware payload (DarkCloud)", "value": "fd2a79d1d304fe12e95149352190a60a0332d8b9b8caa35a2560cf5680e566becfb5f3c0feb7a7a0d713f97634e8fe46", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950547, "uuid": "82edb568-ab74-4298-8fe4-9a0c356f53bd", "value": "T19905230076A8D729C4BE4BF93594C1A68770C957E152D24E8EF170EB37B338A861877B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950547, "uuid": "03b051e5-2610-479e-a8ed-a04970672f02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950547, "uuid": "c90710d1-8b36-4ae9-b306-46ebae118d14", "value": "12288:0IqZxqazl4F0eGAUePy4esizsGipwxFJVaMmhttQ71+VwduCA3+8r3pJjjovw+i7:MLjx3eGAUePJesizdce5Ng3pJnOwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950547, "uuid": "fa865e8a-c1f4-4453-8f36-9e4bbaae2711", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950547, "uuid": "be3e6869-5fc7-42a2-94b9-6bc4dbef2684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950547, "uuid": "0e07dbf2-788d-41a8-8e56-d18134973012", "value": "DHL AWB 4500028900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0866edf-436a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692983600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983600, "uuid": "8e019f87-01a8-481a-a14d-d3a864eb99d9", "comment": "Malware payload", "value": "a49bc405a2f56746810e1f8b81313617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983600, "uuid": "b784169b-f288-45a3-b0c9-2ce11b713c79", "comment": "Malware payload", "value": "8cda420ecd4677794d938f0f9f16eee8c7c3960ac8fb125d70f025e590ed137d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983600, "uuid": "1d0357f4-f1c5-4f89-a9d3-89801d33f58d", "comment": "Malware payload", "value": "3a99d199fc4ad3591d12d2b21cf7f6fb787d101f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983600, "uuid": "e368d8fc-2d87-48d5-8344-bb75d5633301", "comment": "Malware payload", "value": "f30d9c98249e05319f879d1a91894d4ff82e439a2a59418641cacb63f21fa0bdc8be438fef00f69966cc212277397e61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983600, "uuid": "6d4f3764-87a9-4253-87eb-71e0a06b6181", "value": "T13C65234EA7E8D4A6EDB02372A4FF2293AB323CA16C7085BF330195A70D77544A571397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983600, "uuid": "f8865493-b7cb-4d3b-b0e2-d594f1991e2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983600, "uuid": "d1c0f9ad-8b6a-4e0f-9d7b-3835932c8fad", "value": "24576:eypPeUAoWpGBS/YMPtQ2XnKxECZ8NPX7zYwcoXgYJFY/+S+whCkX486:tpFSGytvKxEC2TzYygYJ+n+H+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692983600, "uuid": "dfb0f40a-f644-413f-a52e-91a676dffe49", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692983600, "uuid": "df7907c4-f5a3-4024-b861-8c332a6ea851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983600, "uuid": "ca5f7450-f90e-4a3b-b6e1-873a84819e76", "value": "fotod300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f4982f-4393-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693001064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693001064, "uuid": "465f174f-9515-483f-a2b6-c5f1dd01f46a", "comment": "Malware payload", "value": "8f4f3d4a198b6af8230bb94d41bd25e0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Tsuchigumo", "colour": "#2CE514", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693001064, "uuid": "cf31bfb7-907f-48b7-822a-acbbab94f46b", "comment": "Malware payload", "value": "8d1d36a7ad23626341f658815bfd21a6274f703aca2126bddfad63fa749041be", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Tsuchigumo", "colour": "#2CE514", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693001064, "uuid": "6662f32e-1517-48bf-94e1-536ddff7ffe0", "comment": "Malware payload", "value": "d3abc06d50f8fa4069e232ce41296802f217e47a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Tsuchigumo", "colour": "#2CE514", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693001064, "uuid": "01e06b6d-d787-45a0-b157-d6f0901207a3", "comment": "Malware payload", "value": "668400824b59e5f04f069ae14ca23636715845d9a69287248a6689b654496bf35d8bdf0b11babe80a7613de59888ae20", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Tsuchigumo", "colour": "#2CE514", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693001064, "uuid": "fccd9dee-dc4b-4149-a5c6-d78857249e96", "value": "T150121ED9CE3096B789AE2939062B751A630FE3D52360F50D12D26DC5CF0DA839A13CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693001064, "uuid": "cb82e914-758d-48e6-aa05-74d33e00be84", "value": "192:9pRjeNekmespRje4CHjeNeXpRjeRmeSweXpLeZpOje4k5nH5ZVxooNjR:9pFkApNCHXpG2JXp2pEk5nR+oNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693001064, "uuid": "f9e6a74c-db18-4b31-95e0-d318a21df286", "value": 9626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693001064, "uuid": "07eb44d8-290c-44bf-9003-92bb747a4a9e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693001064, "uuid": "873d9326-84d3-4a71-a113-89ff3dfe3110", "value": "Tsuchigumo.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac839195-4331-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692959112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959112, "uuid": "e0e11383-58ae-4459-90f9-529a41a9fb0f", "comment": "Malware payload (RedLineStealer)", "value": "ec4d697e071729d0af861ff886c18465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959112, "uuid": "6b443050-ab32-42a2-a924-b2dfe4b7529f", "comment": "Malware payload (RedLineStealer)", "value": "8d24d2fbf87c68212475fa784f0acd3243a50d50c249e1852892cdc02bff0654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959112, "uuid": "a142e22c-b363-4437-8850-0352dd915e71", "comment": "Malware payload (RedLineStealer)", "value": "5f755e0524ea7fe5ec8c37b9f7f66a8ae0ca2ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692959112, "uuid": "fb3b2490-9264-4712-8dd7-2fbb826718a4", "comment": "Malware payload (RedLineStealer)", "value": "9475b72f9d03ff0532fc936bc058686076c5c58057c375f59fefd1638b4f54cd8ac2a1c157b7051d3bc6ca70d595f406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959112, "uuid": "2a3c7891-8166-48e3-ab69-022514f8ecf9", "value": "T15394F111BAB2D873C58244349C20C6E4767FBC76895A8847739B3F3F3E71282666721E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959112, "uuid": "9ab5dae1-349d-4e27-8647-8dbaa8e0f7f0", "value": "84062fc609830957c144f26e843d6474", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959112, "uuid": "5c8f43b0-3520-4078-8f94-dca2c29f5779", "value": "6144:3c68mLsMc8QE+H4/OW+fhf8egIUcNNwciUEG6iGDPJdBfp9woQzwATaR:3c68mbnkkOWU8egIUEDbKPTBRaoQMQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692959112, "uuid": "89ac5474-eb8f-419c-923a-0726b6cb67aa", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692959112, "uuid": "69eed9c4-195a-4c75-bec2-fd58da128e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692959112, "uuid": "efbcb181-96cf-4c5c-8d9d-e171239ba02c", "value": "ec4d697e071729d0af861ff886c18465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a905a3b-42ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692929822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929822, "uuid": "9f69fd86-d1db-41be-adab-d5c6e0040d0f", "comment": "Malware payload (RedLineStealer)", "value": "8dbfd9f45c20a8827b0285ede7fa3701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929822, "uuid": "71d057ed-b703-455f-b982-e65de14312d4", "comment": "Malware payload (RedLineStealer)", "value": "8d72c2cb85ac1d506403594695a95c6920722b637d02e351f742ddd73dfa2e41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929822, "uuid": "a83f63be-690b-4d20-a69b-d21c6f578596", "comment": "Malware payload (RedLineStealer)", "value": "91c3c57359203bebe54a128a9640b0a13543a739", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692929822, "uuid": "a8e023f5-140c-4844-8122-557115cffd4e", "comment": "Malware payload (RedLineStealer)", "value": "1b78ae8c7cce9e3de569e3f6b38884f223e67b33e1fb1042da0ed2024a05719478833a955337560a6e5d401c5ccd7b05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929822, "uuid": "1a45fc63-27c9-4e00-8d2f-e97044d8a1e5", "value": "T1D9743AC0338665CECCAF89F1616037748A72D442A757BB53BC4BAAFB39593499F041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929822, "uuid": "c938e9aa-6414-440d-85dc-0468b350845f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929822, "uuid": "28a66a01-ebee-457c-ac23-c6e971282c09", "value": "6144:6R5HwTqTWAsB47OjqptMyd/4XbSN1azTi:SGqz44r/4Xbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692929822, "uuid": "5fcb8253-2c9d-41c3-b930-6e413bc55e46", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692929822, "uuid": "e16f24ff-5aea-41cd-8b1a-c73c14cbb5ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692929822, "uuid": "a32a4148-8552-4584-bd49-cef6a3d35dff", "value": "8dbfd9f45c20a8827b0285ede7fa3701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e583ab5-42fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692935841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935841, "uuid": "75a9f347-7d4c-40ec-bcb8-38045d9fbdaf", "comment": "Malware payload (Formbook)", "value": "d5eb2ad29761398ed7bcaf3648265ea1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935841, "uuid": "b44fe3ae-2215-47c3-8bd5-38204f0f7e55", "comment": "Malware payload (Formbook)", "value": "8dee64363a078fefac0ebda6136979e006bebc231ff17a99cc56c352d3dd1951", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935841, "uuid": "0171a0c1-64b8-409c-9a95-568312f1cd27", "comment": "Malware payload (Formbook)", "value": "6e4e7f644b354ed1ea5edecf0ad1b236f49a7e64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692935841, "uuid": "2b5eab5c-019c-4811-9433-9fc2779f2ca5", "comment": "Malware payload (Formbook)", "value": "5009b52423645714aaca1486b3e4b8a59330c702438eec5d3850b01f59e458abc80282a9b19f9a473d2bd8ee57a6a6cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935841, "uuid": "7b202806-29ae-4ba7-8c5c-8c7c0881930c", "value": "T1FF220A23A3D8C77ED96687778C736A410670B311C523CF6E2459914F5D6E2404FE1BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935841, "uuid": "2d687c0b-f40d-4a21-b8ca-8c4788c9e424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935841, "uuid": "7bfa5dc3-d69d-4e76-b509-474fdc5a68f6", "value": "192:Lplv5pHYKNOx42F48E71H/XF7hHbnOOMAc:LnYK6w8E71jbOOMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692935841, "uuid": "bb50675d-04b8-4f0f-a4b5-24d25bb3c828", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692935841, "uuid": "e206c05e-c7e0-43d6-95cd-5751afb8428f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692935841, "uuid": "e340951d-9152-41ce-a66b-7d8b47b08f3a", "value": "d5eb2ad29761398ed7bcaf3648265ea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783ad8be-435e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692978351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978351, "uuid": "97e89c47-85ac-4695-9d84-e6e62bac250a", "comment": "Malware payload", "value": "38b113f00a29371fa33a31dbef5610a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978351, "uuid": "f40ee7fc-7647-46a2-a846-dd9516ba9f28", "comment": "Malware payload", "value": "8eeee3ac06710a04dbb2e9516201147b98788180c4229ac239717a3e2192f906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978351, "uuid": "552c236d-3b5c-4c81-ba36-9340f3f1ea15", "comment": "Malware payload", "value": "b02d7cb7f7a368b7e7dcf2ce0cac3b6efc62d891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978351, "uuid": "7d2f5bd0-9924-4fe3-80ee-c32aee69330b", "comment": "Malware payload", "value": "d4f9a28a4faab8763e097eb1568085b1658f2e2284e1060bc7dd4fb4e1e45e749d4845dceb49b834162127ced220dcf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978351, "uuid": "b4b94966-a898-4343-b33c-2b5df13d818b", "value": "T1CDA6BFA772D011D8D57BC07D8256F42FE7B3742543A4ABFB56A0626E4F13AC13A3AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978351, "uuid": "18536a86-c088-4b41-82af-796b5b55612f", "value": "230c2f27633d91664bb92f39c5e2c729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978351, "uuid": "6a6ace82-afa4-48e1-8fcd-ecedb0b36d1d", "value": "196608:fmBaXov86o3DqyZbPAgZmmX9vwR/2zsCOSR/pA+o:Uwov8J3DhZrzmmNv1zsu4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978351, "uuid": "b71c3bf4-37d4-41a1-9855-ebb1ed7fef21", "value": 9740304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978351, "uuid": "d8e051ae-4283-4b4a-9a6c-ab16ebb6efb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978351, "uuid": "c519e64e-04df-48bd-8154-86dba259aa71", "value": "Mina.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a971a98-432f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692958008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958008, "uuid": "708f22c2-1cae-4144-945d-8b2631fa02a4", "comment": "Malware payload", "value": "2ffc188385c5ced9a4cb7e46ea24d2fb", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958008, "uuid": "ab979b83-6ea1-4edf-ac0c-52298b15b17a", "comment": "Malware payload", "value": "9050130468a0079a69af507a71b1a558242f60120b0ee9ae493a279dd021a293", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958008, "uuid": "9775ef9b-7a71-41a3-8b6b-ae1196d163a0", "comment": "Malware payload", "value": "ff748c4e14082e4874d14396c859020c556d66b7", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958008, "uuid": "d627ba59-f97c-42a0-b81d-f5d1390bfb38", "comment": "Malware payload", "value": "c0a00d3aa674cad39ea1df6d21f6f967b609008588c1096a1965e14f9e6f8b621c64bea9b8df44c154ee8ed940dac492", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958008, "uuid": "1405e2f0-ee98-4f28-894e-0dd78321934e", "value": "T19FA58C05A692CE27E3E45B7EA163512A8270D6233717BB8F0F7C95793C923B80D523D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958008, "uuid": "4eb84be2-2eb1-4660-ab7c-e59229c50b57", "value": "24576:GFlE1xrJfxT1el3KSquRG+Z7Kvodi4I4dyu+QUF0elQKL8INXV9WR1df9UzjgM/8:H/Jfx3Y5UFeKvNCJ9Uz0w1LYT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692958008, "uuid": "ddf4e082-b473-44b3-9b5a-151c0697ff74", "value": 2248704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692958008, "uuid": "91d851e0-2dea-4fe0-ba51-f29b8b77f831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958008, "uuid": "8985067e-f83e-48b8-a0b4-ac20a75adf80", "value": "1692958005f29a996e6a924275c768c307dea6e4aa5b69767f5a6acf9f2b7cbae9dc912797721.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df000586-42ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692937722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937722, "uuid": "794fb543-a979-4b6f-bf52-a559ed0d04ec", "comment": "Malware payload (AgentTesla)", "value": "4ad9dedd170b73c8fd77e8d08fe9a300", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937722, "uuid": "c8b2fa08-03ce-4aee-ab36-a1f98f9a519c", "comment": "Malware payload (AgentTesla)", "value": "90c969a104f33d6c89449d251002a70b17a89b451da43cd0a71e19f167205293", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937722, "uuid": "19ec4bf8-50ed-45b3-a135-e0f506aa68de", "comment": "Malware payload (AgentTesla)", "value": "af188b5e9c690e38d4d137c63d0f0220439e4504", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692937722, "uuid": "dad33590-3d37-4526-985e-751607cbdfd3", "comment": "Malware payload (AgentTesla)", "value": "a43f0308af70e1bd1a2655a599ce52743d64906343d40e75de151743ff3e3654a68a7c8c8bdb0602e70e03e76c0b0fbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937722, "uuid": "c334d67b-e133-4aed-b371-0cd246254c03", "value": "T1DA457C03B657C9A5D1489B3AC58F624407A9DA513BAFC7AE7EEE137104033E5ED81E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937722, "uuid": "d77f9c5c-6910-4185-952d-ebeee7a6ae13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937722, "uuid": "bc1d253d-4fed-4598-870c-ba7246ecebdf", "value": "24576:tzCv00BIkcgGTj7TwIYWTAZllCS/ElQct47VEzI0:hOGTj7s0k/EyO47qF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692937722, "uuid": "0227f007-91ff-41a6-877f-361a7c33505c", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692937722, "uuid": "1e146cff-e8a1-4cbf-b6e9-9da4215e28d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692937722, "uuid": "5cf50db4-e3a8-4e98-9088-0d735f279542", "value": "SecuriteInfo.com.Win32.DropperX-gen.26829.1574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fa45ad-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950298, "uuid": "9dc60297-e920-4ab0-b64f-94740007cc04", "comment": "Malware payload (AgentTesla)", "value": "65854a94f75dc0b9d19edf69055a2fbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950298, "uuid": "52a9373f-99a8-4c3c-81ec-69fa1308db3c", "comment": "Malware payload (AgentTesla)", "value": "916e351291f1b3d7de57134af5f2caf316294d7d2e4dc80d12d3a59e9c8d1b74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950298, "uuid": "31be0948-ec51-4eea-95f4-29e031881358", "comment": "Malware payload (AgentTesla)", "value": "b1ce94949e70e70a41838289c5c16f506cc97867", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950298, "uuid": "174d664e-87ad-4289-b4c2-debc9e3e9c95", "comment": "Malware payload (AgentTesla)", "value": "0b024e177cd2d322fb7960c1c622b5e938b68968112e1dea7e7f20accf01ba927855901318e5882bf9a9f9c88e63a8b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950298, "uuid": "af050bf5-0b28-40bd-9447-336dedb4ec31", "value": "T194657C5E797682A1E449DF36C0FA060443A7AEA676E3D585254433E90E333BFAF07583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950298, "uuid": "f0196d88-5f80-4d01-97a3-b4ff42dfc7f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950298, "uuid": "f17b9117-f5f1-432f-8219-707ddc9ed830", "value": "24576:s8JQeC22fsmMF3pcPprfzUVGTB/B5yzw2iNTJ5d2/xAQ7nk:x2rgV6/B5ya5gAqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950298, "uuid": "441ed38a-918d-4354-9ea4-106960455fb8", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950298, "uuid": "7f40d432-b71a-44c7-8418-4cb33ecf123c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950298, "uuid": "6e503f30-6548-45b5-b528-2fe7ae487422", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a02b61f-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692961899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961899, "uuid": "2c7c292b-97f3-4dcf-82b8-d707330d03f9", "comment": "Malware payload (SnakeKeylogger)", "value": "d6ccfc99e54d14cb52de4d943ad74166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961899, "uuid": "a95aeabc-7696-4897-9b87-ad883c4b4d97", "comment": "Malware payload (SnakeKeylogger)", "value": "9248252c652a2f2a1476b419f62d426b93b38b530b9ea0d16071c2724e4f48e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961899, "uuid": "46cd4b5f-46bb-4507-89b8-0ecf054f206b", "comment": "Malware payload (SnakeKeylogger)", "value": "1d26d06bc9df7ee8ce56396796ee609f69ea9b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961899, "uuid": "6d0c51ea-9269-4ac1-93de-7951177ad1e2", "comment": "Malware payload (SnakeKeylogger)", "value": "1317a42a2786eac9cf2cd140a38154dfea9cce8e93996ec490b34503c33cea885978e3b4b57154e4ff240c46fabbaf0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961899, "uuid": "30a82b83-71a3-41d5-8608-c41097ee9709", "value": "T188A47103BBCB8DE5D38B1732C59B14084BADDA813627D71F7A4A236639437BA9941F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961899, "uuid": "54efb861-5f9b-4e10-878d-dfe10e6587be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961899, "uuid": "8af28f50-73be-4af9-b624-c1e7f0de4ca7", "value": "12288:WoZ68ecedeZFRS7HwKUbJpOdFe7+DmrFcu5WmJD:968ecedeZ3S7HwXJMd4+DWFcnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961899, "uuid": "31a5da2a-a2a5-4657-850c-5a8e20f5a336", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961899, "uuid": "4ed8c123-62a9-4f45-ac1e-bb73dbd86b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961899, "uuid": "c003f08e-2121-4ac3-af60-623e10560bd7", "value": "RKE2023000000853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d62f239-4369-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692983138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983138, "uuid": "8db6b4f1-6664-4a48-8758-93b9997c88df", "comment": "Malware payload", "value": "e8d5411085e74a0f1833d47d4a9909ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983138, "uuid": "4485dabb-176a-4677-b264-44bfc6aada4e", "comment": "Malware payload", "value": "92f993005c8095c12d1a29c586197d72d5ed39dd27c5577ceb1f3c1e2a08bec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983138, "uuid": "18d5d2e9-2123-4653-bc50-481ac3d157f0", "comment": "Malware payload", "value": "786e91d9e68a47122f9fe19cb809801dd642bb36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692983138, "uuid": "b9646bfb-fc22-4072-a9de-020c07956bc4", "comment": "Malware payload", "value": "e7998141598a8c6fc4007def881143b55a3ef68287b4e253e5aa561d3b933f2ac04898acebacde45a40c8d9c98c9b411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983138, "uuid": "7e0fe074-1a8d-43c5-bf59-4abbc31998ff", "value": "T1E5168D10B642C577D95121B0693DBAAF501C7E290B6454D7E3E83F2E78B46E32A33E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983138, "uuid": "88148ae8-bd61-4c5b-af6f-77c8e63679da", "value": "1e98f19e3d4a6500b611defdd54877e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983138, "uuid": "a0ea8440-c916-434f-8097-7d2deef47702", "value": "98304:HrB3FDqtQKGXW87SltqjM4FzT6n4KQwZF:HrB3FDqtkFSltqriZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692983138, "uuid": "0e60a9ab-a73e-4b0c-87f7-23d5b4c8ad91", "value": 4122456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692983138, "uuid": "a335ee4e-549b-4028-936d-bb03b685a7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692983138, "uuid": "00cd3209-79f1-4b90-9470-9e9d54dae45f", "value": "inst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b879c6a-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692961902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961902, "uuid": "45c3eb16-e153-4d1c-8de9-d3f0e57a4be3", "comment": "Malware payload", "value": "cdf5806bc5651b0eafecb3b2b0666be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961902, "uuid": "64cc07f3-c97c-46fb-8291-ffa77935b1e6", "comment": "Malware payload", "value": "948bd3b4d3c257dff1d4df50163ca1f1e2113ffb389a63cd060efb59dd62cefb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961902, "uuid": "a2241796-9beb-4898-b3a6-9a24eda00e1f", "comment": "Malware payload", "value": "1f74e04930270f6a46f2d74fdf88863d760621c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961902, "uuid": "5b9d3685-cd44-45be-9499-25b0fbad89c4", "comment": "Malware payload", "value": "79fe043436da3c62e9851a919703faec68e220a1e8d8e2ed64f71c8e46a622e856fce43b6afc57282bdb89987c575aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961902, "uuid": "75e8ebe2-9bcd-4796-a264-f75961031d9b", "value": "T1BE151FACBD9C5187E728DD28669F253C1C66D2126D29A380DFB6C4D71F902073A5ECE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961902, "uuid": "e1ce7fe5-5b07-42f2-8a97-a255ccb90d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961902, "uuid": "e5f80178-5d59-4d57-bc85-515ee6902172", "value": "12288:IWPC5NSWr7iOKr8Oc39tE89BFhE+2kgY+6NvoNDYmJm+7b:XZ6XKrLc9PcY+XNcU17b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961902, "uuid": "5f6f16bf-8f7f-4cb5-9dde-8c188dc1a474", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961902, "uuid": "ecd381c9-0a55-478a-8189-62f24dfc3cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961902, "uuid": "b91aa7fd-5ef3-4e80-83c1-f314df1f37ea", "value": "RQ039523.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43384515-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950345, "uuid": "608ae195-defe-4f7b-b37b-f89ed7d6e9cc", "comment": "Malware payload (AgentTesla)", "value": "1e81dc6528c8f8699c1dbc621833f43d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950345, "uuid": "877f5efc-62a9-463f-9866-2fdf999cf5c4", "comment": "Malware payload (AgentTesla)", "value": "975ed61b8817278770ec94d05a8485a1d58d14dd87f1b2da3123d14e0769e353", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950345, "uuid": "6fbae04a-0558-494a-ae8e-7dce3030ff9c", "comment": "Malware payload (AgentTesla)", "value": "2b59efdd55288b1c0528d776d9924ae02374925b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950345, "uuid": "5b38b020-d851-4ca7-bc28-4982cddfde89", "comment": "Malware payload (AgentTesla)", "value": "7b764ea675bcd97cc3b56777c2afd364af7f4b797adb3c4f195804284087269f9e55a6969eb9364e3792ca5d81b78868", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950345, "uuid": "07eba0cc-2b89-416b-ae15-2bb4c209773c", "value": "T1F5558B2A767685A1C904DA35C4DB654446E3AE51BBE3C27A3C9933D006323FD8F8BD4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950345, "uuid": "340d126b-903f-4863-be6f-80f3171e8498", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950345, "uuid": "c18ba1fd-0506-484c-a21f-cb3b4822a952", "value": "24576:ReJt1s1CIuobTaNin5nzA4Jb8bkCianvd59lgbjnUhfwqekfJI59d+dWk:NdWdpgbLUusfK9UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950345, "uuid": "495d76ea-3e07-4d44-86e3-6644d6457460", "value": 1370328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950345, "uuid": "9b37c6dc-b561-4355-9b27-9dee707cb467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950345, "uuid": "6f479144-18a9-48f9-8b31-27973a49c150", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a16e8d4-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934170, "uuid": "6cf55872-fedb-4fd9-b050-f31a305bba27", "comment": "Malware payload", "value": "0115584e32a7254bee7998369f5f3ddf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934170, "uuid": "295162a8-0d5e-4dac-90b5-6d14df02be56", "comment": "Malware payload", "value": "9789e97cb4cfab88bcce75b5e259a52b85f2d0c840d1dfb20077c21567346960", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934170, "uuid": "97071ec8-2a05-4909-8c66-c6d82fb3c829", "comment": "Malware payload", "value": "1d41ecb421450821b04e3a3e8001223ab5e1d6e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934170, "uuid": "80fafa82-45e7-4b1d-8c9e-30e45f4f1e31", "comment": "Malware payload", "value": "1839b6474db2de9f05dd134fbd5274bf3b86a8e9b271a21ea8e7b31a7e63f8cf30dad6a79451bd36e02396a240da9437", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934170, "uuid": "fc076871-5597-44db-b233-75e982ab35b6", "value": "T1AEB49D1176D6C836D5BE06B03A2DD39B0069BD7447F284FF23C84A1E1EB25C1563AEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934170, "uuid": "f6a9618c-569a-4cb0-b717-ed269474db9b", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934170, "uuid": "c964e53d-73de-41ca-aab1-978debbf1066", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHA+lw7eCE:yBqnGIQ5M6DLrVVdWHA+y7eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934170, "uuid": "b173288e-df23-4727-a6b7-93ffa51b65d0", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934170, "uuid": "1df3f92b-31ae-44c9-954c-77b83d96cb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934170, "uuid": "2a8dc6c8-918c-40ab-8188-c37d3f61e94a", "value": "SecuriteInfo.com.BV.Obfuscated-O.4915.22522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f3f934-4320-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692951611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951611, "uuid": "0e8d8b4c-4744-4c18-9003-66f085f3bdfd", "comment": "Malware payload (RedLineStealer)", "value": "570efc68da46e50e3eea236631563a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951611, "uuid": "9a38b68b-9069-48ed-b28d-b29fc8956c37", "comment": "Malware payload (RedLineStealer)", "value": "97d5f77f0a710652228f3275c412593cf378cd631ab0cf32e922a1dce1dd9c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951611, "uuid": "dedf2fd8-b283-4b66-964d-cdbac1900c36", "comment": "Malware payload (RedLineStealer)", "value": "a3005e8c78bbff5b78c2a50d5076115119d2a526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692951611, "uuid": "95b000fa-0e1a-4073-8e2b-04167194c0ea", "comment": "Malware payload (RedLineStealer)", "value": "7b661a826854fad6ef0da51467acb1eaf0c5413a0a3c16152237c0b1347d1c9d3f7d1606f8c4f17f86ea93dc8a0c70d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951611, "uuid": "ac52d3eb-3a36-4b2a-8fc6-a6194375b93a", "value": "T18466334617CDEA9DF2E972F7884662B503768E1EC15D8F11F8B877A7F637A42210C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951611, "uuid": "134eade1-15a8-4730-b1d4-b92165e7ea76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951611, "uuid": "b42362f1-9767-44c6-ac33-9c7f5ef79a6d", "value": "196608:RMrnBhp03r6MN7bIv/ir/xPvhRS23TTdYeDtmC7uO/:RMrb+7FhIv/i9HjS2DTlDwCCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692951611, "uuid": "71f6a05c-f118-486f-98c7-4ae4e5769fc4", "value": 6830592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692951611, "uuid": "a2645658-979d-4cd1-ac4d-43f1faa8c323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692951611, "uuid": "5f46309b-0720-4974-95f5-c1af135a50d6", "value": "570efc68da46e50e3eea236631563a18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594d6c99-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950382, "uuid": "e76a84ff-e9b3-4b31-a6c2-5ced81607cfe", "comment": "Malware payload (AgentTesla)", "value": "81d1d9cf8554391462923fb0cc59bd99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950382, "uuid": "409fd452-11a3-4d25-8678-358029734cdc", "comment": "Malware payload (AgentTesla)", "value": "97fd0ea2f2ebe8dc9decafa546e62a5225feca31893c1e1dd820540d4211a594", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950382, "uuid": "dad17541-d37e-4b88-8b0e-6449d1522c58", "comment": "Malware payload (AgentTesla)", "value": "85a80bd672c95adf95a846d9866376b06607c0ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950382, "uuid": "6a9255eb-4e2a-4fe6-860a-f550bba617ef", "comment": "Malware payload (AgentTesla)", "value": "0423880aaf3d6a2acc6c42ca1c6909d877694d36ef09e1d001f3ffa47a2ad2e70f3ca0c59102c8c3f8acfc844d61d2c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950382, "uuid": "b526893a-74f3-4c46-9f98-7189c3b67e37", "value": "T1C4E42324DB689B75CAFE47F6A060A1A443B36882DD03D7890EDD30EB23B6F454D11B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950382, "uuid": "29966a1d-3026-4a1e-a47c-64efe87d5aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950382, "uuid": "4f832ba7-1784-4ad5-b700-aacf489788c6", "value": "12288:2Iql3qaz3KVcgN72g1g361TEp+N/NpiJna7QMaF/90Qhtz3VU60S9bjGP:6NjuqM72g1gcI0N/WEpS9qzwbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950382, "uuid": "6982d3cf-edb0-4a00-adc1-3901e5ea354e", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950382, "uuid": "bf86004f-c55e-43bb-a97f-7eb1d717f3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950382, "uuid": "eee7f3be-377b-4799-8307-bac50ae88dbe", "value": "CERTIFICADO TITULARIDAD BBVA 9537 A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcc1967-4348-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692968855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968855, "uuid": "a38c872a-3161-402a-873e-791b7676415e", "comment": "Malware payload", "value": "2943336c37975ca61be6a14c21a4ea79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968855, "uuid": "3fbfb470-0989-4c88-b523-48a839cc6bdd", "comment": "Malware payload", "value": "98049e2403f4f085b054724d745fb7ddef80374d3f87e475fcf0e043d4b43bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968855, "uuid": "0606687c-153c-4779-8912-2634c9d897db", "comment": "Malware payload", "value": "e0fe9f7298564d6a59c4f484d835472af7689356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968855, "uuid": "9a8399d1-6a38-40b8-b977-48eaf83ae554", "comment": "Malware payload", "value": "641832d82aed54288dc22795f4b3d5714e3ffa64df48dfa402959b3a6af275898f0abda2bf07547e06a484719813a751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968855, "uuid": "7ceb77bf-f64a-4f77-b214-487854fd2191", "value": "T156A4223032DDEB58E3DE4ABA03DEA5A9126FB5C6195A8D1081D833FFD1C3E181296630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968855, "uuid": "15dfedbf-63ad-44d7-b6ca-e742a133972c", "value": "12288:2SO/0Kkw6EdiO8Bf81JWpqznpsend5GAuS8zXJZQ:9O/bkEdH8+RDpsu5y3L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692968855, "uuid": "cec9f32a-c6d4-4556-9d80-94aca595fd7b", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692968855, "uuid": "f5aebe41-4d82-4f25-afaa-a1a7e02c74d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968855, "uuid": "bf9dc230-399a-429f-86cb-c3e6c8612f90", "value": "isbinzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef97d0c-4365-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692981423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981423, "uuid": "04fee7d7-0548-4df9-9dfb-1b16eebcd347", "comment": "Malware payload (Mirai)", "value": "5030391d02ce5afbbf6b607d86bfb9c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981423, "uuid": "1eb58dee-9037-47cf-b20c-51132f9cf9a0", "comment": "Malware payload (Mirai)", "value": "99d817d97b16bf384f4afd2523ba1239d1837a402adbdc20ef96757f85ae6997", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981423, "uuid": "74a2903b-7ffc-46be-a665-23aa5dc1dc46", "comment": "Malware payload (Mirai)", "value": "631b8331fafd66c0ce1ce6120660b48a24047f0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981423, "uuid": "2fe5533a-5b7a-499c-ad5c-cc4b71851690", "comment": "Malware payload (Mirai)", "value": "ee4d80e0d4641afc0288faee2b1da8d9e8cdbe34e633ba930ba07b0717c04e770991f5e327897dfa2038fe2b8f767ffb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981423, "uuid": "0d447353-0bab-4eed-b175-1729b6fb0083", "value": "T188432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981423, "uuid": "4fd98154-3207-4153-b4f9-5222e4e806e4", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAws:RqtmZPuutfbltZFBSJsBcfDSTFI+BEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692981423, "uuid": "f14460dd-b41e-4040-8bf9-10ce157c418e", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692981423, "uuid": "cdc1cd16-6671-4ad1-89d2-742b30614a74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981423, "uuid": "e3cd2fde-9184-43b9-a2c1-0263fb7550a4", "value": "5030391d02ce5afbbf6b607d86bfb9c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d6556f-4358-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692975587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975587, "uuid": "6fd7ef20-3226-45e9-9735-4eb88ba67f68", "comment": "Malware payload (Stealc)", "value": "07012b1d2b663234e889c9075b48299d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975587, "uuid": "e1ad7cc8-72a0-467b-9874-52b17e85b3a9", "comment": "Malware payload (Stealc)", "value": "99e9bef760af39613ddb9b41f29aa32062cb728f50d036033ccf33383c73a088", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975587, "uuid": "c7ea60af-e51c-478a-8129-6271014f3c4a", "comment": "Malware payload (Stealc)", "value": "bcfe2fdbb767808bee50c482671033fcead0a78b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975587, "uuid": "ddba2df3-fe58-448e-9768-a6a4814d66c3", "comment": "Malware payload (Stealc)", "value": "0091923356d9c1009e4358f58470fe4e27da22e1234207ff2aa65bbf44131b94471144f8c8d8dafc8b4327423630c65a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975587, "uuid": "ad4fa066-ffea-4cc2-820f-d8cc2e515920", "value": "T14BA5C8303FEA1148D8756B311875A2C125FABAFB3B14C71E1A58068C9E237938B55BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975587, "uuid": "2348328e-e371-4c50-9249-6768ae3c34dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975587, "uuid": "bad3a418-b11a-4892-b768-0ab3cbe64383", "value": "12288:I66c2ORtL4hNhw1I0rzhvwnjDepvMnFZFg1o7Rgt2tjm3Jub9E7nvhc5bUDur31e:x64Z1v6etMnDkohFlA0gW9rUGarX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692975587, "uuid": "83646563-31a7-4d04-b6d9-6aeb60fd6924", "value": 2168832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692975587, "uuid": "aba4e243-a0cd-4e1e-951f-4ea3bf2580fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975587, "uuid": "6ec22d54-9aa8-44c2-8b74-eb77fe5efb12", "value": "07012b1d2b663234e889c9075b48299d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1cd6f2-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934150, "uuid": "025d662a-ff35-47c9-9f00-b3c8becebab2", "comment": "Malware payload", "value": "6c1d12335c9f26d9d721a970b874f17c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934150, "uuid": "f2a1865b-7ea9-4dae-bf4c-5b03ee3d1c53", "comment": "Malware payload", "value": "9a4088fcddb92578eb61a36fc975027e3bfb70c60b84438e5ec353a850674b3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934150, "uuid": "8d3282a6-20d5-471f-b4cc-93a160a7b522", "comment": "Malware payload", "value": "136c95644a5c3b70462f081bf5608823c482e5ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934150, "uuid": "89a2aec6-c838-48b5-9e34-9d9680b2f820", "comment": "Malware payload", "value": "d66c6f9ca61cc5520f12647c51db375bbb428f657c236f52ff8d4b444b41da63aa6ac64bfb1921056120db243af2d375", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934150, "uuid": "0f193054-859b-4cf2-8446-998858c1b9c4", "value": "T1AAC59D1279DAC636E93E453465AADB3A14F97FE00BB158DF63C0493A0EB01C252B6F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934150, "uuid": "82e9cf34-3138-4caa-9077-6606fb28fcb1", "value": "466bffc0f5ad3d44699131538ff0d13f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934150, "uuid": "5775019a-5cff-4242-a658-0c1380e607b8", "value": "49152:XmLQr+uclpUO3mDOSP9HnoA/s5tFsT3M6FH02p6RnwqKFBKLfjwP8BlYclrXVVdp:XmLpUUIM6FH02p6RwGYcl8AekeXBXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934150, "uuid": "c27cafa9-8b36-4e0c-915e-2a101a25dd48", "value": 2559488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934150, "uuid": "d6532ad9-7236-4897-8d0f-8b13c57a14cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934150, "uuid": "2b9afb8a-b23a-40b2-bc5b-1ec6ac2e66e0", "value": "SecuriteInfo.com.BAT.Siggen.197.9532.25212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd40156-432e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692957607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957607, "uuid": "cd10c4d6-6832-41e5-a2d6-cee5dac6a8e5", "comment": "Malware payload (Mirai)", "value": "0b275c9621ef752da42da192d39c0fdf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957607, "uuid": "0477d685-e725-443c-8592-68fdf72eb0df", "comment": "Malware payload (Mirai)", "value": "9b2a06033a6eeaa9f6ac2a11a50cc8bbab214ecbe22e0cb1d8d68e60616f993d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957607, "uuid": "61cbdea2-b536-47c0-a238-f9bc38db3015", "comment": "Malware payload (Mirai)", "value": "5cbafd17bb2537262eb8760532207f0e64813337", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957607, "uuid": "1d9fb024-7e91-4e82-969c-3721170c8b59", "comment": "Malware payload (Mirai)", "value": "cef6d8e9a724d3c8580009bf059dcc51ee5d2f6a7a66324037f6071b600a4ea5f914d1bc28769139e14bcedc9b95793f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957607, "uuid": "bc36c308-42d6-479f-adf2-ae60f9fd9a40", "value": "T1FD532856BC919A16CAC02277FB5E418D372613A8D2EF32079C15AF2077CB92F0E77685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957607, "uuid": "98043d27-89d1-4183-878b-0f991853a2be", "value": "1536:f6T36ZjNdHqCIBFVG5ZxAKWuwqqrFKuasdghg3mvv:f6u1HqfzZKW3p4ugh/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692957607, "uuid": "94f55cce-037c-499f-9f35-21a6095e8548", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692957607, "uuid": "b4afa6dc-1884-4b96-8f8b-ccc21b9325e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957607, "uuid": "7bf2cf00-2b58-41c4-a7ac-f6afabd483dd", "value": "gucciarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024012aa-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692964839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964839, "uuid": "2e9213af-8aa5-4b19-b3da-da08387e41c5", "comment": "Malware payload", "value": "494784d89fc79674b8223bb93582294e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964839, "uuid": "378971a0-fcfd-476b-a5d0-8cf95badf2d0", "comment": "Malware payload", "value": "9c540407cf179ea397556de59cea170d36919a7a258294993d3feff5d8dc7d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964839, "uuid": "61752a25-70ac-47fb-a4e0-4a4fc1dee6b9", "comment": "Malware payload", "value": "d4948628a339f65449d72aa7baecf695b387e392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964839, "uuid": "c1313440-05ea-4362-9971-2915d071aa1f", "comment": "Malware payload", "value": "550776302eedc13cda566394901e03d7bd4394df843ab608d14d5718a5a809c25bb45c154a119836ffe2fc24050a7824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964839, "uuid": "3a4b840e-4098-46e1-ac81-5411d0a15ba7", "value": "T1BEE533137AC19A72D47308726E3A9F249A787F2045B10DD793812A4F9FA16D0E771FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964839, "uuid": "65763d75-4d54-4ebc-8f13-e98e2501b7da", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964839, "uuid": "2cb86027-e08b-4eca-9fe6-7760c3668e38", "value": "98304:Pa68vWVZcI5Rhh1xzbse8ECB4HO/yzIW5UaT5e/c0X1:LrfTX/L82fzuaTO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964839, "uuid": "5b73b4a5-4536-4a20-97ce-a2828991d399", "value": 3313593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964839, "uuid": "601d99d5-1582-4a21-98e4-2bf41b206a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964839, "uuid": "c738e83d-32eb-4e64-a891-516c0ace592d", "value": "494784d89fc79674b8223bb93582294e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b44f659-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1692964961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964961, "uuid": "01765002-ca36-4371-90d7-d2ca15f73dd4", "comment": "Malware payload (DarkTortilla)", "value": "41a9482dae5a9348c457c44e8441daf0", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964961, "uuid": "fdfb2c7e-3b97-43a3-9113-d83111f4025e", "comment": "Malware payload (DarkTortilla)", "value": "9c6ce2e75249843f2d6980efba7247338adcf40c6138fca7d0b923b4c8c283b5", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964961, "uuid": "efdcec8a-ee0b-425f-b117-3d07785813c0", "comment": "Malware payload (DarkTortilla)", "value": "c5fc20c70c99eb750b6a0620d52059ad8813a16d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964961, "uuid": "c5eb51ec-8fec-469c-b2dd-2075f2f78031", "comment": "Malware payload (DarkTortilla)", "value": "e276f4a006ba6a3a30b110431edcb9b42eb1ccdc04b77e09980af249c48c01d4cfc0127f7155177f7513cba7a0c3edf8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964961, "uuid": "85fc9a07-a76b-45ea-8ddc-f5609fc298d6", "value": "T10265E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964961, "uuid": "20c61a53-21fd-45f1-87e4-4788c35f6ea6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964961, "uuid": "9062e310-b29a-41a0-9fa2-85af89a566e0", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964961, "uuid": "114ad6f8-5897-4f80-b932-db9e889eca29", "value": 1448795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964961, "uuid": "bb8b71a1-1f86-4a25-bd45-e62659a3f0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964961, "uuid": "6cb7fe61-9d6d-443b-9b91-8668c6b91334", "value": "41a9482dae5a9348c457c44e8441daf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb36a7e0-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1692965230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965230, "uuid": "4c071798-2964-48a4-b58c-82ff36d64b98", "comment": "Malware payload (CoinMiner)", "value": "9fd3617c9957df0e7b78a5e188591982", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965230, "uuid": "2031375a-8b3f-4c22-89b8-d19f416246a1", "comment": "Malware payload (CoinMiner)", "value": "9e4bda4fed0a895f8be050d66d727477e3449e8ba1daf1bba27c002033c6f383", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965230, "uuid": "24e69756-bd10-4c6d-93d1-1c20328d6a31", "comment": "Malware payload (CoinMiner)", "value": "785e7caa6ae195793d5e9d87684fedeb63eecd37", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965230, "uuid": "696cecb8-8deb-4f87-b613-a2d2aac3bd60", "comment": "Malware payload (CoinMiner)", "value": "d7180b0f6cb8a6319f9fc9fc98e29efeae6d278a9a7576e1622ea017d11205946510a5091c423c045c52617c4354d7c1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965230, "uuid": "a061f9ce-e55a-4b31-9f95-245fb9e12e83", "value": "T19985BE47B7B34AF1F6050B36D28B1010275BDBC827B7DB9A790B0E5B4A8B7A9DD05603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965230, "uuid": "180cb906-de58-44ce-a965-1ac483b7b322", "value": "24576:08wTmzM5tCfnLeQa4FcNxc31OcYlATHrhq4rC2qYm1qI7aBEQ6Gjqv:HeQa4yC6ATHrZrLLmZOljqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965230, "uuid": "354c573a-357a-4c65-bdb8-e1317660be3b", "value": 1849856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965230, "uuid": "85c5b1ac-d305-4943-a42d-58f6373e645f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965230, "uuid": "82067b5e-5443-4484-a128-2971c66b70ce", "value": "9fd3617c9957df0e7b78a5e188591982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810a479a-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950449, "uuid": "61a587c7-f377-4aba-8357-4fd3a681240b", "comment": "Malware payload (AgentTesla)", "value": "ea9364c45c5124f95c4b545a365f56fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950449, "uuid": "069dc77c-e1d1-46da-a9a6-9782902bbf00", "comment": "Malware payload (AgentTesla)", "value": "9f0c82c7f2d2029102a1d53c511f5cd7b968a6ac5db156053d88f39d871218d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950449, "uuid": "237fedfe-7578-431a-90d8-cf79c3ab3fc1", "comment": "Malware payload (AgentTesla)", "value": "9853bdd87ad0946716bef43693919e2bec340a8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950449, "uuid": "565aaf39-8d40-41c7-8acf-f9ccdf178321", "comment": "Malware payload (AgentTesla)", "value": "9e2d40414405114f67d4019b78196b930c87d6f68074c7a5e150ba81534db1334c154143cca09526ad62eaa5f286f820", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950449, "uuid": "320e02e1-7a57-476a-bb3e-6d95a33250a9", "value": "T103046AF0317D83C3E1A58EB11FCA86B079F136ACA8D0560DA0F59B2E93D2355149D9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950449, "uuid": "4b75ca1b-0c02-4fe2-b0b4-f91be717f611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950449, "uuid": "d7dec133-a07c-4dd1-bf84-edbb34279f8a", "value": "1536:rzAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgE:r5+9wqY+mhhhmitqOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950449, "uuid": "9d3ac86e-712d-484d-9032-9ca3a412faa2", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950449, "uuid": "bd6966a4-5507-4665-a624-b045b79b7d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950449, "uuid": "4d58693f-017b-482c-81cf-f4df05f61d7a", "value": "FEDEX ACCOUNT,DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b08538-436c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692984387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984387, "uuid": "1417b776-54da-4153-a4d0-be8d68871058", "comment": "Malware payload", "value": "484dcd35f0eba320c5962d01da520e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984387, "uuid": "29e3a87f-32a6-4ae0-ac58-381f29391d7b", "comment": "Malware payload", "value": "a2c0ff0add9a29e1b1af25b0faf553de9098a45b04ad98b51c2c6be7e74b6c9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984387, "uuid": "4c623b26-3b8d-40a9-90ab-2a84c2e35dec", "comment": "Malware payload", "value": "4dd7e1c03714fd2d1d4a564b23bd74b9bd84f438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984387, "uuid": "a000eed7-a1ca-4fea-992c-8dcc7ca13e15", "comment": "Malware payload", "value": "e21a41b789cf1792fa7783c0d4c9d09c1cb6fc78a4204eee7d5879a17e38ca14c95973c563d126044b2f9be6cf4e05bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984387, "uuid": "a92f163d-1f0a-4dfe-bd06-142783ec7267", "value": "T16CF4125BB7FC9022E8B9637019F702D31A367EA09B38836B174E5C4A0D726B59635337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984387, "uuid": "c278d1c4-1f89-48e0-8bda-30a8fdb59108", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984387, "uuid": "91faae16-2f8c-4ede-a05c-75667d3560fd", "value": "12288:YMrVy90X2qD6kE4oJgwkD7varaRZHtSmk5tDO4gsKdrX9pna1VCh/M0y/YHH/aSe:9ycDk4O9k/aODYluAAh/MwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692984387, "uuid": "356b5792-6438-4ea6-9495-f47c09853b7b", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692984387, "uuid": "70e93286-4c83-4d96-9568-ef3edee8d30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984387, "uuid": "f6095504-6023-4671-b965-fb02e6b9f769", "value": "igla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1a8228-4355-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692974444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974444, "uuid": "9ef7848a-0461-4e15-a77f-e7eb1e24fa06", "comment": "Malware payload", "value": "6d9f0c304aeba9e33af28055ad4a435b", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974444, "uuid": "dcc99c0e-4d65-4aad-97e4-d64691f154a7", "comment": "Malware payload", "value": "a2f4df4284fda610f6ecd061c33535a97d87b1d0a5b4e183ecc164e0a1a8cb3e", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974444, "uuid": "967b6f1d-2891-48e9-a3d2-b5be450b0e85", "comment": "Malware payload", "value": "6b03f79b90591e6ec1097bfbf86c66cd9219b5c7", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974444, "uuid": "b473e308-abd7-4b18-925d-a64bf1d2f2d8", "comment": "Malware payload", "value": "1a98c791eb743a47a7b7831aa84347d260d26ffc005d905d51b1859de5a552e82b1000ad3a6b9f8dc3156c15b962c228", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974444, "uuid": "01575a60-94e9-4430-8ed0-8fab3be3a5c5", "value": "T15D21AF17B1F9071CD2B18A3F54B4AE0387367C49A8178F1E72912EBC18652CCA861F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974444, "uuid": "71f41b69-63d2-427d-900d-d41f5c68e227", "value": "24:8N/nFZZsxEZ4meZpyAzkE+/4HFr5ws4fVSPeP7pEQeyTtTVab/2XT7w:8ZFp2LFWLfV4+7iQBab2j7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692974444, "uuid": "438f603a-840e-4a3c-b60b-c692c2e2bd82", "value": 1409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692974444, "uuid": "a24a3adf-14a1-433c-a1c1-46dca841cb2e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974444, "uuid": "5b3c2688-4d80-4a19-a2f8-4a8cc0c5ff63", "value": "accepting(dwnl-upd).lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef6b51b-4317-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692947707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947707, "uuid": "4ef95d0e-8098-4583-87c9-559d5f914d81", "comment": "Malware payload (Amadey)", "value": "15bb8ec418b36fb71fb49546e4975b8c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947707, "uuid": "e4d73049-15cc-4cd0-bdb4-3e8dc7c1f787", "comment": "Malware payload (Amadey)", "value": "a34fc3155fa14a46756b68477949b2653663604648c2d1f27833194cd498047f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947707, "uuid": "01229728-22f1-49db-a381-caf597eb4a45", "comment": "Malware payload (Amadey)", "value": "ff04fa7e4035b3fe4207248e6496db83bd6ebbec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947707, "uuid": "45f43abe-2bb1-4ae0-b60d-454928900ff7", "comment": "Malware payload (Amadey)", "value": "091c697fb0610fdde36390994689154e9fcc649fdc247cb08e2cdd1a8e56d0481bac153205f43b9bbb561bddb691b307", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947707, "uuid": "cb5a7aed-9cbc-47c3-9172-c41ad7838fcb", "value": "T143652353E6D95433EA7A5BF058F602A30235BC354C78837B6784593E1CB2BE46472B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947707, "uuid": "c781a385-43fe-45e4-b04a-b434504fd840", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947707, "uuid": "171e84c2-f13f-486d-9ad6-0cbb9badf3b0", "value": "24576:FyF8DFxgI9YubWKpTMTigQDnt9QRROXKDqaWpx8uRowcqccy01s46V:gF8DFS0SKpTMe/DntaRkXm+3eqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692947707, "uuid": "2be4b509-cad2-4833-abe6-d44bc873771c", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692947707, "uuid": "6ee0f90b-58d2-4b11-bc66-0eba629cd8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947707, "uuid": "f082534e-57e2-48f6-9a3f-5397a0070abd", "value": "15bb8ec418b36fb71fb49546e4975b8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26485f2e-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692961893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961893, "uuid": "ac9bb916-6e3c-4cae-a3de-7b818ecd14e0", "comment": "Malware payload (SnakeKeylogger)", "value": "2e3a206bbc0b4d1b3c17378ded00484c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961893, "uuid": "c6f35a28-2aee-4b72-a185-7df9061b1f08", "comment": "Malware payload (SnakeKeylogger)", "value": "a373042d1c9cfa5f767fb6665ecb1f73d90b6c27f4f7f5940f346ea823bbc625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961893, "uuid": "74ae7908-6c13-44c1-b6a4-499cde3e3e57", "comment": "Malware payload (SnakeKeylogger)", "value": "92e98ed0ec991532dc8f09505d7d8d6329b07173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961893, "uuid": "03a64a4a-d0a0-4641-b629-e3bfec6d8755", "comment": "Malware payload (SnakeKeylogger)", "value": "1ad1c85a8a088d237346eed6978e760c50e4821a750746d2aca3ea3189d4ae07952e41c8e2e446ae203f634ae5be455f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961893, "uuid": "d254a4b9-9adc-4af3-91bb-24032eb2a2d9", "value": "T103A48207FA4F8EE5D38F1B72C59B10004BABFA913627DB0F794A23563A037EA6945507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961893, "uuid": "556ef835-ccd9-4044-8825-5d185d4925c6", "value": "12288:owDnEzEvc0KaXa+9aBUZKBqpabeSODoyYYaV7XpuHCoshONosC+t:rPaCaZziZDoy/HljaLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961893, "uuid": "2d46a94a-4b74-4cb1-bd65-e4ce91efbaf1", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961893, "uuid": "53f373ee-4163-421e-be96-0a743639ffd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961893, "uuid": "101f458c-0012-4f5a-9464-bb53db385e2d", "value": "Bgbei.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900a34e5-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934153, "uuid": "62b4e7a0-0653-43f3-a498-12629adff05f", "comment": "Malware payload", "value": "74e022775429a164e972cc2bdd12b96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934153, "uuid": "912aa180-1c5c-4e84-9432-f168c97b45b1", "comment": "Malware payload", "value": "a445f30f609809dc9a9ff1acf370e47e5dac2590d3f8f88f4a719dfff50cbdd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934153, "uuid": "2e49ec71-77d6-4d01-b4c2-0f71bd588f49", "comment": "Malware payload", "value": "2fadee41072427dc7e6dc8487ef1ecfa725e2f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934153, "uuid": "7c83c6bc-50fe-4d2e-a75e-8d99de51d981", "comment": "Malware payload", "value": "b4188e70c809f2de7313eee708478b19b51178b627f9e4e43acc87ce97979cfc0d20dd6c76a3ba3c96f2678bbbff58a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934153, "uuid": "d1e22a5f-494e-4e36-9659-42072332f25a", "value": "T157159D117BC6C432D4BB05702E29D76A456EBD304BB188EF63D80E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934153, "uuid": "66aba8f8-79db-4d77-ae41-0a0692c32eac", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934153, "uuid": "5e6d6f6e-6f34-4dcf-afe9-373c43f7f771", "value": "24576:iyyzQyz5io+HExGWUAyiqZhYjBqnGIQ5M6DLrVVdWHATY:irz5io+HGGWxyzhYJlrXVVdWHAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934153, "uuid": "63096cda-9dbc-401e-ac67-19f4d844d454", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934153, "uuid": "d844e184-d6cf-4aeb-928c-71a57307f67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934153, "uuid": "36962e8a-91d8-403f-95e4-d0be59a6e1cb", "value": "SecuriteInfo.com.BV.Obfuscated-O.13908.3678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adea0f5-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965444, "uuid": "a9e98696-6a39-4b82-ac46-63542e04fed3", "comment": "Malware payload", "value": "528bf9542f81266f533734065c11d6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965444, "uuid": "6a682022-c420-4e44-8742-9f6e52a97875", "comment": "Malware payload", "value": "a4e633022b0d913383f37f29e1c9620be55ceb1f68e306b853ef7e11c9e1fa5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965444, "uuid": "e3b92cd5-772b-4612-87f5-063fb56ce05d", "comment": "Malware payload", "value": "4d55a54a81c77aaade49f2484bc18ffd7691ff4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965444, "uuid": "9f92d525-3868-447a-a48b-3ad9a5911ef7", "comment": "Malware payload", "value": "fdd7d63e5c40faf75ec5f78b8008780e66d467bf6bee8f337009bdf59c9cb7523564728d2456df235bb22358faa1770f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965444, "uuid": "6ff022bc-5b3f-426a-978d-cab6c66871c5", "value": "T103C53361CAD1B0C5D5DF972D8C12CDAA1DCF4903BCF1929F27A8D227C998098E9762D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965444, "uuid": "eb286d09-3fc2-4432-9a33-9ef7ee8493a7", "value": "49152:4DW7oJK1LMZUg9qkehc09WLRloP58/UuqOyKpLYq1tEvkjcD93wmA2m:46UJZSh7kjoRtHOrpMsgD+TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965444, "uuid": "7c2108c5-019c-413f-bf03-c30bf8216248", "value": 2664000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965444, "uuid": "edca290c-6b53-4f5b-b648-8a99d1e4e62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965444, "uuid": "ee659578-f4a7-4861-a0f9-cfe75fa67a35", "value": "528bf9542f81266f533734065c11d6b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7bccef-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692965450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965450, "uuid": "8111617f-0c91-42b9-8630-75a7495da6a1", "comment": "Malware payload (RedLineStealer)", "value": "0accfefd7d679a557605a48b0b7271fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965450, "uuid": "72e27576-0b3f-4e91-be71-07e0f97a1a51", "comment": "Malware payload (RedLineStealer)", "value": "a59c06635530b5de3a83ee2a3219833a82647f140f1898cd6f36f0caa3cb9b39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965450, "uuid": "d77fb064-a426-49ba-9c7e-4ea9bee436f1", "comment": "Malware payload (RedLineStealer)", "value": "f39143639b4ffd1931fb75a22dd655d4165ada43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965450, "uuid": "942b1724-1912-4533-933e-afac3ee56967", "comment": "Malware payload (RedLineStealer)", "value": "5656b64f24c8bcdfbe94b13b56abe805b14971d9785790b0b82712971e664e1ef128d1ca2607e870b9bf75b4e7f4533b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965450, "uuid": "38269cd6-ec9c-4251-9dd3-9ce1cfdd34fe", "value": "T111652309DBCC983AD8F51B70B5BB07930676BD924EB517AB2319640A4DF3288A835377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965450, "uuid": "774bb671-ce81-4bfa-bedc-d46272984612", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965450, "uuid": "e7614eb4-dfb6-4813-8055-34bbd832cf8d", "value": "24576:Hy7/9ypE79brARUV1EVCu/lar0GJKb2qRvOpSm9lboDKC8sUDz7+a:Sr92E79PARUV1UCu/YYgKbPR6SmzoDKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965450, "uuid": "d4a97d23-546e-418d-92c9-6e39f71e5249", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965450, "uuid": "a79605b4-10c8-4bcb-94f7-ad73c9da989b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965450, "uuid": "570b7118-586b-45e1-a875-ae89ec9ed72b", "value": "0accfefd7d679a557605a48b0b7271fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dedd48-4347-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692968276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968276, "uuid": "d79be61b-04e6-4080-bb59-b232f10cdca3", "comment": "Malware payload", "value": "2ed69010a7a2e9f8083d7cf46ea96231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Screenshot error chat attachment", "colour": "#1862DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968276, "uuid": "b65e11b2-f3c0-4d31-9afd-9ae15c9b4187", "comment": "Malware payload", "value": "a7d84f7ed04e6dc3068d22d89049dbb27f6de4d672c6913e805bc5f6fe3ebcd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Screenshot error chat attachment", "colour": "#1862DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968276, "uuid": "c2489943-db57-4516-8323-1a4c90183d80", "comment": "Malware payload", "value": "8fe2ee950e44ac26573848555a6e935aae155fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Screenshot error chat attachment", "colour": "#1862DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968276, "uuid": "73de4832-00c2-471f-a8db-fbf1aec289f6", "comment": "Malware payload", "value": "56ac0f3e31f77faa0d19779352b21ec2bda90913ee145826c2af33f029ab7148d920ec99b7010715233254a5ba09b744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Screenshot error chat attachment", "colour": "#1862DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968276, "uuid": "50803c9b-9ac0-4ae1-a320-8bbba5ace647", "value": "T18435025AC3EB9161E0ED57B508BF126A7834FCE43A62667B610A749E1CF07807CB530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968276, "uuid": "656183df-63fe-4491-ba4f-5a0c13d313ee", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968276, "uuid": "0d0fd53b-3d6d-4720-a76f-51678aaddb40", "value": "24576:x4mtRbG/SteCp+xjNSKw6Yxn0LX2aVicunC/R:ukRbbeAeY/xQXN4C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692968276, "uuid": "d178b532-accc-4f9d-b77f-81ff88b17486", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692968276, "uuid": "24e3b358-a7b6-443b-8be2-6d5622966ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968276, "uuid": "b0d7d28f-0942-4cf7-8eb0-8df873a900d5", "value": "Screenshot error 22-08-2023 wwwskype.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352656a9-4392-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693000573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693000573, "uuid": "c79d693c-7959-44b6-a055-1ec922c8fe83", "comment": "Malware payload", "value": "58ed97858e9a7c6ac20567f13d57e7a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693000573, "uuid": "5eaff6d2-a3b8-44a6-9e01-52951882a875", "comment": "Malware payload", "value": "aa376dab5cd54a8a191d13102a0d89d6771db7cb99e4ec341bc8bccd5e1b4107", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693000573, "uuid": "7e33b2a5-ebba-46b6-ae01-4d33ac2d1521", "comment": "Malware payload", "value": "18688ecf29707ed27fcd6a296ec7f49cf5526af1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693000573, "uuid": "f0d63bba-7f37-4c52-9680-be9ac09ae5b2", "comment": "Malware payload", "value": "420becea2d3e08278c971a77388589ef9d9348e1b041316d46d0c8a08ca727c9a601cbf87c16b1eb7efe05369f90e33e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693000573, "uuid": "63d4f4fd-4d6f-4b25-84a4-0e1551a1c59c", "value": "T17AC4DF043BA4DD509B2C16E868DB93178B2356A7EDFBFF0706A291341A1B96357413CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693000573, "uuid": "90af6390-4c33-4453-a1e5-8a3b8e7ef329", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693000573, "uuid": "821185e7-7a17-40d9-b5b3-82ea619ecf89", "value": "6144:UrbOV3INiLFXf4TryvV4J24mWNxFMcFjbNJcmq9DrpSaG:obYIN4zI2tw/jbNHq9DrAaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693000573, "uuid": "5bbc919e-6fd6-43e3-8bbe-8ac4b574063f", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693000573, "uuid": "19fcfbfb-0a96-4a57-97e7-1c4dfc4601f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693000573, "uuid": "4c88d418-e834-402b-81fb-e81c8404e131", "value": "KABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZOFRSwUXFUP5E8LYHIuJXZxpPXVUTYQPEINX8QAuVbt_BUWPMnQGKBTVDQs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0236bc-4355-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692974442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974442, "uuid": "5055c0d4-e4e0-444e-9ad3-3a86f6a4e643", "comment": "Malware payload", "value": "e521cb88bf6c2129ab4f5ca1088749f9", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974442, "uuid": "1cf4b6dc-0372-42f5-9434-c456e6244727", "comment": "Malware payload", "value": "aaee48a8a5219b785aad696bf68a36085e47c96b9521110458730e8da8a2cff0", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974442, "uuid": "5bcc0e09-03ed-425a-98a6-f2a3e995ba36", "comment": "Malware payload", "value": "929c17ed870dc13556d306c1be71439babae1186", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692974442, "uuid": "d33d20a2-bb5e-4b8d-abb6-aa40364bfe05", "comment": "Malware payload", "value": "e62c23a848bdc40b433cad72179c97354985108787289863b582e559daae64a0e1fc1c06f0e8cb5f2bd41d9c71e27bd1", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974442, "uuid": "7b0b01bd-984e-4668-afb7-bb3165c002a9", "value": "T1D9C08C21462EC869C12B9A08890A8EFCB8131181612ACD7247B35A48AC821285E4818A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974442, "uuid": "00b0bc2b-a7fc-4aa2-b552-675bff20915a", "value": "3:HRAbABGQYmimmQId4EKEgUkzbzUo1YSo/QJwVynIyYesbBSn:HRYFVmi3N4EfazISoIJdnIyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692974442, "uuid": "ce6924f1-dffe-4f39-99e8-1ea3d242d381", "value": 155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692974442, "uuid": "e3cce45c-119e-4ee7-b1c7-08d6a735f8f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692974442, "uuid": "ca931c95-cc66-4c87-a630-ad7a71fc5099", "value": "load-central(restartneeded)s.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c090f5b5-4343-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692966876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966876, "uuid": "e150bce4-b76e-4171-9d7e-80ecf9799fdd", "comment": "Malware payload", "value": "4ed0397b5b968b53dfc4df6b887f44d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966876, "uuid": "a7b8d2a2-dfc8-461b-a9d5-4cf52b80ee89", "comment": "Malware payload", "value": "ab65ec9d27cd7b1024d1eed8dfecac58a918e8e4c3e97206112051711beec34a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966876, "uuid": "5285faf3-7ad9-414b-90fc-ad2ae1974609", "comment": "Malware payload", "value": "67651d314365d3f3b767c3c01d132bf0559fc8b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692966876, "uuid": "47b78267-7ff9-4347-9996-d3267bbea6ae", "comment": "Malware payload", "value": "a42b0b008fc7447af9f38bb116cd86b0b92c94c0833a49af7544c56adca8066638230af592a7907b010dcbbbf45293ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966876, "uuid": "8c721ba3-78c0-4d8d-bb7b-7ee305e2670b", "value": "T1FF238C50B440C173C10B647840ABCAA65FBE6A111BE0549B3FFB577E5F702D1A63E38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966876, "uuid": "d687c295-12cf-496a-bd47-1ae5d4ab8326", "value": "776ef6f7d9898064a1a9c991c9fb0f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966876, "uuid": "ae1af892-ad93-4bca-97ff-445d5cd2737e", "value": "768:BwKnDLdSmnEioglJsUcQ8UMk1V0rMRyc9VVgcy42J949JM+wdLf:qKNHOglJs9+hRD9VRy42J9OJ0dLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692966876, "uuid": "36cdecfd-efbc-47f3-b9e4-3e704ad9dc82", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692966876, "uuid": "a86efb54-3a3f-49b8-9a55-462526b2f078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692966876, "uuid": "f0949527-3512-4d3a-a7df-1aacd8e22d1d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.12747.20990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addb5180-435e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692978441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978441, "uuid": "3af18b5a-4ee4-40c0-a91a-b8cea9940838", "comment": "Malware payload", "value": "345780d4f7c76062e114bd4d1a15ca86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978441, "uuid": "0b4c3d7c-81ec-4444-b705-9ab75271dd91", "comment": "Malware payload", "value": "aca35c82f5cb90a965355a8dac172cc5a5a2b99439997f7ce7bc59230d54a876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978441, "uuid": "cdd330b0-6816-42c8-a767-333098408918", "comment": "Malware payload", "value": "7efa65e0d1270d9f91b87d0db99c1ef7ed54be43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978441, "uuid": "03d0f4d2-72bc-40f5-a223-7f5fbbacbde7", "comment": "Malware payload", "value": "856b2d58cf99577cd2ec2b2daf5dff3ef6763e8272065e5ae136f3f7ea19ca6d8d8ab927499b54e50f7f885fba871e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978441, "uuid": "6b6c5955-5886-4166-9723-ab35a5c54a43", "value": "T19C96D023BD4A0CE1F0AAC539C929BE64A1BE7DE847218CDB13B47E56F8511D1CD23A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978441, "uuid": "b40b7e07-05ad-488b-9606-f0633618bfd2", "value": "aade837cd69d4b8af58f97ca72e6abab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978441, "uuid": "e51a9f0c-ff84-4029-b966-eee5e709b722", "value": "196608:gbPo2MDmz58MW4DIp7KKLZjfOo+Ox3wN9vPYOfQ1Mbu76AAcddB:gbPo2T5GOlOx3wN9vnfQ1Uu76AAcddB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978441, "uuid": "a7220c67-c3d0-4ff1-910d-744647da0a76", "value": 8935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978441, "uuid": "7864b6a2-b0c3-4e5b-b67a-91ff05bc17be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978441, "uuid": "cde856a3-9f65-41a9-864e-768839156ad5", "value": "CG100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998b5660-4328-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692955214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955214, "uuid": "74cdc848-f177-4ebf-b82d-74763bc1baa0", "comment": "Malware payload (DCRat)", "value": "57254d5a99b5daaf5ef2cb2c71b88278", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955214, "uuid": "01d800ea-cab3-4ec5-a6f1-035eae8f37ab", "comment": "Malware payload (DCRat)", "value": "ad8a70db5fcde7aae714114a2bd09d3f6d24101de23f4b6fddd725077b2a6f51", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955214, "uuid": "72fcd391-8292-42a4-8667-3fafc1bac5bd", "comment": "Malware payload (DCRat)", "value": "0ae05fe50c2d7412b0833547392eae50b7c8af01", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955214, "uuid": "ee432bf6-6504-4414-ac5c-9aaa9e157608", "comment": "Malware payload (DCRat)", "value": "281445eb12898289119692a7cd8739b3c5a90f1d87cbaa405b3ccf6a0abb958fc8b1d8f531983cfea0bb0b4b7eaadf66", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955214, "uuid": "93b752c1-fea9-4559-bfea-90c06dc0d156", "value": "T175A5BE017E8ACA21F0195633C2FF454847B4AC512BA6E31B7EB93B6D55123A37C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955214, "uuid": "37a51bd5-f1f7-4a32-8f3d-568be42dbdb3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955214, "uuid": "1e8f80f9-ae51-4d89-9565-3ec5834cfd18", "value": "24576:X2G/nvxW3WCWbSlHRjp7nVYOeIHOd+gVM3ZWdYtQ/EUe4GZmWEVaeDaCUwqdIj8:XbA3AbMH7cddKMGW/EqGZ3eXUwqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692955214, "uuid": "6543ba40-b429-42da-be1c-7e4ccdef16f4", "value": 2129541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692955214, "uuid": "c7cb7e49-054a-4fdf-9746-ef0775596158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955214, "uuid": "f1a0e20e-6173-4694-9390-0334070828e1", "value": "57254d5a99b5daaf5ef2cb2c71b88278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe09a36-4322-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692952514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952514, "uuid": "3e4bfcf4-ac69-4fa8-9f73-327b4c74ec85", "comment": "Malware payload (RedLineStealer)", "value": "88c22a4ceda5826b5a1a22eb912e9af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952514, "uuid": "6c125c6f-0660-46c2-93ad-ffd378fb53a1", "comment": "Malware payload (RedLineStealer)", "value": "adaaed13e4b05df533f632a6c77a10a98484b6a5f16ed4ef6bbdf3f6178081d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952514, "uuid": "f9530441-4774-411a-898d-6fe92bc4ef42", "comment": "Malware payload (RedLineStealer)", "value": "7be2513606d0e4c54182e88618174582e5fb72e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952514, "uuid": "7d390504-1ef3-495d-95dc-d3a446f443a0", "comment": "Malware payload (RedLineStealer)", "value": "b002f4eede2ef8e80755a4475bb4320cf9d110cc3b44aed5a4a6438f56372629153a7c7ce86f6157eee962210974d67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952514, "uuid": "67ca5927-fd7e-489a-9de3-34a4b603f73d", "value": "T11494F112B692D872C7A644309824C6F4793AB8F2C99D894333683F7E3E713F1A267755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952514, "uuid": "30fd7df1-8090-44fc-aee0-6c3e1684e8b3", "value": "d486cf0d009e476ba5dbcd1e658bee6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952514, "uuid": "4e02864e-d036-44a5-b419-7013db2bbf7c", "value": "6144:DPt8/LsF0u2uDTDV2i3p4Zj/ib5s70bw2GBwkXozmfsoapwTiRrN:DPt8/CxD7VBKZjS5fwZWkqUi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692952514, "uuid": "85dc143c-e8de-454c-8f9b-106668671f60", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692952514, "uuid": "e1bf8175-52e2-46e5-8391-3af25d99f3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952514, "uuid": "1ad70db4-07b4-434e-84bc-a13ff501cebe", "value": "88c22a4ceda5826b5a1a22eb912e9af8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916cdd39-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934155, "uuid": "663dc8c6-a612-4d56-997f-ed906590e67d", "comment": "Malware payload", "value": "70f43b19015561e3ce452a6029ce8c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934155, "uuid": "f023f846-e7ac-4d3a-b568-bbc2b0b89ff1", "comment": "Malware payload", "value": "b11f117050ba7d475909659b8b5364ca134942bddfc08dbabe3d4c013c1a137c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934155, "uuid": "d8913925-1f5a-440b-bbd0-ebd14279aec3", "comment": "Malware payload", "value": "35cb15f946648ea8e9f85022b2a28ae5edc0aaf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934155, "uuid": "be11dee9-3711-41b3-bbe7-f81971cc4373", "comment": "Malware payload", "value": "b838568f8058a912b52cc2c1633867085af2264d52d2e86963b41a27e6dcf7be96cc783028805a7788ffa5efe437d4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934155, "uuid": "cc3c99c0-ee33-46d9-b5c3-3979abba6ee5", "value": "T1AF159D117BC6C432D4BB05702E29D76A456EBD304BB188EF63D80E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934155, "uuid": "4c20f3b0-086b-480f-a2e7-67e93235b061", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934155, "uuid": "49f93fe7-ec34-44a5-88cc-a5f780745b0f", "value": "24576:iyyzQyz5io+HExGWUAyiqZhY3BqnGIQ5M6DLrVVdWHA+:irz5io+HGGWxyzhYtlrXVVdWHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934155, "uuid": "8f61d8fe-6575-4ba4-b077-bbb67c3c205f", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934155, "uuid": "f34ac89f-5038-4333-884f-859f27ca26a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934155, "uuid": "b0579966-af36-4061-8360-71cba13af200", "value": "SecuriteInfo.com.BV.Obfuscated-O.27532.23465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fd4f9c-432e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692957604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957604, "uuid": "c93ad95f-ddc6-4c77-9b0a-66ac9a375516", "comment": "Malware payload (Mirai)", "value": "ce347e06576d4f375df3067a669e5c53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957604, "uuid": "ee56f40a-ac24-4894-9666-87d43b5eb331", "comment": "Malware payload (Mirai)", "value": "b1a581867e3feace3da80c1b926143ca78f1a2869f3355d2c4f6c77ce15dcbc1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957604, "uuid": "1d36a30f-43fa-4739-bd70-1637f0904362", "comment": "Malware payload (Mirai)", "value": "99ea3e2b96d8455dc475f4386325de7cfc2ee55f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692957604, "uuid": "1ae00964-05ef-49dc-89a6-7243ab427459", "comment": "Malware payload (Mirai)", "value": "74e53201f2b5efb4660599a93727bd680c91f765e97d4f6a3063b2e894a55d09d5b7bf3e066a67e61211a47f868ef3f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957604, "uuid": "d24d54a5-8725-4b28-961a-a62e706dbe4f", "value": "T163336CCAE6C3D4F5EC161A712477EB738776E93E2069CB93D3996432BA91602E10335C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957604, "uuid": "1de23386-7466-4b9b-8432-992d151261e0", "value": "1536:89OCtYdVcxgh7f30gWsLD3e8UfH+mqj3I:8IRqY7fgsH3nUfPqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692957604, "uuid": "f974121b-dabb-4962-b2d4-accf165ee8a0", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692957604, "uuid": "fe579307-e972-4ad8-b077-218e4e7acbd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692957604, "uuid": "840f662b-d650-4b5d-83c4-444848ad8ae7", "value": "guccix86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b287263-431b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692949553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949553, "uuid": "4270350f-05b1-4d53-91b1-1f17f2acf716", "comment": "Malware payload (SnakeKeylogger)", "value": "5d7c165e8964a96e5acd9f4265cbcb27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949553, "uuid": "1a145313-3408-43a7-a234-197413adb472", "comment": "Malware payload (SnakeKeylogger)", "value": "b2673aac317ce046fa5eeb0356d6916482b4083fc12e19ff43e37fdadcd58dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949553, "uuid": "b9a5b2e2-61cf-4e8f-a858-e5aeb0054a38", "comment": "Malware payload (SnakeKeylogger)", "value": "10771043817de73153714d4e64599046bcc23b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949553, "uuid": "9e09d747-6a8e-4f08-a77a-3cfad82a14a8", "comment": "Malware payload (SnakeKeylogger)", "value": "7c5e72fa2afc3929508d9d6a9114f67287e9d0fc3a4cb93d09e9f818319e69e67ad4e4d3a6ab115931681b367039d89f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949553, "uuid": "f245462e-1047-4106-aeaa-e19e4b9609c9", "value": "T1F8F4F01062A9867DC67EB3F13BA087103DB6153F8064DE252B75789FE131265F9C3B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949553, "uuid": "232ab3b2-b78c-407e-8f45-7ea774098945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949553, "uuid": "a7de54e3-c588-4b02-ac4b-f37ce5878cbb", "value": "12288:O4jojIkCkax4CQI9gKTe83POZk9uPmZfeH+dfW5cwmOP8ysDJejekWpm:O4RkXaxh7gYeksk90s2HWZwmOPbKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692949553, "uuid": "51890521-a133-4390-9c05-c9be50a61452", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692949553, "uuid": "91083d93-e645-44a2-947a-62f7070d3755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949553, "uuid": "e6ef14f4-5e0a-4a7e-8b30-7df521ab3416", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7907417-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965170, "uuid": "45ae4a26-aada-4c78-a887-a26425cae10b", "comment": "Malware payload", "value": "e626fa56e18dc449c1ca649b5ca224c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965170, "uuid": "ad057855-c651-4fc6-a9b7-7f241f596316", "comment": "Malware payload", "value": "b397b3305b97c85b39449aa686f8f6a89059105c81e5c87a7d073ecee8f83e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965170, "uuid": "49549b45-3aee-437e-b9f5-0db678176991", "comment": "Malware payload", "value": "734dcccebb55ca9c110de7918ece3bc18dd5b6e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965170, "uuid": "65425db8-577e-4fbf-adce-85a690cf84d1", "comment": "Malware payload", "value": "f29b4f304f50477c8f7b388a27ef78e20fb3a24cd05b5be09c7b3a929c1baafa69109d518bdb27d0e5f9b1c229e598a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965170, "uuid": "f639b16b-fcf8-430f-aaa3-8b909e92eb1d", "value": "T159466C4B53B500ECD5BBD138DA57A927E7F2704A53749ADB01A186A22F23EF02D7E710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965170, "uuid": "756696cb-f2b5-4fee-9fa0-d946fd65351c", "value": "98304:d+v+4dyLq0iLF/X4oVrUZEtqtHRlwHY6Xa:d7LqVLF/ooVrUZEtqtH7wHY6Xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965170, "uuid": "e20e6ed7-e407-4cbd-b9f3-e6dd987fdbbc", "value": 5811689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965170, "uuid": "087ec05d-d470-4e8b-a58a-4bbb8d81e26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965170, "uuid": "f38dc262-9136-4aff-9d28-72c33b4adc77", "value": "e626fa56e18dc449c1ca649b5ca224c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe82162-437f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692992350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992350, "uuid": "e654a267-3cf4-453f-a100-4814aad01379", "comment": "Malware payload", "value": "674e3c0ae0f2627c10b58a717ee093bd", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992350, "uuid": "6fc074d6-1726-48da-a530-5257ed503df0", "comment": "Malware payload", "value": "b5f52078915dbe23dcb847e7badd546e1325403e56694ea624aac39c68d6f985", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992350, "uuid": "c5511f90-829d-480a-91a4-76d39b52585a", "comment": "Malware payload", "value": "21f15d58046119712572a5114b781027c99f7bc4", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992350, "uuid": "84174aeb-e2c3-4054-8bb4-aa21b6c1b531", "comment": "Malware payload", "value": "4660b2f0040288edc658330b9453c4713a317ee145a0b2f3c6e9d874015e21d259dac27112446c5695300c5911203d99", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692992350, "uuid": "3f480326-6c38-489b-9976-9cc90ab7a3d6", "value": "T1BC35ED343979BC2043EBD91334F14BA65CD9168FD5703A3B199AD423AA346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692992350, "uuid": "6959391d-fbef-4b8d-95d2-60ac0146de5b", "value": "1536:7pLwiizmnY5q7O2Db9L1/j/SFBOWrhRxPNahQo8y8Im+lIWFT5YhmFfON/H8P2c0:7ppizmnYs7Og9LNjaH1rhRxPNahYYPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692992350, "uuid": "7509a76a-5857-4095-a880-11c7ad88bab1", "value": 1154877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692992350, "uuid": "7f16f162-8602-40b0-af81-4035bdc486e6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692992350, "uuid": "e634af73-b956-4c11-a485-8eb6b87d1a18", "value": "localer-en.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfc75d7-4308-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692941528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941528, "uuid": "5224c7f3-b618-456f-87c3-3e4b4b34110c", "comment": "Malware payload (AgentTesla)", "value": "82347676e97933dc23c247af0a72d72a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941528, "uuid": "a8f267e0-1383-4684-8069-7b66d6a8e548", "comment": "Malware payload (AgentTesla)", "value": "b6a7597769fe666915fed206fa6544f87a6546fc419e1f8ab0990b6c706dfaea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941528, "uuid": "2a50c511-3047-4667-8aa0-839ebc8be8d2", "comment": "Malware payload (AgentTesla)", "value": "282368476b917329fd5ba78cd537be50f1c0232b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941528, "uuid": "d2cbfc37-ebb9-41de-935d-5fe0c7405c13", "comment": "Malware payload (AgentTesla)", "value": "2ecc200ac63a825855449086bdf610aab475eadcd292eb2711bd9a6518d30a5e2028b6b7ee4a38a706575e9c0ae8acc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941528, "uuid": "68ded9fa-d582-4f75-b699-614cc2edcf7f", "value": "T1FF949403BA4785F1D2491736E58B130043ACE681F7BBD71E394A23A6C523FAAED49D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941528, "uuid": "17bef92e-0a89-4023-9b0b-92387699b2d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941528, "uuid": "7b06f286-8439-45f0-8c3d-5dc98346a767", "value": "12288:msn9bAOTrOndLBwH7jXTCdM4HIE1P/DxRJK8K4app3zOQpxMoNevTLuWS:pn9bAOTrOndLBwH7jX8M4HIE1P/DxRJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692941528, "uuid": "f77010a8-e5a9-4c31-98db-90bfd8010d71", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692941528, "uuid": "2639ed37-f722-42a6-9f0c-6724e11d3e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941528, "uuid": "67e5ce14-cffe-4623-af31-339f6c08a022", "value": "SecuriteInfo.com.Win32.PWSX-gen.28629.18829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f004ce0-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950365, "uuid": "4c97337d-7814-473e-ab88-b3b64dd415a7", "comment": "Malware payload (AgentTesla)", "value": "a0feb4143db170069059f1c74732b611", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950365, "uuid": "866e8bbb-49d6-4e1b-a3c8-a40c998888df", "comment": "Malware payload (AgentTesla)", "value": "b6adf82dc2b9784ca98e7e33998c3fab1307f1078bb5ee9431a02d43ced7c3bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950365, "uuid": "40bf9599-12b4-4f2f-97a1-b3e029827c88", "comment": "Malware payload (AgentTesla)", "value": "51123a56207bcf354a20eadfaececbba9e00f931", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950365, "uuid": "87473244-bdc8-48d0-8a90-18742d2624ee", "comment": "Malware payload (AgentTesla)", "value": "4271f8c794728ab54369bf14803602542650a787be31d4c4ea4003fe2ba20395c25660889bd6ac628d788d71332079e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950365, "uuid": "f58f5a42-42b6-4121-9de3-ba5e09c1728f", "value": "T1C9E423552A8DD46CD997B935CECE95A21FC23496D30F11B9872B5B2EBC03215C23EC3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950365, "uuid": "91cbbd61-4bf2-4095-b9c7-9eb267e0858c", "value": "12288:7iqIVOfEmZxVmqwdyCHoLE5wDtWRV3yBPHGp9v4Ap:PgOfEqxVNw/ILE5bRV3qHNAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950365, "uuid": "838bff0c-d76f-4f97-aa35-c9a7e4c19e5b", "value": 661907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950365, "uuid": "734ad1fb-275e-4178-9761-8729903d684c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950365, "uuid": "1b0dcd58-6892-4513-9e71-c5abb5cd3b69", "value": "NOVO PEDIDO-CVE6422-TVOP.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6444466f-4357-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Nitol)", "timestamp": 1692975311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975311, "uuid": "ac085f1e-7374-451d-b10e-998ef22e1872", "comment": "Malware payload (Nitol)", "value": "bfbd391a4354b074c4ae5cbbdf64c1fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975311, "uuid": "e5653411-15c5-436c-a561-84b359da71e9", "comment": "Malware payload (Nitol)", "value": "b6bc28566acdd68792cf2393993f01e992e23be2ba275d74bf697300cb1b250e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975311, "uuid": "37fa2ead-e50f-49d8-96f3-626cb3e2a19a", "comment": "Malware payload (Nitol)", "value": "83bfd5cf9f8d80f51b809b13c04b1a128a3ac182", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692975311, "uuid": "64971dc5-28d9-4d41-b441-c75d179f8222", "comment": "Malware payload (Nitol)", "value": "fe476b53a0db7238655dfd88ee4f652be02812c56fd97ab35215355952fe952f74f77fc45484b600a99e56a56c4a57d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975311, "uuid": "067b5990-0bef-49ed-b3cc-b2b58c14178f", "value": "T17DA57D213BC03076E1F306319B7AF379F1ADA6384E35A19762A48A1D7935C43593C6AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975311, "uuid": "963cc0fa-8bee-4a0f-b1d6-03cce0c84010", "value": "c0eb27925695a4fc0277e9f56cc511bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975311, "uuid": "8848349e-4cbc-4833-81ea-acfdfd936846", "value": "49152:c9n1yHVtHG+OMC4kYthMlZLoH+WlHK6Zf3UjAnOy4UfMMrnmN/Tqe:gn1yHVo+xk8ylZ0+WlHvf3U8nOy4WDr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692975311, "uuid": "bb13fbf7-ff66-405b-acac-97ef0bd81a38", "value": 2157056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692975311, "uuid": "22655275-b0fe-4e52-9096-c70c993c1256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692975311, "uuid": "3c4ebed2-359c-4215-a77f-32d9fe578eab", "value": "bfbd391a4354b074c4ae5cbbdf64c1fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fc5b83-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692934166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934166, "uuid": "8eed4b9f-0ed1-4979-9291-9a903f72ce35", "comment": "Malware payload (AsyncRAT)", "value": "50552fe7269260bc90e22d2461925696", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934166, "uuid": "aa0a8844-a754-49ed-893e-fac526f7aefe", "comment": "Malware payload (AsyncRAT)", "value": "b74f49047aa90d3f56619882edd333f0ed838a93a734a74b60a0639884e64618", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934166, "uuid": "12e8d7e3-5739-43b3-b72a-6d42fe1b3456", "comment": "Malware payload (AsyncRAT)", "value": "94996f078683f237f81895714c571ced2049ad3f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934166, "uuid": "a7db586b-313b-4b9d-a3cd-733c60502e4b", "comment": "Malware payload (AsyncRAT)", "value": "abf16eac80975bc647a3e03f69ed677f24db7912aced4705a312926fdd662c837680367244681552b82a56ed408bb221", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934166, "uuid": "f20dfbcb-97eb-489c-b4a9-727032eb2a5e", "value": "T1F3346CDD766071EFC857C472DEA82DA4FA6134BB831B4503A42716AD9A0D89BCF580F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934166, "uuid": "0fd3f3d4-9db9-4ceb-9e5a-a4dfcb72e822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934166, "uuid": "aeedff68-d11e-462f-b1bd-b6de31be57da", "value": "6144:aNFZSCbkCP30Qaxxs7jOQShh2C3aQrarhI:dChMbQC3aQrara", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934166, "uuid": "0a3f5520-8314-4c8b-8141-9aa74e73f0f2", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934166, "uuid": "c31f03dc-c1bd-437e-b289-4c4e787c3691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934166, "uuid": "d338d5c5-4346-4ddb-81f4-05ae08e0e963", "value": "SecuriteInfo.com.Variant.Bulz.174081.14667.1396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1678c3d7-439a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1693003957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003957, "uuid": "bbe0d73b-39b9-499a-a3d4-f6ba6a185949", "comment": "Malware payload (RecordBreaker)", "value": "5de87b373a800e9ec989dc08dfd4ded0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003957, "uuid": "5da099d3-ef48-44b2-b193-16b1c1e90974", "comment": "Malware payload (RecordBreaker)", "value": "bb08e330702eccd5a5cd5f69a6ab725687324b6274381e5ad5c6abc0f78d5606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003957, "uuid": "ab0f96b7-14a6-4ddf-96fa-c17bf2d377b3", "comment": "Malware payload (RecordBreaker)", "value": "a4413f658843e7b6224b14f38745f1363853ab8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003957, "uuid": "cdf299ee-b5ad-4631-8c12-e56afdc104f5", "comment": "Malware payload (RecordBreaker)", "value": "8b6acf4a90f74516afe41d262680e8a560672e786c8bc93f060d73783a6849cde4f9f416c3cd5ca4c2fbe22e96a71463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003957, "uuid": "89c3f64a-565f-4599-91ee-1c068c83b6a2", "value": "T17C05DF8F16F75FF5FA0B5A3AF2C655B1BB1305A12675BED25C020D5C1AC0B8C226CA93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003957, "uuid": "7eff7b57-d932-453d-92c3-ef2463ccb6d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003957, "uuid": "9919cc92-9c67-4268-a84a-b922d391173f", "value": "12288:otPdWsa7Rpfpe5B1tCVK7ELdaaiPFvScA+SlzKo6307kV1TLUTOp:ydWDRDe5EqEgaidSjzKX1V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693003957, "uuid": "90b9ac14-5adb-4146-ac85-637d7ed23269", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693003957, "uuid": "d8274ee7-8612-487a-9db3-37f0a5834e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003957, "uuid": "3fbaea93-9ae3-4725-a950-71f5bfb81752", "value": "5de87b373a800e9ec989dc08dfd4ded0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3f632a-42ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692930553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930553, "uuid": "c1c06c4a-8e9a-4c3f-b9d9-d86c27c93951", "comment": "Malware payload", "value": "9e1d9446e312c27ae8df6ea6821ce8b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930553, "uuid": "2e4dbeea-36d9-45ec-932e-c3d191ea062c", "comment": "Malware payload", "value": "bbf8cfb6d2f56aa9df32fbc91ca3f2c09962a9a4c6cc48e7bf42c7e601bcfacc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930553, "uuid": "a1a4fe52-061d-408c-9830-6f9282c7a69b", "comment": "Malware payload", "value": "c440e8cf47a5ee55e56f157f5debd2797985ff45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692930553, "uuid": "44cabdec-a1a0-4157-bca3-012e723fffc5", "comment": "Malware payload", "value": "6a43cf7fb48dff3313d506dd6572118b368c9202910bb5a18e2f870f9e0724162af034cab387864855a696711df22342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930553, "uuid": "a16e184d-f89a-44ac-87f6-a249a592e2fe", "value": "T1E9237C057762C0B3E99A063459F586A1077F3C93AAF494977FE9030D5EB12D07A2D3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930553, "uuid": "586b8112-4589-480a-a016-3480686e6b51", "value": "d1ea4807c3cdcc3a0c7e074210d95dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930553, "uuid": "d4acf063-2c95-48d1-9df5-76dbd00840f5", "value": "768:yhDJMDTDqPre0HH6hna92vZ+fullDdbYBIEG4K8WnNK+OKJsQyxdjV4PoUIBD:i2DXqCZnOHullDf8mXJQ7nU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692930553, "uuid": "284051c9-c7db-421e-8d8e-da0ab8f565ee", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692930553, "uuid": "c4ebdde8-4be0-4dd5-a195-76de87b85116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692930553, "uuid": "ae81ad45-8030-4592-b645-9436bbe49d98", "value": "SecuriteInfo.com.Trojan.Win32.Lokibot.DECC.MTB.22978.8795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97620d9d-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1692934165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934165, "uuid": "0da2cc26-cab1-4089-9f83-e0f9cb84f9bf", "comment": "Malware payload (DarkCloud)", "value": "1e71e5b98cffb3045ebd507a9d626ad5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934165, "uuid": "6e3e0b84-2829-4bea-ba12-9f2da9d3d7f1", "comment": "Malware payload (DarkCloud)", "value": "bc2cb5cea71efa29e0b2b3263e1862c103a5729cf112f3c68d0eb0f5b257114e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934165, "uuid": "07fb30e5-c99d-4fc8-be03-282d4c2969ec", "comment": "Malware payload (DarkCloud)", "value": "c19b062e960a71488eca2a3e60d30557a2642546", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934165, "uuid": "8bb18f5f-c736-426b-b0aa-232faf7e834e", "comment": "Malware payload (DarkCloud)", "value": "09c95e94956f27801656e1e9a7a4dfe64131b837e8a37757e7e25b47cb79a41d9d980b8b41fd656c54f1516376271e8b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934165, "uuid": "6c230cf1-3e0f-4668-b744-7b4746b8c70a", "value": "T17C55AE87B51A5DADC7761B7EC39B04045BDCDA9026A3F30F76490362712FBA69B22343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934165, "uuid": "bc4ed146-b3fc-437d-8b61-60744fb43647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934165, "uuid": "31f7062b-48f7-4882-bba0-803fe657ae7d", "value": "24576:pBhInhfyAKwFc3xJtz0yyQJpoiXXRzj1gFw1BHIO23AM/SYeNjoMVlOz:KnsxJtNV1pHIdc1k5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934165, "uuid": "9cc5bff6-6860-40a8-8804-28f08eaa5cfc", "value": 1397760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934165, "uuid": "8a18577c-4e35-480e-aaef-a508b75e6576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934165, "uuid": "23b5b48f-a37a-4f91-9dd8-dee6fee9df69", "value": "SecuriteInfo.com.Win32.DropperX-gen.9644.2151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac655dd-439a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693003964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003964, "uuid": "fc242a65-6405-49e3-8e59-b5a6dd856bf3", "comment": "Malware payload", "value": "8a1c6ab6aeeec522d4d2d483543cb6ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003964, "uuid": "b2d92d00-60b8-4bb2-b987-35f6a5c7766e", "comment": "Malware payload", "value": "bd275a1f97d1691e394d81dd402c11aaa88cc8e723df7a6aaf57791fa6a6cdfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003964, "uuid": "a132c18e-b7b6-4ad2-893c-5ed53e62cf9c", "comment": "Malware payload", "value": "9133c7c95c6639c85f5880d97bfa4187905735b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003964, "uuid": "dae3d8f2-2a29-498d-a957-34a5a654cee8", "comment": "Malware payload", "value": "fe7deb78f211885662ab1977a4d9b6ed14851a7b4875cfe5223539e55c29b99b8e8fc7c2713443f637f22b2c8ec3385f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003964, "uuid": "20092d81-ad8d-4998-970f-4b172ee9c061", "value": "T1D39512EE7A695214F48F5EBFE23C27D993F4267B6192B342097121581D862C3F60ADC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003964, "uuid": "1b027731-7442-4056-bcc3-92ac19affd56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003964, "uuid": "eb2edc2a-9c59-4285-adc9-929d72e55058", "value": "49152:gK2O5r4MM1BBE+qTSMBi9Rbpt/aaxJGC/0UhlHLomjqD:gK2O5rfMLByTSMBap9BxJG4zhlHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693003964, "uuid": "8d381ffe-48ae-4b11-b914-941d6e824ee5", "value": 2024448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693003964, "uuid": "0f2c1ff0-a986-407a-80b7-9b935729733b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003964, "uuid": "c2bffdcd-9621-48ef-ba02-103c3a7ec325", "value": "8a1c6ab6aeeec522d4d2d483543cb6ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f3d70a-4398-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693003064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003064, "uuid": "9d875abc-8479-4652-9df1-0c6e2a39881f", "comment": "Malware payload", "value": "6ca96f0eaa0c0eeed1fb4cfa28164711", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003064, "uuid": "6686c5c9-1a6b-4a57-8d82-67e23fb4c88c", "comment": "Malware payload", "value": "be3463b0b3f83fc205375d50f534c87a480a7e7c62120eda8212bcba4f065966", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003064, "uuid": "f3daee65-7311-4601-82a7-8503fdad0660", "comment": "Malware payload", "value": "1fe35e8c36490c8633bb38879ed823f62197bf39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693003064, "uuid": "307e7030-90b5-4b08-8f2c-0e7918ecb2d2", "comment": "Malware payload", "value": "3d704bf263f36ad395aa9e5cf05749b45a74cea5b37f7ef2d3597af44a2cc2f8d4d1f36401598280bffc077fef0374af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003064, "uuid": "2a0cfe79-acf7-4b30-9c62-95d5586bfaa4", "value": "T149835B01B5C2C075E9BE19321460C9A25B3EB911DEE0ED6F3BD516398FB05C2EE34D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003064, "uuid": "5c1bd836-0b65-432f-ab48-d07464a9a8f8", "value": "ab421f97963f32cc4b7e01bc1198d8b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003064, "uuid": "30169daa-9efe-4b0e-b123-551db98a337b", "value": "1536:TGA264Ok/cpfFrfyklbkY5AlnVipSnR1adEwMJCeDbrzg/sWERcdB1VniWdNHAE:TEEpfFrfykSYWYSn6cCeDvBgB/niWdNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693003064, "uuid": "00e88566-628d-4268-ac93-82ca3e63c748", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693003064, "uuid": "f70a4289-9c12-41ee-a7e6-52f1a504af96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693003064, "uuid": "0e9ad291-7f53-4dc0-bca6-d4adac9f09b7", "value": "SecuriteInfo.com.Win32.PWSX-gen.31263.3999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf277cc-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934146, "uuid": "018e4611-51b3-43f7-b50e-60c2ca91e1b9", "comment": "Malware payload", "value": "dcc6c6bd398cb0d199d8c30b694cb27a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934146, "uuid": "339be81d-abc1-402d-8835-e6ab1680c0fe", "comment": "Malware payload", "value": "bec49d96f0b6db2ba056eb7402bcbd812296545ee6524761ea4c3bb16f5e0c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934146, "uuid": "578291fc-8bf8-4e35-b8af-13fff78acdea", "comment": "Malware payload", "value": "0496772051e4a519a619edefed438319fe0cd849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934146, "uuid": "c731f690-477a-4215-acb7-ac69a0807638", "comment": "Malware payload", "value": "4536d624d615977e6c7de8ad2a5dca7f2d31f4b24998af18a35394abe706dea5f032f5cab2528bcd5ce25159f2dd9752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934146, "uuid": "5aca8191-254b-4287-bb88-43092bb2715f", "value": "T1ACD59D1239DAC636E97E4530696ADB3A14F97EE00BB058DF63D4193E0EB01C252B6F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934146, "uuid": "4941d71b-f9a6-41e5-bd31-f8fd1da3bbab", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934146, "uuid": "37c1dd29-9ab6-4396-a410-c0c1009aad09", "value": "49152:irz5io+HGGWxyzamLQr+uclpUO3mDOSP9HnoA/s5tFsT3M6FH02p6RnwqKFBKLfj:bGGWTmLpUUIM6FH02p6RwGYcl8AekeXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934146, "uuid": "79f5b6e5-b2e0-4484-9ef0-179406649a10", "value": 2980352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934146, "uuid": "9d504963-a80e-4054-bbdb-71ab1b1c0df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934146, "uuid": "e3620296-569b-40ac-8b70-89ab0efd6049", "value": "SecuriteInfo.com.BAT.Siggen.197.27107.6681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94971afe-4382-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692993861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993861, "uuid": "7d31007e-7d13-41a4-8636-b0dda29a5ad2", "comment": "Malware payload (njrat)", "value": "e1ff69cd895879d95d8ec8f674a0a999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993861, "uuid": "f6006e08-6c80-4db9-a276-8b2ae54328ed", "comment": "Malware payload (njrat)", "value": "c1564ff5e4540accd7921c43bb48e567a92fd432bcf35062faf300bb9fbb7818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993861, "uuid": "50197c97-8001-4210-8235-0fbe2f32a92f", "comment": "Malware payload (njrat)", "value": "5accdcd9b28f9305925d27bb958374f874589f5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993861, "uuid": "7762e4fe-3662-40d6-824f-78c3c9a93673", "comment": "Malware payload (njrat)", "value": "700ebecda3f9c98c8a29ae4d2210fec502ffe213e3ac04a3e70a0465dd7a8f8db49e2307e91f31acf6dec0e56def5d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993861, "uuid": "8f54c712-29e4-4493-8a43-c43d21862fdb", "value": "T16EE208067BE94215D6BC5AF88CB313214772E3838432EB6F9CDC98CA4B676D00255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993861, "uuid": "efb21970-b713-4dc6-ae18-709e360fef69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993861, "uuid": "8e2140a3-1fbd-4456-8ad3-bb5f6b630095", "value": "384:R0bUe5XB4e0XfOZzw0Q0mS03AWTxtTUFQqzFaWObbV:KT9Bu2C55dPVbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692993861, "uuid": "57a37b3a-c5ba-4dfd-8983-e8fa336eb38c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692993861, "uuid": "a553cd30-7a26-4b15-aa2c-5e14d56e5380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993861, "uuid": "e9d9a998-1666-4420-aefb-50e649077158", "value": "xDYx5EKwB32a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb553817-4308-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692941527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941527, "uuid": "4252e273-93c7-46e0-8eb5-6f9f3da438d5", "comment": "Malware payload (AgentTesla)", "value": "7a205d4e32b50e0d1299b351abc03890", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941527, "uuid": "e13a3e78-b672-476b-95d2-36c096c62f3e", "comment": "Malware payload (AgentTesla)", "value": "c2e515cdafa2956acfc7e8079643489f1e40fcb7994b056ee7b648b4d72c6f96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941527, "uuid": "b6064ef1-bf68-4444-b182-e7e99cff9c01", "comment": "Malware payload (AgentTesla)", "value": "2bbfc1a67729a59ca2165223a0be574fd1b2de05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941527, "uuid": "000ae8d8-34d0-4824-a7dd-fb0add7ec838", "comment": "Malware payload (AgentTesla)", "value": "991f8b63770d4c5731cd9e55845621c1b59d98cb04a3138790d8c2cd34b3b1689d5786a4fafc62ca848d5e369b54e8ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941527, "uuid": "dd44871c-e208-4e7f-affb-9d0f7be43939", "value": "T17E45AD8334278EB5FB8BE736C98794041FBCE74176A7C71F2939638221037E56A45A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941527, "uuid": "596edbee-3023-476a-9be1-a23be8090074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941527, "uuid": "0a3ed04e-c152-462f-9c68-7292ff50f144", "value": "24576:Tac8CWauYOoaNEIrqW3VmLYVDBrBAvtfU28QpyYCd:TC46NEIrh3VmLYVF6lff8QpyYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692941527, "uuid": "be1efca2-3121-42f7-a4be-931abca858a4", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692941527, "uuid": "5f7f6320-4f88-4632-9064-e7b0a0ad1f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941527, "uuid": "89bf0cdc-9f0d-4712-928d-00dbb833f23f", "value": "SecuriteInfo.com.Win32.DropperX-gen.1157.29213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857d9e8a-436d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692984816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984816, "uuid": "76b708a5-43e3-4008-bc7a-5f1096b7e552", "comment": "Malware payload (RedLineStealer)", "value": "69f79e05d0c83aee310d9adfe5aa7f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984816, "uuid": "936c6b87-8221-4e4b-8f5e-1550db53daf4", "comment": "Malware payload (RedLineStealer)", "value": "c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984816, "uuid": "933f125d-9961-40ea-94b0-1a33383d880a", "comment": "Malware payload (RedLineStealer)", "value": "485c490180380051a14316564fbda07723be11b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692984816, "uuid": "8f5e0684-23f0-4a5c-8026-1b707e336c96", "comment": "Malware payload (RedLineStealer)", "value": "0714c6e993ccfc94a6b3982b6ac44e350c1af46cad0f8e1018967470a26ea4364ef036152e4379cf71bb75caf4c2042e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984816, "uuid": "27ff56fb-d846-40b1-b7a7-ed1d51d349b4", "value": "T1D004C51437FCCD11E1BA6A3F6921A05146BFD8026852F25B76C367CD1E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984816, "uuid": "f2958caa-12d7-40d1-a0d6-c93277d58ce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984816, "uuid": "e3acb694-2f8b-4b57-bfc5-03ce4f94d5d0", "value": "3072:MxqZWPTa9ApGvCbyXcLeM5EohiHxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuK:iqZvCbyscoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692984816, "uuid": "0e9e40d2-bd4f-4022-9a74-d83eac315fcf", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692984816, "uuid": "c1b27ce4-f9f3-4744-87f6-99cd24f7a25e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692984816, "uuid": "a6299845-a463-4cb9-890c-8b5251e722b2", "value": "dubna.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221f13a1-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965322, "uuid": "aa6f4f2b-23c2-4255-b7e8-a0083c0cd92e", "comment": "Malware payload", "value": "573b58c7e41fa332c20b77a7ec3dcf4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965322, "uuid": "a755a532-9e68-45ea-8b5a-31ed85f8cc83", "comment": "Malware payload", "value": "c586506f6f6af6c7de251c1661207d1edbf15ca3d24115d2a9093567c2612d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965322, "uuid": "31d2593d-39dc-4d96-b1f0-c5f25af56786", "comment": "Malware payload", "value": "4eb3583e61d2026a5ce01ff8e53d956948679d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965322, "uuid": "866a05f7-e6b3-4035-a12b-6a9fdcae9023", "comment": "Malware payload", "value": "bb2b448bc52147fb974d01df547b2b2c4203dcf9cc30cd26855f6f56187fd7b831adc67e2c4ae1be0c244ac99f0e9bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965322, "uuid": "3ecc989b-37d4-4535-a151-1190bd173bbd", "value": "T1C826AF7F81AA09AFF48754A38E87709D79E5E02B71131CEC5825F19C57E3A8DB4F8890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965322, "uuid": "2bf530a4-6a84-432f-901a-5a8b25cfd37d", "value": "98304:NGcw8bi2kBOLaUR6SiJNK4rXrdS/cbaJyMUG/3w:NZwPMaUMd+JHUG/3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965322, "uuid": "dc91e3c1-b8ad-4e80-ad1c-0f8677ed50f7", "value": 4777938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965322, "uuid": "afec3264-94ab-46a3-bf4a-d8f06482de51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965322, "uuid": "c891b606-65c9-4ccf-a01c-61dea725b96e", "value": "573b58c7e41fa332c20b77a7ec3dcf4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2887a1a8-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950300, "uuid": "70e92379-f0ea-4ce1-8f83-d835b0159142", "comment": "Malware payload (AgentTesla)", "value": "7d02f6a74f45c2cece33bf9486430165", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950300, "uuid": "33368cb7-3d11-46fd-9051-977a4dbf4cec", "comment": "Malware payload (AgentTesla)", "value": "c85b747c24c8c3fd522bb923422b69f143096b9bb7d3d24961b0b5e1ec0566ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950300, "uuid": "691a7e97-5060-404e-8cba-536ba3371f4e", "comment": "Malware payload (AgentTesla)", "value": "b3f78fdb9fb077abfe4c23bec6cdfb6ab0d46550", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950300, "uuid": "15c318a4-f184-4639-8897-831302c96bc7", "comment": "Malware payload (AgentTesla)", "value": "ba0c37103da08b073794c43665af8c9114505dc18145a0c1adb4b1c5bd0e1fa5321d86b10685bf611bbab1389592ff85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950300, "uuid": "2c95890d-967a-4df8-bb86-2b94d9a310d9", "value": "T14C659D9B3936587DC924D779E2D78804939BCEA267E3F116718472E60632BBD4F23183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950300, "uuid": "35c7eb73-ea83-4b36-bb76-cfa8278b14d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950300, "uuid": "6ec099e4-aeaf-4ed8-932b-b5d0437b2ae9", "value": "24576:N/DuH1x01MuBc5A9Hw9dY85dVY2C21Jx6LjEtbYj90lp:4IkRC21+mbYj90l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950300, "uuid": "d3a04a3e-22d2-4418-9608-e4daa3af859f", "value": 1436672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950300, "uuid": "a0a49965-745d-4e78-8e89-3501491fb6e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950300, "uuid": "13cd5f1b-d6d4-4ca5-88b6-2743463fd7b0", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5131b911-4322-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1692952516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952516, "uuid": "fd51a425-19a3-4afa-8e38-5da7a0a178ef", "comment": "Malware payload (CobaltStrike)", "value": "4647f8ffbd2a06a6e7c3541f079c1462", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952516, "uuid": "8b0aed11-4b8b-4a24-99da-10970c3f9da8", "comment": "Malware payload (CobaltStrike)", "value": "c8916bee66bee9ef57e8c9eb1ff78c5d40f605f95d8c66f9a625a90cc30bf3b2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952516, "uuid": "615d2eab-de33-4f14-9857-ff4c77b7729b", "comment": "Malware payload (CobaltStrike)", "value": "eb3970b69f15888a44c82df93524205be3086286", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692952516, "uuid": "aee3e93d-90ce-4ab8-a9b3-4467a25ade90", "comment": "Malware payload (CobaltStrike)", "value": "fd785162b8afdb01c05cca7a1bbc8fb5247b3827eb0d8cf8fa70e129a4066dffb1d3dfdea41e811b64a541bbf381c1c0", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952516, "uuid": "cee647df-cd3b-4a5e-a216-58e81bbd1f70", "value": "T19454BE4AAD4647F6F6D16EFB27E2D72009784EC072A6BC17D1B29D593211E1CF0B34A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952516, "uuid": "eb0285cb-261c-4e40-b97d-82d4fa944700", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952516, "uuid": "623cd5bf-3d66-43fc-aaea-1c343f0bd7ca", "value": "6144:PCGG0e9P2XhoBjNJ49GLz0/uuk32ga6m0Zz5i:fGGyF0AuJWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692952516, "uuid": "042999db-85be-4219-9a65-58e82e797275", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692952516, "uuid": "6b93f971-59f0-4315-a4e3-dd7c6dc3e110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692952516, "uuid": "c3e747a3-96d7-40aa-bfbb-9737e55c5571", "value": "4647f8ffbd2a06a6e7c3541f079c1462.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6e3e45-431b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692949555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949555, "uuid": "803ba211-3c7c-4d16-bfe3-c56d2b5de4c8", "comment": "Malware payload (Formbook)", "value": "b6cc18265abfe600f6ef708feb17f1fb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949555, "uuid": "834b1530-ec20-41eb-8688-d6969eafc10a", "comment": "Malware payload (Formbook)", "value": "cbd7a7fc7ce2bf5406bf33714dcaf86025fe83c4f885434b615a5133a1d7a620", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949555, "uuid": "b43e7184-78a2-41c4-a428-1ac6a626c67b", "comment": "Malware payload (Formbook)", "value": "bf9788e8fc534eb7d2c4af8673f443cfbef8c927", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949555, "uuid": "967499ed-b692-4215-bd53-b8980f54c7bc", "comment": "Malware payload (Formbook)", "value": "c417f9cb154694b12cc2b653a1428080884f4aa863103b8c4919422d0ea7ec716c80c73f1bc396bbee95f514e5be7032", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949555, "uuid": "6740964c-a6d2-4417-a41d-9aa4f8cfd97a", "value": "T1EB63C62ED30F0919DF5697BB434A4E4A06FCB73EB38540A139AC977437AD82E462257C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949555, "uuid": "63435988-fe1e-49e7-8dcc-f6aa4efe7a6c", "value": "1536:1wAlRFgIdWyc3vmiN69wnafojbWazVFlGbhOYiM6TWhT0qGYowl/6gL/LpOmJ6YY:1wAlNmvmI69wagbWazblGbniDTWhT0qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692949555, "uuid": "0b2bb707-3c8c-4c73-a61b-6beca6d52417", "value": 72259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692949555, "uuid": "9f7f21eb-d17b-4a66-abab-004b3be344d4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949555, "uuid": "17ba0e8a-3bd3-4093-a8e8-04e18ff003e0", "value": "SKMBT13829473.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd5440d-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692964912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964912, "uuid": "6a0f3485-6054-411d-a4a5-4a9ffdde7833", "comment": "Malware payload (RedLineStealer)", "value": "61f682a159bb4844aa794cbf4cc76f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964912, "uuid": "a1f68d2e-ddd1-4088-9fb9-6c816f710377", "comment": "Malware payload (RedLineStealer)", "value": "cc69270c69925d35f72fadaae96a907097be7116882686c4e65b58831d12e586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964912, "uuid": "5cc5889f-cf9a-4c41-9b62-a471c8b16580", "comment": "Malware payload (RedLineStealer)", "value": "e705b2cf4d814cbb2d8e7af655cec2a2301bba7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964912, "uuid": "615761b7-03a1-4b62-bdfc-8357ae4c556a", "comment": "Malware payload (RedLineStealer)", "value": "055fe2bc97ab0aa0f8e9d87ff7da9ca5ebfc9d5349272ae81302acb7531dce966aae8f9e24a251331d9cb3a59549e012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964912, "uuid": "424d0dbc-49b1-4d71-9f23-6a8d79e7e27b", "value": "T1E4E42257AAC4A537C4B62B7068FA43130A357DA29D38472F67569CAF0C72AC0B532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964912, "uuid": "142c232a-c672-402b-bf7e-e0a7a809c6fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964912, "uuid": "940fb514-5df2-4cba-a82e-22d703116919", "value": "12288:RMrRy90VjsnYwg64gbk/CsLSWWmmBsoxI4i1BrtCZd1:0yYs6gQ/RLRv0slb5Cz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964912, "uuid": "d5394225-a125-47a6-b1a4-0ef0bb79830d", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964912, "uuid": "06561b51-f630-43be-a465-621a61097263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964912, "uuid": "f1004fa0-7cdf-46df-bde4-2af504fad5a4", "value": "61f682a159bb4844aa794cbf4cc76f5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef8ad8c-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965290, "uuid": "d2b913d4-6d9f-4ba7-84b2-5dfa590daa10", "comment": "Malware payload", "value": "2090c3634f4c033d4780b6073dc0c70b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965290, "uuid": "17be7ad7-08c4-41a3-bbd2-fa4681b5e541", "comment": "Malware payload", "value": "cd2190873d151da2a16e9165239c15911af0c8c3f085b0baa79a71af6342a987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965290, "uuid": "8f592658-9941-4c45-8eb8-0362333be087", "comment": "Malware payload", "value": "510a4342244a2da446d022f59454fb4f5e6b0605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965290, "uuid": "6f5fae1a-718f-406f-87e3-6efd5697a8c1", "comment": "Malware payload", "value": "59ed844dfcfce06585c918577ffadc1aacde003f075e8a6e812848e0791d5b451184393f652bf9ed0770e0e585cf7abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965290, "uuid": "affc270f-56c6-49a1-ab16-2ae42620b1fe", "value": "T191F53321339350A6C6E6C275F493630BE4A21C358FC3DAB2DD9C7DC16E4EB84552A6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965290, "uuid": "36ed003d-52c7-4611-9b56-25648248ead3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965290, "uuid": "b58e73e9-9382-4b24-88ed-605840f74e94", "value": "49152:ThZtqTNYmCcM5EW8QupDIMNwvlj2oP9AeqZ2g2KvTMbx354bKUAV4roUZ/0O59eP:VxmCcMaGw8t2oP9A7B2P2Zj7er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965290, "uuid": "d065822d-cba7-4c70-bab6-29c4a15049e2", "value": 3398144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965290, "uuid": "885864c2-7f1c-4149-9d2c-f32b1169c3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965290, "uuid": "4a0f8e66-85a1-4035-9ffc-d1b4620d6dc0", "value": "2090c3634f4c033d4780b6073dc0c70b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9405b9e7-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934160, "uuid": "68bc784f-fe52-4359-b025-35695b51ca47", "comment": "Malware payload", "value": "d4f057a3f8652fbdb7599fb56f67cff1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934160, "uuid": "1b94dde9-76ef-480f-989c-96f379ef86f6", "comment": "Malware payload", "value": "cd508d5ccf885d6c14d04e7b420c2489581ee428c9a3931a325e7e003f070406", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934160, "uuid": "399aff12-9e9e-4a8d-9eb2-3400c4692996", "comment": "Malware payload", "value": "b7fc4413cf965a256051d7b8eae916b22fe0a17b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934160, "uuid": "1c6f175c-3094-4a56-aabf-6e8d402d4c81", "comment": "Malware payload", "value": "27771b3ee2934f1d704c2d772d95505ff16c7ceadd3cc6ddfcea2d2ea905cd7c86359c6549b1fbb4e6bbd2dce253a3bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934160, "uuid": "439ca4ca-374c-4a78-8d9e-7de39a18388f", "value": "T136A48D11B6D6C836D5BE06B0362DD39B0169BD6447F184FF23C84E1E1EB24C1563AEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934160, "uuid": "795f6047-5f10-4cd9-9a60-8ec1b96ccaeb", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934160, "uuid": "0e378598-df4e-47d1-877f-2aa952d6ef69", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHAjnMn6d9:yBqnGIQ5M6DLrVVdWHAjnM6d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934160, "uuid": "d6af71df-d504-4cf1-9cea-59fa4baeb00f", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934160, "uuid": "ce083925-83b3-4bb6-8a6a-03a415c941ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934160, "uuid": "91dc6704-6ac6-4610-b3bb-fe6e7005ffe5", "value": "SecuriteInfo.com.BV.Obfuscated-O.24463.19870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29020835-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965334, "uuid": "f607fd71-79d6-4619-8171-bc84b26abb5d", "comment": "Malware payload", "value": "7fbc3553ff034980ed41c3fa67d9deb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965334, "uuid": "8570d2d5-2759-425a-9bfc-632b30d678bb", "comment": "Malware payload", "value": "cdf2cf98bc20b3b529c12c4fc6d9e4d6c1b082acdf802c5c7e78febc6ea4a710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965334, "uuid": "a925f319-e7d4-4556-a228-25c6add97d88", "comment": "Malware payload", "value": "e27d2ea22ac46f17f1b2bc1e579492c2390af35b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965334, "uuid": "0ce6f1fb-6219-49fc-8840-ef42337f5592", "comment": "Malware payload", "value": "850ba70ec1a9d3e0403099ec21495ccac44a7ea802ce52f66c23d5b0be8c7ceed284ac40a48ad523e564f4bc716c57a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965334, "uuid": "0b572c33-9736-4163-ad32-2b08868eed86", "value": "T109B57E19DD90C6A2F87A27B9E8F751F04C3F69B1E69C14851694DCE80EA6272F73C342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965334, "uuid": "1574e3e7-c337-4e41-8cfc-2565cf670e46", "value": "9b9dd0ce11be5cc7646e9cc1614960e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965334, "uuid": "df568813-bfd5-4dc1-bec9-3095ce241fa1", "value": "6144:sB5f3YwKrMducTng1RxdBNE8ZOoXzeprQoXwg4kVUm+vL1kXwT/vEVelKhF:If3zKrMduNndr3zDepGkVwvhHXEV00F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965334, "uuid": "1db157c8-1185-429e-ba4f-74c61c0c4556", "value": 2423072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965334, "uuid": "8dd96096-a3c1-4e90-a189-199fd14f23ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965334, "uuid": "085fcd6a-c5b6-43ce-a50c-11996ac42c61", "value": "7fbc3553ff034980ed41c3fa67d9deb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593031f3-431b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692949523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949523, "uuid": "11d16b99-0081-4146-b301-3afae10fa3ba", "comment": "Malware payload (SnakeKeylogger)", "value": "35183c5591c83010b3cbaef219c3c1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949523, "uuid": "4d20107f-37dc-457c-8151-b4aec42b24b5", "comment": "Malware payload (SnakeKeylogger)", "value": "cee490513c8d804af67412511ca6866e97b27d3c9c76a472068cb3692324561e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949523, "uuid": "a114c40b-b401-451f-a3be-fb1003d8f2ce", "comment": "Malware payload (SnakeKeylogger)", "value": "e94df79b7499bac0868dd9fb8b95b7e37c34af8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949523, "uuid": "40c28ae6-6afa-448a-9c5d-441086d4876f", "comment": "Malware payload (SnakeKeylogger)", "value": "409df5d218a90eaca6ba1d420b0a9fe305f46b85487e30ad13ad8ebdcdffb8d027de1f30e5402900d01faf4b41f46eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949523, "uuid": "fffac0ed-593f-45f9-8acb-1fddf39ae7b2", "value": "T1CDE42314DBAB23BCCD28DEB8E4B9623C0A326611B99E4A4C8944D4F1B857F61F52335D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949523, "uuid": "75038fec-620e-425d-baa0-f9ba60b271ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949523, "uuid": "dc1cf9e7-592a-41d8-8a75-2e673adc073d", "value": "12288:QnCGeNMBLwC8q8vAEYwoBTagpRabRmAqKorvkBWHhoiULoBxlZVzAznpEs1WLxrB:S+MBHPEYBhaykEAdorvkBOWiU0nVzwn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692949523, "uuid": "8c43a962-2232-405f-9777-ac5b225013a4", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692949523, "uuid": "50171069-b87e-4b64-9177-2f9d3d96cd88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949523, "uuid": "969feda7-186f-45c4-b3ec-30d6f5ce74e3", "value": "35183c5591c83010b3cbaef219c3c1a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9920cbf-4308-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692941524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941524, "uuid": "9e94f28f-aaf9-4c46-abc5-16c3af280779", "comment": "Malware payload (AgentTesla)", "value": "844b4764e802581653c54d5883cdfdd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941524, "uuid": "813eb25c-8777-4d38-9bfd-3cec2f2f5571", "comment": "Malware payload (AgentTesla)", "value": "cee78c62aeb8545055769d9c91610875a41407038351b78894f4b4eb512df449", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941524, "uuid": "32988267-76cc-49d9-aacc-b630f906d1b4", "comment": "Malware payload (AgentTesla)", "value": "ecfe7eec8600ba9213c817580e79c7bdf5f96a8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692941524, "uuid": "87c5924f-9d1a-455c-a844-de0dff1d6757", "comment": "Malware payload (AgentTesla)", "value": "ec198a6d21b9dc82491953049dfd1620dc95bacb2b3b623a347260e0b8a5228373fc965c5e869a7bbd098af6a481c262", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941524, "uuid": "62e1bd4b-71f6-42ed-8c23-090e5a63e0ed", "value": "T131E42230176C8732D8F98BB445E155630AB1BE23E919EB496DD932FF2732B814648B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941524, "uuid": "78028625-97f8-41e9-b97f-48182dda508b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941524, "uuid": "a7080a4f-46a2-4f61-a55a-7ce5cc6e102f", "value": "12288:4IqbpqazSrqv5vJX1gvnneej2jXHTUHnFx2sNVsUGnYOh1PuUR:Ytj6wzlgvh2PIF4ssUGnYO1PuUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692941524, "uuid": "697a9532-b0b5-4202-8df3-50ad4f3b668d", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692941524, "uuid": "fa99a818-ed6b-4d75-8e16-a13c7b823b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692941524, "uuid": "38b8e0c3-76b9-4915-8373-7c282468b853", "value": "SecuriteInfo.com.Win32.PWSX-gen.20364.21328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6eac960-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1692965249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965249, "uuid": "c0dc2cc4-14ae-4e30-a07c-b3f1d1a3aec2", "comment": "Malware payload (CoinMiner)", "value": "477dbc33c6dea724c0a9d6969f1aea0e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965249, "uuid": "5a5fe497-26a5-4e21-82fc-14cfc3ecb10e", "comment": "Malware payload (CoinMiner)", "value": "cff4738febe9bfbeeaecf20bf24ec7acd19ed5b94f364da02d09bdedcbf50f91", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965249, "uuid": "3e6586f3-3c9f-4b9b-9bce-10f86070f712", "comment": "Malware payload (CoinMiner)", "value": "e9642b2e0c1f58bab6119b5d9713a2af987715fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965249, "uuid": "ac55a36d-8447-4db7-96ba-90e298102802", "comment": "Malware payload (CoinMiner)", "value": "d5663ae38fd3ff749e8a32dca7b2bf03c5316980208f4f0253c6df0e940586c597ccac8979a8d20bd9b5272793af8dc4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965249, "uuid": "753f8f2b-c005-4c99-a339-e06aab7bec1f", "value": "T150C533413FE482B9D1E64A3458DA55A715B59F748F24A6D35B483A83BC303E87E3E30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965249, "uuid": "50aa74b4-e327-4d78-a592-c802130ac0d6", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965249, "uuid": "14dda656-1076-4969-9f19-71634565cb86", "value": "49152:d/5RE7vq9GJNIg+vtAc/oSr7BZHdNjhKJrb1EdhU5Q6y1M3aNb7Dhf/al:d/5REvquGgGyc/oa7DHdBWCkcdf/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965249, "uuid": "3c175321-fabd-491c-a1ba-9ee8aefdc52b", "value": 2636072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965249, "uuid": "c5272f2f-ff91-41b6-85a9-e7f8d7dc870c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965249, "uuid": "3e7de0cc-6b49-47e0-8c90-b94627600d52", "value": "477dbc33c6dea724c0a9d6969f1aea0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2066c55b-4317-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692947710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947710, "uuid": "3463336e-d289-4027-8cf2-29028bebcbc5", "comment": "Malware payload (DCRat)", "value": "2db4abb2e5169ea5b459c77e2437287e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947710, "uuid": "1e46c7ac-10e7-4c2e-9311-a8f65e8ab7a6", "comment": "Malware payload (DCRat)", "value": "d18e505ce073d9d492f5183f342fd24f306d61cd1bc7dc92e68d265eddc9d276", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947710, "uuid": "c36787e1-9def-47e2-9c61-d8dc4cf08a9a", "comment": "Malware payload (DCRat)", "value": "049316b84ca3829744cdef31c2ceb7bec0aa91f6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692947710, "uuid": "48148ff4-12d1-43cd-8551-a0f19ce54104", "comment": "Malware payload (DCRat)", "value": "f7019d31f9325170cf7a4920dcfe60d9373054c29478ce227ea51b7e67db5b77829e4d0fbb42fc2b0aa9679d051a92ad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947710, "uuid": "e8f3e26d-710f-46a6-9db3-5897ad69279e", "value": "T15E25F122BB3B5A59CA99E87A505FF5CE0CE618523A6542FF7CB937508A140C2C7C8D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947710, "uuid": "1587633e-9c77-4022-bbda-0e74d2e07a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947710, "uuid": "980358da-41d2-48e3-a79b-c49956c0bb61", "value": "24576:cxxJD1ApcDikRJ+bQK5wvktFw/7ITCygbPIZ2TEy:CAp+EbQVvktpT/pZUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692947710, "uuid": "22463f71-4927-4b9e-9c31-9a79e53ddc41", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692947710, "uuid": "82cd2b74-9d05-4f42-ace4-23ddb4f0a166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692947710, "uuid": "4fe7232b-dd93-4c31-b2c0-e76c41789784", "value": "2db4abb2e5169ea5b459c77e2437287e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7463cf-431a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1692949210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949210, "uuid": "200a294a-70b7-4e1b-a56d-f5502bd2c36a", "comment": "Malware payload (CobaltStrike)", "value": "45260506ea9cded817058eb3edf702fa", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949210, "uuid": "b9582557-6ba5-4214-8cf8-a14941935531", "comment": "Malware payload (CobaltStrike)", "value": "d26d5e9e0b05f94be8b86dc7410604cac85557a8f7bdf709beb95ee8cbb98c60", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949210, "uuid": "0d9e7909-d875-4ae0-acfc-2eec4707bb12", "comment": "Malware payload (CobaltStrike)", "value": "d925c50e31d563ba10b578529d8c649a4942eb95", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949210, "uuid": "d5dd8190-2110-4de3-958b-af64989f4f32", "comment": "Malware payload (CobaltStrike)", "value": "331cf48e187a08fe53389cddece3013b8b04b4f88492ae040057e3aad373e50bdfb219d0223191229e907a47d8aa1d3c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949210, "uuid": "e453d8be-497f-4edd-a54f-05ca4b31b49a", "value": "T16C522A75EA0378F6FD1A497414EBB6FFAEB3E1234C104C86CF94DC4168238A6980764E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949210, "uuid": "3b88ff1a-b3b1-4d0b-9648-c6049e0e3fb8", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949210, "uuid": "b86482ee-86eb-41be-953e-238cc710d5de", "value": "192:AVH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzSnQRbqUqV/Qjo7AGa:At+kGKqbOCdWIVBff+xzsKfCXAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692949210, "uuid": "2de28296-c46f-45be-80cc-b62f18d6ff48", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692949210, "uuid": "6a905af1-b8f9-4fd4-bd61-ad1099a61009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949210, "uuid": "c1956d01-41b9-40ab-8c91-5cacf5c623c0", "value": "45260506ea9cded817058eb3edf702fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b02a2a-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934164, "uuid": "d3443c6b-5c83-445c-8ac3-0f6ff999c078", "comment": "Malware payload", "value": "a41e2c95349731f3326defe16bf0c5eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934164, "uuid": "61396399-cc7d-4f9c-8e81-aa72443afbf7", "comment": "Malware payload", "value": "d272a0133604711622deb2c250160c8a811df5f3141f84cadc69c55d0c3219f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934164, "uuid": "3a999729-de7a-41af-843b-5d2d3f044e2f", "comment": "Malware payload", "value": "d304c4cd0ff4d4ebefb072e357a26ae0b1421633", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934164, "uuid": "d9fa1cd3-398e-4f3f-8b17-fc990e59493b", "comment": "Malware payload", "value": "2e7f454b5b7b200107d8b45d969d0f576e0274ce2adcf531e1e2747e35c616c6e146f482864dfb495fa7adb9364bd765", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934164, "uuid": "f48abd0b-527c-4b10-b8d4-4e9f5b18fa5e", "value": "T1AAA49D1176D6C836E5BE06B03A2DD39B4069BD7447F284FF23C84A1E1EB24C15636EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934164, "uuid": "369208b8-8b52-4546-abfe-348d757ea036", "value": "f8cac6e3e6f3790a4b594ed48691db70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934164, "uuid": "fc636f71-1120-4cf7-b9b3-24f1984f1f20", "value": "12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHA+f:yBqnGIQ5M6DLrVVdWHA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934164, "uuid": "0fc5dbab-38b6-4d49-b091-65e8ad78d149", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934164, "uuid": "39a451f7-ea82-47c0-9feb-9efc8f7570ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934164, "uuid": "81c3acad-4ec2-462b-9c59-f34b5b344d84", "value": "SecuriteInfo.com.PowerShell.DownLoader.1445.12909.14248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a42e10a-438b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692997521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997521, "uuid": "59069cbd-8c33-4410-9dc1-27ea63130f26", "comment": "Malware payload (njrat)", "value": "288754c5046b4a7299c322f57d9421c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997521, "uuid": "53610402-3f48-4533-82ea-d5eeab903e3f", "comment": "Malware payload (njrat)", "value": "d32e24c27b58698ab6f50409fcd7f37d5462b3e762f1836e6b361b99879e7cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997521, "uuid": "670b9b78-5e94-4435-9bdf-dc26b44abd83", "comment": "Malware payload (njrat)", "value": "c60820cb83798ce7baa9009a1c95a83e70c17e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692997521, "uuid": "e5d32946-e0c9-4abc-b5cf-4976e088dc4d", "comment": "Malware payload (njrat)", "value": "35be96b2d7679fefd8acb973f7ac1f08bad5c052e8360e4ea015981d276d9eaf5e86a915902dc9f123ca39540389f94e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997521, "uuid": "2e0a7540-d618-4ea5-a50b-2a05742a9d62", "value": "T10A93D74977E56524E4BF56F75472F2004E34B48B1602E39E49F258EA0B33AC44F89EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997521, "uuid": "57b27d44-3a9e-46cd-9ad3-88215b3a4ec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997521, "uuid": "c03bf3ef-1771-4610-b52b-b26ed9a818b4", "value": "1536:WKmC+xhUa9urgOB9mNvM4jEwzGi1dDXyDYgS:WKgUa9urgOidGi1dUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692997521, "uuid": "c880fab2-948c-4e47-9084-0a7cc9070490", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692997521, "uuid": "179491d2-5c74-4ddd-ae68-01b24a4fba57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692997521, "uuid": "03421713-c499-46cd-9c30-2b4bbf537eb2", "value": "288754c5046b4a7299c322f57d9421c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6920a48-42df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692924017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692924017, "uuid": "560be799-6144-4456-babb-8e59f9e60392", "comment": "Malware payload (LummaStealer)", "value": "b5740976a2285bcd92c4625eec726684", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692924017, "uuid": "64638e49-7805-4665-9317-3ca8a49f35d1", "comment": "Malware payload (LummaStealer)", "value": "d42fdb11f10e2455d0197dc973cf384fc2f480e596055dcb1994086c8db4a6da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692924017, "uuid": "100ad9fa-6dc1-4195-af77-b3cd41b52077", "comment": "Malware payload (LummaStealer)", "value": "d44a23a937e54e099539997de3e48c6461950396", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692924017, "uuid": "09e2ca7c-e524-466e-8b69-561e8e5fa1bc", "comment": "Malware payload (LummaStealer)", "value": "1604a1b5b18f3825d9bc66947b82d5167f06978a46524586fb65a778a716a27d1e388f8bd5be702760f3a0fd5668a6eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692924017, "uuid": "dc48d7d1-7a1e-43c4-8ac1-cfef88c84d99", "value": "T1A3A5E83036EA510CD9B567301C3AE6C526BBBE7A7F18C61D2169160C9EB3513CB21FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692924017, "uuid": "bff40689-d2db-413e-aa83-28f6a6b1b569", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692924017, "uuid": "d6af7911-ec9f-41d3-929f-af186a857869", "value": "24576:SnB5rKkCq/0VvD9wNbda6QEdJgdPras82Nd:SnB5rKkCMusa6QEdm4s827", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692924017, "uuid": "1e2b3e99-43ee-4bef-a517-3745dcc2f192", "value": 2114304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692924017, "uuid": "811f7259-54c9-41a0-bb7f-55c3f8d6cfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692924017, "uuid": "ef793304-eb3e-4ebd-9f31-05514adb965f", "value": "b5740976a2285bcd92c4625eec726684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ac0fa1-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950378, "uuid": "ca3deda3-279e-4020-b866-d8e9eb3bcbdf", "comment": "Malware payload (AgentTesla)", "value": "02b8fd7c6ea136ebfb47b2ff2f0d1a72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950378, "uuid": "0ce61fb2-c53f-4a87-a747-92644f251c9b", "comment": "Malware payload (AgentTesla)", "value": "d4be953d9e9504303622fe8c83eb835c8dc6ce07a051ad145a4b419cab8b8566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950378, "uuid": "180c928b-5132-4753-a276-836d832071fb", "comment": "Malware payload (AgentTesla)", "value": "370cdb58d4e273b35f6e38ffc694473143cf9395", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950378, "uuid": "ef1f2bb1-db3b-44c1-83fd-720d9b2f6010", "comment": "Malware payload (AgentTesla)", "value": "5965e69805d36f671b24b54317069e206dbc05f993a4ad225f45939310c70e92a82661eb43ec821e25fd6054a58f7454", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950378, "uuid": "a0accb3e-d75f-4976-bbdd-fc697c1650ec", "value": "T19BE4F0A57FDB4E1BC1B70B768AE69721F334DD001A035B036B55BA7D6D322E16B03292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950378, "uuid": "500bd31e-1a67-4edb-8437-17987471884f", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950378, "uuid": "8a09428a-8554-424f-a495-92110e21bedc", "value": "12288:8ZFpdY/Rmisoh6VO5W/eTraTuiSn1QbFrdn:oasoT5W/I21S1QbFrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950378, "uuid": "dabf4dbd-1760-4ed3-b810-000f85494677", "value": 716838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950378, "uuid": "5be39fe1-5276-42a4-84b3-6ac2c3ccd18a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950378, "uuid": "c6bece01-9388-4ff8-b04b-02919fdbecb4", "value": "Zeki Hidrolik Fiyat talebi_Ticari liste.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55da7655-4381-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692993326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993326, "uuid": "746e536e-0f2d-40f5-bee5-631d873eef8b", "comment": "Malware payload (njrat)", "value": "1ca1d798cf068a8ec73eb68cd8cf5d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993326, "uuid": "082fa392-1a88-4506-b93d-be08534f5aa0", "comment": "Malware payload (njrat)", "value": "d4d76221e7967902519c3524609eb8c2c32dff6d626a7b520a221095a38bf476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993326, "uuid": "142eac04-fcf7-42b8-b363-568872a211a7", "comment": "Malware payload (njrat)", "value": "932382d5d4b09915cfde98bd823f188cfad721a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692993326, "uuid": "4c86d647-84dd-4e12-8742-7e35cdc83552", "comment": "Malware payload (njrat)", "value": "4fc66bd5b78fd0c577926625062335bc60f5323262aed1aaa06b72ca9816eab9b193be437b692397373129a9ab86166f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993326, "uuid": "c4b73c1e-c7c0-4c15-a4d1-d0d7869c1efd", "value": "T106032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993326, "uuid": "9ba3e17d-2e29-4bc8-994e-17ca2929751e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993326, "uuid": "da3a92b0-e9f8-4aa9-bac1-ed043469b4f9", "value": "384:1eSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzX9:YS7TZ38fvCv3E1cQrM+rMRa8Nutjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692993326, "uuid": "2f52232b-de32-4e40-8212-706397425315", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692993326, "uuid": "37980cfc-9c9b-49e3-a774-a1584e41db85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692993326, "uuid": "e67a89c9-d7cd-49a4-903e-c4e6688ab7a9", "value": "1ca1d798cf068a8ec73eb68cd8cf5d97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e515d2-435d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692978032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978032, "uuid": "e2204784-1a1b-4f39-9fac-ab3557e2fd6f", "comment": "Malware payload", "value": "6d62f962f2d3fbb718452f1ee915d4d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978032, "uuid": "0fee7120-ed31-4765-b9ad-ce8574bb6f81", "comment": "Malware payload", "value": "d56dafddf97b45b67dd864ac0cc692f95ebc8e7f555f57f327a6f7755c173c78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978032, "uuid": "3627522f-3312-4fb8-9de1-b3e2cb8a7932", "comment": "Malware payload", "value": "6460d6644774124fbb01a3f7dc2bcc2aefee8e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692978032, "uuid": "aa3e28ce-1fa7-403a-ba20-6edcdb15769e", "comment": "Malware payload", "value": "bbad04e5fc183f6ab4e35f9d37b66405fafa29abff53a8482f8a0e6ca4d216e174f55eac9acffe1c88cf6c656184f671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978032, "uuid": "3908bd62-16ff-4410-99fc-581132bfff24", "value": "T116777B0772E60195E8B7D2388AA75103D773B8634731CADF316D06152FBBAD0AA7B721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978032, "uuid": "455c2d2b-62a2-4364-986e-e2ba9246d59d", "value": "66b10d8b5718b0fd6fb4865843d44280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978032, "uuid": "eb0ab99e-5e64-41a3-9a92-fece05a3794e", "value": "393216:d76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yf0nVQx4urYsANulL7NP:d0LoCOn+20s4urYDNulLBiuDQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692978032, "uuid": "b82bc9a1-24f7-4261-9f1f-13faf32b17ed", "value": 35965907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692978032, "uuid": "57adab80-555c-4b08-89c9-aabc771860e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692978032, "uuid": "bb3c40cd-3730-47ef-b301-e3bca2dee17b", "value": "deliver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bb9f1b-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965269, "uuid": "7af5606f-097c-4928-9be7-1f98c537be62", "comment": "Malware payload", "value": "7c784e59867a19b78be08b0f90125550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965269, "uuid": "e8caee46-4e4c-4b22-b054-c65bf6c64905", "comment": "Malware payload", "value": "d5e35d4ca49777e808205b89986fd5f999715f9616abafc5c6083a7c55cfe578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965269, "uuid": "be4caed2-4561-40ff-a911-e3f4c4af2ac6", "comment": "Malware payload", "value": "a349e1bbce0b9deeb1e2adb679c6acea85d22b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965269, "uuid": "5ecece67-194a-4fd7-ab72-3fc6edbdc70b", "comment": "Malware payload", "value": "09ad43f4da83322ab8c8266f129730462163bc534a32063d8adb7e37d3765cac206e326f64c9410cf4e818215b02474a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965269, "uuid": "cd528832-3247-472c-8c95-0ee51a7ef2ab", "value": "T15F6533421F98203FE9F9E67B911DD046059CA1A347F67E40E89BBFD390660C958CCFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965269, "uuid": "6b0d2720-c8b4-4dc8-ac5b-1eeb3c7ea424", "value": "24576:Ym/35M+nkqL0DvXikGk3dNj6lVn8JitjUV3KZC6BBRlSSqOn7+h:F57GybkTjIugjUV3v6Rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965269, "uuid": "bf4ba329-4fd4-486c-892b-33152d02bb64", "value": 1477816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965269, "uuid": "25e65ecf-0eb0-4f3b-9d59-8b4c43959b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965269, "uuid": "ac1320cc-1256-4f5f-a9a2-f1a72df1eb32", "value": "7c784e59867a19b78be08b0f90125550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fafb68-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692961891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961891, "uuid": "57b2ab12-69e8-47e3-9095-96ae2d86cae1", "comment": "Malware payload (SnakeKeylogger)", "value": "6327c30a30e7d00b14c9f842fab228ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961891, "uuid": "260f642f-61bd-4145-be74-b80532e305ec", "comment": "Malware payload (SnakeKeylogger)", "value": "d75e211a5c16f80a5e58abd81737e95a443d54e8e1fe6bc45c0f1c50c5df3c67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961891, "uuid": "d517313d-276d-42d2-9dd4-dace4b85946e", "comment": "Malware payload (SnakeKeylogger)", "value": "ce3a90b1877895cbe59eeec1835652dec1a0edd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961891, "uuid": "112fe9de-159d-4362-a4f3-be0056c98106", "comment": "Malware payload (SnakeKeylogger)", "value": "ae01ffae37277af03f0b366621fb3be7628dd54bf5b7b3d3d37757399094763b12af9f4742d513ac3b5e11e536e84f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961891, "uuid": "3b7d1871-df69-4656-8c28-2066247a530b", "value": "T134144C1A77E48450E6FF5D3204B09262CA79FC410A2ACD1F17C1E56A1F7DAD08E1AFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961891, "uuid": "c5f2ec72-6dfb-4eb0-a667-4747074b413c", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961891, "uuid": "f8b8af2e-e2c6-4fa0-b8f0-55cec27d0d0b", "value": "3072:XGybM97hOQ/iK2jrOyipP/XbKjvl18TzcNEOtEqvg3+rCTb8akbVxvNOwBIU3Fbi:2DthOzj8PzKMVmEqvbVuUVbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961891, "uuid": "7add2af8-5125-4d61-8b17-8d8620adaf91", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961891, "uuid": "54295961-ac3f-4afb-844e-e0bbaecade8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961891, "uuid": "6c938f1b-a9ac-4a18-8738-307e21dfb41b", "value": "6327c30a30e7d00b14c9f842fab228ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e850205f-42e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meduza)", "timestamp": 1692927000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692927000, "uuid": "08359841-057d-4096-954f-8cc6c3e6a3c9", "comment": "Malware payload (Meduza)", "value": "a0eb9e7e92218a18f3033667f414551b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692927000, "uuid": "70ea521e-fc6c-4575-867a-20ed422f18f7", "comment": "Malware payload (Meduza)", "value": "daa8609a9306df3c463963bbf8a252a1ede8dcd3d8019a2394dd4d914114e8eb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692927000, "uuid": "9fc709c1-ec28-4e34-93f6-4c24e338ac6e", "comment": "Malware payload (Meduza)", "value": "8dcc1559c85b6aca81580c721164e1a47a63a22b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692927000, "uuid": "805d8e1f-7bc3-42b0-9149-f0f001a31c2f", "comment": "Malware payload (Meduza)", "value": "4bb92ee50f7a2e2b4f27b0a42b22c8c2fc2db74a86ca637ebdcf3a9575edec0ba113a1f364340afdef6afd56d4cb85fe", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692927000, "uuid": "ffa8d62e-63e1-42db-ad7c-297e34303df3", "value": "T16A35DF5937F6A8E8E3EE41F96C19090690B234670B6156CB85E0472F9E2BBF46C75F30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692927000, "uuid": "c93fc792-9540-4f89-bd1b-57dab1b34dea", "value": "ec60126f4192985d34dcefad85fc80da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692927000, "uuid": "42333b46-b3fb-46ee-8fc1-6c22ee6ed811", "value": "24576:EnLXTAnzkoeH2z49fTL+DOcL+Fe90FAFDi/MyX31iYTrO2i4yr:EL8nzkBvf+DIkd9i31JaR4yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692927000, "uuid": "8fe3a272-a8b2-4ee7-81f4-e44c068d989f", "value": 1126912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692927000, "uuid": "77df041b-0ecb-4971-865c-3a80913342e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692927000, "uuid": "df4a6960-a539-44cc-ac3c-5a11d52ae08d", "value": "a0eb9e7e92218a18f3033667f414551b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d01883c-4328-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692955113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955113, "uuid": "df87e76f-1b5e-432d-91ab-47fc81bce121", "comment": "Malware payload (AgentTesla)", "value": "8104ab1d6872bdb3bf834724ef56cf03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955113, "uuid": "4c038762-755e-4518-b7fe-dcc526ebc51e", "comment": "Malware payload (AgentTesla)", "value": "db309c1ee2e0d1555a57a2d177be42d52809cbca61f71292f68523c167448080", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955113, "uuid": "8629372c-8891-4d9b-958d-6e5dde7da09c", "comment": "Malware payload (AgentTesla)", "value": "e276e85b4645b47a90a84a84528925263d4a9c56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692955113, "uuid": "3947b9dc-372a-448b-b62d-a413cc894b53", "comment": "Malware payload (AgentTesla)", "value": "9a78243dc141737d7a6806ac96bbf957e94c9d42a641d2d7bd94622c57f4bf003876facf179dea4d945fa96e80fbd28e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955113, "uuid": "3900ed19-d99e-4bd8-ac07-684e23a67078", "value": "T18AA46143BE4B8DE5D38B1B36C18B54004BB8DAB13237D70F794A235E3A637EAA545607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955113, "uuid": "0c9240ce-42d1-4cef-9e57-be8fbc3bccd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955113, "uuid": "47a55b2a-620b-4afd-98c9-6500a200a668", "value": "12288:lHrxNRcRV9qDWlA1qxsy5bVJTjaL/I1pG3Hj1UrOM6+UZ3CKu0wngX/P3SVcwiZn:Fz+JvaLyNpBUiyN+apT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692955113, "uuid": "fe0a040f-1be5-4837-8106-40d4f88a8916", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692955113, "uuid": "fe263e0c-76e8-4ac2-ad97-ff0eb22597fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692955113, "uuid": "42046112-bf6b-496f-a7cd-c04920c6d538", "value": "RFQ 6000066536 - PR 10023150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0104a175-4365-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692981158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981158, "uuid": "a3e6c472-f940-4b20-b6bd-795cf36fdd7a", "comment": "Malware payload (Mirai)", "value": "86ef0b154127ff8e1f6d5135cfbe33ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981158, "uuid": "65153149-76fa-416b-90f1-3e1af1c497d0", "comment": "Malware payload (Mirai)", "value": "db99f7d6c1edb5137e6b185a3d5108f162edfb8f1443609b4808b0e0e1ff510c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981158, "uuid": "895bfe80-0d21-468c-87ef-e6b2864754c6", "comment": "Malware payload (Mirai)", "value": "5d166ab11ecf4b435a5cc7b5fa59d7b6878f21ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981158, "uuid": "617b4429-9f32-455e-90ca-c10624e4f593", "comment": "Malware payload (Mirai)", "value": "3be76993a43403901e9d47308060ea19b09d6ef4f3c25255b387145b4928bd9e79ea9f1ce93572f8fda2678906688b22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981158, "uuid": "dbe96d6b-23f2-4d3a-b157-69a606fbc7e0", "value": "T123330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981158, "uuid": "f8f1b1d8-d74f-471e-957d-f63e9d44c781", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oGQ:r/hqaJM53eqK806MHdMfQXoHuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692981158, "uuid": "86db13cb-60ef-4465-a574-94ed8a957ab1", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692981158, "uuid": "64da02f8-83dc-4a6f-b596-06cd728736ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981158, "uuid": "ae8f6a62-025b-4206-ac34-2ee01f23cb1c", "value": "86ef0b154127ff8e1f6d5135cfbe33ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803eb4c2-438d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692998551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998551, "uuid": "a715db8d-1484-4cb5-a531-9cca5765663d", "comment": "Malware payload", "value": "9b4d865b5fe19ccb3759c72eec748d5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998551, "uuid": "1fc92dd1-4da0-46c9-86d8-8c98fc173a36", "comment": "Malware payload", "value": "dbe723fa44a9064fba8a2d8712c84826ba3e74c00b91bca2492cc1223fa373e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998551, "uuid": "6687aa7b-d4a1-4cd2-b6b4-79561f644d8f", "comment": "Malware payload", "value": "ff483935b69def6843f7cc50ea76392058eb4f94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692998551, "uuid": "5deb32f3-8c52-4ab3-be03-064bf256a8a1", "comment": "Malware payload", "value": "a6aa88481619403c0d9aec587c129a40c90ddc6afd211b556bdc43ee12a7a8d796bf1696a30577da2a600cbcd1785d9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998551, "uuid": "b496ea82-b31b-49f2-9ff3-ee53ec607aec", "value": "T136B5232076C49671E86A193A5BF0AF341738BC710F668ED747902F5F5B305C1EA24BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998551, "uuid": "edf782ac-a998-4ce5-906d-c27b96e66fe9", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998551, "uuid": "814a38af-1695-483d-b119-b37a6f7c2ee4", "value": "49152:8cbi6yDA3Y2cDAqJEcoTaYsuE0qRhEc8mhdbqA1c53d4Q6wZAlZXms:8cbQk3YROcOtsuTqJ8G91qtVPAZXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692998551, "uuid": "55f45ac0-cd7d-4c44-b04e-10c6117557f5", "value": 2431221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692998551, "uuid": "5abd50c6-5b4c-4794-a61b-68697e09f840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692998551, "uuid": "e6d76e93-31ac-4e28-b733-ee4d9b1e6025", "value": "9b4d865b5fe19ccb3759c72eec748d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d2460c-433f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965227, "uuid": "a1b09fe5-ad2d-4324-a528-1e23c4824e5c", "comment": "Malware payload", "value": "5065f7f6905e6f1f896d6c07f6a48346", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965227, "uuid": "7fee10f2-3613-4687-8384-282e07dc92fb", "comment": "Malware payload", "value": "dc8f09306aad5a7072051cefce4743d39d7517230d7de19f53027e08a13a4915", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965227, "uuid": "6fd0db68-8a5c-475e-922a-df3c41571bf6", "comment": "Malware payload", "value": "aa8ef717d3a2d9d6ccc0a98e132568f87a374097", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965227, "uuid": "10a97404-724b-4c82-974b-2eb8499ed1c5", "comment": "Malware payload", "value": "0a8f066276ff27fde3f8ed7b93b3a25dc820b488a0f4e1cfa95112924c2f344c25b4b06b227ca4e692ed6682414e740c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965227, "uuid": "4eb27943-75b5-454b-8e56-160bbf570651", "value": "T1A23633EED97561D1D308903FBE61CF4E2A0094FDC8BC2B6677B8F2C0A521D5185AE1B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965227, "uuid": "4ab046b5-6b76-480f-a1cc-decb1e640a8f", "value": "98304:Nv79P4zrmQotbO6h2Pk1t+w6KMp1oXQclquyaSuxXe7FREY56omRA5nIwWAFD:NZwmQb62Pk1t+w69MCaSuxu70XSUAFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965227, "uuid": "1c39fc39-8d09-43af-b22a-983a1bc4736b", "value": 5008293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965227, "uuid": "7168d570-e44a-4ad6-b421-31ddce26cdd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965227, "uuid": "5ad4846a-ff20-4ed3-879c-a30bb9e5c68c", "value": "5065f7f6905e6f1f896d6c07f6a48346.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3881f696-431b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692949468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949468, "uuid": "70ef265f-323f-498b-b238-791670ad58c9", "comment": "Malware payload (AgentTesla)", "value": "ab4d8ed2ed393bcb62e5fe16a2889746", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CATALOG", "colour": "#4D88C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949468, "uuid": "1ba1969c-623f-4fef-8514-50500bc3f667", "comment": "Malware payload (AgentTesla)", "value": "e1a154c41b5b1562e06e9883399b735ee7420259276875c9cb44e402338240c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CATALOG", "colour": "#4D88C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949468, "uuid": "c54f3f37-e1e2-4f1a-8dc7-3bd69dbe5ed0", "comment": "Malware payload (AgentTesla)", "value": "af23415c8ba34384c61c432767e18891906716bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CATALOG", "colour": "#4D88C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692949468, "uuid": "c6ded954-c0df-48ee-ba66-01f115b7b4d4", "comment": "Malware payload (AgentTesla)", "value": "b3cebaf5de13341336670bbd6a7193d2dffba2208c740de791b4fe46520850717fa0c50b4aca81a4947560ff1eb2e6bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CATALOG", "colour": "#4D88C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949468, "uuid": "b8ce73f2-604d-4ee5-8652-d0bd8d3fe7e6", "value": "T14DE422107A98A7B2C5BF07F610B1221103B42D87E85BD3DA0FE9B1FE2B727489519767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949468, "uuid": "c91efe06-0272-409d-a037-f675e67db98c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949468, "uuid": "4a68a78f-e591-47b9-9645-5f32a2b14826", "value": "12288:2IqpmqazmbqBs2OWlniSotHMCaumw9+knhxva8JiIrK:6sjSOmHfNaum2NhhauiI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692949468, "uuid": "b090f2c8-0e48-41eb-a084-810028fc8eb0", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692949468, "uuid": "9f8db6c3-f854-4c72-b52e-81cd263b1b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692949468, "uuid": "f7d47ad9-12f2-421a-9408-045ff2c266ed", "value": "CATALOG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1df035-42f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692931736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692931736, "uuid": "9f672bb5-4a11-4c5f-8a7a-343cdd9a076e", "comment": "Malware payload (RedLineStealer)", "value": "c913d783de7b3d8af7f333abdab32d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692931736, "uuid": "96a73813-5311-48d7-8592-588766b119cc", "comment": "Malware payload (RedLineStealer)", "value": "e31cd4a352c3550c113a4b3a15646688afd2e92d9f7cf0e23e147203da08d173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692931736, "uuid": "40749b3a-d5e5-4ac2-9f2a-074219fafbca", "comment": "Malware payload (RedLineStealer)", "value": "f5a36e0622b482c886aed99ab2ec75f391db4f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692931736, "uuid": "935e0e7c-6f26-4273-9602-0e7738fab023", "comment": "Malware payload (RedLineStealer)", "value": "14c729920f3aee7173a91e78428751a02216631d5fe0934ceaa49bcdf4f409a49abcb95bf46790e1d611a92efae63577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692931736, "uuid": "d2c7dfd7-c87d-429f-9ff6-5ba355b8a583", "value": "T1E634073911A154ABC8A99E35BF4BD8C131166EE4017D940F3FF36E386B924938DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692931736, "uuid": "63d0d7e7-167d-4fbe-8ecd-660df96f1eea", "value": "de3fc5b72cfeac8d9191c9aff7d23366", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692931736, "uuid": "91fa16fc-0fa9-4bb6-837c-66ab8f53d6fa", "value": "6144:jf/8Rlc0jWtxg3FSwC76VtloLQnfbUyz24q9v:jylrsxg3FSwC76VfHp2/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692931736, "uuid": "712b65b5-203c-4aab-89f8-49119fe5aa0e", "value": 244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692931736, "uuid": "89ce87ce-a58a-40d7-b689-1183784b5fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692931736, "uuid": "b369444e-f398-44ee-b31d-07285bbd58f9", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77d0c30-4333-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1692960043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960043, "uuid": "b9da4514-64c9-4261-9fee-82518693f41f", "comment": "Malware payload (PrivateLoader)", "value": "fb6c448f035f878fa53cf5ef18be4611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960043, "uuid": "3c0fb596-8751-4c6e-9879-96a5b36aca21", "comment": "Malware payload (PrivateLoader)", "value": "e6ea06c6f7b53007e854e986734e79bb0dd84680611e9a3ee9e586cc7a964bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960043, "uuid": "fec72045-d65f-4496-9d2e-b8248c7124dc", "comment": "Malware payload (PrivateLoader)", "value": "1281f21fc45f6cf39837bb90367540fda8b5ca0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692960043, "uuid": "d0045455-96a4-4a00-bf17-f279c2169b35", "comment": "Malware payload (PrivateLoader)", "value": "e3d58c7ceebd4d79116f74452ff2adefacba8755184da4bc6c92f136da9eb10cd1ed4bafab1c387b5a153cb606c8cc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960043, "uuid": "ebde5255-6fc3-4551-a86b-96cb7b0c4492", "value": "T100265B07F25A50EEC8AEC079A3966236A6797C4907307EDF97C04B212E65BE16F3D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960043, "uuid": "16ce7e6e-2e60-4ea5-95b2-2b61782f0f17", "value": "3fa70d43fd8740c853f484160e706724", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960043, "uuid": "8dbb81f4-c0fd-42a9-ad43-2b0e0ed6856e", "value": "49152:74jNK7Anf5WYoyY/PIsYgkBAASKeiq15Jj915tmfErb1OFrfFnFSteh5oWID8+AW:uMEEYuIsDAbfq1triL5oWIDsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692960043, "uuid": "c4d2329b-763d-46c3-b9dd-03b309a01098", "value": 4634240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692960043, "uuid": "81dc7122-ad90-4aed-8c5f-7f2b94a177c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692960043, "uuid": "30a858e6-7a2c-49d3-8ee5-2cdfa647b087", "value": "fb6c448f035f878fa53cf5ef18be4611.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9758bdd0-432f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1692958217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958217, "uuid": "376ae2f7-7c1c-4153-bdcb-25ddb28fb34d", "comment": "Malware payload (RiseProStealer)", "value": "3813559c9eeac4f4dc8b7b322b695007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958217, "uuid": "4b24d967-2f03-4af6-92a0-06b8f93be9c6", "comment": "Malware payload (RiseProStealer)", "value": "e728a9ec09d7e49171144459b742ee41dabaf206970d2a2260694204cd1f5161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958217, "uuid": "ecc59c9a-1b89-4464-8d7f-714754c9cedf", "comment": "Malware payload (RiseProStealer)", "value": "f4f348b0b6ad12488bb49a001cb24e9861a0a151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958217, "uuid": "7cc2195b-a96e-45f9-8f94-3040f5456141", "comment": "Malware payload (RiseProStealer)", "value": "65ffe67cec7bba8dc9b9d24c55e506a97f85f4ac631938030319646f5ba9720144ef59ce92327b9cc5d53f34a32c7efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958217, "uuid": "00630125-778c-4b88-aee7-ff4c317f2f2d", "value": "T137265B07F25A50EEC8AEC079A3966236A6797C4907307EDF97C04B212E65BE16F3D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958217, "uuid": "210d29e8-c792-4a6f-9b4a-3afe90babab3", "value": "3fa70d43fd8740c853f484160e706724", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958217, "uuid": "f73d553d-9422-4259-8276-1a32843c0c30", "value": "49152:z4jNK7Anf5WYoyY/PIsYgkBAASKeiq15Jj915tmfErb1OFrfFnFSteh5o+ID8+Al:GMEEYuIsDAbfq1triL5o+IDsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692958217, "uuid": "2d5ad859-2d21-48b9-897f-4605c20ff38d", "value": 4634240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692958217, "uuid": "676d27c8-deef-48f8-a930-ed57f839944b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958217, "uuid": "24064c31-a7d2-4eac-abd7-675eab9244cb", "value": "3813559c9eeac4f4dc8b7b322b695007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc3605e-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950574, "uuid": "1e92ae6b-c132-4db3-a570-576adac99e69", "comment": "Malware payload (AgentTesla)", "value": "362852912761f21d0b35b53b0e5a34a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950574, "uuid": "30ade671-6594-4ee4-ac7f-55259f0dfb60", "comment": "Malware payload (AgentTesla)", "value": "e77c69d0d28f08dcc0a3f318dac48d003465369e6dda58a721dea8f3a893f930", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950574, "uuid": "32a273af-838a-42d6-97cb-532dedfc61b9", "comment": "Malware payload (AgentTesla)", "value": "22892601c5ca077d321badc7e4b7513d2c591a3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950574, "uuid": "1fbc4adc-b225-4c66-be17-727e643444ac", "comment": "Malware payload (AgentTesla)", "value": "b186511c53a3b494df76abdcfb757f6f51e8ad5e731a154100a1f591ac98d152c998274ee5cf79710e40c169c243e20d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950574, "uuid": "4e939468-bb82-4936-9591-e3f1063bea79", "value": "T1E5E4335039DB30DCE1A8A87E483D9989F80BA37F14DB7937BED55A1604E333AD186D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950574, "uuid": "bfaa90fc-4502-403d-8901-e902ac2b1549", "value": "12288:kdnWN+H0HTDrgKM4esgYS+fxLEtIKipXwlop977Yzphth5xcfT:8+zDrgKpelY5fxCI86tYJ+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950574, "uuid": "f7136a80-9458-4bf8-a738-c1966b6638e1", "value": 672025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950574, "uuid": "4f91f404-8a22-4c18-89fd-0914d2d971ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950574, "uuid": "4380a8e0-6bec-4655-b7e2-47c48a7531b8", "value": "PO.230364.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc4cfc4-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692934173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934173, "uuid": "53dc9559-8d4e-4d39-8f88-9f29d2151c71", "comment": "Malware payload (Amadey)", "value": "739ac92d82f9ae4f557923ee2689099a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934173, "uuid": "287dcf08-98a0-4f92-8bf1-574f8ae3a0ea", "comment": "Malware payload (Amadey)", "value": "e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934173, "uuid": "b14bc66f-416c-4c4b-9ae8-1c876061ef78", "comment": "Malware payload (Amadey)", "value": "93583178a8a370778b95a89c508c6bb7ee304df7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934173, "uuid": "2d2d2788-8c2a-4b46-ae2f-763bc8c6b4da", "comment": "Malware payload (Amadey)", "value": "bce874c018d484b3191922939a1c240169dc360f0998bd72603ff7719e3b8bcb04bbea5642a60d147321a7155cd1a959", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934173, "uuid": "c31b3590-a59c-4927-a36b-416b92a9ace4", "value": "T1A746DE297DF10021A773D338D5F48D8BBCBA3D230892AD5D24A9135E27CAB942D5277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934173, "uuid": "48a7aa63-3711-450d-adfa-248242c92e01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934173, "uuid": "d4511eb1-7b1d-47a6-af63-c3b2592722b9", "value": "98304:eGhiQrGkLDRgEi8qouBe2MBX25lWu2SkP4datub79STffx75rmtasHXFQj95Vsve:BikVgyXUlW6kPWatu/gffBND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934173, "uuid": "719f1737-e29a-4cd4-8530-f634b82c6620", "value": 5375488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934173, "uuid": "a223be75-1039-4ca2-8c01-d7fc0c61de8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934173, "uuid": "2d3555a4-a4d2-48d2-9ef9-547fc5665d75", "value": "SecuriteInfo.com.Trojan.MulDropNET.43.3806.2811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a0d6de-432f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1692958219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958219, "uuid": "d03ff982-114c-4087-a309-42cb3fe8daa0", "comment": "Malware payload (Gh0stRAT)", "value": "60901b7f42fc6fc450ee0254d7899a48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958219, "uuid": "438ea848-64f2-451f-98c7-a087a4bd23df", "comment": "Malware payload (Gh0stRAT)", "value": "ec4518d92784b6a06ce8414bc00d8c22d430fddb4b19e8e343cce089db788b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958219, "uuid": "64e86c40-99b7-4a53-abb0-fcbc9bc6cad8", "comment": "Malware payload (Gh0stRAT)", "value": "98bfb8b6fda973972782ba977b9baba4c4b1af16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692958219, "uuid": "1bf25877-81a0-4093-a759-4fcce7b7eac7", "comment": "Malware payload (Gh0stRAT)", "value": "ceffbeef706611b1bae877809f730704f484527f8aefab19b87156eaf577e760034fe588fbd60e8f2cddd56a30377024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958219, "uuid": "4834958d-5fc7-4e13-bde2-7604ac423fee", "value": "T16DB34C01F6CC81FAE924013598EA37779B31AD74412FAB93B384EE660873594B71678F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958219, "uuid": "e510a060-080f-4c4a-8cbb-e16a65d70d65", "value": "c7e7b8a641518151f1a77de61fdf182d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958219, "uuid": "bfc0d9ff-e1eb-4272-845b-d560ba9e16c2", "value": "1536:4xkNFnI+WzSkqmG8KBbJs+JJ/PNc1tIfxgexgyR0AEHaQsG:4xMdB9s+z/VWtyxgexgyqAEHzsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692958219, "uuid": "458948a7-ee97-49f2-905e-48412d922488", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692958219, "uuid": "8621fab8-153f-4b53-8be1-893305edd2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692958219, "uuid": "52bb368f-bfa6-470c-b19c-aa6af6aab43d", "value": "60901b7f42fc6fc450ee0254d7899a48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde7ba70-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950551, "uuid": "418f2305-ebd1-4774-af5b-2ba8c0737eca", "comment": "Malware payload (AgentTesla)", "value": "d9d901ed238d8f8509aba3280dd7a16b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950551, "uuid": "a69ca5ca-d070-428e-bc7d-d6c747865eaf", "comment": "Malware payload (AgentTesla)", "value": "ed81a7e9c0114354455ec14490bbc9e7de4b42d4cabfe3c52be4b9a63e8e48b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950551, "uuid": "24fb096d-d192-41ab-8545-47f2b41d0c59", "comment": "Malware payload (AgentTesla)", "value": "07a6d21c1b7f8adb83a2d81271e216e6b2327857", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950551, "uuid": "499c7003-cb7f-49a2-a41d-9c093a206419", "comment": "Malware payload (AgentTesla)", "value": "0ef16466fe3fe0f23fc3e3172a893c6bf4f325dc9cb9b29271fbc3a12de4ef88742b50a2b8e4795713fde4f2420b5b91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950551, "uuid": "05e20813-80ec-41f9-a570-483df5fd68e3", "value": "T1DCD423516863095AFAEC89EC65D18EE073F3A2E1C5FC4A019EF80F9D62A72CEDD15314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950551, "uuid": "985b0bb0-5a05-4fe5-97c8-3b443c608f58", "value": "12288:wNcnW5DO521RzdAHUWD8zfbe1zltuVeN+QcV1PQyBEMsMMhXDzf:7GOMzQD3z2eNZsSyBEMsHhzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950551, "uuid": "ed734423-da08-46d4-b97e-11db5b99b389", "value": 623138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950551, "uuid": "ba7edf1d-59e9-499e-bbf9-4afe3d810ca5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950551, "uuid": "cd5ab436-3926-48c9-9438-182fddd12bb6", "value": "12V100AH LFP battery.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6f337f-437f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692992584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992584, "uuid": "f64fdfa3-24ae-490c-95f5-924e927f2642", "comment": "Malware payload", "value": "d379288075e335851ba033fa96f3e68a", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992584, "uuid": "61ab64e9-63e5-41dc-96f3-350152a052e8", "comment": "Malware payload", "value": "edea5a426343c9f0c7e9b329526835745a073ba0c65a8af64ba97fd6798c04b4", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992584, "uuid": "2bb0fb4e-ebda-4e7b-8f88-8ad9c0262772", "comment": "Malware payload", "value": "d6c0dc6d6832ac4362a4dafeee12b91da6548af4", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692992584, "uuid": "e9772a4b-69d9-4d50-b78c-8dd9bb96dd50", "comment": "Malware payload", "value": "28ff5307f576a94bed743fb28bd5306edbd9d2316ac3cab7747f196c0223238212f16a42be6db36006798009922db041", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "RogueRaticate", "colour": "#DE8FAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692992584, "uuid": "b11f5ae4-47c8-4597-be3d-ed548c9a226d", "value": "T1C1D533CC09C83ABDC28C7F78051BDC67819ABF149AF9719552E4D9423ADB4ECA2DE05C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692992584, "uuid": "a10b1047-2c4f-4594-b8ae-66811b3fda93", "value": "49152:Q8sL3HYZucJ34vR7B4ezGJZBORR7ZH1FkOMb+HFis2zDPTFgIy58vEUZ:koocWvxBiSlZH1eOmwFi9LF8mvZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692992584, "uuid": "e81f5d77-f4c3-4f12-a1ec-09b658a741af", "value": 2869834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692992584, "uuid": "66075475-c46a-4d19-b982-b0700ca020c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692992584, "uuid": "53d3065d-ca92-4468-ad44-7fd4e609ef18", "value": "SunnyFa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4e8818-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934149, "uuid": "7892ba3e-0dbd-4644-b491-2e7f57b1f33d", "comment": "Malware payload", "value": "e693639a941075005bfd6523f6ba0abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934149, "uuid": "136ffd6e-ed50-4681-933c-b040ef22b99e", "comment": "Malware payload", "value": "ef1f9cd3dcf5046fa45acfb0b027952a440ce6634c04b35b63e38d51bac65649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934149, "uuid": "d9b5e9c3-6ea7-4850-8aab-8392c46646e7", "comment": "Malware payload", "value": "693d0d79e0edce0a0e507d5753ebde6b4c6c22da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934149, "uuid": "bd03eeaa-2fa0-40c4-b255-942c15a04b0f", "comment": "Malware payload", "value": "8efaf606c7edfc7b72ff5dd6be01d9ff8a4321ed787f6fd39affc8e5246376e7015dc0670b2595116fc273626401e7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934149, "uuid": "d43b55fe-1e49-4eb7-bc2e-f1c060bd4a64", "value": "T161159D117BD6C432D4BB05702E29D76A452EBD304BB188EF63D80E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934149, "uuid": "ecb39983-7809-47e5-bca0-626c02d9e9df", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934149, "uuid": "6ccd954e-ff42-437b-9e41-0d84a1489bf0", "value": "24576:iyyzQyz5io+HExGWUAyiqZhYjBqnGIQ5M6DLrVVdWHAjnM6d9:irz5io+HGGWxyzhYJlrXVVdWHAjnM6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934149, "uuid": "20dcea69-c41b-408d-88d6-e4179df55063", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934149, "uuid": "32ffcce5-7cb0-440a-97c6-58a0363808f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934149, "uuid": "67227e26-824a-4124-96a9-635a01de6b9d", "value": "SecuriteInfo.com.BV.Obfuscated-O.9662.30931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dae844c-4368-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692982494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692982494, "uuid": "ce9875d9-cfae-4831-8d8f-de4e909a5545", "comment": "Malware payload", "value": "269ca98fb9604d8cfe4298f2b966ff73", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692982494, "uuid": "e7734d59-1ea2-49f0-a38f-d5de0cd2b55f", "comment": "Malware payload", "value": "ef75466ef44f193e00c09e827937effd8f3114ef24d34e9b0972fa0fdd3805ba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692982494, "uuid": "77b91a4e-3d87-4294-b87d-797e7e13834f", "comment": "Malware payload", "value": "b02833cd16afa4acd869ad48e00ebcc4211e40d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692982494, "uuid": "17a08653-ce8e-4727-9b7b-08fe1cf43ace", "comment": "Malware payload", "value": "001db64171e1bd4e27194a8f06414c3a1c0e839ebb02b97e6bad2f10bfb3fb33524f83db6dd2d65c323fa786942f0fc8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692982494, "uuid": "b45e22b1-2678-4d1f-bbc2-7a8bf8e2ca8b", "value": "T109B2CF2CF1567815D9D9827C619ED2F6E248027ABF42BC0D0C4A3CEC8B5497F1B2EA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692982494, "uuid": "3ec2c948-6004-481f-84fa-8fd0d5559130", "value": "768:neTGkWL3I9I3v2ql2S1uJeEBfqyTgP5j3sLFFqjK:nM7WL3smvX2S1uJr3+d3+FqjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692982494, "uuid": "7c8131b4-bb5c-44da-a51c-5758d29523ba", "value": 25395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692982494, "uuid": "8fe09318-aabb-4064-afb3-35ddf38b9c2c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692982494, "uuid": "6e0434f8-5374-4b1f-9929-4b19c330f522", "value": "FedEx Delivery Express Service.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e308f66b-43a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1693006877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693006877, "uuid": "b59165d3-7157-4020-a104-bccf34e07ecb", "comment": "Malware payload (RecordBreaker)", "value": "140510ca012bf95c60b339b6388c2ca9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693006877, "uuid": "f5e40d4a-1113-4685-86cd-1a828e957a31", "comment": "Malware payload (RecordBreaker)", "value": "f00b2b25861c0218820c23eca788881bc73c8470f59872989acf60c04cd83630", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693006877, "uuid": "1916e569-934d-43c7-9985-cacbfa6861ad", "comment": "Malware payload (RecordBreaker)", "value": "97f4ef1024bd3c194572e8d3189f8fbf9d5cb127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693006877, "uuid": "d90e2092-0dfb-4ad8-8e8c-fd916ab35047", "comment": "Malware payload (RecordBreaker)", "value": "644c1b9b6991236fdec8a0d5eaa89608ebbebdb94f37126a2bab03f0131c9695caab9a88e17dec152cc675756f794179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693006877, "uuid": "a98b11cc-d86e-4451-8d5d-fd11866788fc", "value": "T11505D0CA342DB93EC83827FD635A8CADB79D4E304213F107F59158729A39B851B726D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693006877, "uuid": "ba0ff879-1d36-4b20-89e6-95644fc2bbae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693006877, "uuid": "970dfc39-31c8-4956-9fc5-c786356e89d6", "value": "12288:X8+/Pqc6JGU0QC6MFqRG1DOkzfAWSiXBZP6haDD5F33XUTmzFJNDVSAQ:s+/PqcFU7vMgqEOrP6haDlFHET0DMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693006877, "uuid": "f1ccbdba-bbc9-4d9c-98a2-3872baeae68a", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693006877, "uuid": "70cd9883-2c01-49fd-bae5-6720429acefd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693006877, "uuid": "e6d1b766-9893-486c-b3e7-4dbe440a6683", "value": "140510ca012bf95c60b339b6388c2ca9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ead56f-42e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1692926992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692926992, "uuid": "458616f0-188a-4828-8c32-df1dad90cd4c", "comment": "Malware payload (LaplasClipper)", "value": "ec8952a8dcbbfaa1fb6fda23df851402", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692926992, "uuid": "07b8635a-0a2f-41af-be1c-2c61e751441e", "comment": "Malware payload (LaplasClipper)", "value": "f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692926992, "uuid": "44d2d89f-e5b0-45b1-9b05-95c7820fc691", "comment": "Malware payload (LaplasClipper)", "value": "4fb7a97221090f3a4ff5263103623da165624881", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692926992, "uuid": "c0a8ae4b-af26-48c1-8b7b-35b1827b219b", "comment": "Malware payload (LaplasClipper)", "value": "cb0d6e9e07f5824d409d9e3206a6bbf5938faf71b4b3e3c441f3757996b32e83aabe363f0748486db7409ea35ce5b6ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692926992, "uuid": "1096191c-de1e-4530-8a00-ba942dfeeff8", "value": "T1CF9533B56EA7C070C062503114A2AAA9AC3BB03A097076DF7BF1279F9D326D33E55753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692926992, "uuid": "29c9f7d4-a5f5-44d1-89e7-dde45a30230c", "value": "2a0116df27e92a9910b42edcbfe45f8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692926992, "uuid": "0f5f3eb4-e7b9-4b65-99b7-4d8d5b4b4b46", "value": "49152:N4o1Bkql93ztp3vKhV2E8rf/L0ZNo2gV6UlAo7TWJ:N4o1Bb73ztVv5Ei0ZTUX7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692926992, "uuid": "10862703-bba1-4ac3-8010-35da6790c367", "value": 1929256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692926992, "uuid": "e81122ba-d102-4a1a-a54b-dd81aab20957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692926992, "uuid": "6b8b7c9c-daeb-435b-a550-c7ed0cf41ea5", "value": "ec8952a8dcbbfaa1fb6fda23df851402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7d5abd-4348-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692968725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968725, "uuid": "059233ca-388c-4253-ab64-4634db675834", "comment": "Malware payload (AgentTesla)", "value": "f793d021ee5482b3c416622610464764", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968725, "uuid": "2711cedb-ac8e-4c40-ab72-9fb53dc50fcc", "comment": "Malware payload (AgentTesla)", "value": "f1fae2208700f84417d78ca53466b9496dc170cd84c4ab9500588394524c2d7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968725, "uuid": "283b1af3-0681-458f-bd69-72b199f60f55", "comment": "Malware payload (AgentTesla)", "value": "4840de965b2a80e99c3687f41463d8395f54be3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692968725, "uuid": "2d923914-c994-4f93-b8c6-b4845a8d867f", "comment": "Malware payload (AgentTesla)", "value": "fa01870a627e3d9f1a37d09336520a5a9c468d9107e50e40c9fbdf0568ea5f6c46542d087e82532f7cc40ce5b51364ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968725, "uuid": "aa067247-d6df-4f3d-a970-f22519f0fd15", "value": "T182946F07BA4B8DE1D38B1736CD9B18000FA8DB99663BDF0F794A239675033BBA941547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968725, "uuid": "d399929a-1d2c-4ba0-8810-0a8293fce53c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968725, "uuid": "853446bf-9c11-4a3a-ba34-6f8658d4bb67", "value": "6144:4qejj0SSEKjL7xhbn6qZpWKTuSRe7BcjGmecbdaO7mfWs:4RjH4nrnjpWKTu/7GjsO7mfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692968725, "uuid": "a7753031-7a1a-466c-bad4-e81c082c0e78", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692968725, "uuid": "c95286d9-0902-4c0d-9655-d6d1f0b5660e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692968725, "uuid": "ce22c6f7-c73b-43bb-8333-4575586c17d1", "value": "order - NLDB-082-8232023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abdc621-431d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692950250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950250, "uuid": "ce0363a4-ba5f-4914-b57d-a330069e8025", "comment": "Malware payload (AgentTesla)", "value": "c54dce88bc8ff834f0e2eb577565e495", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950250, "uuid": "2b0567a9-4496-4a08-8894-a1651f34ad8d", "comment": "Malware payload (AgentTesla)", "value": "f25629c1e4443264f32229cd2215e34852a0e405a4a221e579aa77022249bce0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950250, "uuid": "f25353ff-6988-4d15-9221-33558de3f62b", "comment": "Malware payload (AgentTesla)", "value": "0f972adb5d4b530112afc80304955bf5705f0d40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692950250, "uuid": "ca798642-fc62-47cc-8d12-d006ff53c8d8", "comment": "Malware payload (AgentTesla)", "value": "f9e2b5cfbe1f4dbaf68d196aa82f3d8486d3d7a7d21ff706951c609bb9f13a0532f42e7e5ca54a9c0894fc982701e45b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950250, "uuid": "d8c05383-ecc7-4201-aac3-cec1d5dd802d", "value": "T1A6C4AE57F6D77A65E6AFC2BAC6B1C92C66B3309602B0C3CE774055492D22392483DB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950250, "uuid": "fad1927e-ceb5-401c-8124-1a5a974b01f0", "value": "f20a8db3e4a8c03c1ab177b2660fdd78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950250, "uuid": "dd353071-f43d-48cc-b433-ded863abccdb", "value": "12288:+zLjlZHAt+AZrkOCH8bzbBSreaOi1uWD242S6+4:+zLhltAdkjcX1hDWeS6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692950250, "uuid": "eb06688a-1d11-44c5-89e6-1fb214ede7c6", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692950250, "uuid": "9f0dd4d1-4c97-41fe-a1b2-bdbf6c18e3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692950250, "uuid": "3363a210-08aa-46e5-b544-b99ec3b97153", "value": "invoice 21FV61.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1dd65e-434c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692970813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970813, "uuid": "d9ef6473-26d1-49c2-a949-83717efaddfe", "comment": "Malware payload (RedLineStealer)", "value": "cf642c4d5cc59ef3d84bfaa8d2d03135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970813, "uuid": "5e0d1a41-a72b-40c2-9613-696b583b60e1", "comment": "Malware payload (RedLineStealer)", "value": "f2f0e3b75d549e204bff15af93a43f6fc4a5d09e2669a6b19a3394339613684e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970813, "uuid": "9cb6da7a-7e23-4757-a563-236b5c6f9e0b", "comment": "Malware payload (RedLineStealer)", "value": "e1bac2fbdf77aefdcb7b2bb2a812199f7d7b9a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692970813, "uuid": "2c698cee-ab1c-442f-b7f4-16b809ce9396", "comment": "Malware payload (RedLineStealer)", "value": "0c825d3d07aeff1e35639b03b6e7c247edf493e4f548b4143878a2967d2bc794a5a21cb9ee32186d6ff43842e978e87c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970813, "uuid": "5e6e2579-dc5d-47ce-9780-fb2316fa0213", "value": "T14294F111BB91C471D85640338824C6F4E67FB873F999998337A83FAF2D31382AA67355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970813, "uuid": "fbc50783-c871-4bff-aad3-b007653cb386", "value": "d3222423d0989f54e4fb484f2a3e8764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970813, "uuid": "493682c5-88b2-4907-9edd-3a22cc939376", "value": "12288:XGJ8X1//8fjAsV6xt1PWTnJKcV8/ZeG7a:XG+9gV6b1ynj+h/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692970813, "uuid": "41bd9a05-730a-4dc4-9b54-70eb440731c1", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692970813, "uuid": "3b7d5c29-daf1-464b-b866-9717193c267d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692970813, "uuid": "5a3f8822-fee6-4c97-a1a7-201c48524d7d", "value": "cf642c4d5cc59ef3d84bfaa8d2d03135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5479c100-4340-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692965406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965406, "uuid": "01b7ca50-3fae-4220-80f5-ac220265d9c9", "comment": "Malware payload", "value": "8fc93b7a093218362e92f56b2110713a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965406, "uuid": "b1fd8f20-46fe-47a9-bf0a-8081560c9fe4", "comment": "Malware payload", "value": "f3a4aab34188fb2ee3e5577c088b25d45e87c9260df492adc2283b39bdf5d59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965406, "uuid": "93b4d54b-7462-4caa-9d1a-c2d22246ba07", "comment": "Malware payload", "value": "04aff7186a5003a0e4cd7fc595d4461cc67de779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692965406, "uuid": "51c331c2-0416-4943-937e-839936634e72", "comment": "Malware payload", "value": "1b30293d4f7c627b7cabe2568e310c4a8756697955abcbd93aac185c2d1c5d5e52c325119ce9e73ff9e64aa4fac046da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965406, "uuid": "0f7af97d-2bb6-4053-a3b5-b9f3f70bca32", "value": "T1772523410E0C507FD5BBE67FE71AD40A46ACA4A39BD53F80E5D17FC262422877984F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965406, "uuid": "1fd49a99-f394-4862-9f63-332101d30fa3", "value": "12288:/tGm/VHhbsASpX/2nkqLxKT1ZdV4rHenX9QkMua/1e3DxNjd0lVBaMsAxuvOMxRe:Ym/35M+nkqL0DvXikGk3dNj6lVn8Jitr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692965406, "uuid": "52221a7b-a495-4d39-ae1a-bc4b9a682887", "value": 1024920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692965406, "uuid": "43ae9e83-fd9a-4e16-94ac-33497c1662ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692965406, "uuid": "6dd12acb-3ab9-46ab-95c5-1f202b830714", "value": "8fc93b7a093218362e92f56b2110713a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52c1d60-439a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693004223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693004223, "uuid": "295974fd-d832-4cd3-8a91-9d9becd8ebd8", "comment": "Malware payload", "value": "f91db36135a994d00b92ec2b1be0fca9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693004223, "uuid": "b0b0469b-b8c4-4a35-8765-215c62a37ec9", "comment": "Malware payload", "value": "f3aba98cd53c71d4d5e917e9e1fd43e3db61b46c59610eefba45b8c81f3e68ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693004223, "uuid": "9dd5d881-3e24-4d84-8db4-ab9982d887f3", "comment": "Malware payload", "value": "4219943320a7f291a4da37aed89bce5a4a09e250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693004223, "uuid": "db2837df-ba49-4fc1-a3a2-30a2116b5f97", "comment": "Malware payload", "value": "2d0361bc1942c46155f43d12c3df4453825c92f29c59d56ea1c9b09831febcb7e01de9af40f8905b33cf14dcf6ad453c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693004223, "uuid": "16b8bc10-774a-4208-800e-dcc7ea11209d", "value": "T1FFE523F097CC6A21CE2D8FFA4B8CB65277FE01E34AD3560A8E2B757B6D4234B8811545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693004223, "uuid": "ca8672b9-38c2-4fd2-aa8c-de232a5ad615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693004223, "uuid": "82047f92-551d-4820-86f0-53cb7e844b29", "value": "49152:mwOiIXJQSGd77+om1nVr6AZxPbxlhqhMKucCuTOgVrp7vRo6JE3CGiiFlENhh4xM:mT5af+tF6UxPFlQ+KdnESGNFe4xLafv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693004223, "uuid": "554482b2-e26a-46ce-b340-03dca143f34f", "value": 3174912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693004223, "uuid": "9342b651-be26-4f61-b5e5-39bb52038e6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693004223, "uuid": "869caff2-01a8-42fe-a0cd-abfcc3e6d2f1", "value": "f91db36135a994d00b92ec2b1be0fca9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9973563d-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692934169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934169, "uuid": "682eb851-f463-4c98-8715-6fa18aec237f", "comment": "Malware payload", "value": "a48b86ddc48b5df500a358a095853b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934169, "uuid": "4a379769-f9d8-44f1-bf82-a3bb2e624f42", "comment": "Malware payload", "value": "f70b2a865bd89d510130072aa8036d8a4d19afda516a4b8124a14d833aa8f006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934169, "uuid": "245a430e-e24e-409b-a25b-812f6ecd478f", "comment": "Malware payload", "value": "6be01b1c592cac1bcd03f9391b1bf116b1010767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934169, "uuid": "ec435176-ca6a-43ac-8340-0a7ef730cb0c", "comment": "Malware payload", "value": "9ebf41be4ddfabd1372b900e40b624e3fd29b8cf94b94d4dbb1ed010d9d300423bf57b59b59dabc5407cec816e081cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934169, "uuid": "a5c2a381-56f0-4778-8b15-96940e5eaccd", "value": "T1F8159D117BC6C432D4BB01702E29D76A456EBD304BB188EF63D81E2E1E726C25636F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934169, "uuid": "4792462e-ca1f-463a-88fc-5a108ecd22e2", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934169, "uuid": "6162a657-fde3-42b6-a927-daf5f6762642", "value": "24576:iyyzQyz5io+HExGWUAyiqZhY3BqnGIQ5M6DLrVVdWHA+y7eX:irz5io+HGGWxyzhYtlrXVVdWHAha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934169, "uuid": "b81773a8-4266-4a84-9ede-aa518afe0d5b", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934169, "uuid": "4542a1f7-5af1-4ff4-bead-d7502b9ea350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934169, "uuid": "e493a6f8-25f3-4b71-9986-be35b203ec12", "value": "SecuriteInfo.com.BV.Obfuscated-O.439.3609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0a4050-4364-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692981149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981149, "uuid": "0166ca2d-4cb8-49dc-be70-3577435f5179", "comment": "Malware payload (Mirai)", "value": "f7f106cf4ef124920fdf4192dc6f7db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981149, "uuid": "30d51ab7-d55e-48cb-8799-75afc53ba72d", "comment": "Malware payload (Mirai)", "value": "f98c40b0dc682317364b2172460e90cef054ade952a7fc7909e161a1f2fce338", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981149, "uuid": "aeda6804-bc09-417a-9d0e-dc248cec3de6", "comment": "Malware payload (Mirai)", "value": "16b12d44b633c6dea3897894f4b80586ca6b80d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981149, "uuid": "3c34d704-12e8-4464-80bc-34f94b4e1e6c", "comment": "Malware payload (Mirai)", "value": "08c7ee1fa2a7e3963b18518f47607f3535d4b69906fcfeb6604da351e71ae1860e0b8fb5c40b37ff9ddb6de865ede742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981149, "uuid": "12d34ccb-6b51-4fa1-812b-6d76835989ac", "value": "T16FB2CFCC65543084CA8D7C7C578D4A674FACA190BAED9F26E350CD98B3BAA4F385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981149, "uuid": "bde386c2-fe2a-4725-9024-eda6a3d57cb3", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBphyZqEWvJ:/QlS07FUXqIYSXQKquhWqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692981149, "uuid": "66ebbeed-746b-4fac-a7af-bdb873fcc928", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692981149, "uuid": "e5b66345-a03a-43f8-9741-afcc7d913285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981149, "uuid": "8cd9c0cd-5adb-4246-b196-114a37a69945", "value": "f7f106cf4ef124920fdf4192dc6f7db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28caf412-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692961897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961897, "uuid": "55fb17f4-8676-4bc5-bdc7-52cc95a92b9e", "comment": "Malware payload (SnakeKeylogger)", "value": "06f7ea93f9795f468bb5d6061046d744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961897, "uuid": "ae8f8323-a32a-4f98-886c-28cdfb4b0312", "comment": "Malware payload (SnakeKeylogger)", "value": "fb9c41960ea195480341cfdf13deee325e5c563064f21acf1c89e488ee4ea841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961897, "uuid": "60b646b9-a2fd-4722-a455-a4d17529ecf1", "comment": "Malware payload (SnakeKeylogger)", "value": "ead474c554c1b7ccabc5a959c2bf999e2ff507e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961897, "uuid": "008e5fb8-909b-4df1-8494-3167d0130c14", "comment": "Malware payload (SnakeKeylogger)", "value": "2c61199b0c1ed25a71f4bd08fb71f40eaaeca31291a596b884c1bd89f05f80c2c99f9d6ebbeb08e69380edd28c79005e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961897, "uuid": "32700fe0-9e10-4d85-be66-48e7b197d19f", "value": "T111A4B603BA4B85E5D2881B36CF8B1C0053ACDAB137A7D71E798E33961A437ABED45507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961897, "uuid": "e39d780f-1138-4389-b892-bdb14425492f", "value": "12288:trREZVELIFokfm5NSHswPPx9ikS76859RAd8:9REZVELIFo0HswPPx91S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961897, "uuid": "a3eb04f9-6a29-4a13-9577-c40bea33e634", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961897, "uuid": "6e5208b2-507f-4f17-9797-4cecc5002fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961897, "uuid": "26857c50-c20a-498d-9872-64e65125732d", "value": "Dryswpzby.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d84190-4364-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692981134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981134, "uuid": "34ec51f7-7f3a-4c72-8cf8-f2a8876855c1", "comment": "Malware payload (Mirai)", "value": "0d13e1f6bebdaf6070e6e585a0fb5aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981134, "uuid": "e497fa18-a07c-4da6-8292-4b2f52132c51", "comment": "Malware payload (Mirai)", "value": "fc810ab806dfe1c5c10953a1124b60412bf63270e44cf945b8f3c35cb71efaca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981134, "uuid": "2006433b-4830-4521-a2fa-3e421a60e8fc", "comment": "Malware payload (Mirai)", "value": "eec3089ffda01a8d7c1d50fff56f7aca47b8ef6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692981134, "uuid": "00bd6fbd-b148-4811-98e6-13cad4a585ac", "comment": "Malware payload (Mirai)", "value": "00de146b1e972c4a7670bcacde38911b6fc6d528fe17a8819a56bb0f6a55d3ecf34b7f70ccadee000280d1868145b441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981134, "uuid": "e3ee3ee9-0c15-4e40-9ba3-b13a907782d4", "value": "T1FCA2D025D345AEF4DFAF9D9052C1D2C276F542C7278AC8E340EEAF012916446BB88D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981134, "uuid": "1d91e69c-869e-43a2-93a6-9ecbcd5b9e25", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5vIM4uVcqgw05VxJ7:9RxsSVsMD6xiJJE5zRWNF4uVcqgw09B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692981134, "uuid": "8f12e601-7e25-4795-a7ac-7e1286f4fc53", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692981134, "uuid": "26d7a208-662c-4a71-a10c-4066fd9335ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692981134, "uuid": "d09e5996-26a1-4ad3-a7b3-5d005eb5a35d", "value": "0d13e1f6bebdaf6070e6e585a0fb5aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b27e97b-42f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692934145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934145, "uuid": "a3716a60-61b2-4bbf-9771-af617ec2e3f5", "comment": "Malware payload (AgentTesla)", "value": "78f43948831492977dca697e6ceaa6ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934145, "uuid": "c27ce84c-ac07-49c6-bec8-44ceb02b4cbe", "comment": "Malware payload (AgentTesla)", "value": "fe1b1d519bca018fe9ae3754b85a0c649dd8be1b30a6ac528704b3ef2ee80bb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934145, "uuid": "ae7c0008-5f6c-47a9-b88b-4b3202ddef8f", "comment": "Malware payload (AgentTesla)", "value": "58631fa7789db2771bf64702c13d47c285b846cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692934145, "uuid": "44646052-1543-4e45-b18f-57047b670baf", "comment": "Malware payload (AgentTesla)", "value": "a1d243fe7d8153a7f750606adf0657eafc7d184b694fdb929bcb773b095bdb47700a9c715260ca72cd2d5547ee4bfd29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934145, "uuid": "22343e22-94df-467d-8031-dafd69d49441", "value": "T1382530ACBD9C5187E728CD28669F253C1C66D2126D69A380DFB6C4D71F902073A5ECE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934145, "uuid": "2929c027-3b1d-41d5-a57b-c357c4f2d071", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934145, "uuid": "22c731e0-28e6-4972-84ef-a697f5af2b49", "value": "12288:7Rf5gSWrI1+Z/EG6oqQ9Fi49Q4dRlgobfUl80euneZ2:x62MRqQ5zRPcHln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692934145, "uuid": "36d76685-1a53-41e4-bfc4-17127151073e", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692934145, "uuid": "62b0d9be-76c0-45f9-b049-0ae6dcd7c6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692934145, "uuid": "988c45fb-2ee9-4e3a-aec3-dbecc6a02b05", "value": "SecuriteInfo.com.Heur.MSILRandomKrypt.3.18459.29183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fc5e99-433d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692964042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964042, "uuid": "5a5c203e-1d1a-43fb-a194-55a95dfbec56", "comment": "Malware payload (AgentTesla)", "value": "edce437cd597ee4bdd89bdb4907e1569", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964042, "uuid": "572c86fc-109e-4a22-97e5-47646e343b3b", "comment": "Malware payload (AgentTesla)", "value": "fe561cf56cd580b3bb34099feec06059cd9b276a1c07f9316036058d22d661ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964042, "uuid": "93db9b6e-4f85-401f-b997-b2b78fa08692", "comment": "Malware payload (AgentTesla)", "value": "f2893fc569be32d109c711bddfeaf12c0afc49f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692964042, "uuid": "b979e8f1-c72a-4bb5-8acd-e0e800485bdf", "comment": "Malware payload (AgentTesla)", "value": "45c8e2e24566f6173028ca2db9e9544ee509cfc3501656ac6ab39390eacecb6765d03e1ac8aaaff2e532f8e268b839ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964042, "uuid": "59cba123-cfc2-4005-a739-2652e096a0bb", "value": "T1B0458D03BA5749A5C1489B3ACB8F6C4807A9DAB137ABC75E7C9E335109023E7DD85D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964042, "uuid": "208b984b-1cd9-42fc-be8d-b018926133a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964042, "uuid": "d24794eb-2c5d-4b2b-a01e-6e8d04432161", "value": "24576:wsh08bAQ605fMDQgAdqAKsItQ+0T2G7he8Tx0Epx8Gx75QNUqW7POKjehXeD9XDi:mhQ+7NSKopkpXtOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692964042, "uuid": "bcf5cb98-f324-45cf-b32c-93470bda9b35", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692964042, "uuid": "aa7c7fb9-9705-49e9-846c-c4eafb111414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692964042, "uuid": "3e970377-2219-477b-919d-be34bfa3a313", "value": "SecuriteInfo.com.Win32.CrypterX-gen.9631.27758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4423597b-4338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692961943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961943, "uuid": "98a82c4a-78ee-4627-bb1d-14b94d1f7a5b", "comment": "Malware payload (AgentTesla)", "value": "1047f6b044fe6e70cc55bf46a4adac51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961943, "uuid": "45a39164-0012-45bd-a6db-7195afb73f38", "comment": "Malware payload (AgentTesla)", "value": "fec588a1419c185f1e56e1a05d7b85a6c9ab06e877c994205972feae15456f7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961943, "uuid": "232a2d76-398b-4f46-9369-64f825b60198", "comment": "Malware payload (AgentTesla)", "value": "223427caedc9c0703f3344857e3d97f97af0f120", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692961943, "uuid": "9b4053fd-a067-4201-81f3-6c03d6ffc6bb", "comment": "Malware payload (AgentTesla)", "value": "81c0c14f262f3708864fd1ce9b82c311f1f139a78d6d905a8a9ba5f453f06ba8d9b249512b0e748d2b8c5dd754e5c291", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961943, "uuid": "59099eac-8922-44b4-9c74-0608c9c84e1d", "value": "T19864AB1025EFA48DB2B33F9347DDB6DA8F9BF3B21B17915D2504430B5A62E40CE95A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961943, "uuid": "9e5f5b68-1508-47cf-854f-0eb2c205549f", "value": "6144:f9EEEE5cAxAgZ39EEEE39EEEEb9EEEEv9EEEEq9EEEEP9EEEE1o9EEEER:f9EEEE59EEEE39EEEEb9EEEEv9EEEEqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692961943, "uuid": "6ca78a76-bf16-4386-882c-8e7b8aee99de", "value": 317356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692961943, "uuid": "92f09fdf-6d11-48d9-9b45-82935ccb6982", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692961943, "uuid": "2bab96a3-06e5-432f-9f1b-ef212f66832a", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }